| |
CyberheistNews Vol 4, 06
Editor's Corner
Cryptolocker Scrambles All Legal Files Of US Law Firm
WSOCTV in North Carolina state capital Charlotte reports on a Goodson's, a small US law firm there which stepped forward and bravely admitted that their whole file server was scrambled by Cryptolocker and they lost all their files. Here is the TV clip:
http://www.wsoctv.com/news/news/local/computer-virus-locking-important-files-targets-loc/ndF4Z/
Their IT team tried to disinfect the machine, but that made things even worse because that prevents decryption. Then they tried to pay the ransom but it was too late since they had tampered with the malware. The TV clip shows the workstation where an employee fell for the Cryptolocker social engineering attack which used an email "from AT&T" with a malicious attachment that was mistaken for a voice-mail message from their phone answering service.
That error encrypted all files on their main server including Word, WordPerfect and PDF files, said Goodson's owner, Paul M. Goodson. No word if there was a backup of the file server but it sounds like they did not have one. The only blessing was that the malware had scrambled files and not stolen them, Goodson added.
Goodsons is not alone. Cryptolocker attacks are very successful and include Greenland, New Hampshire's town hall. Town Administrator Karen Anderson said: "The results have left us with documents that are no longer readable, I've lost eight years worth of my work." There is even a police department that admitted to having paid $750 for two Bitcoins to buy back sensitive files that were encrypted. The TV station claimed the eastern European gang has made US 30 million with this scam.
So, here are two points of advice. 1) Grab your most recent backup and see if it actually will restore the files. Make sure you always have a recent offsite backup. 2) It is urgent and important to step all employees through effective security awareness training ASAP.
New Ammo To Get More IT Security Budget
Some interesting data has surfaced the last few days, all clustered together for some reason. Here are three important data points that you can use to illustrate the fact that more budget (and brainpower) NEEDS to be spent for IT security.
First of all, several sources in the antivirus industry are now indicating that around 200,000 new flavors of malware are released every day. This is spread over many malware families of course. A conservative estimate is a million new versions a week. No wonder endpoint security has trouble keeping up.
Second, a new instance of identity fraud happened every two seconds in the U.S. in 2013. According to the "2014 Identity Fraud Study," an annual report compiled by Javelin Strategy and Research, identity fraud increased by more than 500,000 victims in 2013, the second-highest number since the study began 11 years ago. Story:
http://www.darkreading.com/end-user/javelin-study-a-new-identity-fraud-victi/240165969
Third, RSA identified a new phishing attack every minute in 2013. They publish fraud stats every month, and part of these is their "phishing report". The average of phishing attacks per month is about 44,000 which is roughly one every minute. Here is their report at slideshare:
http://www.slideshare.net/emcacademics/rsa-monthly-online-fraud-report-december-2013
Don't let your C-level execs wind up at Capitol Hill like this:
http://blog.knowbe4.com/bid/373603/Dont-Let-Your-C-Level-Execs-Wind-Up-At-Capitol-Hill-Like-This
BOOK: Cyberheist 50% off at Amazon
If you need to explain IT security to non-IT Execs, it can be challenging as we do speak very different languages. That's why I wrote the book Cyberheist. There is a 50% off special for the Kindle version (now only $9.95) and the paperback is also available. Here is the back cover "pitch", recommended for "bosses". The special ends February 28th.
"Not since the markets melted down, and the recession sank its icy hooks into the business climate in 2008, has American business faced a threat as serious as the current cybercrime scene. Small to medium enterprises have been hard-hit in particular, amounting to tens of millions of dollars being stolen out of their bank accounts.
"This book is meant to educate you about the dangers of conducting business online. In particular, it covers phishing, a particular type of social engineering attack delivered by email or over the Internet.
"Our goal is to help you recognize the increasing danger that individuals and organizations face when they use the Internet, especially when conducting financial activity, and take proactive measures to protect your organization. These risks include theft of sensitive information, theft of goods and services, loss of intellectual property, and exposure to fraudulent online money transfers that empty your bank accounts: a cyberheist.
"Don't become a statistic. Read this book and apply the strategies and techniques described within to protect your organization from a potentially devastating cyberheist." Get your copy here:
http://www.amazon.com/Cyberheist-financial-American-businesses-meltdown/dp/0983400008/
Quotes of the Week
"None are more hopelessly enslaved than those who falsely believe they are free." - Johann Wolfgang von Goethe
"Appreciation is a wonderful thing: It makes what is excellent in others belong to us as well." - Voltaire
Thanks for reading CyberheistNews! Please forward to your friends. But if you want to unsubscribe,
you can do that right here
|
Whitepaper: Legal Compliance Through Security Awareness Training
Not Sure How To Comply?
This new whitepaper from Michael R. Overly Esq., CISA, CISSP, CIPP, ISSMP, CRISC shows you the common threads in compliance laws and regulations. Did you know that "CIA" means Confidentiality, Integrity, and Availability, and how lawmakers incorporated that language in Infosec regulations? Are you familiar with the concept of Acting “Reasonably” or taking “Appropriate” or “Necessary” measures? Find out how this can keep you from violating compliance laws or regulations. Know you are supposed to "scale security measures to reflect the threat"? We have some examples of the Massachusetts Data Security Law and HIPAA to explain what is required. Download this whitepaper now:
http://info.knowbe4.com/whitepaper-overly-kb4-13-10-28
Comcast Customer Surprised To Learn New Router Is Also Public Hotspot
New routers installed by Comcast have public Wi-Fi signal broadcasting for other Comcast accounts turned on by default, unless you ask Comcast to turn it off.
"We encourage all subscribers to keep this feature enabled as it allows more people to enjoy the benefits of XFINITY Wi-Fi around the neighborhood," the company says.
This is unconscionable, What about a hacked account that is now being used from a car to consume illegal content using your router? That could ultimately lead to a SWAT team breaking down your door. This is an ill-advised strategy and if you use Comcast I suggest you read this and turn that signal off ASAP:
http://arstechnica.com/information-technology/2014/02/comcast-customer-surprised-to-learn-new-router-is-also-public-hotspot/
Should We Go "Chip-and-PIN"? Well, There Is A Rub...
Payment systems experts told the Senate Banking Committee's Subcommittee on National Security and International Trade and Finance that adopting chip and PIN technology would go a long way in helping to protect American consumers from payment card fraud resulting from data breaches, but cautioned that no "single technology is a silver-bullet solution."
They are right, as "chip-and-PIN" is not the panacea it is claimed to be. Does it make fraud harder? Yes. Will it prevent fraud completely? No, as in the U.K. last year credit card fraud was a Billion dollars. Yes, that's a capital B, and that's -with- "chip-and-PIN" cards. Do I think we should move to that model? Yes, we should, but combined with other measures. More:
http://www.govinfosecurity.com/finger-pointing-at-breach-hearing-a-6468
Win $500. Participate in the 2014 State of Security Survey
KnowBe4 and ITIC’s joint 2014 State of Security Survey is live! The survey polls organizations on their current security practices with respect to BYOD, the status of their security mechanisms (e.g. AV software, intrusion detection, firewalls and encryption) as well as the current and planned measures organizations are taking to safeguard their data and networks.
When you complete this survey, you will be able to enter our sweepstakes for a chance to win a $500 Amazon.com Gift Card! And there are other prizes too.
The survey should take only about 5 minutes to complete. All responses are confidential. As always, anyone who completes the survey AND leaves an essay comment with their contact information is eligible to win one of two additional prizes.
First prize for the best essay comment is a $200 Amazon gift certificate; second prize is a $100 Amazon gift certificate. To be eligible to win the prizes you must leave your email address along with your comment in the comment box of the last question. No sales people will call you and we never share your information with anyone.
Once the survey results are tabulated we will post an Executive Summary in CyberheistNews and on the ITIC Website: www.itic-corp.com. Anyone who completes the survey is eligible to receive a complimentary copy of the full Report when it’s published. All you have to do is Email
ldidio@itic-corp.com or stus@knowbe4.com.
Here’s the link to the survey:
https://www.surveymonkey.com/s/XC6KL2J
Thanks in advance for your participation!
Cyberheist 'FAVE' LINKS:
* This Week's Links We Like. Tips, Hints And Fun Stuff.
The Chrysler 200 Super Bowl 2014 Commercial presented by Bob Dylan and also featuring American icons such as Marilyn Monroe and James Dean:
http://www.flixxy.com/chrysler-and-bob-dylan-super-bowl-commercial-2014.htm
A bear comes for visit, gets cookies, shakes hands, gives a high five and is very appreciative of Russian hospitality:
http://www.flixxy.com/russian-bear-comes-for-a-visit.htm
It is not easy to find a parking spot in Moscow. When you find one, you go for it, using any driving and drifting skills you have acquired. LOL:
http://www.flixxy.com/spectacular-parallel-parking-skills-in-moscow.htm
M&M's classic James Bond-style spy thriller Super Bowl ad is funny and well made:
http://www.flixxy.com/delivery-m-and-m-2014-super-bowl-ad.htm?
Maurizio Sera put a GoPro on top of his BMW and drove from Hollywood to Washington DC, snapping a picture every 2 seconds - 6 min Coast to coast:
http://www.flixxy.com/hollywood-to-washington-dc-in-6-minutes.htm
The giant container ship 'Arnold Maersk' makes an impressive pass under the Bayonne Bridge in New York. Man these things are monsters:
http://www.flixxy.com/huge-container-ship-in-new-york.htm?
Iridium Go! hotspot can turn your smartphone into a satellite phone:
http://www.gizmag.com/iridium-go-satellite-hotspot/30711/
Can any of these top golfers knock a clay pigeon out of the sky with a golf ball?
http://www.flixxy.com/clay-pigeon-golf-shot.htm?utm_source=nl
Users forget to lock their PC when AFK? This kickstarter project automates that. Very handy!:
http://www.gizmag.com/gatekeeper-unlock-pc-proximity/30737/
Jeremy Clarkson in an Audi RS4 races speed climbers Leo Houlding and Tim Emmett up a cliff face of 'Gorge du Verdon' in the South of France. The skill and speed of the mountain climbers is amazing. Make sure you watch the video all the way to the end - there is a surprise!:
http://www.flixxy.com/audi-rs4-vs-speed-mountain-climber-top-gear.htm?
|
|
