Giveaway Scam Infects 65,000 Devices with Malware

in ,

A family of Android apps is using the lure of free items to distribute a novel ad fraud botnet.

Victims of the scam are told that they will receive a complimentary gift when they download an app from the Google Play Store. However, the only thing received by victims is an infection of malware that silently loads ads in the background on their smart device.

The ad fraud operation, discovered by White Ops’ Satori Threat Intelligence & Research team, which named it TERRACOTTA, started in late 2019. The team found that by the end of June 2020, more than 65,000 devices had been unwitting participants in the scam, over 5,000 apps had been spoofed, and more than 2 billion bid requests had been generated.

“What makes this unique is that the fraudsters were advanced in knowing how to pull off ad fraud verification plausibly,” said a White Ops spokesperson.

“This means the ads were never being reported via the Google Play Store for showing ads, nor were users complaining of seeing unwanted ads. Instead, they were lying dormant, and the only ‘free product’ being delivered to users was a payload of ad fraud malware.”

Among the free gifts used as lures were boots, sneakers, event tickets, coupons, and expensive dental treatments. The real item that victims received was a customized Android browser packaged alongside a control module written in the React Native development framework.

When loaded onto the victim’s phone, the browser generates fraudulent ad impressions, sold into the programmatic advertising ecosystem to defraud advertisers.

Google Play Store reviews for the apps started out at five stars as victims applauded the giveaway idea. However, disappointed victims who didn’t receive the promised freebies soon took to the review section to express their disappointment and share their suspicions that the app they had downloaded was malicious.

One victim’s review read: “Terrible. I received confirmation of my free Nike Air Jordans but never received any delivery, tracking number or anything. Possibly a fraudulent site, do not give personal information.”

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

TeamViewer Flaw Risks Password Exposure

in ,

A vulnerability in the TeamViewer app could allow malicious actors to steal passwords.

The high-severity flaw was discovered in the desktop version of the app for Windows before 15.8.3. By exploiting the weakness, authenticated threat actors operating remotely could execute code on victims’ systems or crack their TeamViewer passwords.

TeamViewer is a proprietary software application that allows users to control a range of smart devices remotely to perform functions like file transfers, desktop sharing and web conferencing.

As a result of flaw CVE-2020-13699, TeamViewer Desktop for Windows does not properly quote its custom URI handlers. As a result, an attacker could force a victim to send an NTLM authentication request and either relay the request or capture the hash for offline password cracking.

Victims could also be persuaded to go to a specific website set up by threat actors to steal credentials or personal data.

The flaw’s discoverer, security engineer at Praetorian, Jeffrey Hofmann, explained: “An attacker could embed a malicious iframe in a website with a crafted URL that would launch the TeamViewer Windows desktop client and force it to open a remote SMB share.”

According to Hofmann, most web browsers are set up to prevent attacks like this from happening.

He said: “Every modern browser except for Firefox URL encodes spaces when handing off to URI handlers which effectively prevents this attack.”

TeamViewer versions prior to 15.8.3 are vulnerable to the flaw, which has been fixed in the latest release.

Andy Harcup, VP, Absolute Software, commented: “Security flaws in certain software and applications will always be located and exploited by opportunistic cyber-attackers, and this latest revelation could potentially impact millions of Windows users.”

Harcup advised companies to protect their operating system by keeping up with the latest security updates.

“For users to ensure that they are kept safe from the influx of cyber-attacks now facing them, the IT operations team must ensure their systems are kept up-to-date, whilst training their staff to simultaneously maintain a high level of online vigilance and awareness toward internet safety protocol. It is important for enterprises to keep the operating system up-to-date with the latest security updates in order to ensure maximum protection.”

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Eight Million Freepik Users Suffer Data Compromise

in ,

Popular stock photo site Freepik has disclosed a major data breach affecting over eight million customers.

The incident also affected users of the sister site Flaticon, which claims to run the world’s largest database of free icons.

In a breach notice over the weekend, the firm claimed an attacker had compromised an SQL injection vulnerability in the Flaticon site which allowed them to access user information in a database.

Of the 8.3 million customers affected, all had their email address taken, and nearly 3.8 million had a hashed password for the site also stolen.

Most (3.6 million) were encrypted with bcrypt, whilst 229,000 were protected with the less secure MD5. The latter have since been upgraded to bcrypt.

The remaining 4.5 million users logged in with their federated Google, Facebook or Twitter credentials so the hacker only got away with their emails. However, these could still be used to craft phishing emails requesting password confirmation.

The firm does appear to have acted swiftly to mitigate the issue, claiming to regularly review customer emails and passwords that end up on the web and notify affected customers if they find one.

“Those who had a password hashed with salted MD5 got their password cancelled and have received an email to urge them to choose a new password and to change their password if it was shared with any other site (a practice that is strongly discouraged),” explained Freepik.

“Users who got their password hashed with bcrypt received an email suggesting them to change their password, especially if it was an easy to guess password. Users who only had their email leaked were notified, but no special action is required from them.”

Jayant Shukla, CTO and co-founder of K2 Cyber Security, argued that firms need to do more to mitigate the risk of SQL injection exploitation, which remains one of the most popular among attackers.

“Organizations need to take action to better protect themselves against SQL vulnerabilities: 1) implement better coding practices to prevent SQL injection, 2) run better tests for SQL injection vulnerabilities before code makes it to production and 3) make sure they have protection against SQL injection attacks during runtime,” he said.

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Nearly Half of UK IT Leaders Have Not Upgraded to Cloud Security

in ,

Nearly half (47%) of UK IT leaders have not updated their security strategies to account for their move to cloud environments, putting their organizations at higher risk of cyber-attack, according to a new study by Trend Micro commissioned for CLOUDSEC Online.

This is despite the fact that traditional on-premises security such as firewalls, network intrusion prevention systems (IPS/IDS) and anti-virus are unsuitable for cloud environments as they tend to create performance bottlenecks and security gaps.

Yet the survey showed that many IT leaders are keen for a single platform to provide cloud and on-premises security, with lack of integration between the two types of tooling cited by 43% of respondents as the biggest barrier to the adoption of cloud security. Additionally, 33% stated that this integration issue was their biggest day-to-day operational headache.

Over half (55%) also expressed a desire for third-party security providers to integrate with multiple platform and application vendors, while 54% want a security vendor “aligned” to their cloud journey.

The report noted that security vendor integration is becoming more important as organizations increasingly shift to multi-cloud environments.

Bharat Mistry, principal security strategist at Trend Micro, commented: “This is particularly concerning as 23% of organizations explained that they’ve already moved partly or fully to a DevOps model in order to drive digital transformation. Container, serverless and other emerging technologies require specially designed security capabilities delivered as application program interfaces (APIs) in order to provide appropriate protection without interrupting development pipelines.”

Earlier this month, the 2020 Cloud Security Report revealed that configuration errors are the number one threat to cloud security in the view of industry professionals, with multiple barriers to the further adoption of cloud services outlined by those surveyed.

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Nearly 40% of Firms Fired Staff for Security Policy Breaches

in ,

Almost two-fifths (39%) of British business decision makers have sacked employees because they breached corporate security policy during the pandemic, according to new data from Centrify.

The IAM specialist polled 200 UK respondents to find out more about how COVID-19 and mass remote working has impacted corporate cybersecurity.

Over half (58%) of respondents admitted that employees are more likely to try and bypass enterprise security practices when working from home.

That may explain why nearly two-thirds (65%) said they had made major changes to their cybersecurity policy to take account of their newly distributed workforce.

Changes to policy could include updates to remote access and authentication, which 57% of business decision makers said they are currently trying to implement. Multi-factor authentication (MFA) is regarded as industry best practice in helping to mitigate the risk of phishing and brute force attacks on RDP and corporate user accounts, for example.

A further 55% of respondents told Centrify that they are planning to formally ban staff from using personal devices to work from home.

This could also help to reduce cybersecurity risk as personal IT kit might be less well secured than corporate equivalents, and potentially used by other members of the household who may engage in risky online behavior.

Centrify VP, Andy Heather, argued that humans continue to be the weakest link in the corporate security chain.

“With more people than ever working from home and left to their own devices, it’s inevitable that some will find security workarounds, such as using personal laptops and not changing passwords, in order to maximize productivity,” he added.

“It’s also possible that the changes in security procedures are not being communicated well to employees, and many are practicing unsafe internet usage without even realizing.”

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Data Firm Exposes 235 Million Social Media Profiles

in ,

A social media data broker has exposed the public-facing profiles of 235 million users via a misconfigured online database, according to researchers.

Comparitech teamed up with Bob Diachenko to uncover three identical copies of the data on August 1, left online with no password or other authentication required to access it.

In total, 192 million profiles were scraped from Instagram, 42 million from TikTok and four million from YouTube.

Each record contained some of the following: profile name, real name, profile pic, account description, age, gender and more.

Around a fifth of profiles also contained either a phone number or email address, according to Comparitech.

Although the personal information contained in this trove was all publicly available, social media companies like Facebook have threatened legal action in the past against automated data scraping firms that subsequently sell their collections to marketers.

Comparitech said that although access to the exposed database was shut down three hours after its first disclosure, it’s unclear how long the information was left online without a password.

The firm warned that, if discovered, the trove could have been used by spammers or to make follow-on phishing attacks more convincing.

The data itself was traced back to Social Data, a firm that apparently sells data on social media influencers to marketers. It was at pains to point out that the exposed information was taken from publicly available profiles, even though their consolidation into a single database makes it a more attractive prospect for cyber-criminals.

Comparitech also claimed that “evidence” suggests a connection between the data and a now-defunct company known as Deep Social which was removed from Facebook and Instagram marketing APIs in 2018 and threatened with legal action.

Social Data reportedly denied any connection between the two companies, although some of the original datasets were labelled as follows: “accounts-deepsocial-90” and “accounts-deepsocial-91.”

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Travel Site Exposed 37 Million Records Before Attack

in ,

The company behind one of India’s most popular travel booking sites exposed 43GB of customer and corporate data before it was deleted by the infamous “Meow” attacker, according to researchers.

A team at SafetyDetectives led by Anurag Sen discovered an Elasticsearch server without password protection or encryption on August 10.

It failed to get a response from the company in question, government-backed travel marketplace RailYatri, but the database was eventually secured after contact was made with India’s national CERT (CERT-In).

However, that was too late to save most of the information stored there: the Meow bot struck on August 12 and apparently deleted all but 1GB of the data.

The trove itself contained an estimated 37 million records linked to around 700,000 unique users of the popular site, a mobile app version of which has been downloaded over 10 million times on Google Play.

Exposed in the misconfiguration were users’ full names, age, gender, physical and email addresses, mobile phone numbers, booking details, GPS location and names/first and last four digits of payment cards.

“Exposed user information could potentially be used to conduct identity fraud across different platforms and other sites,” argued SafetyDetectives.

“Users’ contact details could be harnessed to conduct a wide variety of scams while personal information from the breach could be used to encourage click-throughs and malware downloads. Personal information is also used by hackers to build up rapport and trust, with a view of carrying out a larger magnitude intrusion in the future.”

The firm also warned that exposed data could have put customers in physical danger.

“RailYatri’s server recorded and stored users’ location information when booking their tickets, and also allowed users to track their journey progress with integrated GPS functionality. This information could be used by hackers to locate the nearest cell tower to the user, and potentially, the user’s actual location including current address,” it explained.

“Regular train users generate clear and distinguishable travel patterns which malicious actors could use to commit violent crime directly upon the individual.”

The bot-driven Meow attack campaign has so far destroyed data from thousands of victims, providing an even greater urgency for IT managers to ensure any cloud databases are properly configured.

 

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Poor Cybersecurity Behaviours Prevalent Amongst UK Remote Workers

in ,

Nearly a quarter (23%) of UK office workers rely on unauthorized devices to work from home, a new study by CybSafe has found.

The research revealed that poor personal cybersecurity practices are commonplace amongst workers operating outside of corporate environments, which is worrying as home working is expected to become far more prevalent following the COVID-19 crisis.

The survey of 600 UK workers also found that one in 10 (9%) share their work devices with other people in their household.

One in five (20%) said they do not keep collaboration and video conferencing software, such as Zoom, Webex and Microsoft teams up-to-date, while 23% do not ensure software on devices connected to their home WiFi network, including work computers, are updated.

These bad habits could be linked to a lack of adequate cybersecurity training for staff, according to the report, with 65% of workers revealing that they have not received any training on keeping data secure when working remotely in the last six months. Additionally, only 37% of workers had received a working from home cybersecurity policy from their employer by the start of lockdown.

Oz Alashe, CEO of CybSafe, commented: “We now live in a world of borderless organizations where increasing numbers of people work remotely. Many are mobile. The lines between personal and professional are increasingly blurred, and everyone is at greater risk.

“Some staff are making cybersecurity mistakes in their homes, and businesses will need to adjust their cybersecurity approaches accordingly. What may have worked in the past doesn’t necessarily work now. Cybersecurity policy, as well as awareness and behavior change programs, will all require updates based on today’s working conditions.”

Dr John Blythe, head of behavioural science at CybSafe, added: “While our latest research suggests that many UK businesses have been forthcoming with changes to cybersecurity strategy, these haven’t taken place on the scale that we would have hoped for.”

In June, a study by CyberArk found that employee work from home habits are putting businesses at greater risk of cyber-attack.

 

We’re Cloudscape.

We believe you should have the best backup solutions for your business.

We’ll get to know your business and determine the most appropriate solution to meet your technical requirements while being commercially sensible in cost and productive with time.

If you feel that your data isn’t being backed up correctly, please get in touch.

 

News Source: https://www.infosecurity-magazine.com/

Tackle your business challenges head on – With Microsoft Planner

in ,

“If only there was a tool to help me manage my project work.”

Looking for a project management tool? Look no further than Microsoft Planner.

Struggling to Effectively manage tasks and projects?

Task management is an uphill battle for many businesses. Many businesses use a multitude of different applications in their daily operation, each with a different purpose and function. This inevitably leads to task management becoming a logistical nightmare, with tasks and projects often getting overlooked and even getting completely forgotten about.

A culture of poor task management frequently leading to unfinished and abandoned tasks can result in systemic low productivity. Therefore, efficient and effective task management should be at the forefront of your business’ productivity strategy, as it’s virtually impossible to achieve a decent level of productivity when tasks are going missing and remaining unfinished.

As mentioned above, using a range of unrelated, unconnected applications is one of the most common issues when it comes to managing tasks. Integration is key! You need an umbrella-type application that allows you to keep track of and monitor task progress in a range of applications. Luckily, Microsoft Planner lets you do exactly that!

Introducing Microsoft Planner

Similar to other project management tools such as Asana, Slack and Trello, Microsoft Planner acts as a project/task management hub, enabling users to monitor task progress and outcomes, assign tasks and create plans. It also functions as a gathering space for the whole team and acts as a central file sharing resource.

What’s more, seamless integration within the Office suite ensures a hassle-free user experience. See below for an overview of some of the useful components and features of this productivity-boosting application.

Plans. Alternatively, you could consider these ‘projects.’ Plans are the structures into which you set tasks. Plans allow you to gather all the tasks relevant to a specific project or outcome in one place, allowing for easy management and tracking of task progress.

Groups. ‘Groups’ refer to the people connected to a particular project. When you create a plan and add ‘group members’ the individuals concerned will automatically be notified.

Tasks. Once you establish a plan you can set up tasks within it. Why not include a description, assign team members to it, attach files, add a due date or expected completion time; with a rich range of features available your team will always know what they’re doing.

Seamless Integration. Firmly embedded within the Office 365 family, Planner offers the convenience of seamless integration with the other office applications your team are using. From file sharing via SharePoint, automated email notifications via outlook or team communication via the Teams app the ability for all your favourite apps to ‘talk to each other’ is sure to make life a lot easier.

Office 365 users should look no further than Microsoft planner for all their project and task management needs. It’s compatibility with the Office family and intuitive dashboard makes keeping track of tasks and projects a dawdle.

 

Struggling to find a solution that fits around your business?

At Cloudscape, we use our extensive experience to deliver custom-fit technology solutions to SMEs in London and the home counties. Technology should serve your business’ aims and aspirations, it shouldn’t be something to mould your operation around. We are experts in Cloud-computing and we know how empowering Cloud Services can be when leveraged correctly, so let us help you tailor Office 365 so that it works for your business and the unique challenges you face. Call us on 0207 952 8123 or send us an email info@cloudscape.it.

Ensuring an effective workforce – The Challenges of our new working world

in ,

The turbulent business environment of the past 5 months has likely left business owners feeling stressed and exhausted. The Covid-19 pandemic has presented an ever-evolving business landscape that has required businesses to continually adapt their offering and operations in response to ever-changing restrictions on working life.

For many businesses, this has resulted in a compromised service offering.  Factors such as unfamiliar new ways of working and a reduced workforce have threatened operational capacity. As a result, it’s more important than ever that businesses level-up their productivity to maintain their service, remain competitive and even countenance the prospect of growth despite a difficult environment.

Let’s assume that you now have the basics of remote-working sorted; your team are comfortable working from home, have access to the resources and equipment they need and you’re confident that your data is secure. It’s now time to look at the tools that will let you extract every drop of value from the working day. Working flexibly has been on the rise for several years now, so thankfully the platforms that enable effective collaboration and workflow management have been a long time in development. In this article, we will look at a few of such offerings available through Microsoft 365. These affordable, accessible, and intuitive platforms will act as a springboard to your business’ productivity aims while requiring little investment in terms of time or money.

 

Innovate, perform, deliver – make you’re working week more fruitful with Collaboration and Task management solutions from Microsoft 365

Introducing Microsoft Teams

Microsoft’s workplace communication focal point, Teams is popular with remote and office-based workforces alike.  If you are already a Microsoft 365 customer or if your team use the Office apps daily, then you really don’t have to look any further than Teams for your communication needs.

  • An all-in-one communication platform. Teams have it all; instant messaging, video conferencing, scheduling capabilities and effortless document sharing and real-time editing thanks to deep integration with SharePoint and OneDrive. Microsoft Business voice even lets you turn Teams into your business’ phone system and the eagerly anticipated ‘lists’ app will help you organise work schedules, track task progression and more; all within Teams’ interface.
  • Organise discussions with ‘Teams’ and ‘Channels.’ Teams let you assemble groups of employees for collaboration on specific topics. You can then subdivide discussion to focus on even more specific issues using ‘channels.’
  • It’s intuitive. Launched in 2017, Teams was born in the age of ‘intuitive software,’ and it shows. There is a very little learning curve with Teams; your employees will be up to speed with most features in a few hours.
  • Customise the experience with your favourite third–party apps. If you’re currently using a third-party productivity or workflow management app there is a good chance you’ll be able to bring it under the Teams umbrella. Compatibility with hundreds of popular apps such as ‘Zoom’ and ‘Asana’ means Teams really can function as your one and only communications hub.
  • Peerless security and compliance capabilities. A core component of MS 365, Microsoft’s Enterprise Mobility and Security platform lets you manage access, control document permissions, monitor online threats, secure your endpoint devices and much more. This empowering security platform coupled with the flexibility of Teams will let your Teamwork effectively while ensuring your digital assets remain secure.

Available with many Microsoft 365 subscriptions or as a standalone product discover why Teams is one of the world’s most popular collaboration platforms today!

 

Say ‘Hello’ to Planner

There are several workflow managements tools within the MS 365 landscape. Microsoft Project offers the most in-depth, feature-rich experience and at the other end of the scale you’ll find ‘To-Do,’ a more basic application that’s great for managing straightforward work tasks and personal errands. ‘Planner’ is situated between these 2 offerings and offers a good balance of features and ease-of-use; offering more features and greater insights than To-Do and while avoiding the learning curve that comes with the more complex Microsoft Project.

  • Plans. Set up project sites called ‘plans’ and organise all tasks relating to a particular topic in one space.
  • Tasks. Assign tasks to individuals or groups. Set start and end dates, attach a ‘priority’ status, add attachments, and add a detailed description so that your team know what they’re doing.
  • Buckets. Buckets let you arrange and sort tasks in any way you want. You might want to gather all high priority tasks in a single place or move all completed tasks to one bucket.
  • Chart, schedule and Board views. Planner features several ‘views’ that allow you to review task progression and look ahead to see what’s coming up. The ‘charts’ dashboard contains info pertaining to task progression; see at a glance how much progress your team are making. The ‘Board’ view displays tasks in their allocated ‘buckets.’ ‘Schedule’ view displays tasks in a calendar format, enabling you to schedule tasks well in advance. Filters let you view information relating to priority, task status, assignees and more.

Available to Premium, Business and Educational subscribers to MS365, you may already have planner available to you if you’re a 365 customer. Take this intuitive tool for a spin today and see if it could help you simplify your task management challenges.

 

Streamline scheduling with ‘Bookings,’ improve engagement with ‘Forms’ and keep the conversation going with ‘Yammer’

With so many peripheral apps complementing the ‘core’ services in the Microsoft environment you’re bound to find a solution to some of your business challenges with a little digging….

‘Bookings’ is an invaluable scheduling tool that takes the time-consuming legwork out of meeting scheduling. It lets you publish your timetable so attendees can select a time that suits, thus avoiding the tedium of lengthy email threads that arranging meetings can involve.

‘Forms’ is a simple survey generation application that lets you create and publish surveys, quizzes and polls. A great way to gauge customer satisfaction, test employee knowledge, drive engagement and much more.

‘Yammer’ Without the hubbub and camaraderie of the office environment, keeping spirits high and employees engaged while working remotely can be more of a challenge. Yammer functions as a social networking site for businesses; a great way to help employees connect and share news and updates.

How can I get the ball rolling?

As part of the government’s economic response to the Covid-19 pandemic, packages of grant funding are to be announced to help businesses make efficiency transitions. These grants of between £1000 and £5000 could help your business innovate and optimise its IT system, to drive efficiency and productivity gains using some of the ideas we’ve discussed above.

 

Struggling to find a solution that fits around your business?

At Cloudscape, we use our extensive experience to deliver custom-fit technology solutions to SMEs in London and the home counties. Technology should serve your business’ aims and aspirations, it shouldn’t be something to mould your operation around. We are experts in Cloud-computing and we know how empowering Cloud Services can be when leveraged correctly, so let us help you tailor Office 365 so that it works for your business and the unique challenges you face. Call us on 0207 952 8123 or send us an email info@cloudscape.it.