Scamwatch Nigeria en What is a Keylogger? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt=" What is a Keylogger?" title=" What is a Keylogger?" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>A keylogger (short for keystroke logger) is a Malicious software (<a href="" target="_blank">malware</a>) that tracks or logs the keystrokes on your keyboard typically in a covert manner so that you don’t know that your actions are being monitored. This is usually done with malicious intent to collect your account information, credit card numbers, user names, passwords, and other private data.</p> <p>Keyloggers can pose a serious threat to users, as they can be used to intercept passwords and other confidential information entered via the keyboard. As a result, cybercriminals can get PIN codes and account numbers for your financial accounts, passwords to your email and social networking accounts and then use this information to take your money, steal your identity and possibly extort information and money from your friends and family.</p> <h3><strong>How could i get infected with a keylogger?</strong></h3> <p>Keyloggers spread in much the same way that other malicious programs spread. Excluding cases where keyloggers are purchased and installed by a jealous spouse or partner, and the use of keyloggers by security services, keyloggers are installed on your system through a phishing expedition either via email, text message, P2P networks, instant message or social networks. <br /><br /> Keyloggers can also be installed just by you visiting a website if that site is infected.</p> <h3><strong>How do you detect a keylogger?</strong></h3> <p>Keyloggers are tricky to detect. Some signs that you may have a keylogger on your device include: slower performance when web browsing, your mouse or keystrokes pause or don’t show up onscreen as what you are actually typing or if you receive error screens when loading graphics or web pages.</p> <h3><strong>What can you do to protect yourself?</strong></h3> <ul> <li>Use caution when opening attachments – files received via email, P2P networks, chat, social networks, or even text messages (for mobile devices) can be embedded with malicious software that has a keylogger.</li> <li>Watch your passwords – Consider using one-time passwords and make sure key sites you log into offer two-step verification (<a href="" target="_blank">2FA</a>). </li> <li>Try an alternative keyboard layout – Most of the keylogger software available is based on the traditional QWERTY layout so if you use a keyboard layout such as DVORAK, the captured keystrokes does not make sense unless converted.</li> <li>Use a comprehensive security solution – Protect all your devices—PCs, Macs, smartphones and tablets—with a solution like <a href="" target="_blank">Kaspersky</a>, that offers antivirus, firewall, as well as identity and data protection.</li> </ul> <p> </p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Sun, 19 Jan 2020 12:17:20 +0000 admin 64 at What is a Brute Force Attack? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="What is a brute force attack?" title="What is a brute force attack?" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>A brute force attack, also known as an exhaustive search, is a cryptographic hack that relies on guessing possible combinations of a targeted password until the correct password is discovered. The longer the password, the more combinations that will need to be tested. A brute force attack can be time consuming, difficult to perform if methods such as data obfuscation are used, and at times down right impossible. However, if the password is weak it could merely take seconds with hardly any effort. Weak passwords are like shooting fish in a barrel for attackers, which is why all organizations should enforce a strong password policy across all users and systems.</p> <h3><strong>How are Brute Force Attacks Used?</strong></h3> <p>Brute force attacks are usually used to obtain personal information such as passwords, passphrases, usernames and Personal Identification Numbers (PINS), and use a script, hacking application, or similar process to carry out a string of continuous attempts to get the information required.</p> <h4><strong>Goals of a brute force attack include:</strong></h4> <ul> <li>Theft of personal information such as passwords, passphrases and other information used to access online accounts and network resources</li> <li>Harvesting credentials to sell to third parties</li> <li>Posing as users to send phishing links or spread fake content</li> <li>Defacement of websites and other information in the public domain that could damage the reputation of the organization</li> <li>Redirecting domains to sites holding malicious content</li> </ul> <p>They can also be used for positive gains. Many IT specialists use this method of attack to test network security and more specifically, the strength of the encryption used on the network.</p> <h3><strong>Brute Force Attack Tools</strong></h3> <p>An attacker is usually aided by automated software that uses computing to systematically check password combinations until the correct one is identified. Using a brute force password cracking application is required in order to go through numerous combinations and possibilities that can be difficult or impossible to calculate by a human alone. Popular examples of brute force attack tools include:</p> <ul> <li><a href="" rel="nofollow" target="_blank">Aircrack-ng</a></li> <li><a href="" rel="nofollow" target="_blank">John the Ripper</a></li> <li><a href="" rel="nofollow" target="_blank">L0phtCrack</a></li> <li><a href="" rel="nofollow" target="_blank">RainbowCrack</a></li> </ul> <h3><strong>Types of Brute Force Attack</strong></h3> <p>There are a number of different types of brute force attack, each of which has the same goals detailed above.</p> <p><strong>Hybrid Brute Force Attacks</strong></p> <p>You may have heard of dictionary attacks. These are one of the most common forms of brute force attack and use a list of words in a dictionary to crack passwords. Other types of attack may use a list of commonly used passwords. If your password is 'password', for example, a brute force bot would be able to crack your password within seconds.</p> <p><strong>Reverse Brute Force Attack</strong></p> <p>Reverse brute force attacks don't target a specific username, but instead, use a common group of passwords or an individual password against a list of possible usernames.</p> <p><strong>Credential Stuffing</strong></p> <p>When a username and password pairing is known by the attacker, they can use this information to gain access to multiple websites and network resources. For example, many users choose the same password to access many different websites for the sake of simplicity. Taking precautions like using two-factor authentication and using different passwords for every different network resources can help to prevent brute force attacks that rely on credential stuffing.</p> <h3><strong>How to Prevent Brute Force Attacks</strong></h3> <p>Brute force attacks typically rely on weak passwords and careless network administration. Fortunately, these are both areas that can be improved easily in order to prevent vulnerabilities that could bring your network or website resources to their knees. For example, utilizing strong passwords, allowing a limited number of login attempts and enabling <a href="" target="_blank">two-factor authentication</a> can help to prevent brute force attacks.</p> <p>Ultimately, it is important to educate your organization on the importance of password strength and the general information security habits. Even with a strong password, employees can fall victim to insider threats if security is not a strong part of your culture. Learn more about Forcepoint’s Insider Threat Program offerings.</p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a>, <a href="/cybersecurity/brute-force">Brute force</a></li></ul></div> Fri, 17 Jan 2020 10:06:13 +0000 admin 63 at Ransomware quiz <div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>Someone in your company gets an email. It looks legitimate — but with one click on a link, or one download of an attachment, everyone is locked out of your network. How do you identify ransomware and what should you do to protect your business? To find out how much you know about ransomware, select the correct response for each question or statement.</p> </div></div></div><table id="quiz-view-table"> <tbody> <tr class="odd"><th width="25%">Questions</th><td>2</td> </tr> <tr class="even"><th>Available</th><td>Always</td> </tr> <tr class="odd"><th>Pass rate</th><td>75 %</td> </tr> <tr class="even"><th>Backwards navigation</th><td>Allowed</td> </tr> </tbody> </table> <a href="/node/60/take" class="quiz-start-link">Start Quiz</a> Thu, 16 Jan 2020 16:23:56 +0000 admin 60 at What is Malware? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="What is malware?" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>Malware is the collective name for a number of malicious software variants, including viruses, <a href="">ransomware</a> and spyware. Shorthand for malicious software, malware typically consists of code developed by cyberattackers/cyber criminals, designed to cause extensive damage to data and systems or to gain unauthorized access to a network. Malware is typically delivered in the form of a link or file over email and requires the user to click on the link or open the file to execute the malware.</p> <p>Malware has actually been a threat to individuals and organizations since the early 1970s when the Creeper virus first appeared. Since then, the world has been under attack from hundreds of thousands of different malware variants, all with the intent of causing the most disruption and damage as possible.</p> <h3><strong>What Can Malware Do?</strong></h3> <p>Malware delivers its payload in a number of different ways. From demanding a ransom to stealing sensitive personal data, cybercriminals are becoming more and more sophisticated in their methods. The following is a list of some of the more common malware types and definitions.</p> <h4><strong>Types of Malware:</strong></h4> <p><strong>Virus</strong></p> <p>Possibly the most common type of malware, viruses attach their malicious code to clean code and wait for an unsuspecting user or an automated process to execute them. Like a biological virus, they can spread quickly and widely, causing damage to the core functionality of systems, corrupting files and locking users out of their computers. They are usually contained within an executable file.</p> <p><strong>Worms</strong></p> <p>Worms get their name from the way they infect systems. Starting from one infected machine, they weave their way through the network, connecting to consecutive machines in order to continue the spread of infection. This type of malware can infect entire networks of devices very quickly.</p> <p><strong>Spyware</strong></p> <p>Spyware, as its name suggests, is designed to spy on what a user is doing. Hiding in the background on a computer, this type of malware will collect information without the user knowing, such as credit card details, passwords and other sensitive information.</p> <p><strong>Trojans</strong></p> <p>Just like Greek soldiers hid in a giant horse to deliver their attack, this type of malware hides within or disguises itself as legitimate software. Acting discretely, it will breach security by creating backdoors that give other malware variants easy access.</p> <p><strong>Ransomware</strong></p> <p>Also known as scareware, ransomware comes with a heavy price. Able to lockdown networks and lock out users until a ransom is paid, ransomware has targeted some of the biggest organizations in the world today — with expensive results.</p> <h3><strong>How Does Malware Spread?</strong></h3> <p>Each type of malware has its own unique way of causing havoc, and most rely on user action of some kind. Some strains are delivered over email via a link or executable file. Others are delivered via instant messaging or social media. Even mobile phones are vulnerable to attack. It is essential that organizations are aware of all vulnerabilities so they can lay down an effective line of defense.</p> <h3><strong>How to Protect Against Malware</strong></h3> <p>Now that you understand a little more about malware and the different flavors it comes in, let's talk about protection. There are actually two areas to consider where protection is concerned: protective tools and user vigilance. The first is often the easiest to implement, simply because you can often set and forget best-in-class protective software that manages and updates itself. Users, on the other hand, can be prone to temptation ("check out this cool website!") or easily led by other emotions such as fear ("install this antivirus software immediately"). Education is key to ensure users are aware of the risk of malware and what they can do to prevent an attack.</p> <p>With good user policies in place and the right anti-malware solutions constantly monitoring the network, email, web requests and other activities that could put your organization at risk, malware stands less of a chance of delivering its payload. </p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Mon, 13 Jan 2020 13:53:03 +0000 admin 56 at What is Ransomware? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="What is Ransomeware?" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>Ransomware is malicious software with one aim in mind: to extort money from its victims. It's one of the most prolific criminal business models in existence today, mostly thanks to the multimillion-dollar ransoms criminals demand from individuals and corporations. These demands are very simple: pay the ransom, or have your operations severely compromised or shut down completely.</p> <p>Very often, the first an organization knows of an attack is when they receive an on-screen notification informing them that data on their network has been encrypted and will be inaccessible until the ransom has been paid. Only on payment will they be given the decryption key to access their data. Failure to pay could result in the key being destroyed, rendering the data inaccessible forever.</p> <h3><strong>How Ransomware Works</strong></h3> <p>The good news is that ransomware does not usually appear on its own. It must be activated in order to deliver its payload, usually through a malicious link or attachment in an email.</p> <p>There are generally five steps required for ransomware to achieve its objective:</p> <p><strong>Step One</strong>: The System Is Compromised</p> <p>The majority of ransomware attacks start life as a social engineering exercise, usually in the form of an attachment or malicious link. The aim is to entice the user to click on these objects in order to activate the malware.</p> <p><strong>Step Two</strong>: The Malware Takes Control</p> <p>Once the malware has taken control of the system, certain file types will be encrypted and access will be denied to users.</p> <p><strong>Step Three</strong>: The Victim Is Notified</p> <p>For the ransom to be paid, the user must be aware of the demands of the criminals. At this point, they will usually receive notification on the screen explaining the demands and how they can regain access.</p> <p><strong>Step Four</strong>: The Ransom Is Paid</p> <p>Once they have system access, attackers will either identify and encrypt certain file types or deny access to the entire system.</p> <p><strong>Step Five</strong>: Full Access Is Returned</p> <p>In the majority of cases, attackers return full control to the victim. It is in their interest to do this; failure to do so would mean few organizations would be willing to pay if they didn't believe their data would be restored.</p> <h3><br /><br /> <strong>Types of Ransomware</strong></h3> <p>Ransomware may have only hit the headlines in recent years, but it is thought the first ransomware virus emerged as far back as 1998 when the PC Cyborg strain used symmetric encryption to prevent access to files. However, it wasn't until 2012 that the Reveton worm appeared: the first strain of malware that would hold data hostage until a ransom payment was made.</p> <p>There are effectively two types of ransomware in the wild today: Crypto ransomware and Locker ransomware. Both prevent access to data and files, usually through the means of encryption.</p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Mon, 13 Jan 2020 13:40:05 +0000 admin 55 at What is spoofing? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="What is spoofing?" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>Spoofing is the act of disguising a communication from an unknown source as being from a known, trusted source. Spoofing can apply to emails, phone calls, and websites, or can be more technical, such as a computer spoofing an IP address, Address Resolution Protocol (ARP), or Domain Name System (DNS) server.</p> <p>Spoofing can be used to gain access to a target’s personal information, spread malware through infected links or attachments, bypass network access controls, or redistribute traffic to conduct a denial-of-service attack. Spoofing is often the way a bad actor gains access in order to execute a larger cyber attack such as an advanced persistent threat or a man-in-the-middle attack.</p> <p>Successful attacks on organizations can lead to infected computer systems and networks, data breaches, and/or loss of revenue—all liable to affect the organization’s public reputation. In addition, spoofing that leads to the rerouting of internet traffic can overwhelm networks or lead customers/clients to malicious sites aimed at stealing information or distributing malware.</p> <h3><br /><br /> <strong>How spoofing works</strong></h3> <p>Spoofing can be applied to a number of communication methods and employ various levels of technical know-how. Spoofing can be used carry out phishing attacks, which are scams to gain sensitive information from individuals or organizations. The following different examples of spoofing attack methods gives more detail on how different attacks work. <br /><br /> Types of spoofing</p> <h3><strong>Email Spoofing</strong></h3> <p>Email spoofing occurs when an attacker uses an email message to trick a recipient into thinking it came from a known and/or trusted source. These emails may include links to malicious websites or attachments infected with malware, or they may use social engineering to convince the recipient to freely disclose sensitive information.</p> <p>Sender information is easy to spoof and can be done in one of two ways:</p> <ul> <li>   Mimicking a trusted email address or domain by using alternate letters or numbers to appear only slightly different than the original</li> <li>   Disguising the ‘From’ field to be the exact email address of a known and/or trusted source</li> </ul> <h3><strong>Caller ID Spoofing</strong></h3> <p>With caller ID spoofing, attackers can make it appear as if their phone calls are coming from a specific number—either one that is known and/or trusted to the recipient, or one that indicates a specific geographic location. Attackers can then use social engineering—often posing as someone from a bank or customer support—to convince their targets to, over the phone, provide sensitive information such as passwords, account information, social security numbers, and more.</p> <h3><strong>Website Spoofing</strong></h3> <p>Website spoofing refers to when a website is designed to mimic an existing site known and/or trusted by the user. Attackers use these sites to gain login and other personal information from users.</p> <h3><strong>IP Spoofing</strong></h3> <p>Attackers may use IP (Internet Protocol) spoofing to disguise a computer IP address, thereby hiding the identity of the sender or impersonating another computer system. One purpose of IP address spoofing is to gain access to a networks that authenticate users based on IP addresses.</p> <p>More often, however, attackers will spoof a target’s IP address in a denial-of-service attack to overwhelm the victim with traffic. The attacker will send packets to multiple network recipients, and when packet recipients transmit a response, they will be routed to the target’s spoofed IP address.</p> <h3><strong>ARP Spoofing</strong></h3> <p>Address Resolution Protocol (ARP) is a protocol that resolves IP addresses to Media Access Control (MAC) addresses for transmitting data. ARP spoofing is used to link an attacker’s MAC to a legitimate network IP address so the attacker can receive data meant for the owner associated with that IP address. ARP spoofing is commonly used to steal or modify data but can also be used in denial-of-service and man-in-the-middle attacks or in session hijacking.</p> <h3><strong>DNS Server Spoofing</strong></h3> <p>DNS (Domain Name System) servers resolve URLs and email addresses to corresponding IP addresses. DNS spoofing allows attackers to divert traffic to a different IP address, leading victims to sites that spread malware.<br /><br /> How to protect against spoofing attacks</p> <p>The primary way to protect against spoofing is to be vigilant for the signs of a spoof, whether by email, web, or phone.</p> <p>Do, when examining a communication to determine legitimacy, keep an eye out for:</p> <ul> <li>    Poor spelling</li> <li>    Incorrect/inconsistent grammar</li> <li>    Unusual sentence structure or turns of phrase</li> </ul> <p>These errors are often indicators that the communications are not from who they claim to be.</p> <p>Other things to watch out for include:</p> <ul> <li>    The email sender address: sometimes addresses will be spoofed by changing one or two letters in either the local-part (before the @ symbol) or domain name.</li> <li>    The URL of a webpage: similar to email addresses, the spelling can be slightly changed to trick a visitor not looking closely.  </li> </ul> <p>Don’t click on unfamiliar links or download unfamiliar/unexpected attachments. If you receive this in your email, send a reply to ask for confirmation. If an email address is spoofed exactly, the reply will go to the actual person with the email address—not the person spoofing it.</p> <p>Don’t take phone calls at face value; be wary of the information the caller is requesting. </p> <p>Spoofing can sometimes be easy to spot, but not always—more and more, malicious actors are carrying out sophisticated spoofing attacks that require vigilance on the part of the user. Being aware of different spoofing methods and their signs can help you avoid being a victim.</p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Mon, 13 Jan 2020 12:51:13 +0000 admin 54 at What is phishing? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="What is phishing? and how to avoid it" title="What is phishing? and how to avoid it" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>Phishing is the fraudulent use of electronic communications e.g email, sms , phone call etc. to deceive and take advantage of users. <br /><br /> Phishing attacks attempt to gain sensitive, confidential information such as usernames, passwords, credit card information, network credentials, and more. By posing as a legitimate individual or institution via phone or email, cyber attackers use social engineering to manipulate victims into performing specific actions—like clicking on a malicious link or attachment—or willfully exposing confidential information.</p> <p>Both individuals and organizations are at risk; almost any kind of personal or organizational data can be valuable, whether it be to commit fraud or access an organization’s network. In addition, some phishing scams can target organizational data in order to support espionage efforts or state-backed spying on opposition groups.</p> <h3><br /><br /> <strong>Phishing Methods</strong></h3> <p>Phishing attempts most often begin with an email attempting to obtain sensitive information through some user interaction, such as clicking on a malicious link or downloading an infected attachment.</p> <ul> <li>Through link manipulation, an email may present with links that <a href="">spoof</a> legitimate URLs; manipulated links may feature subtle misspellings or use of a subdomain.</li> <li>Phishing scams may use website forgery, which employs JavaScript commands to make a website URL look legitimate.<br /><br /> Using covert redirection, attackers can corrupt legitimate websites with malicious pop-up dialogue boxes that redirect users to a phishing website.</li> <li>Infected attachments, such as .exe files, Microsoft Office files, and PDF documents can install ransomware or other malware</li> </ul> <p>Phishing scams can also employ phone calls, text messages, and social media tools to trick victims into providing sensitive information.</p> <h3><strong>Types of Phishing Attacks</strong></h3> <p>Some specific types of phishing scams use more targeted methods to attack certain individuals or organizations.  </p> <h4><strong>Spear Fishing</strong></h4> <p>Spear phishing email messages won’t look as random as more general phishing attempts. Attackers will often gather information about their targets to fill emails with more authentic context. Some attackers even hijack business email communications and create highly customized messages.</p> <p><strong>Clone Phishing</strong><br /><br /> Attackers are able to view legitimate, previously delivered email messages, make a nearly identical copy of it—or “clone”—and then change an attachment or link to something malicious.</p> <h4><strong>Whaling</strong></h4> <p>Whaling specifically targets high profile and/or senior executives in an organization. The content of a whaling attempt will often present as a legal communication or other high-level executive business.</p> <h3><strong>How to Prevent Phishing Attacks</strong></h3> <p>Organizations should educate employees to prevent phishing attacks, particularly how to recognize suspicious emails, links, and attachments. Cyber attackers are always refining their techniques, so continued education is imperative.</p> <p>Some tell-tale signs of a phishing email include:</p> <ul> <li>‘Too good to be true’ offers</li> <li>The email is not addressed to the recipient, instead the recipient is addressed as "Dear Customer", "Dear User" etc.</li> <li>Unusual sender</li> <li>Poor spelling and grammar</li> <li>Threats of account shutdown, etc., particularly conveying a sense of urgency</li> <li>Unexpected attachments, especially .exe files</li> </ul> <p><strong>Additional technical security measures can include:</strong></p> <ul> <li><a href="" target="_blank">Two Factor Authentication</a> incorporating two methods of identity confirmation—something you know (i.e., password) and something you have (i.e., smartphone)</li> <li>Email filters that use machine learning and natural language processing to flag high-risk email messages. DMARC protocol can also prevent against email spoofing.</li> </ul> <p><a href="" target="_blank">Please click on this link to report a phishing scam.</a></p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Mon, 13 Jan 2020 12:07:15 +0000 admin 53 at What is Business Email Compromise (BEC)? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="What is Business Email Compromise (BEC)?" title="What is Business Email Compromise (BEC)?" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>What is Business Email Compromise (BEC)?</p> <p>Business email compromise (BEC) is a form of cyber crime in which the cybercriminal gains access to a corporate / business email account and (spoofs) the owner’s identity to defraud commercial, Government and non-profit organizations or its employees, customers or partners of money or steal sensitive information.</p> <p>In some cases, an attacker simply creates an account with an email address that is very similar to one on the corporate network(e.g <a href=""></a> could be used as <a href=""></a> or <a href=""></a>.)</p> <p>In some other cases, the attackers set up C+C (.cc) domains (e.g <a href=""></a> could be used as <a href=""></a>) to mimic the actual name of the company / institution targeted, or blended of the site’s legitimate name and its top-level domain.</p> <p>BEC are also referred to as man-in-the email attacks.</p> <p>In a BEC exploit, the attacker typically uses the identity of someone on a corporate network to trick the target or targets into sending money to the attacker’s account. BEC may involve malware,  social engineering or a combination of the two. The most common victims of BEC are companies / institutions that use internet banking platforms for financial transaction or send and receive sensitive documents electronically.</p> <p>TYPES OF BEC SCAMS</p> <p>There are numerous ways that BEC can be used to defraud targets. Here are a few examples:</p> <ul> <li>Bogus invoicing scams use a compromised employee account to request a change in payee information, transferring payments to the Criminal’s account.</li> <li>In CEO fraud scams, the criminal pretends to be an executive and requests that an HR or finance department employee make an emergency payment.</li> <li>In an employee account compromise, the attacker might, for example, send an invoice to partner vendors.</li> <li>An attorney’s email identity might be used to pressure for payments, claiming to be handling time-sensitive, confidential matters and requesting immediate payment.</li> </ul> <p>Cybercriminals may further use a compromised account (especially those of HR employees) to gain more personally-identifiable information (PII) for later use in defrauding the company or its clients.</p> <p>SAFETY TIPS FOR PREVENTING BEC SCAMS</p> <ul> <li>Always confirm requests that arrive via email for wire transfers and large amounts of sensitive data. Call the person who supposedly made the request or speak to them in person.</li> <li>Also review such emails carefully. Compare the email address to the address used in similar correspondence from the past.</li> <li>Does the email try to pressure the employee? Does it suggest the request is an emergency and must be fulfilled immediately? These are red flags.</li> </ul> </div></div></div> Mon, 28 Oct 2019 16:49:26 +0000 admin 50 at What is Two factor authentication (2FA)? <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="Two factor authentication 2fa" title="Two factor authentication 2fa" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p>What is Two factor authentication (2FA)?</p> <p>Two-factor authentication (2FA), sometimes referred to as two-step verification or dual factor authentication, is a security process in which the user provides two different authentication factors to verify themselves to better protect both the user's credentials and the resources the user can access. </p> <p>Two-factor authentication provides a higher level of assurance than authentication methods that depend on single-factor authentication (SFA), in which the user provides only one factor -- typically a password or passcode. Two-factor authentication methods rely on users providing a password as well as a second factor, usually either a security token or a biometric factor like a fingerprint or facial scan.</p> <p>Two-factor authentication adds an additional layer of security to the authentication process by making it harder for attackers to gain access to a person's devices or online accounts, because knowing the victim's password alone is not enough to pass the authentication check. Two-factor authentication has long been used to control access to sensitive systems and data, and online service providers are increasingly using 2FA to protect their users' credentials from being used by hackers who have stolen a password database or used phishing campaigns to obtain user passwords.<br /><br /> What are authentication factors?</p> <p>There are several different ways in which someone can be authenticated using more than one authentication method. Currently, most authentication methods rely on knowledge factors like a traditional password, while two-factor authentication methods add either a possession factor or an inherence factor.</p> <p>Authentication factors, listed in approximate order of adoption for computing, include:<br /><br />     Something you know:<br /><br />     A knowledge factor is something the user knows, such as a password, a PIN or some other type of shared secret.<br /><br />     Something you have:<br /><br />     A possession factor is something the user has, such as an ID card, a security token,push notifications  a smartphone or other mobile device.<br /><br />     Something you are:<br /><br />     An inherence factor, more commonly called a biometric factor, is something inherent in the user's physical self. These may be personal attributes mapped from physical characteristics, such as fingerprints authenticated through a fingerprint reader; other commonly-used inherence factors include facial and voice recognition. It also includes behavioral biometrics, such as keystroke dynamics, gait or speech patterns.<br /><br />     A location factor, usually denoted by the location from which an authentication attempt is being made, can be enforced by limiting authentication attempts to specific devices in a particular location, or more commonly by tracking the geographic source of an authentication attempt based on the source IP address or some other geolocation information derived from the user's mobile phone or other device such as GPS data.<br /><br />     A time factor restricts user authentication to a specific time window in which logging on is permitted, and restricting access to the system outside of that window.</p> <p>It should be noted that the vast majority of two-factor authentication methods rely on the first three authentication factors though systems requiring greater security may use them to implement multifactor authentication, which can rely on two or more independent credentials for more secure authentication.<br /><br /> What is two-factor authentication?</p> <p>Two-factor authentication is a form of multifactor authentication. Technically, it is in use any time two authentication factors are required to gain access to a system or service. However, using two factors from the same category doesn't constitute 2FA; for example, requiring a password and a shared secret is still considered single-factor authentication, as they both belong to the same authentication factor -- knowledge.<br /><br /> two-factor authentication</p> <p>As far as single factor authentication services go, user ID and password are not the most secure. One problem with password-based authentication is it requires knowledge and diligence to create and remember strong passwords. Passwords require protection from many inside threats, like carelessly stored sticky notes with login credentials, old hard drives and social-engineering exploits. Passwords are also prey to external threats, such as hackers using brute-force, dictionary or rainbow table attacks.</p> <p>Given enough time and resources, an attacker can usually breach password-based security systems. Passwords have remained the most common form of single factor authentication because of their low cost, ease of implementation and familiarity. Multiple challenge-response questions can provide more security, depending on how they are implemented, and stand-alone biometric verification methods can also provide a more secure method of single-factor authentication.<br /><br /> Types of two-factor authentication products</p> <p>There are many different devices and services for implementing 2FA -- from tokens, to RFID cards, to smartphone apps.</p> <p>Two-factor authentication products can be divided into two categories: tokens that are given to users to use when logging in, and infrastructure or software that recognizes and authenticates access for users who are using their tokens correctly.</p> <p>Authentication tokens may be physical devices, such as key fobs or smart cards, or they may exist in software as mobile or desktop apps that generate PIN codes for authentication. These authentication codes, also known as one-time passwords, are usually generated by a server and can be recognized as authentic by an authentication device or app. The authentication code is a short sequence linked to a particular device, user or account and that can be used once as part of an authentication process.</p> <p>Organizations need to deploy a system to accept, process and allow -- or deny -- access to users authenticating with their tokens. This may be deployed in the form of server software, a dedicated hardware server or provided as a service by a third-party vendor.</p> <p>An important aspect of 2FA is ascertaining that the authenticated user is given access to all resources the user is approved for -- and only those resources. As a result, one key function of 2FA is linking the authentication system with an organization's authentication data. Microsoft provides some of the infrastructure necessary for organizations to support 2FA in Windows 10 through Windows Hello, which can operate with Microsoft accounts, as well as authenticating users through Microsoft Active Directory (AD), Azure AD or with FIDO 2.0.<br /><br /> How 2FA hardware tokens work</p> <p>Hardware tokens for 2FA are available supporting different approaches to authentication. One popular hardware token is the YubiKey, a small USB device that supports one-time passwords (OTP), public key encryption and authentication and the Universal 2nd Factor protocol developed by the FIDO Alliance. YubiKey tokens are sold by Yubico, Inc., based in Palo Alto, Calif.</p> <p>When a user with a YubiKey logs into an online service that supports OTP, such as Gmail, GitHub or WordPress, they insert their YubiKey into the USB port of their device, enter their password, click in the YubiKey field and touch the YubiKey button. The YubiKey generates an OTP and enters it in the field.</p> <p>The OTP is a 44-character, single-use password; the first 12 characters are a unique ID that identifies the security key registered with the account. The remaining 32 characters contain information that is encrypted using a key known only to the device and Yubico's servers, established during the initial account registration.</p> <p>The OTP is sent from the online service to Yubico for authentication checking. Once the OTP is validated, the Yubico authentication server sends back a message confirming this is the right token for this user. The 2FA is complete. The user has provided two factors of authentication: Their password is the knowledge factor, and their YubiKey is the possession factor.<br /><br /> Two-factor authentication for mobile device authentication</p> <p>Smartphones offer a variety of possibilities for 2FA, allowing companies to use what works best for them. Some devices are capable of recognizing fingerprints; a built-in camera can be used for facial recognition or iris scanning and the microphone can be used for voice recognition. Smartphones equipped with GPS can verify location as an additional factor. Voice or Short Message Service (SMS) may also be used as a channel for out-of-band authentication.</p> <p>Apple iOS, Google Android, Windows 10 and BlackBerry OS 10 all have apps that support 2FA, allowing the phone itself to serve as the physical device to satisfy the possession factor. Duo Security, based in Ann Arbor, Mich., and purchased by Cisco in 2018 for $2.35 billion, is a 2FA platform vendor whose product enables customers to use their trusted devices for 2FA. Duo's platform first establishes that a user is trusted before verifying that their mobile device can also be trusted for authenticating the user.<br /><br /> Biometric authentication for smartphones</p> <p>Authenticator apps replace the need to obtain a verification code via text, voice call or email. For example, to access a website or web-based service that supports Google Authenticator, the user types in their username and password -- a knowledge factor. The user is then prompted to enter a six-digit number. Instead of having to wait a few seconds to receive a text message, Authenticator generates the number for them. These numbers change every 30 seconds and are different for every login. By entering the correct number, the user completes the user-verification process and proves possession of the correct device -- an ownership factor.<br /><br /> Is two-factor authentication secure?</p> <p>While two-factor authentication does improve security -- because the right to access no longer relies solely on the strength of a password -- two-factor authentication schemes are only as secure as their weakest component. For example, hardware tokens depend on the security of the issuer or manufacturer. One of the most high-profile cases of a compromised two-factor system occurred in 2011, when security company RSA Security reported its SecurID authentication tokens had been hacked.</p> <p>The account-recovery process itself can also be subverted when it is used to defeat two-factor authentication, because it often resets a user's current password and emails a temporary password to allow the user to log in again, bypassing the 2FA process. The business Gmail accounts of the chief executive of Cloudflare were hacked in this way.</p> <p>Although SMS-based 2FA is inexpensive, easy to implement and considered user-friendly, it is vulnerable to numerous attacks. NIST has deprecated use of SMS in 2FA services in its Special Publication 800-63-3: Digital Identity Guidelines. NIST concluded that one-time passwords sent via SMS are too vulnerable due to mobile phone number portability, attacks like the Signaling System 7 hack against the mobile phone network and malware like Eurograbber that can be used to intercept or redirect text messages.<br /><br /> Higher levels of authentication</p> <p>Most attacks originate from remote internet connections, so 2FA makes these attacks less threatening. Obtaining passwords is not sufficient for access, and it is unlikely an attacker would also be able to obtain the second authentication factor associated with a user account.</p> <p>However, attackers sometimes break an authentication factor in the physical world. For example, a persistent search of the target premises might yield an employee ID and password in the trash, or in carelessly discarded storage devices containing password databases. However, if additional factors are required for authentication, the attacker would face at least one more obstacle. Because the factors are independent, compromise of one should not lead to the compromise of others.</p> <p>This is why some high-security environments require a more demanding form of multifactor authentication, such three-factor authentication, which typically involves possession of a physical token and a password used in conjunction with biometric data, such as fingerprint scans or voiceprints. Factors such as geolocation, type of device and time of day are also being used to help determine whether a user should be authenticated or blocked. Additionally, behavioral biometric identifiers, like a user's keystroke length, typing speed and mouse movements, can also be discreetly monitored in real time to provide continuous authentication, instead of a single one-off authentication check during login.</p> <p>Learn how to enable two-factor authentication(2fa) for different online accounts at: <a href=""></a></p> <p>Ref: <a href=""></a></p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Thu, 03 Oct 2019 06:46:46 +0000 admin 49 at Cyber Security Tips For Public Institutions <div class="field field-name-field-news-featured-image field-type-image field-label-hidden"><div class="field-items"><div class="field-item even"><img src="" alt="Cyber security awareness tips for public institutions" title="Cyber security awareness tips for public institutions" /></div></div></div><div class="field field-name-body field-type-text-with-summary field-label-hidden"><div class="field-items"><div class="field-item even"><p><strong>Cyber Security Tips For Public Institutions</strong></p> <p>The Network against Scams &amp; Cyber Crime &amp; Scam watch Nigeria's cyber security advice to help protect public institutions, and the technology they rely on.</p> <p>Cyber criminals often target government institutions to gain access to sensitive Government information. The challenge for any agency is to identify threats and vulnerabilities, invest in risk mitigation and continually assess and improve cybersecurity efforts.</p> <p>Different types of perpetrators can initiate cyber threats, and their motivations vary widely.<br /><br /> Some may seek to obtain sensitive voter information; private health data, government employee data to sell and commit fraud etc.</p> <p><strong>Top tips for staying secure for Public Institutions</strong></p> <p>1. <strong>Data Backup</strong><br /><br />     Understand the importance of data backup</p> <p>    Ransomware is popular among cybercriminals who can lock computer to deny access to valuable files &amp; data including word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files.<br /><br />     One of the best ways to combat the threat of ransomware is to back up your data on a regular basis using external backup devices (Flash drives or external hard drives) or by using cloud storage services.</p> <p>    Regularly backup the data on all computers. Critical data  Backup data automatically if possible, or at least weekly, and store the copies either offsite or on the cloud. </p> <p>    <strong>Maintain Cloud Backups</strong></p> <p>    Back up all business to a cloud server in a different geographical region. <br /><br />     Google provides 15 GB of storage are free.<br /><br /> 2. <strong>Phishing</strong></p> <p>    PHISHING is dangerous. One careless click is all it takes for malicious software to get into devices and wreak havoc. <br /><br />     Employees should learn not to automatically click on links in emails. They should learn to hover the mouse over the link to make sure it is going to a reputable address. </p> <p>    Spelling mistakes, odd emails from popular companies, and threatening messages urging quick action are some of the telltale signs of a phishing email designed to install malware on your device. When in doubt, do not click on the link. Instead go straight to the company’s website and contact the customer service department to ensure such a mail was sent to you. Fortunately, most high-quality antivirus software, will catch these phony emails before they come to you.</p> <p>    Be careful when clicking directly on links in emails, even if the sender appears to be known; attempt to verify web addresses independently (e.g., contact your organization's helpdesk or search the Internet for the main website of the organization or topic mentioned in the email).<br /><br />     Exercise caution when opening email attachments. <br /><br />     Be particularly wary of compressed or ZIP file attachments.</p> <p>3. <strong>BYOD (Bring your Own Devices)</strong></p> <p>    BYOD refers to the policy of allowing employees to bring their own devices for official use. Instead of issuing employees with a company laptop or smartphone, organisations allow staffs to use their own devices to access the company networks, systems, software or information and stay connected beyond the workplace. </p> <p>    In recent times, the concept of BYOD has been proven to bring several key benefits to organisations who adopt this approach, including increased productivity and cuts to IT and operating costs.</p> <p>    Aside from the cost effectiveness and benefits of not having to invest heavily in new devices, employees will be familiar with their own devices. For example – one may be comfortable operating Apple technology whilst someone else may be more of a Windows user. BYOD gives employees the comfort of operating a hardware / software platform that they’re already familiar with and takes the stress away of trying to adapt to new systems and technology. </p> <p>    As such, the concept of BYOD helps drives efficiencies – saving time as well as money in the long run.</p> <p>    But of course, as much as the advantages of BYOD are enormous, it has its own disadvantages – mainly security concerns.     <br /><br />     Strong IT policies followed with strict compliance must be put in place such as:<br /><br />      - Use of strong passwords<br /><br />      - Use of Updated Softwares<br /><br />      - Use of Strong Antivirus Applications<br /><br />      - Etc.</p> <p>4. <strong>Audit your social media inventory</strong></p> <p>    Audit your list of social media accounts, password holders, and hosted websites.</p> <p>    Ensure no former employees, contractors or interns have access to current passwords.</p> <p>    Review any third-party app you use to monitor or post to social media, such as IFTTT, Social Rabbit etc.</p> <p>    Review your other digital services, including websites, for signs of cyber-vandalism and any vulnerabilities.<br /><br />     A commitment to cyber hygiene and best practices is critical to protecting organizations and users from cyber threats, including malware.</p> <p>5. <strong>Social Engineering</strong></p> <p>    Be suspicious of unsolicited phone calls, visits, or email messages from individuals asking about employees or other internal information. If an unknown individual claims to be from a      legitimate organization, try to verify his or her identity directly with the company / institution.<br /><br />     Avoid providing personal information or information about your organization, including its structure or networks, unless you are certain of a person's authority to have the information.<br /><br />     Avoid revealing personal or financial information in email, and do not respond to email solicitations for this information. This includes following links sent in email.<br /><br />     Be cautious about sending sensitive information over the Internet before checking a website's security.</p> <p>     If you are unsure whether an email request is legitimate, try to verify it by contacting the company directly. Do not use contact information provided on a website connected to the     request; instead, check previous statements for contact information. Information about known phishing attacks is also available             online from anti-phishing groups such as the APWG.</p> <p><br /><br /> 6. <strong>Organizing Cyber Security Training and Seminars for Employees Regularly</strong><br /><br /> 7. <strong>Deploy Antivirus Software</strong></p> <p>    There's the need to install antivirus software that can protect all devices within the organization from viruses, spyware, ransomware and phishing scams. Make sure the software not only offers protection, but also technology that helps you clean computers as needed and resets them to their pre-infected state.</p> <p><strong>How to Report Scams &amp; Cyber Crimes</strong></p> <p>If you think you might have been a victim of cyber crime, please <a href="">send a report to us and the Police by filling this form</a></p> </div></div></div><div class="field field-name-field-content-category field-type-taxonomy-term-reference field-label-above clearfix"><h3 class="field-label">Related: </h3><ul class="links"><li class="taxonomy-term-reference-0"><a href="/cybersecurity/cybersecurity">Cybersecurity</a></li></ul></div> Sun, 29 Sep 2019 15:20:14 +0000 admin 48 at