Fakebank Malware Evolved to Block Your Phone Calls

Serious young hacker using laptop and mobile phone in dark room

Yet again, a security company has found a version of malware that has evolved to be more damaging. Symantec found a new variant of the Android malware called Fakebank that can delay users from placing a phone call to their financial institutions to report fraud and cancel cards.

This version of Fakebank scans the device for certain banking apps and if it finds one, it will prompt the user to delete that app and install the bad one. Be wary if an app asks you to delete it when you are not expecting it to ask such a thing of you.

The best piece of advice for this one is to avoid downloading apps from sources other than the official app stores for your device. Sideloading, as it’s called adds an additional risk element to anyone wanting to take that chance. This is because those apps don’t typically go through as much security scrutiny before they are distributed to users as they do when they are placed into the Google Play or Apple App Store for example.

If fraud or suspicious card activity is noticed on any of your payment cards, contact your financial organization right away to take care of it. If your phone ceases to work, as may happen with this malware, use email or preferably another phone to contact them.

In addition to preventing calls, this new version will also collect banking login data and monitor phone calls. So far, this one has only been seen in South Korea and Russia. However, as with any malware, it’s only a matter of time before it hits the U.S.

© Copyright 2016 Stickley on Security

Study of the Worst Passwords Reveals People Are Not Paying Attention

Cute Daydreaming Girl Next To Floating Hearts with Puppy Within.

Every year someone does a study to find out the worse passwords on the web for a given year. For the first few months of this year, Salted Hash looked at over a quarter of a million passwords and let out a big sigh. No matter how much discussion surrounds how important it is to have strong passwords, how to create them, how it’s important to change them regularly, and to have different ones for each online account, it doesn’t seem to get through. In fact, the number one password in 2013 was exactly the same as the number one password they found; and it’s terrible.

Salted Hash collected phishing logs that the company found on the Dark Web. The sample they examined included companies such as Apple, Microsoft, Google, PayPal, and social media and banking account login details. They hoped to see improvements, but alas, they were sorely disappointed.

People go to great lengths to make sure their homes are protected; deadbolt locks, security systems, big and noisy dogs, for example. But when it comes to protecting online accounts, they seem to think it’s not as important. Yet, if someone with bad intentions gets your online banking or PayPal credentials, the damage could be very significant. It is an intrusion into your financial home.

Take some time to create strong passwords and phrases and to change them regularly. Do this at least quarterly, if not more often. Reusing the same credentials for several years means that if stolen data shows up on the Dark Web two, three or more years after it was stolen, as it did with LinkedIn, someone could still get into your account.

And before you just toss aside the significance of someone getting into your LinkedIn account, think about some of the information that is included in your profile:
•Your name
•Your title or function
•Your city
•Your employer
•Your previous employers
•Referrals that may have useful details
•Your hobbies
•Your email address(es)
•Your connections and often their relationship to you

While this is public, it also makes you trustworthy. And if a cyber criminal wanted to go spear-phishing, he or she would have a lot of information with which to start targeting your connections right there inside LinkedIn from your account.

Of course we don’t need to tell you what can happen if someone gets your four-year-old login credentials to your bank account. So take some time to change it. Use at least eight characters, upper and lower case letters, numbers, and special characters.

The top five passwords in Salted Hash’s list were very uncreative. They included “123456789” and 3 variations of it, but the numbers were still in order. The only diversion off of this path was in the number 4 spot. That was “filosofia.” So, don’t delay. Change your passwords if you haven’t done it within the past three months. Go ahead. Do it right now. We’ll wait.

© Copyright 2016 Stickley on Security

Over 900 Million Android Devices Vulnerable to Quadrooter

android

Android smart devices are making news again. This time those that were shipped with a Qualcomm chip have four vulnerabilities with which to be concerned. More than 900 million smartphones and tablets are affected by what is being called Quadrooter. Three of these flaws were addressed and fixed in the latest set of security updates from Google. However, one of them won’t be fixed until September. And those that were released by Google haven’t necessarily made it into the releases by individual carriers. This is because carriers have control over when to release them to their users. While most of the time it is shortly after they are provided to them, sometimes they delay releasing them to try to lure people into buying new devices. If you haven’t received a notice for one of the affected Android devices that an update is available, call your carrier and inquire.

If you haven’t updated your Android devices lately, take some time to check if any are available and get at least the three available patches applied. The flaws could allow an attacker to get full control of a vulnerable device; which means he or she would have access to the microphone, the camera, and everything on it.

Fortunately, it would take some effort by the attacker to trick a user into installing a malicious app to be successful. Most Android smartphones at least, don’t allow sideloading of apps (installing them from a location other than the Google Play store), but some malicious apps have still made it past the additional checks and were allowed in. It’s still safer to check the official app store on all devices rather than getting them from other locations.

Some of the devices affected include:

  • Google’s Nexus 5X, Nexus 6, and Nexus 6P
  • HTC’s One M9 and M10
  • Samsung’s Galaxy S7, S7 Edge
  • BlackBerry DTEK50, Priv
  • Blackphone 1 and 2
  • LG G4, G5, V10
  • Motorola New Moto X
  • OnePlus One, 2, and 3
  • Sony Xperia Z Ultra

Remember that when you are looking for apps to install, make sure they are from reputable developers. Check the reviews and make sure there are more than just a few and that they are not all glowing. Sometimes this means they are fake and the app could be malicious. Also check elsewhere online for reviews and information. Sometimes the reviews in the app stores review the app itself and not the company. If there is a complaint about how a company does business, whether via an app, online, or brick and mortar, there will be information on those elsewhere and they may include information on how the app installs malware, if it does.

© Copyright 2016 Stickley on Security

Facebook Notifications Alert You Right Into a Great Scam and Malware

1470408437

A friend commented on your Facebook post and you see a notification in the corner of your app or an email arrives getting you all excited to know what that friend said. So you click the included link in the notification or email and Bam! You download malware to your device.

This is one of the scams making its way around Facebook right now. In this scam, merely clicking the link in the notification that you were tagged or a comment was made will not execute the malware. However, if you click on the file that was downloaded, it will. This one primarily preys on users of the Chrome browser using a JavaScript encoded file, but other browsers are likely not immune. A second Facebook scam uses clickbait to lure unsuspecting victims and is getting around Facebook’s filters for malicious links.

Clickbait is a photo or headline that is of a provocative or sensational nature with the intent of attracting clicks, views, or site visits. The objective of the hackers in this second scam is to steal login credentials, which will ultimately allow them to do more phishing. The clickbait is pornographic in nature and theoretically should be caught by the phishing filters.  However, it has not yet been and the links are being posted to various Facebook groups.

When the play button on the video is clicked, the user does not see the promised nude girl, but is redirected to a site where he or she is asked to enter Facebook login credentials and a phone number.

Then the user is redirected to an online survey that collects additional information. In some cases, users are redirected again to another site that downloads a fake version of Flash Player that includes either malware or adware, or possibly both. In any case, it’s not a good thing.

One good thing is that users of Chrome seem to be somewhat protected against the second scam because Chrome blocks one of the sites hosting it. However, the scammers are onto that and are already using other ones that have not yet been identified.

It’s always best to avoid clicking links in email messages or in other types of notifications, especially if they are not expected. Instead, go directly into the app or to the site using a previously bookmarked link or by typing the URL into the address bar, being careful not to mistype it (this could lead to other infections by typosquatters or do-jackers). Use caution when clicking on videos or links in Facebook or any social media. Even if they appear to have been posted by your friends, they may actually come from a hacker who has compromised your friend’s account in some way. If you are suspicious in any way, it’s best not to click it.

If you click a link and it asks you if you want to run a program or execute something else, click the negative option unless you know it’s legitimate. And always keep your computers and mobile devices updated with the latest versions of software. Make one of those pieces of software a good anti-malware product.

The Google Chrome browser has been used in several cases to compromise users’ systems. Not long ago a fake Chrome for Android update was used to steal personal data and last year, the CTB Locker ransomware was circulating masquerading as a Chrome update.

© Copyright 2016 Stickley on Security

Welcome to the Workforce

workforce_banner

It’s time to roll up your sleeves and put that lifetime of education to work for you. Finding the right job isn’t easy—it takes motivation to go after the industry or company you want, effort to ace the application and interview process and a bit of luck to land the job. Read on for tips, advice and tools that will help ensure a successful search.

Resources

Your school career center is an excellent place to start when looking for work. As a resource provided to students, the point of a career center is to find jobs that relate to specific fields of study. Check in with a career counselor for advice on resume building or to sign up for on-campus interviews. Recruiters often come to schools and universities looking for future prospects. Many campuses hold job fairs and career events year round. It’s a great way to get your foot in the door of an otherwise out-of-reach company.

The Internet has made job hunting more convenient. Specifically, job search sites like Indeed, Career Builder and Monster allow you to apply for jobs and/or post your resume for potential employers to come find you. Craigslist is another resource to find part-time or full-time positions. Submitting a cover letter and resume online is often the preferred method these days.

Headhunters and employment services can also be a good source for job leads. One of the major benefits of working with placement agencies is that they already have established relationships within the industries they service and know exactly who to put you in front of. The downside is that some may charge you a fee for their services or require a percentage of your pay from the company who has hired you.

Networking is a great way to get your foot in the door. Many of the best jobs out there are never advertised. The key to landing them is a lucky combination of being in the right place at the right time and talking to the right person. Don’t be afraid to go to social events and advertise yourself or talk about your goals. Or share your plans with friends and family. If they can’t immediately connect you with a job, they can often provide valuable advice on where to look and who the best contacts might be. It’s also important to join online networking circles. Post a profile on LinkedIn and join groups to connect with relevant professionals.

Know What You’re Looking For

Think about the big picture and not just the job you want now. Beyond earning a paycheck, what skills and experiences do you want to take away from your new job? Look to the next step of your career and think about which job will get you closer to that goal. Also, look at the associated benefits. A high-paying job with no benefits may not be as advantageous as a lower-paying position with a complete benefits package.

Consider cost of living and your expenses before you relocate for a job. Every city is different, so a starting salary in one area may not be enough to support you in a new location. Moving costs are another factor to take into consideration. If your prospective employer isn’t going to pay your moving costs, make sure the salary will make up for these costs in the long run, or that you have additional funds to cover the expenses.

NASA Federal Credit Union Celebrates the 50th Anniversaryof Star Trek™ with a Special 50,000 Bonus Points Offer on Their Official Star Trek Credit Cards

Press Release Art (003)

Upper Marlboro, Maryland—August 5, 2016—NASA Federal Credit Union announced today it will join in the celebration of the 50th Anniversary of the Star Trek franchise at the Annual Star Trek Convention in Las Vegas from August 3 through 7, 2016. As part of the celebration, NASA Federal will be promoting a limited time offer of 50,000 bonus points on their line of official Star Trek credit cards. Points may be redeemed for exclusive Star Trek merchandise and experiences not available with other credit cards.

NASA Federal will also raffle off NASA flight jackets to those entering the contest at nasafcu.com/nasajacket. In addition, they will give away Star Trek-branded headphones to attendees who post selfies with Star Trek card fans to @nasafcu on Facebook, Twitter, and/or Instagram using the #StarTrekCardFan.

“We are excited to be part of the Star Trek 50th Anniversary by offering Star Trek fans 50,000 bonus points on their new Star Trek credit cards. And the good news is that Star Trek fans don’t have to be at the convention to get the Star Trek credit cards or enter to win a NASA Flight Jacket,” says NASA Federal Credit Union President & CEO Douglas Allman. “We also hope that holders of Star Trek credit cards feel pride in the Star Trek franchise every time they use their cards, while also earning points toward exclusive Star Trek merchandise and experiences.”

In late 2015, under license by CBS Consumer Products, NASA Federal launched four new Star Trek Platinum Advantage Rewards Credit Cards, which included the Starfleet Academy, United Federation, Captains and Starfleet Command Cards. In addition to exclusive Star Trek merchandise and experiences, all four cards feature a competitive interest rate, no balance transfer fee, and a low 7.9% APR balance transfer for life, along with a generous rewards program.

Star Trek fans may apply for the new cards online at nasafcu.com/startrek, or by calling 1-888-NASA-FCU. And they may also enter to win a NASA Flight Jacket at nasafcu.com/nasajacket.