phishing
Latest
Fifth 'Celebgate' account hijacker sentenced to 34 months in prison
The "celebgate" photo leaks might be years old by now, but that isn't stopping the courts from doling out stiff punishment for the account hijacks. A federal judge has sentenced Chris Brannan to 34 months in prison after he pleaded guilty to identity theft and unauthorized access charges. He admitted to compromising the iCloud, Facebook and Yahoo accounts of 200 targets through both phishing attacks as well as social engineering (where he researched targets to answer their security questions).
Google pulls 29 photo apps that stole pictures and promoted scams
Google still has to deal with malicious Android apps slipping through the cracks despite improvements in its screening technology, and some of the offenders are worse than others. Case in point: the company recently pulled 29 camera and photo apps from the Play Store after it became clear they were meant to push intrusive ads, scam users and even steal content. Multiple apps will push full-screen ads, including porn, and some will use the opportunity to run phishing scams that steal your personal info under the guise of contests. Another group of camera apps were ostensibly meant to beautify your photos, but really just stole the uploaded pictures and gave users a fake update prompt.
Alphabet made a quiz to help you detect phishing scams
For decades, phishing has proven an effective method for attackers to dupe just about anyone into clicking on malicious links so they can wreak havoc on personal and professional lives. Just ask John Podesta, Hillary Clinton's 2016 campaign chief. Phishing scams can be tricky to spot, and Alphabet hopes to help you figure out whether links in your emails genuinely will lead to untold riches or help you lose weight with a magic pill (hint: probably not).
DNC claims Russians launched more phishing attacks after midterms
The New York Times cites court documents filed by the Democratic National Committee that said it believes a Russian group launched a hacking attempt against it after last year's midterm elections. The lawsuit alleges a conspiracy between President Trump's campaign, Russian intelligence and Wikileaks targeting Hillary Clinton's campaign in 2016. According to the NYT, the DNC said "dozens" of email addresses in its organization were targeted by spearphishing, while security firm FireEye linked them to a larger campaign that included thinktanks, public sector, law enforcement and more. While they said a Russian hacking outfit known was APT29, Cozy Bear or the Dukes is likely behind the attempt, it didn't offer a firm attribution -- and we know how tricky those can be. As far as the case itself, some defendants have tried to have it dismissed saying it's just cover for the DNC losing the 2016 election. While that continues to be decided, you probably have security issues of your own to keep an eye on.
FTC issues warning about a Netflix phishing scam
In between bouts of binge watching, keep a close eye on any emails you get that claim to be from Netflix. The Federal Trade Commission issued a warning today about fake messages claiming to be from the streamer that are really just trying to snag your login info or distribute malware. The screenshot shared came from Ohio police, but the message used British English spelling, and the UK's Action Fraud service gave a similar warning a few months ago.
Half of phishing sites trick you into thinking they're 'secure'
You can't assume that a site is honest because it has that "secure" padlock in the address bar, and PhishLabs just illustrated why. The anti-phishing company has determined that 49 percent of all known phishing sites used Secure Sockets Layer protection (and thus displayed the padlock) as of the third quarter of 2018. That's a sharp rise from 35 percent in the second quarter, and a steep climb from 25 percent a year earlier. They'll still try to trick you into handing over vital details -- it's just that their web traffic will be encrypted while they do it.
Fifth person pleads guilty to 'celebgate' account hijacks
Did we say that all the 'celebgate' perpetrators had faced justice? Well, not quite. A fifth person embroiled in the incident, Virginia resident Chris Brannan, has pleaded guilty to unauthorized access and identity theft charges for his part in the data leaks. He used a combination of phishing emails and simple social engineering efforts (such as hunting Facebook accounts for answers to security questions) to obtain logins for iCloud and email accounts to harvest their data. He compromised more than 200 accounts for "celebrities and noncelebrities," using software to comb iCloud accounts for nude photos and other sensitive info.
Apple apologizes for phishing scam that stole Chinese user IDs
Apple apologized today over stolen Apple IDs that were used to make unauthorized App Store purchases in China. The Wall Street Journal reports that the IDs were obtained through phishing scams. Users had connected their Apple accounts to mobile payment systems Alipay and WeChat Pay; these IDs were then used to purchases through the App Store. "We are deeply apologetic about the inconvenience caused to our customers by these phishing scams," Apple said in a statement to its Chinese users.
Google is giving parents a toolkit to educate kids on internet safety
Google and the National Parent Teacher Association are joining forces to help educate parents and kids about online safety. The search giant will give out all-in-one kits that include a Google Pixelbook and presentations covering a variety of topics regarding online safety including phishing and scams, privacy and security, cyberbullying and "inappropriate" content. They also include some decorative reminders of best practices like banners and posters in both English and Spanish.
Last 'celebgate' hacker sentenced to eight months in prison
The "celebgate" saga appears to be winding to a close. A federal judge in Connecticut has sentenced George Garofano to eight months in prison and three years' supervised release after pleading guilty to compromising celebrities' iCloud accounts (plus hundreds of others) by tricking them into providing usernames and passwords. His defense had pushed for a five-month prison term with five months of home confinement, but the judge appeared to side more closely with prosecutors, who wanted 10 to 16 months behind bars.
Google removes accounts tied to Iran-led misinformation campaign
Google shared an update today regarding its efforts to combat state-sponsored phishing attacks and to remove accounts associated with an influence operation linked to Iran. The company said that in recent months, it has detected and blocked state-sponsored groups from targeting political campaigns, journalists, activists and academics with phishing attempts. Along with notifying law enforcement when these sorts of attacks are discovered, Google also notifies affected users, and it issued a series of alerts to Gmail users earlier this week over suspicious emails. It said the emails originated from a wide range of countries. You can read more about that specific round of notifications here.
DNC cyberattack scare was just a phishing test
Yesterday, reports surfaced that the Democratic National Committee had been the target of a phishing scheme aimed at collecting officials' login information for a voter database. But it turns out the incident was just a security test. "We, along with the partners who reported the [fake] site, now believe it was built by a third party as part of a simulated phishing test on VoteBuilder," DNC Chief Security Officer Bob Lord said in a statement to the Washington Post. "The test, which mimicked several attributes of actual attacks on the Democratic party's voter file, was not authorized by the DNC, Votebuilder nor any of our vendors," he said.
DNC reports attempted cyberattack targeting its voter database
The Democratic National Committee appears to be the target of another cybersecurity attack, CNN reports, and it has alerted the FBI about a phishing attempt aimed at gaining access to its voter database. A fake login page created to look just like the one Democratic officials use to log into a service called Votebuilder was spotted by a the cybersecurity firm Lookout earlier this week. Lookout then informed the DNC of its findings.
Phishing scam targets iPhone users with a fake call to ‘Apple Care’
As more and more people use their mobile devices for everyday computing tasks, it makes sense that there would be more attacks. The latest phishing attempt, discovered over at Ars Technica, involves a false webpage that initiates a call on your iPhone. According to the site, when they made the call, they were connected to a fake representative who said he was "Lance Roger from Apple Care." The person quickly hung up as the reporter tried to stall and get more detail on the scam.
Olympic hackers may be attacking chemical warfare prevention labs
The team behind the 2018 Winter Olympics hack is still active, according to security researchers -- in fact, it's switching to more serious targets. Kaspersky has discovered that the group, nicknamed Olympic Destroyer, has been launching email phishing attacks against biochemical warfare prevention labs in Europe and Ukraine as well as financial organizations in Russia. The methodology is extremely familiar, including the same rogue macros embedded in decoy documents as well as extensive efforts to avoid typical detection methods.
California teen phished his teachers to change grades
Phishing attacks have been a key part of some of the most high-profile hacks in recent years, but they're also used in smaller, less diabolical schemes as well. KTVU reports that a student at Ygnacio Valley High School in California used a phishing scam to access the school district's computer system and change a number of students' grades. He was arrested last week on 14 felony counts.
Chinese spies linked to decade-long hacking campaign
China's long-running hacking efforts may be more extensive than first thought. Security researchers at ProtectWise's 401TRG team have determined that a long series of previously unconnected attacks are actually part of a concerted campaign by Chinese intelligence officials. Nicknamed the Winnti umbrella, the effort has been going on since "at least" 2009 and has struck game companies (like Nexon and Trion) and other tech-driven businesses to compromise political targets.
Microsoft's Chrome extension fights phishing attacks
Due to the dominance of Google's Chrome browser, even if you're on Windows you're probably not using Microsoft Edge. You can still enjoy some of its technology, however, since Microsoft has plugged its Windows Defender browser protections into Chrome via a just-released extension. It cites third-party testing that claims Microsoft Edge protects against 99 percent of phishing attacks with its constantly updated list of malicious URLs, while Google's built-in feature manages to stop only 87 percent. If you're concerned you might cross an ill-meaning link in an email or message and need some additional peace of mind, then install and enable Microsoft's extension from the Chrome store. It will get the job done without requiring a browser switch -- unless you're on Chrome OS since users report it doesn't work there.
Avast claims its secure browser is 30 percent faster than yours
Avast has updated its browser to give users greater control over their online privacy. According to the company, its renamed Avast Secure Browser (formerly SafeZone) is designed to plug the security gaps that result from users' misplaced protection expectations. Features such as Stealth Mode, HTTPS Encryption, anti-tracking and anti-fingerprinting have been designed to account for the 69 percent of UK consumers who believe standard private-browsing modes will anonymize their identity, and the 81 percent who believe their browser would alert them to web-based threats, such as malicious cryptomining and extensions.
Most White House email domains could be vulnerable to phishing
We can likely all agree that governmental cyber security is an important issue. While the Attorney General has created a task force to deal with election hacking, there have been plenty of digital security fails in the past year. And the FCC doesn't seem to care too much about data privacy, either. Now, according to a report from security firm Global Cyber Alliance (GCA), more than 95 percent of the email domains managed by the Executive Office of the President (EOP) — including WhiteHouse.gov — could be used in a phishing attack due to lax security protocol.
