How Did the DNC Get Hacked by Phishing Emails in 2016?

Cyber Attack, email links, Hacking, malware, Password Security, Phishing, Phishing Email, Security, , ,
18
Sep 2018

You may think that political parties understand the need for good security, but back in 2016 the DNC suffered a major hack due to phishing emails.

Thanks to a sustained attack, Russian hackers were able to infiltrate email accounts of those involved within Hilary Clinton’s campaign to become president of the United States. And, as you know, the rest is history. However, not many people are aware of exactly how the DNC got hacked so extensively that highly sensitive information was obtained and then leaked to the public.

Although not every single detail has been revealed, we know enough that the hack was, in relative terms, a fairly simple execution. Naturally, you’re unlikely to be targeted by the same people who are involved in political attacks, but their methods are likely to be similar. Therefore, we’re going to take a look at how the DNC was hacked by phishing emails, so you can understand how to avoid it.

Phishing for DNC Secrets

The hack began on March 10th, 2016 and involved a batch of heavily disguised emails, which appeared to be sent by Google, being sent to key members of Hilary Clinton’s campaign team. These emails purported to be advising the recipients that their passwords needed changing in order to strengthen their security. However, the links contained within these emails sent users to a malicious website where strengthening security was the last thing on their mind. With these email accounts compromised, the hackers were then able to access private contact lists held within them.

Within a day, the hackers had access to confidential email addresses for key targets within the DNC campaign. And, almost immediately, the hackers began to send phishing emails to these email addresses in order to work their way higher up the chain of command. Despite the presence of two-factor authentication, the hackers’ persistence paid off as they eventually managed to breach the defenses of John Podesta, chairman of the DNC’s campaign. This email account, alone, provided access to 50,000 confidential emails.

This assault is believed to have been organized and orchestrated by the Russian cyber-espionage organization known as Fancy Bear. Despite accessing such a huge amount of emails from Podestra, Fancy Bear intensified their hacking campaign and this led to security experts becoming suspicious of methods being employed to dupe Google’s spam filter into accepting malicious emails into the inboxes of DNC targets. The clean-up operation, however, was too late and Podestra’s breached emails were soon published on Wikileaks.

Be Clever, Don’t Get Phished

The 2016 attack on the DNC is probably the most famous, and damaging, phishing attack in cyber-history. Simply due to a few members of staff clicking malicious links, an entire election campaign was brought to its knees. Reinforcing good email security, therefore, remains a crucial practice for any organization in modern business. Even with millions of dollars of security in place, the DNC fell victim to a simple phishing scam and, next time, it could easily be your organization.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

What Should You Do When You Receive a Phishing Email?

Hacking, malware, Phishing, Phishing Email, Security, Security Threats, , , ,
11
Sep 2018

Phishing emails are the scourge of our inboxes and there seem to be more and more each week, so what should you do when you receive a phishing email?

The aim of phishing emails is for the sender of said emails to obtain sensitive information from the recipient. This goal is realized by cleverly disguising the email to make it look as genuine as possible and, therefore, gain the recipient’s trust. Data targeted by phishing emails usually relates to sensitive details including login details and passwords. And this data leakage can cause serious harm to businesses with the average cost of a phishing attack on a medium sized business costing around $1.6 million.

No organization that wants to remain productive and competitive wants to deal with the chaos of a phishing attack, so we’re going to take a look at what you should do when you receive a phishing email.

Do Not Open Phishing Emails

The best way to avoid the dangers of phishing emails is very simple: Don’t open them! This, of course, is easier said than done as phishing emails have become incredibly sophisticated over the years e.g. spoofing email addresses. However, if for any reason whatsoever you do not recognize an email address or there’s something unusual about the email subject then it’s always best to err on the side of the caution. Instead, move the cursor away and get your IT team to investigate it before going any further.

Leave Links Well Alone

Opening a phishing email isn’t enough, on its own, to activate the malicious payload, but it’s very simple to do so. Phishing emails often contain links which, once clicked, send the user to malicious websites where malware is automatically downloaded to the user’s PC. This malware is usually very discreet and is able to run silently in the background where it is able to log keystrokes or even take control of the user’s PC. So, remember: if you don’t recognize the sender of an email, it’s crucial that you never click their links.

Don’t Respond

Phishing emails will often try to gain your trust by establishing a connection, so you need to be mindful of these deceptive tactics. By hitting the reply button, for example, you’re demonstrating to the hacker that not only is your email account active, but that you’re willing to engage. And, if a phone number is provided, never ever ring it as it will involve further social engineering and potentially a very high phone charge to a premium member. It may be tempting to respond, but always say no and move away from engaging.

Report the Email

Any form of hacking represents a serious threat to the security of your organization, so it should be every employee’s duty to report a phishing email as soon as possible. This allows your IT team to analyze the email and its contents before taking action. This could be as simple as deleting it securely or telling you that, actually, it’s safe to open. Ultimately, shared knowledge allows your entire organization to stay on top of phishing emails, so, even if you’ve clicked something you shouldn’t have, report it immediately.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

The 5 Most Important IoT Security Concerns Coming in 2018

Cyber Attack, Hacking, Internet of things, IOT, IoT Attacks, malware, Phishing, Ransomware, Security, Security Threats, , , ,
20
Feb 2018

If you want to keep the IoT (Internet of Things) secure in 2018 then you’re going to have your work cut out due to the number of threats on the horizon.

Significant progress has been made in the last couple of years when it comes to understanding the security concerns presented by IoT devices, but this is only encouraging hackers to become more innovative. And 2018 is going to deliver more IoT security threats than ever before, so you’re going to need to be ready for this surge in activity and the new hacking methods employed.

Let’s take a look at the most pressing IoT security concerns coming in 2018.

  1. IoT Attacks Being Undetectable

Many IoT attacks take place on a micro scale compared to large scale attacks such as Distributed Denial of Service Attacks. The problem with micro attacks is that conventional security systems are unlikely to recognize them as a threat, whereas major attacks are likely to ring alarm bells very quickly. Therefore, investing in highly sensitive security systems and manual monitoring may become vital to any organization using IoT devices.

  1. Automation Will Become More Important

Some organizations can have thousands of IoT devices operating on their network at any one time, so manually monitoring this activity is virtually impossible. And that’s why automation and artificial intelligence could prove highly popular in 2018 when it comes to providing a front line defence against IoT attacks e.g. installing crucial firmware upgrades immediately.

  1. The Irresistible Allure of Cryptocurrency

You only have to take a quick look at the financial headlines to understand just how valuable cryptocurrencies are at the moment. And, to a hacker, the financial rewards on offer are hard to resist. The Satori botnet, for example, takes control of IoT devices and also allows the hackers to exploit Bitcoin mining software. So, if your organization is involved with cryptocurrencies in any capacity, it’s going to pay to monitor your activity very closely.

  1. More and More Devices Will Be Targeted

Automobiles, security cameras and baby monitors are just a small selection of the IoT devices which have been hacked in the last couple of years, but this is set to increase further in 2018. In particular, devices which come with weak passwords (or even no password) are constantly being scouted by hackers. And, when they discover one, this can easily be leaked online, so the need to enforce a strong password culture remains essential.

  1. Privacy Concerns

Trusting IoT devices to transmit and receive personal and sensitive data is going to come under serious scrutiny in 2018. Due to the recent IoT attacks which have exploited weak passwords and poor security protocols in IoT devices, the public concern is growing over how their data is handled. Naturally, hackers are excited by the prospect of being given a free run at such a huge number of vulnerable devices without adequate security frameworks in place. 2018, therefore, is going to find organizations having to soothe customer concerns by only working with secure hardware and software.

For more ways to secure and optimize your business technology, contact your local IT professionals.

 

Read More

Creating a Culture of Security in the Internet of Things

Cyber Attack, Hacking, Internet of things, IOT, malware, Password Security, Security, Security Threats, , , , , ,
30
Jan 2018

Hackers aren’t the only threat to the security of your organization’s Internet of Things (IoT), your employees can be just as culpable for security risks.

Let’s face it, the IoT is a relatively new phenomenon and, even though most of your employees will have smart devices at home, the majority of your workforce won’t be aware of the many security dangers. It’s this lack of knowledge which can lead to major security flaws which leave your network open to hackers and their accompanying chaos.

However, humans have a huge capacity for learning and if you can ingrain the basics of IoT security in the business culture, you’ll find that your employees are soon on top of things. And this knowledge can provide an extra layer of defense, so let’s take a look at how you can provide this.

Ban All Guest Access

Many organizations provide guest access to, at the very least, their Wi-Fi network so that visitors can check emails, liaise with their own staff and, more likely, check Facebook! However, whilst this is a generous gesture, it opens your network up to a whole host of security risks. If there’s a freely available guest network then it’s likely that everyone in your organization will know the password and it can be passed on to any visitors.

Now, you’re never going to know every single visitor to your company and, crucially, you’re never going to know how secure these visitors’ devices are. Therefore, it’s a highly dangerous move to allow your employees to grant free access to any section of your network. The simplest way to combat this and prevent bad security practices is to ban all guest access to your organization’s Wi-Fi. It may seem drastic, but it will really hammer home the security risk to your employees.

Improve the Password Culture

Passwords are one of the oldest forms of computer security, but they’re also one of the most effective. IoT devices, though, have a reputation for coming pre-loaded with highly weak default passwords, so the effort required to hack them is relatively low. Changing not only default passwords, but also regularly changing existing passwords remains a highly important task to secure your smart devices.

Your employees are likely to be highly busy, though, so changing their password will tend to fall down their list of things to do. This is where you, as an employer, need to ensure that regular reminders are sent out to your employees to indicate when passwords require changing. Ideally this should be between 6 – 12 weeks of the last password change and the best way to enforce this is by restricting access to applications if the password is not changed.

Whilst employees will initially grumble about having to change their password and remember a new one, these complaints will soon subside and employees will become compliant with the process.

Regular Training

As mentioned in my opening, the IoT is a new phenomenon and the collective knowledge of your employees will be limited. And that’s why you need to make sure that your staff are given regular training sessions on the importance of IoT security.

Ideally, the IT induction that all new starters take should include a section on IoT security; after all, almost of all your employees will bring a personal smartphone into work and, of course, certain employees will be issued with company laptops and smartphones, so the need for good security practices from the off are vital.

It may seem time consuming to complete inductions and regular refreshing training, but the enhanced knowledge among your workforce will ensure that your networks remain safe from the most simple (yet damaging) IoT security mistakes.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More

Mamba Highlights a Change in Ransomware

Mamba, Ransomware, Security, ,
12
Sep 2017

MAMBA-RANSOMWARE

We’re all aware that ransomware can hit you financially, but ransomware is now changing its modus operandi for causing chaos and becoming more dangerous.

The Mamba ransomware first appeared in September 2016 and, rather than just scrambling certain file extensions, it scrambles every single disk sector on your hard drive. And in layman’s terms this means that your whole PC will be next to useless. However, whilst ransomware usually offers you a way out of this mess through a ransom payment, this is where Mamba differs.

In recent attacks on organizations in Brazil and Saudi Arabia, the Mamba ransomware doesn’t specifically demand a ransom. Instead, it merely provides two email addresses and an ID number for you to use in correspondence. The ransom note also asks those infected to enter a key which, we can only assume, could be provided once contact has been made with the aforementioned email addresses.

Of course, much like the NotPetya attack, this could be a form of ransomware which simply sabotages a hard drive by making all its data inaccessible. Regardless of this, it’s not a situation that you want to find yourself in, so let’s take a look at what Mamba consists of. 

The Mamba Attack

There’s a lot of concern that Mamba may be another piece of ‘wiper’ malware which simply dumps data once encrypting it rather than offering a decryption service. It’s also difficult to determine who has been authoring this new Mamba variant – sure, a Russian email address is used, but it would be foolhardy to assume that the attack comes from Russia simply because of an email address.

The attack itself seems to execute the Mamba ransomware by exploiting the PSEXEC application – a piece of software which allows communication between remote systems and crucial for organizations networks to operate effectively. The malware works in two stages with the first line of attack seeing DiskCryptor – a free encryptor – installed on the infected system before rebooting the system. Upon bootup, DiskCryptor begins encrypting disk partitions and, once the hard drive is fully encrypted, the system is rebooted once more.

It’s at this point that the ‘ransom’ note is delivered to the user. It’s too early to say exactly what correspondence with the emails provided will result in, but it’s fair to assume that the hackers aren’t just going to hand over the key. Now, each infected computer has a specific password generated for it, so this hints that, perhaps Mamba isn’t a piece of wiper malware and that payment will result in your hard drive being decrypted. However, it could also just be a diversionary tactic and your files could be lost forever. 

internet-1593448_960_720

Combatting Mamba

The level of encryption carried out by Mamba through DiskCryptor is exceptionally strong, so there’s currently no way of retrieving your files without somehow receiving help from the hackers. Whether this help will be forthcoming is debatable, so it in no way represents a way out from this particularly difficult hack.

Good security practices, as ever, are essential to prevent your organization falling foul of ransomware, particularly when it’s one which appears to be very enigmatic and provides little light at the end of the tunnel. Such attacks are likely to increase, so make sure you practice the following:

  • Always backup your files and data to ensure they’re not compromised on an infected system. It’s also recommended that these are backed up to a system not connected to your network to prevent falling foul of malware which can spread throughout a network.
  • Use multi-layered security in the form of firewalls, web filtering and antivirus software in order to stop malware from either activating or even reaching your network.
  • Restrict user privileges and access on your network as, again, this can stop ransomware spreading through your network once it has started to gain a foothold in your network.

For more ways to secure and optimize your business technology, contact your local IT professionals.

Read More
1 … 5 6 7 8 9