Free And Cheap AI Tools 

Although deepfakes have now been around for several years, as the report points out, deepfake fraud has become significantly easier and more accessible due to the widespread availability of free and cheap generative AI tools. In simple terms, these tools have democratised the ability to create hyper-realistic fake images and videos, which were once only possible for those with advanced technical skills and access to expensive software. 

Prior to the public availability of AI tools, for example, creating a convincing fake video or image required a deep understanding of computer graphics and access to high-end, often costly, software (a barrier to entry for would-be deep-fakers).  

Document and Biometric Fraud – The New Frontier 

The Onfido data reveals a worrying trend in that while physical counterfeits are still prevalent, there’s a notable shift towards digital manipulation of documents and biometrics, facilitated by the availability and sophistication of AI tools. Fraudsters are not only altering documents digitally but also exploiting biometric verification systems through deepfakes and other AI-assisted methods. The Onfido report highlights a dramatic rise in the rate of biometric fraud, which doubled from 2022 to 2023. 

Deepfakes – A Growing Threat 

As reinforced by the findings of the report, deepfakes pose an emerging and significant threat, particularly in biometric verification. The accessibility of generative AI and face-swap apps has made the creation of deepfakes easier and highly scalable, which is evidenced by a 31X increase in deepfake attempts in 2023 compared to the previous year! 

Minimum Effort (And Cost) For Maximum Return 

As the Onfido report points out, simple ‘face swapping’ apps (i.e. apps which leverage advanced AI algorithms to seamlessly superimpose one person’s face onto another in photos or videos) offer ease of use and effectiveness in creating convincing fake identities. They are part of an influx of readily available online AI assisted tools that are providing fraudsters with a new avenue into biometric fraud. For example, the Onfido data shows that Biometric fraud attempts are clearly higher this year than in previous years with fraudsters favouring tools like the face-swapping apps to target selfie biometric checks and create fake identities.  

The kind of fakes these cheap, easy apps create have been dubbed “cheapfakes” and this conforms with something that’s long been known about online fraudsters and cyber criminals – they seek methods that require minimum effort, minimum expense and minimum personal risk, yet deliver maximum effect. 

Sector-Specific Impact of Deepfakes 

The Identity Fraud Report shows that (perhaps obviously) the gambling and financial sectors in particular are facing the brunt of these sophisticated fraud attempts. The lure of cash rewards and high-value transactions in these sectors makes them attractive targets for deepfake-driven frauds. In the gambling industry, for example, fraudsters may be particularly attracted to the sign-up and referral bonuses. In the financial industry, where frauds tend to be based around money laundering and loan theft, Onfido reports that digital attacks are easy to scale, especially when incorporating AI tools. 

Implications For UK Businesses In The Age of (AI) Deepfake-Driven Fraud 

The surge in deepfake-driven fraud highlighted by the somewhat startling statistics in Onfido’s 2024 Identity Fraud Report, suggest that UK businesses navigating this new landscape may require a multifaceted approach. This could be achieved by balancing the implementation of cutting-edge technologies with heightened awareness and strategic planning. In more detail, this could involve: 

– UK businesses prioritising the reinforcement of their identity verification processes. The traditional methods may no longer suffice against the sophistication of deepfakes. Therefore, Adopting AI-powered solutions that are specifically designed to detect and counter deepfake attempts could be the way forward. This could work as long as such systems can keep up with the advancements in fraudulent techniques (more advanced techniques may emerge as more AI sophisticated AI tools emerge). 

– The training of staff, i.e. educating them about the nature of deepfakes and how they can be used to perpetrate fraud. This could empower employees to better recognise potential threats and respond appropriately, particularly in sectors like customer service and security, where human judgment plays a key role. 

– Maintaining customer trust. UK businesses must navigate the fine line between implementing robust security measures and ensuring a frictionless customer experience. Transparent communication about the security measures in place and how they protect customer data can help in maintaining and even enhancing customer trust. 

– As the use of deepfakes in fraud rises, regulatory bodies may introduce new compliance requirements and UK businesses will need to ensure that they stay abreast of these changes both to protect customers and remain compliant with legal standards. This in turn could require more rigorous data protection protocols or mandatory reporting of deepfake-related breaches. 

– Collaboration with industry peers and participation in broader discussions about combating deepfake fraud may also be a way to gain valuable insights. Sharing knowledge and strategies, for example, could help in developing industry-wide best practices. Also, partnerships with technology providers specialising in AI and fraud detection could offer access to the latest tools and expertise. 

– Since deepfake fraud may be an ongoing threat, long-term strategic planning may be essential. This perspective could be integrated into long-term business strategies, thereby (hopefully) making sure that resources are available and allocated not just for immediate solutions but also for future-proofing against evolving digital threats. 

What Else Can Businesses Do To Combat Threats Like AI-Generated Deepfakes? 

Other ways that businesses can contribute to the necessary comprehensive approach to tackling the AI-generated deepfake threat may also include:  

– Implementing biometric verification technologies that require live interactions (so-called ‘liveness solutions’), such as head movements, which are difficult for deepfakes to replicate. 

– The use of SDKs (platform-specific building tools for developers) over APIs. For example, SDKs provide better protection against fraudulent submissions as they incorporate live capture and device integrity checks. 

The Dual Nature Of Generative AI 

Although, as you’d expect an ‘Identity Fraud Report’ to do, the Onfido report focuses solely on the threats posed by AI, it’s important to remember that AI tools can be used by all businesses to add value, save time, improve productivity, get more creative, and to defend against the AI threats. AI-driven verification tools, for example, are becoming more adept at detecting and preventing fraud, underscoring the technology’s dual nature as both a tool for fraudsters and a shield for businesses. 

What Does This Mean For Your Business? 

Tempering the reading of the startling stats in the report with the knowledge that Onfido is selling its own deepfake (liveness) detection solution and SDKs, it still paints a rather worrying picture for businesses. That said, The Onfido 2024 Identity Fraud Report’s findings, highlighting a 3000 per cent increase in deepfake fraud attempts due to readily available generative AI tools, signal a pivotal shift in the landscape of online fraud. This shift could pose new challenges for UK businesses but also open avenues for innovative solutions. 

For businesses, the immediate response may involve upgrading identity verification processes with AI-powered solutions tailored to detect and counter deepfakes. However, it’s not just about deploying advanced technology. It’s also about ensuring these systems evolve with the fraudsters’ tactics. Equally crucial is the role of employee training in recognising and responding to these sophisticated fraud attempts. 

As regulatory landscapes adjust to these emerging threats, staying informed and compliant is also likely to become essential. The goal is not only to counter current threats but to build resilience and innovation for future challenges.

The post Featured Article : 3000% Increase in Deepfake Frauds appeared first on Mear Technology.

What is the significance of this takedown?

16Shop specialises in the sales of phishing kits that other cybercriminals can purchase to mount phishing attacks on a large scale, ultimately facilitating the theft of credentials and payment details from users of popular services such as Apple, PayPal, American Express, Amazon, and Cash App, among others.

It is estimated that around 70,000 users across 43 countries have been compromised thanks to 16Shop. So it is good news globally that this has been a successful campaign.

To find out more about how Trend helped click here

In the News

https://newsroom.trendmicro.com/2023-08-14-Trend-Micro-Teams-Up-with-INTERPOL-to-Take-Down-Notorious-Phishing-Operation#assets_all

https://www.interpol.int/en/News-and-Events/News/2023/Notorious-phishing-platform-shut-down-arrests-in-international-police-operation

https://thehackernews.com/2023/08/interpol-busts-phishing-as-service.html

The post Trend Micro Takes Down Notorious Phishing Operation by Working with INTERPOL appeared first on Mear Technology.

Sophisticated Attacks That Highlight Vulnerabilities 

In the ever-evolving landscape of digital threats and cyber warfare, one term often sends chills down the spines of cybersecurity professionals: Zero-Day Attacks. These sophisticated and stealthy cyber-attacks represent a significant challenge in today’s interconnected business world. They symbolise not just the advancement of cybercriminals’ tactics but also highlight the vulnerabilities that exist within our most trusted digital infrastructures. 

Exploiting Zero-Day Vulnerabilities 

Zero-day attacks are attacks by threat actors that exploit zero-day vulnerabilities. These are undisclosed software vulnerabilities (unknown to vendor or victims) that hackers can exploit to adversely affect computer programs, data, additional computers, or a network.  

Vulnerabilities targeted in zero-day attacks can be found in operating systems, web browsers, Office applications, open-source components, hardware and firmware, and the Internet of Things (IoT). 

Why “Zero-Day”? 

The term “zero-day” comes from the fact that software developers and those in charge of digital security have zero days to fix the vulnerability because it is simply not known to them until the first attack. This means that attackers can exploit the vulnerabilities before developers become aware and are able to issue any patches or remediations.  

How Big Is The Problem? 

Although zero-day vulnerabilities fell by almost a third in 2022, it was still the second highest year on record (Mandiant research) with 55 zero-day vulnerabilities exploited and products from the three largest vendors (Microsoft, Google, and Apple) were the most commonly exploited (for the third year in a row). 

What Can Happen? 

Zero-day attacks commonly result in unauthorised data access, data theft, or service disruptions. These, in turn, can result in reputational damage, lost customers, fines (e.g. legal action by those affected an/or ICO fines), plus possibly the loss of the business itself if the attack is serious enough. Secondary attacks on the business and those affected by data theft could also come from the first attack,.e.g. malware, ransomware, phishing, social engineering attacks, and more. 

Cybersecurity experts, therefore, continually work to discover these types of vulnerabilities before hackers do, to try and prevent potential attacks. 

Vulnerabilities, Exploits, Then Attacks 

After threat actors have discovered a zero-day vulnerability, the next stage is ‘zero-day exploits’ – the blueprints that outline how these hidden flaws can be taken advantage of, often traded on the dark web. The zero-day attack itself is, therefore, the act of exploiting the flaw/vulnerability, using the guidance of the exploit, before a patch can be rolled out, leaving a digital system scrambling in the wake of the unforeseen breach. 

Who? 

These under-the-radar strikes are often orchestrated by advanced cyber criminals, state-sponsored hacking groups, or unscrupulous entities with nefarious motives. The objectives are as varied as the threat actors themselves. For some, it’s about monetary gains whereas for others, it’s a tool for intellectual property theft, infiltrating state secrets, or merely sowing seeds of chaos. Corporate espionage and political machinations are just the tip of the iceberg when it comes to reasons behind these attacks. 

Recent High-Profile Examples 

Some recent, high-profile examples of Zero-Day attacks include: 

– In 2023, a critical vulnerability was uncovered in the secure managed file transfer (MFT) service provided by MOVEit, a transfer platform widely used by large companies in a variety of sectors including healthcare, government, finance, and aviation. The Russian-based Clop Ransomware group exploited the vulnerability and were able to steal data from eight UK organisations including BBC, British Airways, Aer Lingus, and Boots. 

– In 2022 the CVE-2022-30190, a.k.a. Follina vulnerability in Microsoft Diagnostics Tool (MDST), was exploited and victims were persuaded to open Word documents which enabled attackers to execute arbitrary code. The government of the Philippines, business service providers in South Asia, and organisations in Belarus and Russia were all subject to the same zero-day attack. 

– The notorious Microsoft Exchange Server hack in early 2021, widely believed to have been sponsored by a nation-state, exploited several previously unknown vulnerabilities in Microsoft’s email server software. The damage was widespread and profound, with tens of thousands of organisations worldwide left grappling with the aftermath before a security patch could be rolled out. 

– Google’s Chrome suffered a series of zero-day threats in 2021, causing Chrome to issue updates. The vulnerability was a bug in the V8 JavaScript engine used in the web browser. 

– A zero-day attack on video conferencing platform Zoom in 2020 where hackers accessed a user’s PC remotely if they were running an older version of Windows. The hackers targeted the administrator, allowing them to completely take over their machine and access all files. 

– In 2020, the Apple iOS was attacked twice with zero-day vulnerabilities and one zero-day bug allowed attackers to compromise iPhones remotely. 

How Businesses Can Protect Themselves 

So, how can businesses protect themselves against the threat of zero-day attacks? Given their nature, these attacks pose a formidable challenge, but protective measures that can be taken include: 

– Regularly updating software updates and staying up to date with patching. 

– Employing advanced threat detection tools that utilise behaviour-based detection techniques to pinpoint anomalies and unusual activity in network traffic (often the first sign of a zero-day attack). 

– Conducting regular penetration tests and vulnerability assessments. These proactive practices can unearth previously unknown vulnerabilities within systems, allowing businesses to patch them before they are exploited. Following the principle of least privilege – limiting user access rights to the bare minimum needed for their work – can also help reduce the extent of potential damage should an attack occur. 

– Beyond technological defences, investing in comprehensive cybersecurity awareness training for employees is crucial. An informed team acts as the human firewall against cyber threats, understanding the risks, recognising signs of possible attacks, and knowing how to respond swiftly and effectively. 

What Does This Mean For Your Business? 

In the face of the ominous threat of zero-day attacks, businesses must adopt a proactive and comprehensive approach to digital security. A robust defence strategy isn’t a luxury but an absolute necessity in today’s digital age. It involves a constant balancing act of risk management, regular system updates, advanced threat detection, routine penetration testing, and vulnerability assessments, regular system audits, and maintaining a culture of security vigilance throughout the organisation. 

A multi-layered security approach and a zero-trust model could, therefore, provide a solid foundation for defence although, because some vulnerabilities may still not be known until it’s too late, zero-day attacks remain an ever-present threat. 

The potential devastation of zero-day attacks and their aftermath is unquestionable, but it is not an insurmountable challenge. By being as vigilant and proactive in defence measures as is realistically possible, businesses can steer through the murky waters of the cyber threat landscape, securing their digital assets, and upholding the trust of their customers and partners. The world of cybersecurity may be akin to a never-ending arms race, but with the right preparation and resilience, staying one step ahead must be an achievable goal.

The post Tech Insight : What Are ‘Zero-Day’ Attacks? appeared first on Mear Technology.

There has been lots of information in the news about AI Microsoft has announced that soon AI will be integrated into their Office Suite by way of copilot. While the benefits of AI are helping deliver faster solutions to issues those who make their living from exploiting others have also been gaining from these advanced.

Voice cloning, once limited to science fiction, has become a reality with the advent of deepfake technology. While voice cloning has legitimate applications, it has also become a powerful tool for scammers and cybercriminals to deceive and manipulate unsuspecting victims. In this blog post, we will explore the insidious ways in which scammers exploit voice cloning technology, highlighting the need for awareness and vigilance in an increasingly digital world.

1. Understanding Voice Cloning: Voice cloning technology utilizes deep learning algorithms to replicate and synthesize a person’s voice. By analyzing a target’s vocal patterns, intonation, and speech patterns, scammers can create a convincing replica that mimics the original speaker. This technology has numerous positive applications, such as improving text-to-speech systems or aiding those with speech impairments. However, scammers have found ways to exploit it for malicious purposes.
2. Impersonation and Social Engineering: Scammers can use voice cloning to impersonate someone familiar to the victim, such as a family member, friend, or colleague. By mimicking the voice of a trusted individual, scammers aim to deceive victims into believing they are communicating with the real person. This tactic is particularly effective in social engineering schemes, where scammers manipulate victims into disclosing sensitive information, transferring funds, or granting unauthorized access to accounts.
3. Phishing and Vishing Attacks: Voice cloning adds a chilling level of authenticity to phishing and vishing attacks. Phishing scams involve sending fraudulent emails, while vishing (voice phishing) attacks use phone calls to trick victims. Scammers can use cloned voices to make phone calls or leave voice messages that seem legitimate, urging victims to provide personal information or perform certain actions. The familiar voice combined with urgency can lead unsuspecting individuals to fall prey to these fraudulent schemes.
4. Malicious Content Generation: Voice cloning enables scammers to generate convincing audio content, such as fake news, forged voice messages, or doctored recordings. By mimicking the voices of prominent figures, scammers can spread misinformation, incite panic, or even damage reputations. The widespread availability of social media platforms and messaging apps amplifies the potential harm of such manipulated content, as it can easily be shared and disseminated to a large audience.
5. Combining Voice Cloning with Other Technologies: Voice cloning can be further enhanced by combining it with other technologies like artificial intelligence (AI) chatbots or video deepfakes. By synchronizing a cloned voice with an AI-powered chatbot or overlaying it on a video, scammers can create highly realistic and persuasive interactions. This multi-modal deception can intensify the impact on victims, making it even more challenging to discern between genuine and manipulated content.

As voice cloning technology continues to advance, scammers are increasingly harnessing its power to exploit unsuspecting individuals. It is crucial for individuals and organizations to be aware of these risks and take precautions to protect themselves. Educating oneself about voice cloning, being vigilant while interacting with others, and implementing robust security measures are key to mitigating the dangers posed by scammers who abuse this technology. By staying informed and exercising caution, we can safeguard ourselves and prevent falling victim to the insidious tactics of voice cloning scammers in this digital age.

One of the youtube channels we follow has a nice youtube short basically saying the same thing

How to protect yourself from voice cloning scams and what are the risks

The risks of voice cloning scams are serious. You may lose money, compromise your identity, expose your sensitive data or damage your relationships. You may also feel violated, betrayed and confused by hearing a familiar voice that is not real.

Here are some tips:

• Be sceptical of any unexpected or urgent calls from people you know asking for money or personal information. Verify their identity by asking questions that only they would know, or by calling them back on their known number.
• Do not rely on caller ID alone to identify the caller. Caller ID can be easily manipulated by scammers using spoofing techniques.
• Do not send money or share personal information through unusual methods, such as gift cards, cryptocurrency or wire transfers. These methods are often untraceable and irreversible.
• Do not follow any instructions that ask you to keep the call secret or not to tell anyone about it. This is a common tactic used by scammers to prevent you from seeking help or advice.
• Report any suspicious calls to your local authorities, your bank or your phone company. You may also want to warn your contacts about the possibility of voice cloning scams and ask them to be careful.

The post How scammers are using AI appeared first on Mear Technology.

Spear Phishing Accounted For Two-Thirds Of All Attacks Last Year 

A recent report from security provider Barracuda has revealed that although spear phishing attacks make up just 0.1 per cent of all email-based attacks in 2023, they were responsible for two-thirds of all breaches. The report showed that a massive 50 per cent of the 1,350 organisations surveyed had fallen victim to a spear-phishing attack in 2022, a quarter had had at least one email account compromised via an account takeover. The report also showed that of those who fell victim to a successful spear phishing attack, 55 per cent had machines infected with malware or viruses, and 49 per cent and 48 per cent respectively had sensitive data or login details stolen. 

What Is Spear Phishing? 

Spear phishing is a targeted form of phishing that aims to deceive individuals or organisations by sending bogus, fraudulent emails or messages. While traditional phishing attempts are more generic and widespread, spear phishing campaigns are highly tailored and personalised to trick specific targets, such as employees of a particular company or members of an organisation. 

Targets Are Researched 

The attackers behind spear phishing typically research their targets extensively to gather information that will make their messages appear legitimate and increase the chances of success. They may gather details from social media profiles, online directories, or leaked data from previous breaches. This information is then used to create highly convincing email messages that appear to be from a trusted source, such as a colleague, a client, or a supervisor. 

Personalised Content To Make Them More Convincing 

Spear phishing emails often contain personalised content, such as the recipient’s name, job title, or other relevant details, which makes them appear more authentic. They may also exploit psychological manipulation techniques to evoke a sense of urgency, curiosity, or fear to compel the target to click on a malicious link or download a malicious attachment. Once the recipient interacts with the malicious content, the attacker may gain unauthorised access to sensitive information, such as login credentials, financial data, or proprietary information. 

The Consequences 

Spear phishing attacks can have severe consequences for individuals and organisations, including data breaches, financial loss, reputational damage, and further exploitation of compromised accounts.  

How To Protect Your Business From Spear Phishing 
 
To protect against spear phishing, it is important to exercise caution when opening emails, verify the legitimacy of unexpected or suspicious requests, and regularly educate and train employees on identifying and reporting phishing attempts. Also, account takeover protection solutions with artificial intelligence capabilities can be effective. 

It is difficult, however, to stop attackers from gathering the information about a business and specific personnel within that business to help them target their attacks. For example, some information may have been gathered from information stolen in previous cyberattacks or data breaches and may have been gathered from social media. Businesses should, where possible, be careful about how much information is shared online about the business and staff members, e.g., ‘meet the team’ or ‘about us’ pages, as this could also be used by attackers. 

A Launching Point For More Advanced Attacks 

Spear Phishing is widely recognised as one of the most successful and commonly used techniques in cybercriminal campaigns and is favoured by attackers because it capitalises on human vulnerabilities/human error, exploits the trust placed in familiar or authoritative sources, and can be easier than trying hack complicated and well-defended systems – cyber criminals always look for the maximum payoff from minimum effort and risk.  

By carefully crafting personalised messages, attackers can significantly increase the chances of success in compromising targets compared to generic phishing attempts. The level of sophistication and customisation in spear phishing attacks makes them harder to detect and raises the probability of successful infiltration. 

Moreover, spear phishing serves as a launching point for more advanced attacks, such as targeted malware infections, social engineering exploits, or business email compromise (BEC) schemes. Once an attacker gains a foothold through spear phishing, they can proceed with their malicious activities, including data exfiltration, network infiltration, or financial fraud. 

Reasons For The New Figures 

The reasons why spear phishing makes up only 0.1 per cent of all email-based attacks but are responsible for two-thirds of all breaches (i.e they have disproportionately higher success rate compared to other types of email-based attacks) are, therefore, that: 

– Spear-phishing attacks are highly targeted and tailored to specific individuals or organisations, and this customisation makes the attacks more convincing, increases the likelihood of victims falling for them and, therefore, increases their effectiveness. 

– These attacks take advantage of human psychology and behavioural traits, such as trust, curiosity, and urgency and, by leveraging these vulnerabilities, attackers can trick individuals into divulging sensitive information or performing actions that compromise security. 

– Spear Phishing bypasses technical security measures, e.g. firewalls, antivirus software, and spam filters, enabling attackers to circumvent traditional security controls and directly target individuals. 

– While spear-phishing attacks may target a specific individual initially, their success can lead to broader repercussions. For example, compromising one employee’s credentials through a spear-phishing attack could provide the attacker with access to sensitive systems or information, potentially leading to a significant breach affecting an entire organisation. 

Most Ransomware Attacks Target Backups  

The 2023 Ransomware Trends Report from software company Veeam has revealed that 93 per cent of cyber-attacks target backup storage to force the ransom payment because it removes the option of recovery. The report found that these attacks are successful in debilitating their victims’ ability to recover in three-quarters of events and that more than one-third (39 per cent) of backup repositories are completely lost in these backup-targeted attacks. 

Ransomware? 

As the name suggests, ransomware is a type of malicious software designed to encrypt files on a victim’s computer or network, rendering them inaccessible until a ransom is paid to the attacker (usually to a crypto account like bitcoin to avoid detection). It is a form of cyber extortion that aims to extort money from individuals, businesses, or organisations by holding their valuable data hostage. 

Paying The Ransom? 

It is widely known that paying the ransom often doesn’t work and even if the ransom is paid, data can still be destroyed and/or, the attackers don’t provide the decryption key and simply make off with the money.  

That said, according to the Veeam report, for the second year in a row, most of the organisations surveyed (80 per cent) said they had paid the ransom to end an attack and recover data, despite 41 per cent of organisations actually having a “Do-Not-Pay” policy on ransomware. Still, while 59 per cent paid the ransom and were able to recover data, 21 per cent paid the ransom yet still didn’t get their data back from the cyber criminals. Additionally, only 16 per cent of organisations avoided paying ransom because they were able to recover from backups. Sadly, the global statistic of organisations able to recover data themselves without paying ransom is down from 19 per cent in last year’s survey. 

Protecting Your Business Against Ransomware Attacks 

Typically, preventing ransomware attacks involves a combination of proactive measures such as regularly updating software and systems, implementing robust security practices, training employees on recognising and avoiding suspicious emails or websites, maintaining secure backups of important data, and deploying reliable antivirus and anti-malware solutions. 

Veeam notes in its comments about the report’s findings that while best practices like securing backup credentials, automating cyber detection scans of backups, and auto verifying that backups are restorable can help protect against attacks, “the key tactic is to ensure that the backup repositories cannot be deleted or corrupted. To do so, organisations must focus on immutability.”  

Immutability 

Veeam reports that those who have fallen victim to ransomware have learned lessons and 82 per cent use immutable clouds, i.e. a cloud computing environment where the data stored within the cloud infrastructure is maintained in an immutable or unchangeable state. Also, 64 per cent now use immutable disks, and only 2 per cent of organisations don’t have immutability in at least one tier of their backup solution. 

Being Careful About Re-Infection During Recovery 

In Veeam’s study, respondents were asked how they ensure that data is ‘clean’ during restoration. 44 per cent of respondents said they complete some form of “isolated-staging” to re-scan data from backup repositories prior to reintroduction into the production environment. Whilst this is positive news, the flip side of this statistic is that more than half (56 per cent) organisations risk re-infecting the production environment by not having a means to ensure clean data during recovery. The point is, therefore, that it’s important to thoroughly scan data during the recovery process. 

What Does This Mean For Your Business? 

The obvious effectiveness of spear phishing attacks and the fact that most ransomware attacks are now targeting backups presents significant challenges for businesses, requiring proactive measures to protect themselves. 

As highlighted by Barracuda’ report, spear phishing attacks have proven to be highly successful, accounting for two-thirds of all breaches despite constituting a small percentage of email-based attacks. The targeted and personalised nature of spear phishing makes it difficult to detect, as attackers extensively research their targets to create convincing messages. To protect against spear phishing, businesses should, therefore, exercise caution when opening emails, verify the legitimacy of requests, and provide regular training to employees on identifying and reporting phishing attempts. Account takeover protection solutions with artificial intelligence capabilities can also be effective. 

As highlighted by Veeam’s report, ransomware attacks, on the other hand, have increasingly targeted backup storage, rendering organisations unable to recover their data even if they pay the ransom. While some organisations have paid the ransom and recovered their data, many have not been as fortunate. For businesses, the key to protecting against ransomware attacks lies in proactive measures such as regularly updating software, implementing robust security practices, training employees, maintaining secure backups, and deploying reliable antivirus and anti-malware solutions. Additionally, businesses should focus on immutability, ensuring that backup repositories cannot be deleted or corrupted. 

To combat the risks associated with spear phishing and ransomware attacks, businesses should favour a multi-layered approach to security. This includes investing in employee education and training, implementing strong technical security measures, and regularly evaluating and updating security protocols. Businesses can also help protect themselves by staying informed about emerging threats and best practices in cybersecurity to enable them to adapt their defences accordingly. 

The post New Reports Reveal Two Key Cyber Security Insights appeared first on Mear Technology.

Social Engineering and Targeted Attacks

Social engineering is a form of attack where an attacker uses psychological manipulation to trick people into divulging confidential information or performing specific actions. One of the most common forms of social engineering is phishing, where an attacker impersonates a trustworthy entity to deceive a victim into giving up sensitive information or clicking on a malicious link. Phishing attacks can be highly targeted, with attackers using publicly available information to craft emails that appear to come from a known source.

Listing employees on your website provides attackers with a wealth of information that they can use to launch targeted attacks. By researching your employees, an attacker can gather information such as their job titles, email addresses, phone numbers, and even personal details such as their hobbies and interests. With this information, an attacker can craft highly convincing phishing emails that are specifically tailored to individual employees, increasing the chances of success.

Additionally, by listing employee job titles and contact information, attackers can identify potential targets for more sophisticated attacks such as spear-phishing, where attackers use social engineering to target specific individuals within an organization, often with the goal of gaining access to sensitive systems or data.

Mitigating the Risks

So, what can businesses do to mitigate the risks of listing employees on their websites? The following are some best practices that organizations can adopt to minimize the risks:

1. Limit the Information Available: Consider limiting the information displayed on your website to only essential details, such as an employee’s name and job title. Avoid including personal information such as hobbies or interests that could be used by attackers to craft targeted attacks.
2. Implement Access Controls: Restrict access to sensitive information such as employee contact details, and limit access to only those who require it to perform their job functions. Additionally, implement two-factor authentication for employees accessing sensitive information.
3. Educate Employees: Educate your employees about the risks of social engineering attacks and how to identify and report suspicious emails or phone calls. Conduct regular training sessions to reinforce this knowledge and ensure that employees remain vigilant.
4. Monitor for Attacks: Implement monitoring and detection tools to identify suspicious activity on your network and systems. Monitor your email systems for phishing attempts, and implement a response plan to quickly contain and mitigate any incidents.

Even a photo can put you at risk

Profile pictures can provide valuable information about an individual, and when used in conjunction with other publicly available information, they can be used to find more information about staff on social sites.

Attackers can use facial recognition software to identify individuals and cross-reference their profiles with other online sources to gather additional information such as job titles, phone numbers, and email addresses. This information can be used to craft highly targeted social engineering attacks, increasing the likelihood of success. Additionally, profile pictures can be used to impersonate an individual, creating a fake account and tricking others into believing that the attacker is a legitimate individual.

This information can be used to gather further sensitive information or launch attacks on unsuspecting victims. Businesses should be aware of these risks and take steps to protect their employees’ privacy, such as limiting the information available on social media profiles and providing education on the risks of sharing personal information online.

Some examples of sites that can be used to search using an image

1. Google Images – You can use Google’s “Search by image” feature to search for similar images or to identify an image’s source.
2. TinEye – TinEye is a reverse image search engine that allows you to search for images by uploading them or by entering a URL.
3. Bing Image Match – Bing’s Image Match feature lets you search for similar images or to identify the source of an image.
4. Social Catfish – Social Catfish is a people search engine that can search for people using a picture.
5. Pictriev – Pictriev is a face recognition search engine that allows you to search for people using a picture.

Be creative

If you really want to present the friendly face of your team then be creative. Make it interesting to look at, don’t give details. Avoid using names be creative with descriptions if you need them don’t make it easy for hackers who don’t like each person to their LinkedIn page or Facebook or Twitter.

Our advice is you use pictures of your team to create engagement with visitors. Ditch the Meet the Team Page. Introduce your team into the fabric of the site or as buttons to book a meeting or get more information.

Get photographs taken professionally. While smart phones can take brilliant pictures a photographer will simply do a superior job.

Conclusion

Listing employees on your website can expose your organization to social engineering attacks, which can be highly damaging. By limiting the information available, implementing access controls, educating employees, and monitoring for attacks, businesses can reduce the risks and protect themselves against these threats. It’s important to remember that social engineering attacks are constantly evolving, and businesses must remain vigilant to protect against them.

The post Why adding “Meet the Team” to your website could put you at risk. appeared first on Mear Technology.

• 3CX: https://www.3cx.com/blog/news/desktopapp-security-alert
• Trend Micro: https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html
• Crowd Strike: https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
• 3CX appoints 3rd party to investigate issue https://www.3cx.com/blog/news/desktopapp-security-alert-updates/ (30/03/23)

What Mear Technology have done for our clients

30/03/23 am Identified all machines we manage with 3CX Desktop app 18.12.407 & 18.12.416.

30/03/23 am Removed the affected version of 3CX desktop app on all clients and installed Web App (PWA) version. Sent a secure message directly to affect staff with instructions on what to do. Staff will need to Activate this install.

30/03/23 pm forced a full scan of all machines that received

30/03/23 pm patched all phone systems

What else can we tell you?

All our customers using our Managed Antivirus will be glad to know that the infection was picked up by our Antivirus blocked and cleaned at the point of deployment.

How to activate/Install 3CX Web App (PWA)

To do this please log in to your webclient details can be found in your 3CX Welcome email

Click Apps (bottom left corner)

Click Web App (PWA)

Click install

The post 3CX DesktopApp Security Alert appeared first on Mear Technology.

Announcement 

On February 19, Meta’s CEO, Mark Zuckerberg, announced that Meta is starting the rollout of its new ‘Meta Verified’ subscription service for Facebook and Instagram, staring in Australia and New Zealand. For a monthly subscription of $11.99 / month on web or $14.99 / month on iOS., Meta Verified lets users verify their account “with a government ID” in return for which they get a blue badge, i.e. extra impersonation-protection against accounts claiming to be them, plus direct access to customer support.  
 
Meta says that the new feature “is about increasing authenticity and security across our services” and Mark Zuckerberg says that a blue badge “effectively find and remove any imposter accounts since we know which account is the real you.” 

Imposter Accounts Problem 

Facebook and Twitter (two of the most widely used social media platforms) and other platforms have suffered from the issue of people setting up imposter accounts. Imposter accounts on social media platforms like Facebook or Twitter can pose several problems, including: 

– Misrepresentation. Imposter accounts often pretend to be someone else, such as a celebrity or a public figure, and use their name, image, or brand to mislead people. This misrepresentation can damage the reputation of the person or brand being impersonated. 

– Identity theft. Imposter accounts can also use stolen personal information to create fake accounts, which can lead to identity theft and other fraudulent activities. 

– The spreading of misinformation. Imposter accounts can also spread false information, rumours or propaganda, which can harm individuals or groups and influence public opinion. 

– Cyberbullying. Imposter accounts can also use fake identities to harass or bully people, which can cause emotional distress and harm mental health. 

– Security concerns. Imposter accounts can be used to gain access to personal information or to spread malware or viruses, which can compromise the security of social media users. 

Like Twitter’s ‘Blue Tick’ Service 

Meta’s Blue Badge service appears to be remarkably similar to Twitter’s Blue service. 

Twitter’s Blue service, often referred to as ‘Blue Tick’ was originally introduced back in 2021 following reports that perhaps as much as 19 per cent of Twitter accounts could be fake and untrustworthy. The problem persisted and became an issue last year when Elon Musk was buying Twitter when it was estimated that spam and fake accounts / bot accounts (not run by humans) made up 5 per cent of Twitter accounts.  

With Musk also needing a revenue stream in addition to advertising, a revamped, subscription Blue service was introduced in November 2022 with users able to verify (by use of a blue tick next to their name) that their account is genuine and get editing and customisation options that free accounts don’t have. Despite the service experiencing a backlash that alarmed some advertisers, and being temporarily halted, it was resumed it in December 2022. 

A recent tweet suggesting that Meta’s ‘Meta Verified’ subscription service (Blue Badge) is essentially a copy of Twitter’s idea was met with a reply from Elon Musk saying that Meta’s move was “inevitable.” 

What Does This Mean For Your Business? 

For Meta, in addition to being a competitive move, it’s also a way to increase revenue, tackle the problem of fake accounts and the spreading of disinformation and misinformation that Facebook, along with other platforms, has suffered from, while increasing trust in the platform. That said, the Meta Verified service is just in Australia and New Zealand at the moment, so it remains to be seen what kind of reaction there is to it, and how successful it looks likely to be if rolled out elsewhere.

It may initially be more useful and more popular among some user groups than others, e.g. celebrities, political leaders, well known businesses, and content creators wanting to increase their presence on Facebook and Twitter. For those who subscribe to Meta Verified, it may be the case that access to customer support is a large part of the real value of the service, and not just the blue badge. 

The post Tech News : New Meta Verified Blue Badge Subscription Service appeared first on Mear Technology.

The list of changes includes:

• User devices: With the exception of network devices, all user devices declared within the scope of the certification only require the make and operating system to be listed. The requirement for listing the model of the device has been removed. This change will be reflected in the self-assessment question set, rather than the requirements document.
• Clarification on firmware: Router and firewall firmware are the only firmware that must be kept up to date and supported. This information has been clarified following feedback that it can be difficult to find.
• Third-party devices: More information and a new table clarify how third-party devices, such as a contractor or student devices, should be treated in your application.
• Device unlocking: A change has been made here to mitigate some issues around default settings in devices being unconfigurable. Where that is the case, it is now acceptable for applicants to use those default settings.
• Malware protection: Anti-malware software will no longer need to be signature-based, and sandboxing is removed as an option. The requirements have also been clarified to indicate which mechanism is suitable for different types of devices.
• New guidance on zero trust architecture for achieving CE and a note on the importance of asset management.
• Style and language: Several language and format changes have been made to make the document easier to read.
• Structure updated: The technical controls have been reordered to align with the updated self-assessment question set.
• CE+ testing: The CE+ Illustrative Test Specification document has been updated to align with the requirements changes. The biggest change here is a refreshed set of Malware Protection tests, to simplify the process for both applicants and assessors.

These changes are based on feedback from assessors and applicants and have been made in consultation with technical experts from the National Cyber Security Centre (NCSC). Small businesses should note that the new requirements will take effect from 24 April 2023, and all applications started on or after this date will use the new requirements and question set. The Cyber Essentials delivery partner, IASME, will provide additional guidance and resources to help small businesses during the certification process.

How do small business tackle and maintain Cyber Essentials

To help our customers achieve and maintain Cyber Essentials or Cyber Essentials Plus we have combined a collection of solutions to help achieve and maintain Cyber Essentials.

Our aim is to reduce disruption and costs to our customers helping them make required changes and put in tools to enforce any procedures put in place.

To find out more book a meeting with our Director, let’s find out about your business and discuss how we can help get your business certified

The post Cyber Essentials – Changes in April 2023 appeared first on Mear Technology.

More Strains With Shorter Lifespans 

However, the number of unique ransomware strains being used in attacks increased dramatically in 2022 (Fortinet). Also, Chainanalysis reports that ransomware lifespans are dropping. For example, in 2022, the average ransomware strain remained active for just 70 days, down from 153 in 2021 and 265 in 2020. 

How Does Chainanalysis Know Criminals Get Paid? 

Being a blockchain data platform (blockchain is the technology behind cryptocurrencies) Chainanalysis can track money flowing in and out of Bitcoin wallets. Ransomware crews use bitcoin wallets to collect ransoms and retain their anonymity. Also, evidence from cyber insurance firms who are usually the ones reimbursing victims for ransomware payments, show that these payments are down. 

Why Are People Refusing To Pay Ransomware? 

There are several reasons why more victims are refusing to pay the ransomware ransom, including: 

– Increased awareness. More people are becoming aware of the risks, so this has led to improved cyber-security at organisations, while increased awareness of the potential consequences of paying the ransom has led to many choosing not to do so. 

– Improved and more secure backups. With the increased use of more secure cloud-based backups and other disaster recovery solutions, more people are able to recover their data without paying the ransom. It’s worth noting that insurance companies are driving security by tightening underwriting standards, and by not renewing a policy unless the insured has comprehensive backup systems, uses EDR, and has multi-authentication. 

– Greater segmentation of data backups, resulting in less material business impact as a result of an attack, thereby reducing the economic justification to pay. 

– US sanctions against hacker groups, e.g. those Russia’s Federal Security Service, have made paying some groups legally risky. 

– Increased openness due to how common ransomware attacks have become. For example, a ransomware attack is now less of a PR disaster for companies, meaning that companies are less likely to keep quiet and pay the money to stay out of the news. 

Why Are Ransomware Lifespans Dropping? 

There are several reasons why ransomware lifespans are dropping (including those mentioned above), such as: 

– The increased use of anti-ransomware software. As more organisations and individuals use anti-ransomware software to protect their systems, the lifespan of ransomware attacks may be shorter, as the malware is detected and neutralised more quickly. 

– Improved incident response. As organisations and individuals become more familiar with the signs of a ransomware attack and have better incident response plans in place, they are able to quickly detect and respond to the attack, which can shorten the lifespan of the ransomware. 

– The development of decryption tools, some security researchers have been able to develop decryption tools that can help victims recover their data without paying the ransom. This can significantly shorten the lifespan of a ransomware attack. 

– More effective law enforcement action. Law enforcement agencies have been successful in shutting down some larger ransomware operations and gangs. This can also shorten the lifespan of a ransomware attack. 

– Cyber insurance and the involvement of specialised teams. More companies are now using cyber insurance and have specialised teams to deal with ransomware attacks, this also can shorten the lifespan of a ransomware attack. 

What Does This Mean For Your Business? 

Criminal earnings from ransomware are down for the reasons mentioned above, and although larger ransomware gangs have been disrupted, there are now many smaller groups operating. It’s also worth noting that new strains of ransomware are being developed all the time, so the threat continues to be present (and is growing as previously stated). With this in mind, businesses should continue to focus on not falling victim to ransomware attacks in the first place. Measures businesses can take include having recurring meetings with all relevant teams/persons (security, networking, IT, server administration, PR, finance) and the company leadership to develop a clear picture of the strengths and weaknesses/vulnerabilities and establish how the business can remain secure and understand who’s responsible for all aspects of security. Also, seeking professional advice about cyber security and implementing best practices, e.g. with data backups and other security measures, can help keep the business safe from new as well as existing ransomware strains. 

The post Fewer Victims Pay Ransomware, Yet More Victims appeared first on Mear Technology.