How Did the DNC Get Hacked by Phishing Emails in 2016?

Cyber Attack, email links, Hacking, malware, Password Security, Phishing, Phishing Email, Security, , ,
18
Sep 2018

You may think that political parties understand the need for good security, but back in 2016 the DNC suffered a major hack due to phishing emails.

Thanks to a sustained attack, Russian hackers were able to infiltrate email accounts of those involved within Hilary Clinton’s campaign to become president of the United States. And, as you know, the rest is history. However, not many people are aware of exactly how the DNC got hacked so extensively that highly sensitive information was obtained and then leaked to the public.

Although not every single detail has been revealed, we know enough that the hack was, in relative terms, a fairly simple execution. Naturally, you’re unlikely to be targeted by the same people who are involved in political attacks, but their methods are likely to be similar. Therefore, we’re going to take a look at how the DNC was hacked by phishing emails, so you can understand how to avoid it.

Phishing for DNC Secrets

The hack began on March 10th, 2016 and involved a batch of heavily disguised emails, which appeared to be sent by Google, being sent to key members of Hilary Clinton’s campaign team. These emails purported to be advising the recipients that their passwords needed changing in order to strengthen their security. However, the links contained within these emails sent users to a malicious website where strengthening security was the last thing on their mind. With these email accounts compromised, the hackers were then able to access private contact lists held within them.

Within a day, the hackers had access to confidential email addresses for key targets within the DNC campaign. And, almost immediately, the hackers began to send phishing emails to these email addresses in order to work their way higher up the chain of command. Despite the presence of two-factor authentication, the hackers’ persistence paid off as they eventually managed to breach the defenses of John Podesta, chairman of the DNC’s campaign. This email account, alone, provided access to 50,000 confidential emails.

This assault is believed to have been organized and orchestrated by the Russian cyber-espionage organization known as Fancy Bear. Despite accessing such a huge amount of emails from Podestra, Fancy Bear intensified their hacking campaign and this led to security experts becoming suspicious of methods being employed to dupe Google’s spam filter into accepting malicious emails into the inboxes of DNC targets. The clean-up operation, however, was too late and Podestra’s breached emails were soon published on Wikileaks.

Be Clever, Don’t Get Phished

The 2016 attack on the DNC is probably the most famous, and damaging, phishing attack in cyber-history. Simply due to a few members of staff clicking malicious links, an entire election campaign was brought to its knees. Reinforcing good email security, therefore, remains a crucial practice for any organization in modern business. Even with millions of dollars of security in place, the DNC fell victim to a simple phishing scam and, next time, it could easily be your organization.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What Should You Do When You Receive a Phishing Email?

Hacking, malware, Phishing, Phishing Email, Security, Security Threats, , , ,
11
Sep 2018

Phishing emails are the scourge of our inboxes and there seem to be more and more each week, so what should you do when you receive a phishing email?

The aim of phishing emails is for the sender of said emails to obtain sensitive information from the recipient. This goal is realized by cleverly disguising the email to make it look as genuine as possible and, therefore, gain the recipient’s trust. Data targeted by phishing emails usually relates to sensitive details including login details and passwords. And this data leakage can cause serious harm to businesses with the average cost of a phishing attack on a medium sized business costing around $1.6 million.

No organization that wants to remain productive and competitive wants to deal with the chaos of a phishing attack, so we’re going to take a look at what you should do when you receive a phishing email.

Do Not Open Phishing Emails

The best way to avoid the dangers of phishing emails is very simple: Don’t open them! This, of course, is easier said than done as phishing emails have become incredibly sophisticated over the years e.g. spoofing email addresses. However, if for any reason whatsoever you do not recognize an email address or there’s something unusual about the email subject then it’s always best to err on the side of the caution. Instead, move the cursor away and get your IT team to investigate it before going any further.

Leave Links Well Alone

Opening a phishing email isn’t enough, on its own, to activate the malicious payload, but it’s very simple to do so. Phishing emails often contain links which, once clicked, send the user to malicious websites where malware is automatically downloaded to the user’s PC. This malware is usually very discreet and is able to run silently in the background where it is able to log keystrokes or even take control of the user’s PC. So, remember: if you don’t recognize the sender of an email, it’s crucial that you never click their links.

Don’t Respond

Phishing emails will often try to gain your trust by establishing a connection, so you need to be mindful of these deceptive tactics. By hitting the reply button, for example, you’re demonstrating to the hacker that not only is your email account active, but that you’re willing to engage. And, if a phone number is provided, never ever ring it as it will involve further social engineering and potentially a very high phone charge to a premium member. It may be tempting to respond, but always say no and move away from engaging.

Report the Email

Any form of hacking represents a serious threat to the security of your organization, so it should be every employee’s duty to report a phishing email as soon as possible. This allows your IT team to analyze the email and its contents before taking action. This could be as simple as deleting it securely or telling you that, actually, it’s safe to open. Ultimately, shared knowledge allows your entire organization to stay on top of phishing emails, so, even if you’ve clicked something you shouldn’t have, report it immediately.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

How to Keep Your Business Servers Safe from Hackers

Backup and Recovery, Hacking, Security, Servers, Windows Server, , ,
21
May 2018

The computer servers that support your business are the backbone that keeps your organization productive, but how do you keep your business servers safe?

Every week seems to bring a new security threat and you can rest assured that the number and ferocity of these attacks isn’t going to subside anytime soon. Your business servers, of course, contain untold amounts of sensitive data that could be used to harm not only your business, but also your customers. Therefore, keeping on top of your servers’ security is paramount in protecting your data from the all too real threat of hackers.

To help you stabilize and improve the security of your business servers, we’ve put together a plan of recommendations to help you meet your security objectives.

Run an Antivirus. Regularly.

Viruses can spread from file to file very quickly and, before you know it, your entire server can become compromised. However, a piece of antivirus software can prevent the majority of existing viruses taking hold of your servers. Quarantining infected or suspicious files allows you to analyze anything that is flagged as potentially dangerous, so installing antivirus software really is a prerequisite of good security practices. And, to really maximize its effectiveness, run it regularly as an infection could occur at any point during in the day.

Update Your Server Software

Many pieces of malware work by exploiting security vulnerabilities in software such as Petya and NotPetya, but these vulnerabilities could be easily avoided by patching. Installing patches, though, can feel like a tiresome task, particularly when your organization needs to stay productive. To put things into perspective you need to weigh up the minimal downtime of installing updates against the havoc caused by an infected server. The answer’s pretty obvious, right? Install those patches and install them immediately.

Educate Your Staff on Security Threats

Your staff are the first line of defense against any cyber-attacks on your organization, so it’s crucial that they’re trained in what to look for and what to do in the case of an attack. Naturally, they’re not going to be partitioning infected servers or installing critical updates, but they can do the very basics. And this can be as simple as good password practices or understanding how to identify a phishing email.

Backup Your Data

Ransomware has become a major issue for businesses in the last couple of years and, in many cases, paying the ransom doesn’t even guarantee the release of your files. And this is why it’s vital that your organization embraces backups to help safeguard your data in the event of a ransomware attack. Backups have been a cornerstone of IT security since the dawn of the digital age and their importance should never be underestimated.

Keep Web Browsing Separate

The internet is a portal to untold amounts of information, but it’s also a gateway to untold security threats. And this is the last thing you want your business server exposed to. Providing internet access through a separate server (to your main server), therefore, allows you to minimize the risk to your most important data.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Infected Websites Are Mining Cryptocurrency

bitcoin, cryptocurrency, Hacking, Security, Security Threats, , ,
06
Apr 2018

Hackers are now infecting websites in order to take control of your PC’s processor and help power the resource heavy activity of cryptocurrency mining.

Cryptocurrencies, such as Bitcoin, have been generating countless headlines in the last year due to the huge values being attributed to them in the financial world. Now, despite cryptocurrencies being purely digital, they still need to be mined to help produce new coins. Naturally, this isn’t a simple task or, otherwise, everyone would be doing it and making millions. Instead, you need plenty of time and even more computing power to carry out the mining process.

For a hacker, of course, harnessing such huge amounts of computing power isn’t exactly rocket science, so it’s no surprise that this is their latest enterprise. And, to make this task a little easier, they’ve started infecting websites to help steal your processing power and power their cryptocurrency mining.

Mining for Cryptocurrency

While leaching off the CPU of innocent users to facilitate cryptocurrency mining is nothing new, the use of websites to help capture this valuable resource is a new one on security experts. And the manner in which it’s being done is ridiculously simple.

Hackers are setting up malicious adverts on websites that run a JavaScript file directly in the browser whenever that site is opened. There’s no need for the hacker to have direct access to the victim’s PC, everything takes place in the victim’s browser. And, if the victim has JavaScript enabled, then the malicious code will automate and hand over a significant amount of their processor power to the hacker’s mining activities.

There are certainly more sensitive hacks – such as those which exploit or encrypt your data – but the real bugbear of having your CPU taken advantage of is the impact it has on your computer’s performance. Mining cryptocurrency requires significant processing power to power through the labor intensive tasks involved, so this drain on resources is going to cause your system to grind to a halt.

Is a Website Hacking Your Processor?

Organizations, in particular, do not want to see their productivity affected by a slowdown in performance, so it’s crucial that you understand the warning signs of these infected sites. If the internet is in use and your system starts slowing down then you should check the performance of your CPU by:

  • Right clicking the taskbar on your PC and selecting Task Manager. This will allow you to access the Performance tab where you can see which resources are taking up your processor’s usage.

If opening a webpage is causing your PC’s performance to rocket, then there’s a chance that this could be down to an infected webpage. The simplest way to deduce this is by closing individual webpages and monitoring the effect within your Performance tab in Task Manager.

Final Thoughts

These infected websites are not going to cause major damage to your organization, but they are going to put a drain on your resources. Understanding that any potential reductions in processor speed could be caused by this new method of hacking is vital to stay on top of your digital security.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Hide ‘N Seek Botnet Threatens the Internet of Things

Cyber Attack, Hacking, Internet of things, IOT, malware, Password Security, Security, Security Threats, , ,
08
Mar 2018

The Internet of Things (IoT) has a new security threat and this time it uses peer-to-peer communication to spread, infect and compromise devices.

In January 2018, security researchers working for Bit-defender discovered a new botnet which, although not related, has similarities to the Reaper botnet. Originally infecting just 12 IoT devices, the Hide ‘N Seek botnet had soon amassed over 32,000 IoT devices by the end of the month. With the ability to steal data, take control of the device and run malicious code, Hide ‘N Seek represents a serious threat.

Understanding new and emerging threats to IoT devices is crucial if you want to protect your organization’s network, so it’s time to investigate Hide ‘N Seek a little closer.

Hide ‘N Seek is No Game

A brand of IP camera manufactured in South Korea appears to be the initial infection source for Hide ‘N Seek, but the botnet is actively attacking other IoT devices. Using randomly generated IP addresses, Hide ‘N Seek attempts to connect to any devices listed against these addresses. If the botnet succeeds in connecting then it either uses default login/password combinations to gain access or performs a brute force attack using a dictionary list to crack the login credentials.

With access obtained, Hide ‘N Seek analyses the device to discover any potential vulnerabilities such as the ability to download malware or launch DDoS attacks. The remote botnet hacker also has the option of executing any command they wish on the infected device; this option provides them with the chance to steal any files they wish. The capabilities of Hide ‘N Seek are clearly advanced and innovative, but what’s even cleverer is that it appears to be constantly redesigning itself to minimize detection.

Communication between the infected devices is made possible by the peer-to-peer network at the heart of Hide ‘N Seek. Using peer-to-peer software for hacking is nothing new, but previous methods have always involved modifying existing torrent software. Hide ‘N Seek is taking hacking to a new level by using completely custom built peer-to-peer software which has no central command unit; therefore, closing this network down is virtually impossible.

Combating Hide ‘N Seek

The advanced design of Hide ‘N Seek is proof that it’s the work of highly skilled hackers, but, once again, the vulnerability being exploited is the use of default passwords. Let’s face it, giving a hacker a key to a locked door is the worst form of security you can imagine, but this is exactly what default passwords are. And this is why password security remains the number one priority for any devices within your network, whether they’re connected to the IoT or otherwise.

By changing these default passwords while devices are on isolated networks, your organization can seriously increase the strength of their defenses. Otherwise, you’re leaving your networks at the mercy of malicious botnets such as Hide ‘N Seek. And, believe me, just as Reaper wasn’t the last IoT botnet, neither will Hide ‘N Seek be the final word in hacking in this new IoT landscape.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 5 6 7 8 9