What is the significance of this takedown?

16Shop specialises in the sales of phishing kits that other cybercriminals can purchase to mount phishing attacks on a large scale, ultimately facilitating the theft of credentials and payment details from users of popular services such as Apple, PayPal, American Express, Amazon, and Cash App, among others.

It is estimated that around 70,000 users across 43 countries have been compromised thanks to 16Shop. So it is good news globally that this has been a successful campaign.

To find out more about how Trend helped click here

In the News

https://newsroom.trendmicro.com/2023-08-14-Trend-Micro-Teams-Up-with-INTERPOL-to-Take-Down-Notorious-Phishing-Operation#assets_all

https://www.interpol.int/en/News-and-Events/News/2023/Notorious-phishing-platform-shut-down-arrests-in-international-police-operation

https://thehackernews.com/2023/08/interpol-busts-phishing-as-service.html

The post Trend Micro Takes Down Notorious Phishing Operation by Working with INTERPOL appeared first on Mear Technology.

Sophisticated Attacks That Highlight Vulnerabilities 

In the ever-evolving landscape of digital threats and cyber warfare, one term often sends chills down the spines of cybersecurity professionals: Zero-Day Attacks. These sophisticated and stealthy cyber-attacks represent a significant challenge in today’s interconnected business world. They symbolise not just the advancement of cybercriminals’ tactics but also highlight the vulnerabilities that exist within our most trusted digital infrastructures. 

Exploiting Zero-Day Vulnerabilities 

Zero-day attacks are attacks by threat actors that exploit zero-day vulnerabilities. These are undisclosed software vulnerabilities (unknown to vendor or victims) that hackers can exploit to adversely affect computer programs, data, additional computers, or a network.  

Vulnerabilities targeted in zero-day attacks can be found in operating systems, web browsers, Office applications, open-source components, hardware and firmware, and the Internet of Things (IoT). 

Why “Zero-Day”? 

The term “zero-day” comes from the fact that software developers and those in charge of digital security have zero days to fix the vulnerability because it is simply not known to them until the first attack. This means that attackers can exploit the vulnerabilities before developers become aware and are able to issue any patches or remediations.  

How Big Is The Problem? 

Although zero-day vulnerabilities fell by almost a third in 2022, it was still the second highest year on record (Mandiant research) with 55 zero-day vulnerabilities exploited and products from the three largest vendors (Microsoft, Google, and Apple) were the most commonly exploited (for the third year in a row). 

What Can Happen? 

Zero-day attacks commonly result in unauthorised data access, data theft, or service disruptions. These, in turn, can result in reputational damage, lost customers, fines (e.g. legal action by those affected an/or ICO fines), plus possibly the loss of the business itself if the attack is serious enough. Secondary attacks on the business and those affected by data theft could also come from the first attack,.e.g. malware, ransomware, phishing, social engineering attacks, and more. 

Cybersecurity experts, therefore, continually work to discover these types of vulnerabilities before hackers do, to try and prevent potential attacks. 

Vulnerabilities, Exploits, Then Attacks 

After threat actors have discovered a zero-day vulnerability, the next stage is ‘zero-day exploits’ – the blueprints that outline how these hidden flaws can be taken advantage of, often traded on the dark web. The zero-day attack itself is, therefore, the act of exploiting the flaw/vulnerability, using the guidance of the exploit, before a patch can be rolled out, leaving a digital system scrambling in the wake of the unforeseen breach. 

Who? 

These under-the-radar strikes are often orchestrated by advanced cyber criminals, state-sponsored hacking groups, or unscrupulous entities with nefarious motives. The objectives are as varied as the threat actors themselves. For some, it’s about monetary gains whereas for others, it’s a tool for intellectual property theft, infiltrating state secrets, or merely sowing seeds of chaos. Corporate espionage and political machinations are just the tip of the iceberg when it comes to reasons behind these attacks. 

Recent High-Profile Examples 

Some recent, high-profile examples of Zero-Day attacks include: 

– In 2023, a critical vulnerability was uncovered in the secure managed file transfer (MFT) service provided by MOVEit, a transfer platform widely used by large companies in a variety of sectors including healthcare, government, finance, and aviation. The Russian-based Clop Ransomware group exploited the vulnerability and were able to steal data from eight UK organisations including BBC, British Airways, Aer Lingus, and Boots. 

– In 2022 the CVE-2022-30190, a.k.a. Follina vulnerability in Microsoft Diagnostics Tool (MDST), was exploited and victims were persuaded to open Word documents which enabled attackers to execute arbitrary code. The government of the Philippines, business service providers in South Asia, and organisations in Belarus and Russia were all subject to the same zero-day attack. 

– The notorious Microsoft Exchange Server hack in early 2021, widely believed to have been sponsored by a nation-state, exploited several previously unknown vulnerabilities in Microsoft’s email server software. The damage was widespread and profound, with tens of thousands of organisations worldwide left grappling with the aftermath before a security patch could be rolled out. 

– Google’s Chrome suffered a series of zero-day threats in 2021, causing Chrome to issue updates. The vulnerability was a bug in the V8 JavaScript engine used in the web browser. 

– A zero-day attack on video conferencing platform Zoom in 2020 where hackers accessed a user’s PC remotely if they were running an older version of Windows. The hackers targeted the administrator, allowing them to completely take over their machine and access all files. 

– In 2020, the Apple iOS was attacked twice with zero-day vulnerabilities and one zero-day bug allowed attackers to compromise iPhones remotely. 

How Businesses Can Protect Themselves 

So, how can businesses protect themselves against the threat of zero-day attacks? Given their nature, these attacks pose a formidable challenge, but protective measures that can be taken include: 

– Regularly updating software updates and staying up to date with patching. 

– Employing advanced threat detection tools that utilise behaviour-based detection techniques to pinpoint anomalies and unusual activity in network traffic (often the first sign of a zero-day attack). 

– Conducting regular penetration tests and vulnerability assessments. These proactive practices can unearth previously unknown vulnerabilities within systems, allowing businesses to patch them before they are exploited. Following the principle of least privilege – limiting user access rights to the bare minimum needed for their work – can also help reduce the extent of potential damage should an attack occur. 

– Beyond technological defences, investing in comprehensive cybersecurity awareness training for employees is crucial. An informed team acts as the human firewall against cyber threats, understanding the risks, recognising signs of possible attacks, and knowing how to respond swiftly and effectively. 

What Does This Mean For Your Business? 

In the face of the ominous threat of zero-day attacks, businesses must adopt a proactive and comprehensive approach to digital security. A robust defence strategy isn’t a luxury but an absolute necessity in today’s digital age. It involves a constant balancing act of risk management, regular system updates, advanced threat detection, routine penetration testing, and vulnerability assessments, regular system audits, and maintaining a culture of security vigilance throughout the organisation. 

A multi-layered security approach and a zero-trust model could, therefore, provide a solid foundation for defence although, because some vulnerabilities may still not be known until it’s too late, zero-day attacks remain an ever-present threat. 

The potential devastation of zero-day attacks and their aftermath is unquestionable, but it is not an insurmountable challenge. By being as vigilant and proactive in defence measures as is realistically possible, businesses can steer through the murky waters of the cyber threat landscape, securing their digital assets, and upholding the trust of their customers and partners. The world of cybersecurity may be akin to a never-ending arms race, but with the right preparation and resilience, staying one step ahead must be an achievable goal.

The post Tech Insight : What Are ‘Zero-Day’ Attacks? appeared first on Mear Technology.

• 3CX: https://www.3cx.com/blog/news/desktopapp-security-alert
• Trend Micro: https://www.trendmicro.com/en_us/research/23/c/information-on-attacks-involving-3cx-desktop-app.html
• Crowd Strike: https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/
• 3CX appoints 3rd party to investigate issue https://www.3cx.com/blog/news/desktopapp-security-alert-updates/ (30/03/23)

What Mear Technology have done for our clients

30/03/23 am Identified all machines we manage with 3CX Desktop app 18.12.407 & 18.12.416.

30/03/23 am Removed the affected version of 3CX desktop app on all clients and installed Web App (PWA) version. Sent a secure message directly to affect staff with instructions on what to do. Staff will need to Activate this install.

30/03/23 pm forced a full scan of all machines that received

30/03/23 pm patched all phone systems

What else can we tell you?

All our customers using our Managed Antivirus will be glad to know that the infection was picked up by our Antivirus blocked and cleaned at the point of deployment.

How to activate/Install 3CX Web App (PWA)

To do this please log in to your webclient details can be found in your 3CX Welcome email

Click Apps (bottom left corner)

Click Web App (PWA)

Click install

The post 3CX DesktopApp Security Alert appeared first on Mear Technology.

Announcement 

On February 19, Meta’s CEO, Mark Zuckerberg, announced that Meta is starting the rollout of its new ‘Meta Verified’ subscription service for Facebook and Instagram, staring in Australia and New Zealand. For a monthly subscription of $11.99 / month on web or $14.99 / month on iOS., Meta Verified lets users verify their account “with a government ID” in return for which they get a blue badge, i.e. extra impersonation-protection against accounts claiming to be them, plus direct access to customer support.  
 
Meta says that the new feature “is about increasing authenticity and security across our services” and Mark Zuckerberg says that a blue badge “effectively find and remove any imposter accounts since we know which account is the real you.” 

Imposter Accounts Problem 

Facebook and Twitter (two of the most widely used social media platforms) and other platforms have suffered from the issue of people setting up imposter accounts. Imposter accounts on social media platforms like Facebook or Twitter can pose several problems, including: 

– Misrepresentation. Imposter accounts often pretend to be someone else, such as a celebrity or a public figure, and use their name, image, or brand to mislead people. This misrepresentation can damage the reputation of the person or brand being impersonated. 

– Identity theft. Imposter accounts can also use stolen personal information to create fake accounts, which can lead to identity theft and other fraudulent activities. 

– The spreading of misinformation. Imposter accounts can also spread false information, rumours or propaganda, which can harm individuals or groups and influence public opinion. 

– Cyberbullying. Imposter accounts can also use fake identities to harass or bully people, which can cause emotional distress and harm mental health. 

– Security concerns. Imposter accounts can be used to gain access to personal information or to spread malware or viruses, which can compromise the security of social media users. 

Like Twitter’s ‘Blue Tick’ Service 

Meta’s Blue Badge service appears to be remarkably similar to Twitter’s Blue service. 

Twitter’s Blue service, often referred to as ‘Blue Tick’ was originally introduced back in 2021 following reports that perhaps as much as 19 per cent of Twitter accounts could be fake and untrustworthy. The problem persisted and became an issue last year when Elon Musk was buying Twitter when it was estimated that spam and fake accounts / bot accounts (not run by humans) made up 5 per cent of Twitter accounts.  

With Musk also needing a revenue stream in addition to advertising, a revamped, subscription Blue service was introduced in November 2022 with users able to verify (by use of a blue tick next to their name) that their account is genuine and get editing and customisation options that free accounts don’t have. Despite the service experiencing a backlash that alarmed some advertisers, and being temporarily halted, it was resumed it in December 2022. 

A recent tweet suggesting that Meta’s ‘Meta Verified’ subscription service (Blue Badge) is essentially a copy of Twitter’s idea was met with a reply from Elon Musk saying that Meta’s move was “inevitable.” 

What Does This Mean For Your Business? 

For Meta, in addition to being a competitive move, it’s also a way to increase revenue, tackle the problem of fake accounts and the spreading of disinformation and misinformation that Facebook, along with other platforms, has suffered from, while increasing trust in the platform. That said, the Meta Verified service is just in Australia and New Zealand at the moment, so it remains to be seen what kind of reaction there is to it, and how successful it looks likely to be if rolled out elsewhere.

It may initially be more useful and more popular among some user groups than others, e.g. celebrities, political leaders, well known businesses, and content creators wanting to increase their presence on Facebook and Twitter. For those who subscribe to Meta Verified, it may be the case that access to customer support is a large part of the real value of the service, and not just the blue badge. 

The post Tech News : New Meta Verified Blue Badge Subscription Service appeared first on Mear Technology.

More Strains With Shorter Lifespans 

However, the number of unique ransomware strains being used in attacks increased dramatically in 2022 (Fortinet). Also, Chainanalysis reports that ransomware lifespans are dropping. For example, in 2022, the average ransomware strain remained active for just 70 days, down from 153 in 2021 and 265 in 2020. 

How Does Chainanalysis Know Criminals Get Paid? 

Being a blockchain data platform (blockchain is the technology behind cryptocurrencies) Chainanalysis can track money flowing in and out of Bitcoin wallets. Ransomware crews use bitcoin wallets to collect ransoms and retain their anonymity. Also, evidence from cyber insurance firms who are usually the ones reimbursing victims for ransomware payments, show that these payments are down. 

Why Are People Refusing To Pay Ransomware? 

There are several reasons why more victims are refusing to pay the ransomware ransom, including: 

– Increased awareness. More people are becoming aware of the risks, so this has led to improved cyber-security at organisations, while increased awareness of the potential consequences of paying the ransom has led to many choosing not to do so. 

– Improved and more secure backups. With the increased use of more secure cloud-based backups and other disaster recovery solutions, more people are able to recover their data without paying the ransom. It’s worth noting that insurance companies are driving security by tightening underwriting standards, and by not renewing a policy unless the insured has comprehensive backup systems, uses EDR, and has multi-authentication. 

– Greater segmentation of data backups, resulting in less material business impact as a result of an attack, thereby reducing the economic justification to pay. 

– US sanctions against hacker groups, e.g. those Russia’s Federal Security Service, have made paying some groups legally risky. 

– Increased openness due to how common ransomware attacks have become. For example, a ransomware attack is now less of a PR disaster for companies, meaning that companies are less likely to keep quiet and pay the money to stay out of the news. 

Why Are Ransomware Lifespans Dropping? 

There are several reasons why ransomware lifespans are dropping (including those mentioned above), such as: 

– The increased use of anti-ransomware software. As more organisations and individuals use anti-ransomware software to protect their systems, the lifespan of ransomware attacks may be shorter, as the malware is detected and neutralised more quickly. 

– Improved incident response. As organisations and individuals become more familiar with the signs of a ransomware attack and have better incident response plans in place, they are able to quickly detect and respond to the attack, which can shorten the lifespan of the ransomware. 

– The development of decryption tools, some security researchers have been able to develop decryption tools that can help victims recover their data without paying the ransom. This can significantly shorten the lifespan of a ransomware attack. 

– More effective law enforcement action. Law enforcement agencies have been successful in shutting down some larger ransomware operations and gangs. This can also shorten the lifespan of a ransomware attack. 

– Cyber insurance and the involvement of specialised teams. More companies are now using cyber insurance and have specialised teams to deal with ransomware attacks, this also can shorten the lifespan of a ransomware attack. 

What Does This Mean For Your Business? 

Criminal earnings from ransomware are down for the reasons mentioned above, and although larger ransomware gangs have been disrupted, there are now many smaller groups operating. It’s also worth noting that new strains of ransomware are being developed all the time, so the threat continues to be present (and is growing as previously stated). With this in mind, businesses should continue to focus on not falling victim to ransomware attacks in the first place. Measures businesses can take include having recurring meetings with all relevant teams/persons (security, networking, IT, server administration, PR, finance) and the company leadership to develop a clear picture of the strengths and weaknesses/vulnerabilities and establish how the business can remain secure and understand who’s responsible for all aspects of security. Also, seeking professional advice about cyber security and implementing best practices, e.g. with data backups and other security measures, can help keep the business safe from new as well as existing ransomware strains. 

The post Fewer Victims Pay Ransomware, Yet More Victims appeared first on Mear Technology.

Why Are We Being Tracked? 

Internet tracking is used for a number of reasons, including: 

– Improving user browser experiences on websites. 

– For analytics to improve business performance and inform/feed-into marketing content strategies, and to monitor a website’s usability. 

– To enable the targeting of users with advertising, and to generate revenue by selling data about our browsing activities. 

Why Should We Be Concerned About Tracking? 

Some of the risks associated with tracking include: 

– Privacy and security risks, i.e. our personal data being taken and potentially falling into the wrong hands / being used by cybercriminals, and companies building profiles of users based on sensitive information gained from trackers in websites.  

– Matters of transparency and losing control of personal data. For example, where user data is stored and who has access to it is difficult to ascertain, and feeds into privacy and security worries. 

– The possible contravention of a user’s legal rights and matters of consent. For example, GDPR, the California Consumer Privacy Act (CCPA) and Privacy Rights Act (CPRA) and others have meant that tech companies can no longer legally track everything that users do and share that data with multiple other third parties as they wish without permission. For example, in the UK, since GDPR’s introduction, websites must display cookie consent and privacy information displayed on the home page. 

Most Websites Use Tracking Tools 

Over 80 percent of websites use one or more tracking tools (Epic) and reasons for private browsing may be to avoid having your browsing history recorded, perhaps being on a shared or public computer (to avoid being tracked by your browser), or to avoid downloading cookies (to avoid being tracked by websites), or to be able to sign into multiple accounts simultaneously. 

How Are We Being Tracked? 

The different ways that your browsing and free searching behaviour on the web can be tracked include: 

– IP address tracking. The IP address (a string of numbers), set by the ISP, is a way for each computer using the Internet Protocol to communicate over a network. The IP address is necessary for accessing the Internet so that web servers know where to send the information that’s being requested. 

– Cookies. These are text files loaded into a folder on the user’s web browser by the sites they visit. Cookies record details such as users’ preferences, and the last time they visited the website. Session cookies are used when a person is actively navigating a website but tracking cookies can be used to create long-term records of multiple visits to the same site. From the user point of view, cookies can serve a useful purpose (e.g. for logins) or can be used for targeted advertising.  Google recently announced an end to its third-party (tracking) cookies within 2 years for its Chrome browser following similar, earlier announcements by Safari (Apple), Mozilla’s Firefox (Mozilla) and Brave. 

– Signed-in accounts. The accounts a user is signed-in to (e.g. Google or Facebook) can also track what a user has viewed, liked and more. 

– Agent strings. When a user sends a request to a webserver to view a website, the request comes with information about the user attached to the User-Agent HTTP header. This ‘agent string’ contains information such as the browser (type and version) and operating system being used. 

– Web beacons. These web bugs / tracking beacons track how a user engages with a specific webpage, including the content a user clicks on. 

– Mouse tracking / cursor tracking software that records online users’ mouse movements to reveal how they interact with a website. 

– Session replay scripts, i.e. programs that record a website visitor’s activity, such as mouse movements, clicks, and scrolls. 

– Favicons (super cookies). These work in a similar way to cookies but are more difficult to decline or remove. 

– Browser fingerprinting. This involves gathering and combining a variety of information about a user’s device to create a unique online identity which can be tracked. 

– Cross-device tracking. This is the matching up of a user’s browsing habits across devices. 

Tracked By Mobile Apps 

All mobile apps gather basic data, e.g. the user’s phone number and email address. Also, users are now tracked by 60 per cent of the world’s most used mobile apps (i.e. harvesting and storing data generated through private conversations). 80 per cent of mobile apps collect data on messages their users send and receive. 

In addition to trying to gather data, some mobile apps also try to collect cookies, and 50 per cent of them can access a user’s photos and videos. 

How To Avoid Being Tracked 

There are many ways that users can try to avoid tracking, including using: 

– Incognito/private browsing mode. 
– Private Browsers and Private Browser Extensions. 
– VPNs.
– Other privacy tools 

Incognito Mode / Private Browsing 

Different browsers have different names for private browsing mode, e.g. InPrivate browsing (Edge), ‘Private’ for Firefox (Mozilla) and Safari, and Incognito for Google Chrome.  

Switching to this browser mode loads a new private window. This means that the new window is not signed to any accounts so can’t be tracked by them, cookies are not used, and any browsing is not added to the browser history. In this mode, however, the user’s IP address can still be tracked. 

Private Browsers 

Neeva is a new advert- and tracker-free search engine which has just been launched in Europe by former Google executive Sridhar Ramaswamy, using funding by investors. Neeva offers free-to-use search and a password manager, and VPN (for a subscription). Neeva also stresses that its searches are free from bias / corporate influence, suggesting a more impartial experience. 

For a more detailed picture of how much tracking is taking place when visiting web pages, Neeva’s Chrome browser extension lists the trackers installed on web pages visited. See https://neeva.com/. 

DuckDuckGo is a privacy-centred search engine / privacy browsing app, which is available as a download for mobile devices and a Chrome extension. DuckDuckGo retains a user’s privacy by not saving the user’s browser history, forcing sites to use encrypted connections, blocking cookies and trackers (including ‘hidden trackers’ before they load), and by stopping a user’s searches being sold to third parties for profiling and advertising. 

DuckDuckGo employs Smarter Encryption which utilises a list of millions of HTTPS-encrypted websites, which has been generated by continuous crawling the of the web instead of crowdsourcing, thereby keeping it current. Also, DuckDuckGo’s Smarter Encryption enables users to be extra-secure in their browsing by being able to detect unencrypted, non-secure HTTP connections to websites and then automatically upgrading them to encrypted connections. See https://duckduckgo.com/. 

Epic is a privacy and security focused, Chromium-based browser that blocks ads, trackers, fingerprinting, crypto mining, ultrasound, signalling, and offers free VPN (with servers in 8 countries). See https://www.epicbrowser.com/. 

The Brave privacy-focused, Chromium based browser that is free and open-source. It blocks ads and trackers and allows users to use a Tor in a tab to hide history, and masks location from the sites a user visits by routing a user’s browsing through several servers before it reaches its destination. See https://brave.com/. 

The Tor browser uses a distributed network (randomly selected nodes) to anonymise a user’s IP address and encrypts traffic. This makes it incredibly difficult for a user’s web traffic to be traced and very difficult for users to be tracked unless they reveal their IP address by enabling some browser plugins, downloading torrents, or opening documents downloaded using Tor. However, Tor is also used for accessing and is associated with the ‘dark web.’ See https://www.torproject.org/download/. 

Private Extensions For Browsers 

Another option for users to try and maintain private browsing is to use an additional private browsing extension/add-on. Examples include: 

– Privacy Badger. This is a free extension that gradually learns to block invisible trackers. 

– Ghostery. This is a free, open-source privacy and security-related browser extension and mobile browser app that blocks ads and stops trackers. 

– Cookie AutoDelete. This is an extension for erasing cookies for a browser tab when it closes. 

– HTTPS Everywhere. This free, open-source browser extension automatically switches thousands of sites from “http” to secure “https” thereby protecting the user from many different types of tracking/surveillance and account hijacking. 

VPNs – Will Using A VPN Stop You From Being Tracked? 

The short answer is no. Although a virtual private network (VPN) routes a user’s internet through another computer (where many other users of the VPN are using the same IP address) making tracking difficult, it does not stop tracking altogether.  

A VPN makes a secure connection to another network over the Internet, encrypts traffic, and hides the user’s IP address. However, VPNs do not protect a user from being tracked, from cookies, from user-agent strings, or through the accounts they are logged into (e.g. Google), or from any VPN’s that keep logs of user activity and which could sell those logs to third parties. Also, some services discourage the use of a certain VPN, and VPNs can slow down the user’s Internet connection dues to the re-routing and encrypting through the VPN server. 

Other Privacy Tools 

Examples of some other privacy tools that users can choose to avoid being tracked include combination firewall, antivirus, and VPN tools like Norton 360 Deluxe or Panda Dome, or web proxy tools like Privoxy. 

Third-Party Cookies Being Phased Out 

Some recent ‘good’ news in the tracking world is that last year Google announced that it was phasing out third-party cookies (over two years) and would not use other technology to replace these cookies or build features into its Chrome Browser to allow itself access to that data. Google said that it would be switching to Federated Learning of Cohorts (FLoC), a method which groups what it categorises as like-minded online users together so they can be collectively tracked. 

What Does This Mean For Your Business? 

The risk of cybercrime, data breaches, and simply being targeted by advertisers mean that for most business users, the security of knowing that they’re not being tracked and that there is a high level of privacy protection by default may be an attractive and useful part of company security measures. Also, using a trusted app/extension/desktop browser may be a convenient way to get greater peace of mind and ensure that all reasonable measures are being taken to cover the many angles of security and privacy. For many businesses, it is likely to be a case of a combination of privacy solutions, e.g. VPNs, secure browsers and extensions, and other privacy tools being used as and when required in a way that is compatible with daily working practices, authorised, approved, and recommended by the company and other relevant stakeholders.

The post Forget Hacking, What About Tracking? appeared first on Mear Technology.

Following the attack, a ransom request of $1m (A$1.5m / £938,000) in cryptocurrency was made to Optus. The advice to those Australian customers affected has been to look out for signs of identity theft and for any opportunistic scammers looking to exploit the confusion in the aftermath. It is thought that the hack could lead to lead to European-style privacy laws being introduced in Australia.

The post Security Stop-Press : Biggest Cyber Hack In History – Australia’s ‘Optus’ appeared first on Mear Technology.

Benefits 

On the surface, there appears to be some clear benefits to using pirated software such as acquiring the capabilities of possibly expensive and powerful software at little/no cost, getting the up-to-date capabilities of the latest versions plus reaping the commercial advantages, while learning and getting the enjoyment that this can bring. There may also be feelings and thoughts that the price of the legitimate software may have been too high anyway and that the probably wealthy software manufacturer is not going to miss the potential profit it would have made on a few pirated downloads, thereby relieving users of feelings of guilt. 

However, the true cost of using pirated software may not simply be calculated in costs saved or profits lost. There are risks and effects that the pirated-software user may not be fully aware of. Here are some examples which help to illustrate those true costs to users and their businesses. 

The Risk of Malware 

A recent investigation by Zscale, for example, revealed that threat actors use SEO poisoning to elevate the positions of their mostly .com domain websites in the search engines for key phrases like ‘Adobe Acrobat Pro,’ or ‘7-Data Recovery Suite’. Downloading their pirate software or cracks, keygens, and activators, however, can mean downloading info-stealing malware, such as RedLine Stealer, or RecordBreaker which can steal passwords and payment data. Downloading pirated software can also mean downloading other malware, ransomware, viruses, or adware which can pose a huge security risk for businesses and individual users. 

No Support Or Help 

Using pirated software can also mean forfeiting access to essential support and security features for a program such as training, upgrades, customer support, manuals, and bug fixes/patches. This can mean lost time and the associated costs, added frustration and reduced productivity in trying to learn a program. It can also mean lost features and functions / a lack of access to the latest features (making the program less effective) and can pose a security risk. Having no access to upgrades and fixes can also mean that the program is more likely to fail, thereby causing disruption, affecting productivity, and cancelling out the cost benefits of getting a free pirated version. 

Copyright Infringement Penalty Risks 

Using or distributing pirated software comes with the risk of some serious penalties for violating copyright law or using unlicensed software. For example, following an investigation by the Business Software Alliance (BSA), an unnamed infrastructure and public services sector organisation paid a record fine of £250,000 for running unlicensed copies of software Adobe, Autodesk, and Microsoft software on hundreds of PCs in several UK locations. In the US, companies or individuals can be fined up to $150,000 in penalties for every instance and could face up to five years in prison for a software piracy felony. 

Increased Risk Of Cyber Crime And Data Breaches Going Forward 

Malware downloaded unwittingly as part of a pirated software program could have the kind of backdoors, monitoring, and exploit capabilities that could be operated at a later date, thereby increasing a company’s risk of falling victim to cybercrime and/or data breaches further down the line.  

Damage To Reputation And Loss Of Customers Or Suppliers 

If, for example, a business is fined (or if it becomes known that the business has been using pirated software), and thus potentially posing a risk to stakeholder data and systems, this could lead to lost customers, a breakdown in or damage to relationships with suppliers, and reputational damage. 

Compliance-Related Issues 

With many more companies now exploring the risks to their own data protection compliance beyond their own company boundaries, i.e. assessing how supplier systems and practices could pose a risk to their own data protection compliance, using pirated software could lose a company business and affect supplier/customer relationships. 

Risks Of Disgruntled Employees Reporting The Company To Receive A Reward 

Although it may sound like one of the lesser risks, i.e. a disgruntled employee or whistleblower reporting the use of unlicensed software in a business, they may nevertheless become motivated to do so by revenge and the offer of a reward – even years afterwards. For example, the Business Software Alliance (BSA) says that a reward may be payable if the BSA pursues an investigation and, as a direct result of the information provided by the informant, receives a monetary settlement from the reported organisation. For example, if a company settles for $15,000 – $100,000, the informant can receive $5,000 or, in large cases, if the company settles for $800,001 – $1,000,000, the informant can receive a $50,000 payment! 

Individual Job Threat 

For individuals who download and use pirated software at work and/or onto work devices, giving access to work systems, if this contravenes IT and security policies, the individual could face disciplinary action or the threat of losing their job. 

How To Protect Your Business From Pirated Software And Its Negative Effects 

Ways that businesses can protect themselves and their employees from the risks of pirated software, unlicensed software, and other potentially dangerous ‘Shadow IT’ software can include: 

– Software asset management and monitoring, including keeping track of all license expiration dates, purchasing any licenses to cover compliance gaps, and keeping software updated. This can include conducting audits of all installed software across the organisation, including all devices. 

– Educating employees about the risks of software piracy and its legal repercussions. 

– Adopting a software and hardware policy that prevents employees from installing software on work devices themselves and procedures that make software administrators responsible instead. 

– Keeping a close eye on any BYOD policy, e.g. developing a clear BYOD policy that works for both the business and the employee on permitted and not permitted tasks, services that can be accessed, control limits over devices, enforcement measures and more. 

– Limiting access to systems and data to a ‘need to use’ basis, using encryption, and adopting zero-trust access can all help. 

What Does This Mean For Your Business? 

Although using pirated software may seem like a way to save money, the potential costs to the business could far outweigh those cost savings and could create weak points in security that could put the business at constant risk of cyber attacks and more. Malware, adware, and other threats that are downloaded with some pirate software are significant risks to the business as are the potential legal penalties and reputational repercussions of being found to be using pirated and unlicensed software. Businesses, therefore, need to create clear policies and procedures around software and who is responsible for installing it, pay close attention to software asset management and monitoring (including audits), and educating staff about the risks and the rules. Businesses with BYOD, for example, should be especially vigilant. Remote working using only centralised, approved cloud-based apps with restrictions in place can be helpful in reducing the risk, as can adopting zero-trust and other security-focused practices.

The post The True Cost Of Using Pirated Software appeared first on Mear Technology.

The Internet of Things (IoT)   

IoT devices are those devices that are now present in most offices and homes that have a connection to the Internet and are, therefore, ‘smart’ and inter-connected. These devices, each of which has an IP address, could be anything from white goods, smart thermostats, digital assistants (Amazon Echo) to CCTV cameras, medical implants, industrial controllers, building entry systems, and even the car. There are now even smart malls and cities in some parts of the world. IoT devices transmit and collect data which can be processed in datacentres or the cloud and uses several different communications standards and protocols to communicate with other devices (Wi-Fi, Bluetooth, ZigBee or message queuing telemetry transport (MQTT).   

Privacy Risks   

Although the smart element of these devices can be used to improve their performance, it can also represent a risk to privacy and security. For example, smart security cameras and smart assistants are essentially cameras and microphones in the home. Also, W-Fi routers, smart lightbulbs and other gadgets and wearables collect and transmit personal data. The risk is that the private data collected by IoT devices and shared over the internet could be vulnerable to hackers around the world. This, in turn, can compromise security as well as privacy as the hacked/intercepted data is used for cybercrime and physical crime (e.g. burglary) using information gained from CCTV cameras. Other risks include:   

– Hackers remotely taking control of devices to misuse them and spy.   

– Some IoT devices have pre-set, default unchangeable passwords, which, if discovered by cyber-criminals, can enable the device to be taken over and misused.   

– IoT devices are prevalent and are often overlooked in security planning, leaving them unguarded and vulnerable to hacks and attacks.   

– IoT devices are deployed in many systems that link to (and are supplied by) major utilities, e.g. smart meters in homes. This means that a large-scale attack on these IoT systems could affect the economy.   

– “Shadow IoT” devices (i.e. connected to corporate networks without the knowledge of IT teams) also now pose a threat to organisations by allowing attackers a way to get into a corporate network. These devices can include fitness trackers, smartwatches and medical devices.   

Protecting Privacy   

Actions that can be taken to retain privacy and limit the potential risks posed by IoT devices include:   

– Securing your router by changing the default settings, i.e. the change the default administrative username, password, network name, and avoid using login names or passwords that contain your name, address, or router brand. Also, enable encryption and check for hardware and software updates.   

– Changing the default username and password on IoT devices that connect to the router, using two-factor authentication (2FA). 

– Not sharing passwords between devices.   

– Taking time to understand what a device collects and how. Users may then make informed choices such a turning smart speakers or cameras off occasionally for privacy.   

– Regularly updating each device’s firmware.   

– Taking advantage of any extra security features on a device, e.g. enabling encryption or setting up a passcode lockout (“three strikes, and you’re out”).   

– Disabling any data collection that is not seen as necessary on a device and disabling or disconnecting any devices that are not in regular use.   

IoT Security   

The threat of the IoT being used for cybercrime has prompted many businesses to start investing in IoT security solutions. According to a recent report by Meticulous Research®, the IoT Security Market could be worth as much $59.16 Billion by 2029.   

What Does This Mean For Your Business?  

The IoT brings many advantages to businesses in terms of cost savings, the gathering of valuable data, monitoring and management. For consumers, smart devices deliver new levels of value-adding functionality and looking ahead, towns and cities will begin to rely even more on the benefits of IoT devices and systems. However, smart devices come with a privacy and security risk if certain steps are not taken such updating firmware, changing default passwords, and disconnecting them when they’re not needed. For businesses, IoT security has become an important issue and demand for it has increased in many industries and organisations. This demand is being driven by an increasing number of ransomware attacks on IoT devices, and an increase in the number of IoT security regulations. The risk may be even greater now in the light of the war waged by Russia on Ukraine. Businesses, therefore, need to take an audit of which IoT devices are in use and make sure appropriate measures are taken to maximise security and privacy.

The post How To Stop Your Smart Devices From Being Used To Spy On You appeared first on Mear Technology.

Trend 

According to the researchers, this rise is in keeping with a trend that has been evident in the last few years where attackers have been increasing their attempts at smishing (SMS/text-based phishing) and sending malware to mobile devices.

Android Is A More Popular Target 

Research shows that Android is a far more popular target for cyber criminals than Apple iOS. This may be because Apple’s App Store has strict quality controls and iOS doesn’t allow sideloading. Most mobile malware is still downloaded from app stores, and this may be due to Android’s more open approach. For example, it is open to multiple app stores and users can easily sideload apps from anywhere. 

What Mobile Malware Does 

The Proofpoint research shows that even though the basic purpose of malware (i.e to give attackers control of a system) remains the same, the latest versions are becoming more advanced. Proofpoint reports that some of this malware is capable of activities such as recording telephone and non-telephone audio and video, tracking locations, destroying or wiping content and data, to name but a few. Also, mobile banking malware lays in wait until the user activates a financial app and then intervenes to steal credentials or information. 

Adapted For Different Languages, Regions, and Devices 

Proofpoint’s Cloudmark Mobile Threat Research has revealed that Mobile malware isn’t limited to any specific geographic region or language and that threat actors adapt their campaigns to a variety of languages, regions and devices.   

Common Mobile Malware Types 

Some of the common types of mobile malware highlighted in Proofpoint’s research include: 

– FluBot – spreads by accessing the infected device’s contacts list or address book and sending the information back to a command-and-control (C&C) server. This malware can access the internet, read and send messages, read notifications, make voice calls, and delete other installed applications. 

– TeaBot – a multifunctional Trojan that can steal credentials and messages and stream an infected device’s screen contents to the attacker. 

– TangleBot – Discovered by Proofpoint and Cloudmark researchers in 2021, this mobile malware spreads via fake package-delivery notifications. 

– Moqhao – originating from China, this remote access Trojan has spying and exfiltration features so it can monitor device communications and grant an attacker remote access to the device. 

How To Protect Your Device 

Ways to protect your device from becoming infected with mobile malware include: 

– Use a mobile antivirus app from a trusted source (three quarters of users don’t have this on their smartphone). 

– Be wary of unexpected or unrequested messages with links, URLs or requests for data of any type, and don’t click on the links. 

– Report spam, smishing and suspected malware delivery to the Spam Reporting Service by using the spam reporting feature in your messaging client or forwarding suspicious text messages to 7726 (“SPAM” on the phone keypad). 

What Does This Mean For Your Business? 

With many people now using their smartphone for many aspects of business, remote working and BYOD now commonplace, while mobile malware is surging and becoming more sophisticated, there is clearly an increased risk. Those with Android smartphones need to be particularly cautious. With three-quarters of users not having a trusted mobile antivirus app on their phone, downloading and using one would be a good place to start (while ensuring it’s a trusted one). Also, awareness should be raised among staff of the danger of clicking on links in unsolicited and suspicious messages (smishing risk) and of the danger of downloading apps outside of the Google Play Store. Caution should also be used when downloading apps within the Google Play Store as some may harbour malware. It’s good practice also to avoid using public Wi-Fi, especially without a VPN, and to keep Bluetooth and Wi-Fi disabled when they’re not in use to minimise the risk of hacking attempts. 

The post Tech News : Mobile Malware Surges By 500% appeared first on Mear Technology.