FreshRSS

🔒
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Europol announces “targeting” of 12 suspects in ransomware attacks

By Naked Security writer
More anti-ransomware activity by law enforcement, this time in Switzerland and Ukraine.

Kaseya ransomware suspect nabbed in Poland, $6m seized from absent colleague

By Naked Security writer
Suspects nabbed, millions seized, in ransomware busts across the globe.

Sophos 2022 Threat Report: Malware, Mobile, Machine learning and more!

By Paul Ducklin
The crooks have shown that they're willing to learn and adapt their attacks, so we need to make sure we learn and adapt, too.

How to Live a Digital Life Free of Spyware

By McAfee

Spyware is tricky. Some types notify users that they’re monitoring activity. Others function in stealth mode and use the information they collect for nefarious purposes. Spyware is a type of software that collects data about online users and reports it to a company or an individual. What just about everyone can agree on is that anonymous browsing is looking more and more appealing and is likely the way of the future.  

Here’s more about the types of spyware, which types are legal, and how you can scrub your device and live more confidently online. 

Types of Spyware 

Here are a few types of spyware and facts about each: 

 Keyloggers 

Is it legal? Definitely not! 

What is its purpose? Criminal 

Keyloggers are the most intrusive of the spyware variations. It does exactly as its name suggests: It takes note of keyboard strokes, logs them, and reports to the owner of the nefarious software. Once the cybercriminal has digitally looked over your shoulder at your online activity, they make note of your passwords, walk into your online accounts, and pilfer your private personal information. They could use this information to gain entry to your online bank accounts or steal your identity. 

Keyloggers are downloaded onto devices (cellphones, tablets, laptops, or desktop computers) without the user’s knowledge. Cybercriminals can hide them within email attachments or in malicious web pages. So, the best way to steer clear of keyloggers is to never download attachments you’re unsure about and don’t visit sites that seem unprofessional. One rule of thumb is to mostly stick to URLs that begin with https and include a lock icon. These sites are almost always secure. 

To determine if your device is infected with a keylogger, check your system’s performance. Is your device running slowly? See if there are any spikes in activity or unknown programs running in the background. This could indicate that your device is hosting a malicious program. 

Adware 

Is it legal? Sometimes 

What is its purpose? Advertising and criminal 

Adware is categorized as a type of spyware. It tracks users’ online activity and spits out targeted pop-up advertisements. If you have the pop-up blocker enabled on your browser, you’ll likely be spared from the annoyance. Additionally, pop-ups can slow your device, so that’s another reason to turn on the pop-up blocking feature. Legitimate adware often asks users to opt into targeted ads. 

Adware turns malicious (and illegal) when it contains malware. Sometimes cyber criminals hide malware within pop-ups. It’s easy to accidentally hit a link within a pop-up when you’re aiming quickly for the X to close it. 

It’s easy to spot a device with an adware infestation. First, the number of pop-ups will be out of control. Also, the device will crash often, run very slowly, and have a short battery life. An antivirus program will likely be able to identify and remove the culprit. You can also check out your system monitor and end tasks that are draining your device’s power. 

Cookies 

Is it legal? Yes 

What is its purpose? Advertising 

Cookies are delicious, especially to advertisers who use them to better target ads and make profits selling collected user data to third-party companies. Cookies are sometimes categorized as spyware, because they log the websites you visit and report them. You may notice the banners on websites that ask you to accept cookies. 

Many users today are uneasy with sharing their online activity with strangers and advertisers. Sometimes the ads that pop up on your social media feed or in sidebars seem a little too targeted and it feels like someone is listening in to your conversations and attempting to make a profit from them. 

How to Browse Free of Spyware 

To scrub cybercriminals from your devices and confuse advertisers, consider the following steps you can easily add to your daily routine: 

  1. Clear your cache periodically. This is a quick way to delete all the cookies from your device. It also helps if your device is running slowly. Clearing your cache deletes your browsing history, meaning that you won’t be able to type in your usual shortcuts to your most-visited sites and the browser won’t automatically auto-fill the rest of the URL or remember your passwords. Consider making bookmarks of your favorite sites for quick access and entrust your passwords to a password manager that will remember them for you. 
  2. Know how to spot phishing attempts. Cybercriminals often hide their spyware within phishing texts and emails, so it’s key to know how to spot them. Phishers trick users into acting quickly, either through scare tactics or fake exciting news, to download attachments or give up personal information. Luckily, phishing attempts usually aren’t too difficult to identify and delete immediately. Did you enter a contest lately? No? Then why would someone get in touch saying you’re a winner? Also, phishing messages are often full of typos and poor grammar. Before you click any links in an email, hover your cursor over it to see where the URL will take you. If it has typos, is filled with a long string of letters or numbers, or doesn’t match the site the message says it’ll redirect you to, delete it. 
  3. Browse in incognito mode. Browser sallow users to toggle incognito mode to use the internet anonymously. Once users exit incognito mode, all of their browsing history and the cookies collected during the session are deleted. Incognito mode, though effective against cookies, does not combat keyloggers or aggressive adware.  
  4. Use a VPN. A virtual private network (VPN) is even more secure than incognito mode. It completely scrambles your online data, making it impossible for a spy to hack into your device if you’re connected to a public wi-fi network. A VPN doesn’t stop cookies, but the geographic information they report may be incorrect. 
  5. Sign up for antivirus software. A comprehensive online protection software suite that includes antivirus software, such as McAfee Total Protection, can boost your confidence in your online safety. It can scan your phone, tablet, or computer for viruses or malware and automatically logs you into a VPN for secure browsing. 

The post How to Live a Digital Life Free of Spyware appeared first on McAfee Blog.

Emotet malware: “The report of my death was an exaggeration”

By Paul Ducklin
"Old malware rarely dies." The best way to predict the future is to look at the past... if it worked before, it will probably work again.

5 Signs Your Device May be Infected with Malware or a Virus

By Toni Birdsong

The malware landscape is growing more complex by the minute, which means that no device under your family’s roof—be it Android, iPhone, PC, or Mac—is immune to an outside attack. This reality makes it possible that one or more of your devices may have already been infected. But would you know it? 

Ho Ho Ho, Merry Hackmas 

According to 2021 statistics from the Identity Theft Resource Center (ITRC), the number of data breaches reported has soared by 17 percent over last year. In addition, as reported by McAfee, cybercriminals have been quick to take advantage of the increase in pandemic connectivity throughout 2020. McAfee Labs saw an average of 375 new threats per minute and a surge of hackers exploiting the pandemic through COVID-19 themed phishing campaigns, malicious apps, malware, and more. With Black Friday and Cyber Monday now at hand, we can count on even more new threats.  

Have you been hacked? 

Often, if your device has been compromised, you know it. Things get wonky. However, with the types of malware and viruses now circulating, there’s a chance you may not even realize it. The malware or virus may be working in the background sending usage details or sensitive information to a third party without disrupting other functions. So, be on the lookout for these tell-tale signs.  

5 signs of malware or a virus 

  1. Your device is hot to the touch. When you accidentally download malware, your device’s internal components immediately begin working harder to support the malware or virus that’s been embedded. This may cause your device to be hot to the touch or even overheat.  
  2. Everything ‘feels off.’ Much like a human virus can impact our whole body, a digital virus can impact every area of a device’s performance. For instance, it may cause websites to load slower, it may cause apps to crash, or your battery may not hold a charge. Overall performance remains sluggish no matter how many times you reboot or how many large files you delete.  
  3. An increase in random pop-ups and new apps. If your device is housing a malicious app or a virus, you may notice an increase in random pop-ups (more than usual). And, if you take a closer look at your app library, you may even see app icons from apps you never downloaded.   
  4. Fraudulent links from your accounts. It’s common for malware to gain access to your contacts list and then use your phone to send out messages to your friends—a powerful tactic designed to spread the malware to your contacts and their contacts and so on. This can happen via email, and more commonly, via your social media accounts. If you notice this cycle, change your passwords immediately and scan your devices for malware that may be working in the background on all devices.  
  5. You have unauthorized charges. If you notice unauthorized charges on your credit card or banking statements, dig deeper. It may be a malicious app making purchases on your behalf or malware that’s grabbed your personal information to make fraudulent purchases.  

Ways to safeguard family devices

  • Stay on top of updates. In addition to installing comprehensive security software to block malware and viruses, be sure to update your device’s security features. Regular updates give you the latest security features, some of which have been developed to thwart specific attacks. 
  • Use strong, unique passwords. Every family device should have a strong password along with a unique username. This means changing your factory settings immediately and getting your family on a schedule to change passwords.  
  • Know your apps. Only download apps from trusted sources. Avoid third-party apps. Also, consider researching the app safeguards and reading reviews before installing. A best practice is to stick to apps from the app store or verified associated app stores. 
  • Don’t click that link. Slow down and notice your digital surroundings. Does that link look suspicious? Phishing scams that load malware and viruses onto your devices often come in emails, text messages, or via your trusted social media circles.  
  • Lockdown settings and limit app permissions. A great way to block malware is to make all accounts as private as possible and limit app permissions. Instead of opting for “always-on” in an app’s permissions, change the setting, so it requires you to give the app permission every time. In addition, if an app requests access to your contacts or connect to other apps in your digital ecosystem, decline. Each time you allow an app to connect to different branches of your digital footprint, you hand over personal data and open yourself up to various new risks.  
  • Clear browsing history. Take the time to go through your history and data. If you notice a suspicious link, delete it. Clear your browsing history by choosing your browser and clicking “clear history and website data.” 

Next steps 

If you discover a family device has been compromised, there are several things you can do. 1) Install security software that will help you identify the malware so you can clean your device and protect yourself in the future. 2) Delete any apps you didn’t download, delete risky texts, delete browsing history and empty your cache. 3) In some situations, malware warrants that you wipe and restore your device (Apple or Android) to its original settings. Before doing so, however, do your research and be sure you’ve backed up any photos and critical documents to the cloud. 4) Once you’ve cleaned up your devices, be sure to change your passwords.  

The surge in malware attacks brings with it a clear family mandate that if we want to continue to live and enjoy the fantastic benefits of a connected life, we must also work together at home to make online safety and privacy a daily priority.  

The post 5 Signs Your Device May be Infected with Malware or a Virus appeared first on McAfee Blog.

Black Friday and Cyber Monday – here’s what you REALLY need to do!

By Paul Ducklin
The world fills up with cybersecurity tips every year when Black Friday comes round. But what about the rest of the year?

Firefox update brings a whole new sort of security sandbox

By Paul Ducklin
Firefox 95.0 is out, with the usual security fixes... plus some funky new ones.

So, Your Kids Have Left School. Do You Still Need To Worry About Their Online Safety?

By Alex Merton-McCann

Last week, I waved my 18-year-old off as he embarked on the Aussie school leaver’s rite of passage – Schoolies!! A week spent kicking up your heels and living life to the max without any parental supervision at all! Oh, the sleepless nights many of us parents have had! And once Christmas and New Year celebrations are done, he’ll be heading away to University to ‘live his best life’ away from his dedicated cyber mother! 

And of course, I’m delighted for him, although secretly devastated to be losing my baby boy. But it does prompt the question, am I now done with cyber parenting? Is my work here officially done? 

Do You Ever Stop Being a Parent? 

I remember when my kids were little, my mother shared some words of wisdom with me: ‘Alex, you never stop being a parent. The kids are the same, it’s just the issues that change.’ And she was so right. As our boys have grown up, we’ve been less involved in their day-to-day needs but still very much needed. Whether it’s to help review a work contract, provide advice on an issue with a flatmate or help pick out a suit, the parenting hasn’t stopped instead entered a new chapter. And of course, there’s no doubt that having interested, devoted parents at the end of the telephone – day or night – makes navigating life so much easier! 

And when it comes to their digital lives, it’s the same story. While we have no reason to be involved in their day-to-day online lives, we have definitely been called upon to help them troubleshoot situations from receiving inappropriate messages, identifying potential scams or managing terse exchanges.  And, might I add, I have also proactively offered my advice on the appropriateness of pictures they have shared online – many times!! 

How To Help Your Young Adult Kids Manage Their Cyber Safety? 

So, after having managed 3 kids through this transition to early adulthood with another one currently underway, I thought I’d share with you some of my best strategies for ensuring their digital life is in good shape without micro-managing them! 

1. Stay Friends with Them Online But Don’t Embarrass Them Ever 

Every few days, I’ll check out my boys’ socials. Not only does it give me a ‘feel’ for what’s happening in their lives – where they’ve been and who with – it also allows me to check they are making good decisions about what they share. There have been multiple times during this period where I have sent off a quick text suggesting they remove a photo or perhaps rephrase a comment! And while I know these texts aren’t always warmly received, in nearly all cases, they take my advice! 

And it goes without saying that your ability to provide input to their digital lives will only happen if you don’t cross boundaries! So, never embarrass them. If you see something you don’t like, message them privately – do not workshop it on their Facebook page! And if you want to post a pic or video of them, always get their ‘ok’ first.  

2. Buy Them Security Software for Christmas! 

OK, security software probably won’t be top of their Christmas list, but knowing that they have comprehensive security software like McAfee’s Total Protection on their devices which works hard in the background to minimize threats and issues will give you real peace of mind. This year, I’m buying my older boys an air-fryer and frypans for Christmas. Why not continue the pragmatic theme and invest in some software for them too? 

3. Set Up A Family Messaging Group 

About 4 years ago, I set up a family Messenger Group and it’s now something I absolutely treasure. We share pics of our cats and dog, potential family holiday dates, funny photos, and videos, and relevant news stories – particularly during COVID. But the other thing I like to share is reminders about important ‘tech stuff’, like changing passwords, when to update their Apple software or details about scams that are doing the rounds. Whether it’s Whats AppTelegram, or my personal favorite, Messenger, I strongly recommend establishing a family group chat as an effective way of covering off key issues with your young adult kids. 

4. Don’t Stop Walking About Digital Reputation  

With potential employers, partners, and even friends using Google to conduct their due diligence on you, digital reputation is everything. So, weaving constant reminders into conversations with your adult kids should still be a priority. Now, of course, some kids will instinctively ‘get this’ but others will need a few pointers. According to a  70% of employers use social media to screen candidates during the hiring process, and about 43% of employers use social media to check on current employees. So, why not encourage them to ‘Google’ themselves – and why not do yourself also? How you present online could mean the difference between being employed or unemployed!  

So, if you have a school leaver in your family and you’re not sure whether your job is done, I’m here to confirm that you’ll still be required for a very long time! Whether they know it or not, our big kids will still continue to need a sprinkling of our wisdom and experience for years to come. And even though they may have fled the nest, remember you will always be one of their most influential role models. So, make sure your digital life is in good shape too because as American novelist James Baldwin shares: ‘Children have never been very good at listening to their elders, but they have never failed to imitate them.’ 

Till next time 

Take care 

The post So, Your Kids Have Left School. Do You Still Need To Worry About Their Online Safety? appeared first on McAfee Blog.

REvil ransomware crew allegedly busted in Russia, says FSB

By Naked Security writer
The Russian Federal Security Bureau has just published a report about the investigation and arrest of the infamous "REvil" ransomware crew.

How iOS Malware May Snoop on Our Devices

By Vishnu Varadaraj

Smartphones have become such an integral part of our lives that it’s hard to imagine a time when we didn’t have them. We carry so much of our lives on our devices, from our social media accounts and photos of our pets to our banking information and home addresses. Whether it be just for fun or for occupational purposes, so much of our time and attention is spent on our smartphones. 

Because our mobile devices carry so much valuable information, it’s important that we stay educated on the latest cyber schemes so we can be prepared to combat them and keep our data safe.  According to Bleeping Computer, researchers have developed a trojan proof of concept tool that fakes a shutdown or reboot of iPhones, preventing malware from being removed and allowing hackers to secretly snoop on microphones and cameras.  

Let’s dive into the details of this technique.  

How “NoReboot” allows hackers to spy on a device 

Typically, when an iOS device is infected with malware, the solution is as simple as just restarting the device. However, with this new technique researchers are calling “NoReboot,” ridding a device of malware is not quite as simple. 

“NoReboot” blocks the shutdown and reboot process from being carried out, preventing the device from actually restarting. Without a proper shutdown and reboot, a malware infection on an iOS device can continue to exist. Because the device appears to be shut off with a dark screen, muted notifications, and a lack of response, it is easy to assume that the device has shut down properly and the problem has been solved. However, the “NoReboot” technique has only simulated a reboot, allowing a hacker to access the device and its functions, such as its camera and microphone. If a hacker has access to these functions, they could record the user without their knowledge and potentially capture private information.  

This attack is not one that Apple can fix, as it relies on human-level deception rather than exploiting flaws found on iOS. That’s why it’s important that we know how to use our devices safely and stay protected. 

How to know if your smartphone has been hacked 

As previously mentioned, smartphone usage takes up a big chunk of our time and attention. Since we are so often on these devices, it is usually fairly easy to tell when something isn’t working quite like it is supposed to. While these things could very well just be technical issues, sometimes they are much more than that, such as malware being downloaded onto your smartphone. 

Malware can eat up the system resources or conflict with other apps on your device, causing it to act oddly. 

Some possible signs that your device has been hacked include: 

Performance issues 

A slower device, webpages taking way too long to load, or a battery that never keeps a charge are all things that can be attributed to a device reaching its retirement. However, these things may also be signs that malware has compromised your phone. 

Your phone feels like it’s running hot 

Malware running in the background of a device may burn extra computing power, causing your phone to feel hot and overheated. If your device is quick to heat up, it may be due to malicious activity. 

Mysterious calls, texts, or apps appear 

If apps you haven’t downloaded suddenly appear on your screen, or if outgoing calls you don’t remember making pop up on your phone bill, that is a definite red flag and a potential sign that your device has been hacked. 

Pop-ups or changes to your screen 

Malware may also be the cause of odd or frequent pop-ups, as well as changes made to your home screen. If you are getting an influx of spammy ads or your app organization is suddenly out of order, there is a big possibility that your device has been hacked. 

Six tips to prevent your phone from being hacked 

To avoid the hassle of having a hacked phone in the first place, here are some tips that may help. 

1. Update your phone and its apps

Promptly updating your phone and apps is a primary way to keep your device safe. Updates often fix bugs and vulnerabilities that hackers rely on to download malware for their attacks. 

2. Avoid downloading from third-party app stores

Apple’s App Store and Google Play have protections in place to help ensure that apps being downloaded are safe. Third-party sites may not have those same protections or may even be purposely hosting malicious apps to scam users. Avoiding these sites altogether can prevent these apps from allowing hackers into your device. 

3. Stay safer on the go with a VPN

Hackers may use public Wi-Fi to gain access to your device and the information you have inside of it. Using a VPN to ensure that your network is private and only you can access it is a great way to stay protected on the go. 

4. Turn off your Wi-Fi and Bluetooth when not in use

Turning off your Wi-Fi and Bluetooth when you are not actively using them is a simple way to prevent skilled hackers from working their way into your devices. 

5. Avoid public charging stations

Some hackers have been known to install malware into public charging stations and hack into devices while they are being charged. Investing in your own personal portable charging packs is an easy way to avoid this type of hack.  

6. Encrypt your phone

Encrypting your phone can protect your calls, messages, and information, while also protecting you from being hacked. iPhone users can check their encryption status by going into Touch ID & Passcode, scrolling to the bottom, and seeing if data protection is enabled.  

7. Determine whether your device rebooted properly

Although researchers agree that you can never trust a device to be fully off, there are some techniques that can help you determine whether your device was rebooted correctly.2 If you do suspect that your phone was hacked or notice some suspicious activity, restart your device. To do this, press and hold the power button and either volume button until you are prompted to slide the button on the screen to power off. After the device shuts down and restarts, notice if you are prompted to enter your passcode to unlock the device. If not, this is an indicator that a fake reboot just occurred. If this happens, you can wait for the device to run out of battery, although researchers have not verified that this will completely remove the threat.  

Stay protected 

If you are worried that your device has been hacked, follow these steps: 

  • Install and run security software on your smartphone if you haven’t already. From there, delete any apps you didn’t download, delete risky texts, and then run your mobile security software again. 
  • If you still have issues, wiping and restoring your phone is an option. Provided you have your photos, contacts, and other vital info backed up in the cloud, it’s a relatively straightforward process. A quick search online can show how to wipe and restore your model of phone. 
  • Lastly, check your accounts and your credit to see if any unauthorized purchases have been made. If so, you can go through the process of freezing those accounts, getting new cards, and credentials issued with the help of McAfee Identity Protection Service. Further, update your passwords for your accounts with a password that is strong and unique

The post How iOS Malware May Snoop on Our Devices appeared first on McAfee Blog.

Microsoft blocks web installation of its own App Installer files

By Paul Ducklin
It's a big deal when a vendor decides to block one of its own "features" for security reasons. Here's why we think it's a good idea.

At last! Office macros from the internet to be blocked by default

By Paul Ducklin
It's been a long time coming, and we're not there yet, but at least Microsoft Office will be a bit safer against macro malware...

VMware fixes holes that could allow virtual machine escapes

By Paul Ducklin
Hats off to VMware for not using weasel words: "When should you act?" Immediately...

Social Media: How to Steer Your Family Clear of Cryptomining Malware

By Toni Birdsong

It’s fun to jump on our favorite social media sites such as Facebook, Instagram, or LinkedIn and know we can quickly check in with friends and family, discover interesting content, and instantly connect with colleagues worldwide. The last thing on most of our minds when tapping our way into these familiar online communities is being the target of cybercrime. 

But it’s happening more and more.  

Last month, The Federal Trade Commission (FTC) described popular social media sites as “goldmines” for malicious attacks. The FTC revealed that more than one in four people who reported losing money to fraud in 2021 said it started on social media with an ad, a post, or a message. More than 95,000 people reported about $770 million in losses to fraud initiated on social media platforms in 2021. According to the FTC, those losses account for about 25 percent of all reported losses to fraud in 2021 and represent a stunning eighteenfold increase over 2017 reported losses. 

Dark Web Goes Mainstream

The social environment is a magnet for bad actors because people of every age and country flock there each day. The constant flow of conversation and content—and more importantly, the climate of trust—makes social networks juicy targets for cybercrime.  

The biggest motivation? The emerging digital security threat of cryptojacking (aka illegal cryptomining). Cryptojacking is illegally accessing another person’s computer power to mine cryptocurrency. Cybercriminals do this by getting a victim to click on a malicious link delivered via direct message, a news story, or an ad. Once clicked, that link loads crypto mining code on the victim’s computer or leads them to an infected website or online ad with JavaScript code that auto-executes once it’s loaded in the victim’s browser. Often the malware goes undetected, and the only way a victim might know their system has been compromised is that it may start performing more slowly.    

The Fallout 

While bad actors use social media platforms to distribute cryptomining malware, they also spread other malware types such as advertisements, faulty plug-ins, and apps that draw users in by offering “too good to be true” deals. Once clicked on, the malware allows cybercriminals to access data, create keyloggers, release ransomware, and monitor social media accounts for future scamming opportunities.  

Protecting Your Family  

Educate your family.

Be sure your kids understand the risks and responsibilities associated with device ownership. Consider putting time aside each week to discuss crucial digital literacy topics and ongoing threats such as cryptomining malware. Consider a “device check-in” that requires each person in your family to “check off” the following security guidelines.  

Use comprehensive security software.

To help protect your family devices from viruses, malware, spyware, and other digital threats entering social media sites, consider adding extra security to your family devices with McAfee Total Protection. 

Avoid sharing personal information online.

Avoid posting home addresses, full birth dates, employer information, school information, as well as exact location details of where you are.  

Keep software and operating systems up to date.

Install software updates so that attackers cannot take advantage of the latest security loopholes.  

Use strong passwords.

Select passwords that will be difficult for bad actors to guess and use different passwords for different programs and devices.  

Pay attention to device performance.

For a virus to solve cryptographic calculations required to mine cryptocurrency requires an enormous amount of computer processing power (CPUs). Cryptojacking secretly consumes a victim’s processing power, battery life, and computer or device memory. Look out for a decline in device processing speed. 

Avoid connecting with people you don’t know.

Be careful when accepting friend requests, direct messages, or clicking on links sent by someone you don’t know personally. This is one of the most popular ways cybercriminals gain access.  

Verify known friend requests and messages.

Be discerning even when a known friend sends you a second friend request claiming they’ve been hacked. Search known names on the platform for multiple accounts. Cybercriminals have been known to gather personal details of individuals, pose as that person, then connect with friend lists using familiar information to build trust with more potential victims.  

Report spam and suspicious accounts.

Be sure to report any fraudulent activity you encounter on social platforms to help stop the threat from spreading to other accounts, including friends and family who may be connected back to you. 

New scams and more sophisticated ways to steal data—and computer processing power for illegal cryptomining—surface daily. Staying in front of those threats and folding them into your family dynamic is one of the most powerful ways to give your kids the skills and security habits they will need to thrive in today’s digital world.   

The post Social Media: How to Steer Your Family Clear of Cryptomining Malware appeared first on McAfee Blog.

Alleged Kaseya ransomware attacker arrives in Texas for trial

By Naked Security writer
The US Independence Day weekend of 2021 wasn't much of a holiday for cybersecurity staff. That was when the Kaseya attack unfolded...

Beware bogus Betas – cryptocoin scammers abuse Apple’s TestFlight system

By Paul Ducklin
"Install this moneymaking app" - this one is so special that it isn't available on Google Play or the App Store!

Serious Security: DEADBOLT – the ransomware that goes straight for your backups

By Paul Ducklin
Some tips on how to keep your network safe - even (or perhaps especially!) if you think you're safe already.

A Parent’s Guide to TikTok

By Alex Merton-McCann

Finding someone who hasn’t heard of TikTok in 2022 would be quite the achievement. As one of the most popular social media platforms of the moment, it is not only being used by our tweens, teens and even grownups to connect but also as a crucial way to tell important stories amidst a backdrop of natural disasters and even war.  

As parents, we know we need to keep up with the latest social media platforms but let’s be real – we don’t always have enough time. So, I’m going to do the hard work for you. Here’s my overview of TikTok – what it is, the risks, and most importantly, how you can help your kids (or yourself) stay safe while using it. You’re welcome!! 

What Actually Is Tik Tok? 

Tik Tok is a social media platform that can be downloaded on any smartphone via an app. Once you’ve signed up to the app and become a user, you can create and then share short videos of 15 seconds in length on any topic. 

The app started life as Musical.ly, a super popular video streaming app that also allowed users to make funny 15-second videos, many of which focussed on lip-syncing. By mid-2017, the app had over 200 million registered users.  In 2018, the app was taken over by Chinese company ByteDance and all of its users (and their content) were moved to TikTok. 

How Popular is Tik Tok? 

According to Hootsuite, TikTok is the 6th most used social media platform in the world. As of late September 2021, TikTok had over a billion monthly users and as of August last year, it overtook Facebook to become the world’s most downloaded app. Facebook does, however, have more monthly users, reporting a massive 2.74 billion users as of August 2021 

Who Is Using It? 

It appears TikTok is used by females (57%) more than males (43%) however its user base is very diverse and cuts across all age categories – yes, even us parents! But brands hoping to reach younger female audiences are without a doubt using TikTok to showcase their wares. What is interesting is that although we all think that TikTok dominates the Gen Z market, research shows that it doesn’t rank as the top choice for younger users – in fact only 4.3% of users name it as their favorite platform. Users between 16 and 24 nominate Instagram as their top choice! 

How Old Do You Need To Be To Use TikTok? 

Unlike other social media platforms, there is no minimum age requirement when using TikTok. The company says that it adjusts a user’s privacy settings based on the birthday entered when setting up the account. If a user is under the age of 13, they will automatically be directed into the TikTok for Younger Users program which has additional privacy and safety protections. Of course, anyone can lie about their age, but TikTok has said publicly that it has moderators trained to predict when a user is suspected of being underage. 

What Are The Risks of Tiktok? 

As you would know, there are risks associated with using all social media platforms and TikTok is no exception. However, in my opinion the majority of these can be managed with a combination of critical thinking, parental controls, and preparation – more about these later.  

But let’s go worst-case scenario for one moment. Here are the potential risks that your child could encounter: 

  • Contact from online predators 
  • Inappropriate content: sexualized, violent, racist  
  • Potentially damaging conversations around mental health 
  • Anxiety from potentially poor reaction to their videos 

How To Manage The Risks On Tiktok? 

Unfortunately, it isn’t possible to keep our tweens and teens in a bubble – I know, so disappointing! So, the best and only option is to prepare them for challenges online and arm them with tools to navigate the tricky stuff. Here’s my advice on how to best help them manage TikTok:  

1. Download The App & Start a Conversation 

Knowledge is power, my friends. So, download the app and have a play so you better understand it. Then, why not ask your experienced in-house ‘TikTokers’ to show you how it works. Use this as an opportunity to ask them what they do when they see something that concerns them, or how they would manage approaches from people they don’t know. Why not weave in reminders about the importance of online privacy and the permanence of their digital footprint? Commit to making these conversations regular.  

2. Foster A Critical Thinking Mindset 

Helping your kids become critical thinkers is, without doubt, one of the best ways of helping them prepare for life’s challenges – both online and offline. Being able to rigorously question ideas and assumptions rather than accepting them at face value is your kids’ golden ticket! So, if they are approached by friendly (but ill-intentioned) strangers online or sent a link to a super compelling offer online, they will have the ‘smarts’ to realise that all is not as it seems and to hit delete! 

3. Use TikTok’s Parental Controls Or Help Them Set Up Privacy & Safety Settings  

If the horse has already bolted and your tween or teen has been using TikTok for a while, then introducing boundaries might be tricky but don’t give up! TikTok has a Family Pairing feature which allows parents to link their TikTok account to their teen’s account so they can control the settings remotely. This might be a good option if your child is younger or just starting out on TikTok. This gives parents the power to turn on Restricted Mode, screen time limits, and also turn off the direct message option.  

Leverage Tiktok’s Privacy Controls 

If your child has been using TikTok for some time and you want to pull things back, then why not work with them to set up their privacy and safety features. I find kids always respond best when you explain why you are doing something so assure them you are just wanting to keep them safe. TikTok has a long list of features you can enable that will make your offspring’s experience that much safer. From turning off downloads, filtering comments to introducing screen time limits, there is a great range of ways of making the TikTok experience much less risky. Check out the full list from TikTok here. 

So, next time you hear your kids reference TikTok, don’t immediately feel a pang of guilt that you don’t really know what they are talking about. You’ve got this! Download the app, take a look around, read this post a few more times, and you’ll be fine! And remember, our kids don’t expect us to be experts straight away, or even at all. They just need to know that we’re interested in all parts of their life and respect just how important their digital life is to them. 

You’ve got this!! 

Take care all 

Alex xx 

The post A Parent’s Guide to TikTok appeared first on McAfee Blog.

World Backup Day: 5 data recovery tips for everyone!

By Paul Ducklin
The only backup you will ever regret is the one you didn't make

LAPSUS$ hacks continue despite two hacker suspects in court

By Paul Ducklin
Do you know where in your company to report security anomalies? If you receive such reports, do you have an efficient way to process them?

Hospital robot system gets five critical security holes patched

By Paul Ducklin
Fortunately, we're not talking about a robot revolution, or about hospital AI run amuck. But these bugs could lead to ransomware, or worse...

What Are Browser Cookies and How Do I Manage Them?

By McAfee

As an avid internet surfer, you’ve most likely heard of cookies. No, we’re not talking about the ones filled with chocolate chips. We’re talking about the ones that allow you to log in to your favorite websites. Cookies may impact your online security, so check out these tips to manage them and keep your online accounts safe.  

What Are Cookies in Browsers?  

Ever wonder how a website saves the items you placed in your shopping cart last week, even though you closed the tab before making the purchase? This is made possible by cookies. According to the Federal Trade Commission, a cookie is information saved by your web browser. When you visit a website, the site may place a cookie on your web browser so it can recognize your device in the future. If you return to that site later, it can read that cookie to remember you from your last visit, keeping track of your activities over time.1  

First-party vs. Third-party Cookies  

Cookies come in either the first-party or third-party variety. There’s no difference between the two in how they function, but rather in where and how you encountered them. First-party cookies belong to sites you visited first-hand in your browser. Third-party cookies, or “tracking cookies,” generally come from third-party advertising websites. 

Magic Cookies vs. HTTP Cookies 

Although cookies generally function the same, there are technically two different types of cookies. Magic cookies refer to packets of information that are sent and received without changes. Historically, this would be used to log in to a computer database system, such as an internal business  network. This concept predates the modern cookie we use today. 

HTTP cookies are a repurposed version of the magic cookie built for internet browsing and managing online experiences. HTTP cookies help web developers give you more personalized, convenient website experiences. They allow sites to remember you, your website logins, and shopping carts so you can pick back up where you left off from your last visit. However, cybercriminals can manipulate HTTP cookies to spy on your online activity and steal your personal information. 

What Is Cookie Hijacking?  

Cookie hijacking (also known as session hijacking) is typically initiated when a cybercriminal sends you a fake login page. If you click the fake link, the thief can steal the cookie and capture anything you type while on the fraudulent website. Like a phishing attack, cookie hijacking allows a cybercriminal to steal personal information like usernames, passwords, and other important data held within the cookie. If you enter your information while on the fake website, the criminal can then put that cookie in their browser and impersonate you online. They may even change your credentials, locking you out of your account.  

Sometimes, criminals initiate cookie hijacking attacks without a fake link. If you’re browsing on an unsecured, public Wi-Fi connection, hackers can easily steal your data that’s traveling through the connection. This can happen even if the site is secure and your username and password are encrypted. 

Can Cookies Compromise Your Browser Security?  

Because the data in cookies doesn’t change, cookies themselves aren’t harmful. They can’t infect computers with viruses or malware. But if your cookies are hijacked as part of a cyberattack, a criminal could gain access to your browsing history and use cookies as the key to enter your locked accounts. For example, a hacker may steal your identity or confidential company information, purchase items in your online shopping carts, or loot your bank account.  

Tips for a More Secure Browsing Experience 

Preventing cookie hijacking attacks can allow you to browse the internet with greater peace of mind. Follow these tips to not only safeguard your personal information but to also enhance your browsing experience:  

Clean out the cookie jar  

Make it a habit to clear your cookie cache regularly to prevent cookie overload, which could slow your search speeds. Also, almost every browser has the option to enable/disable cookies on your computer. So if you don’t want them at all, your browser’s support section can walk you through how to disable them. 

Turn off autofill features 

Although it’s convenient to not have to re-type your credentials into a website you frequently visit, autofill features could make it easier for a criminal to extract your data with cookie hijacking. Plus, autofill is risky if your physical device falls into the wrong hands. To browse more securely without having to constantly reenter your passwords, use a password manager like McAfee True Key. True Key makes it so you only have to remember one master password, and it encrypts the rest in a vault protected by one of the most secure encryption algorithms available. 

Opt into multi-factor authentication 

Strong, unique passwords for each of your accounts, updated regularly, offer ample protection against hackers. Multi-factor authentication (MFA) adds yet another layer of security by double-checking your identity beyond your username and password, usually with a texted or emailed code. When your accounts offer MFA, always opt in. 

Connect to a virtual private network (VPN) 

Criminals can hijack your cookies if you’re browsing on an unsecured, public Wi-Fi connection. To prevent a criminal from swiping your data, use a virtual private network (VPN), a service that protects your data and privacy online. A VPN creates an encrypted tunnel that makes you anonymous by masking your IP address while connecting to public Wi-Fi hotspots. This is a great way to shield your information from online spies while you’re banking, shopping, or handling any kind of sensitive information online. 

Use antivirus software 

McAfee LiveSafe™ is an antivirus solution that protects your computer and mobile devices from suspicious web cookies by: 

  • Allowing you to keep your online passwords (which are often stored in cookies) in one secure location. 
  • Warning you of suspicious links, keeping potentially harmful cookies off your device. 
  • Protecting you against viruses and malware. 
  • Blocking spam and emails that could lead to sites containing dangerous cookies.  

The post What Are Browser Cookies and How Do I Manage Them? appeared first on McAfee Blog.

Ransomware Survey 2022 – like the Curate’s Egg, “good in parts”

By Paul Ducklin
You might not like the headline statistics in this year's ransomware report... but that makes it even more important to take a look!

Smarter Homes & Gardens: Smart Speaker Privacy

By Natalie Maxfield

So is your smart speaker really listening in on your conversations? 

That’s the crux of a popular privacy topic. Namely, are we giving up some of our privacy in exchange for the convenience of a smart speaker that does our bidding with the sound of our voice? After all, you’re using it to do everything from search for music, order online, and control the lights and temperature in your home. 

What is your smart speaker really hearing—and recording? 

Let’s take a look at what’s going on inside of your smart speaker, how it processes your requests, and what companies do with the recordings and transcripts of your voice. 

So, are smart speakers listening in? 

More or less, smart speakers are listening to all the time. Each smart speaker has its own “wake word” that it listens for, like Alexa, Siri, or Google. When the device hears that wake word or thinks it hears it, it begins recording and awaits your verbal commands. Unless you have the microphone or listening feature turned off, your device indeed actively listens for that wake word all the time. 

Here’s where things get interesting, though. There’s a difference between “listening” and “recording.” The act of listening is passive. Your smart speaker is waiting to hear its name. That’s it. Once it does hear its name, it begins recording for a few seconds to record your command. From there, your spoken command goes into the company’s cloud for processing by way of an encrypted connection.  

There are exceptions to when your command may go to the company’s cloud for processing, like Siri on iPhones, which according to Apple, “You don’t sign in with your Apple ID to use Siri, and the audio of your requests is processed entirely on your iPhone.” Also, Google Assistant may process some requests without going to the cloud, like “When a user triggers a smart home Action that has a local fulfillment path, Assistant sends the EXECUTE intent or QUERY intent to the Google Home or Google Nest device rather than the cloud fulfillment.” 

In the cases where information does go to the cloud, processing entails a few things. First, it makes sure that the wake word was heard. If it’s determined that the wake word was indeed spoken (or something close enough to it—more on that in a minute), the speaker follows through on the request or command. Depending on your settings, that activity may get stored in your account history, whether as a voice recording, transcript, or both. If the wake word was not detected, processing ends at that point. 

Enter the issue of mistaken wake words. While language models and processing technologies used by smart speakers are constantly evolving, there are occasions where a smart speaker acts as if a wake word was heard when it simply wasn’t said. Several studies on the topic have been published in recent years. In the case of research from Northeastern University, it was found that dialogue from popular television shows could be interpreted as wake words that trigger recording. For example, their findings cite: 

“We then looked at other shows with a similarly high dialogue density (such as Gilmore Girls and The Office) and found that they also have a high number of activations, which suggests that the number of activations is at least in part related to the density of dialogue. However, we have also noticed that if we consider just the amount of dialogue (in a number of words), Narcos is the one that triggers the most activations, even if it has the lowest dialogue density.” 

Of interest is not just the volume of dialogue, but the pronunciation of the dialogue: 

“We investigated the actual dialogue that produced Narcos‘ activations and we have seen that it was mostly Spanish dialogue and poorly pronounced English dialogue. This suggests that, in general, words that are not pronounced clearly may lead to more unwanted activations.” 

Research such as this suggests that smart speakers at the time had room for improvement when it comes to properly detect wake words, thus leading to parts of conversation being recorded without the owner intending it. If you own a smart speaker, I wouldn’t be too surprised to hear that you’ve had some issues like that from time to time yourself. 

Is someone on the other end of my smart speaker listening to my recordings? 

As mentioned above, the makers of smart speakers make constant improvements to their devices and services, which may include the review of commands from users to make sure they are interpreted correctly. There are typically two types of review—machine and human. As the names suggest, a machine review is a digital analysis and human reviews entail someone listening to and evaluating a recorded command or reading and evaluating a transcript of a written command. 

However, several manufacturers let you exercise some control over that. In fact, you’ll find that they post a fair share of articles about this collection and review process, along with your choices for opting in or out as you wish: 

Setting up your smart speaker for better privacy 

The quickest way to ensure a more private experience with your smart speaker is to disable listening—or turn it off entirely. Depending on the device, you may be able to do this with the push of a button, a voice command, or some combination of the two. This will keep the device from listening for its wake word. Likewise, this makes your smart speaker unresponsive to voice commands until you enable them again. This approach works well if you decide there are certain stretches of the day where your smart speaker doesn’t need to be on call. 

Yet let’s face it, the whole idea of a smart speaker is to have it on and ready to take your requests. For those stretches where you leave it on, there’s another step you can take to shore up your privacy.  

In addition to making sure you’re opted out of the review process mentioned above, you can also delete your recordings associated with your voice commands. 

Managing your voice history like this gives you yet one more way you can take control of your privacy. In many ways, it’s like deleting your search history from your browser. And when you consider just how much activity and how many queries your smart speaker may see over the course of days, weeks, and months, you can imagine just how much information that captures about you and your family. Some of it is undoubtedly personal. Deleting that history can help protect your privacy in the event that information ever gets breached or somehow ends up in the hands of a bad actor.  

Lastly, above and beyond these privacy tips for your smart speakers, comprehensive online protection will help you look out for your privacy overall. In the case of ours, we provide a full range of privacy and device protection, along with identity theft protection that includes $1M identity theft coverage, identity monitoring, and identity restoration assistance from recovery pros—and antivirus too, of course. Together, they can make your time spent online far more secure. 

You’re the smart one in this relationship 

With privacy becoming an increasingly hot topic (rightfully so!), several companies have been taking steps to make the process of managing yours easier and a more prevalent part of their digital experience. As you can see, there are several ways you can take charge of how your smart speaker uses, and doesn’t use, your voice. 

It used to be that many of these settings were tucked away deep in menus, rather than something companies would tout on web pages dedicated to privacy. So as far as smart speakers go, the information is out there, and I hope this article helps make the experience with yours more private and secure.  

The post Smarter Homes & Gardens: Smart Speaker Privacy appeared first on McAfee Blog.

Attackers Use Event Logs to Hide Fileless Malware

By Nate Nelson
A sophisticated campaign utilizes a novel anti-detection method.

USB-based Wormable Malware Targets Windows Installer

By Elizabeth Montalbano
Activity dubbed ‘Raspberry Robin’ uses Microsoft Standard Installer and other legitimate processes to communicate with threat actors and execute nefarious commands.

Low-rent RAT Worries Researchers

By Nate Nelson
Researchers say a hacker is selling access to quality malware for chump change.

Conti Ransomware Attack Spurs State of Emergency in Costa Rica

By Elizabeth Montalbano
The threat group has leaked data that it claims was stolen in the breach and is promising more government-targeted attacks.

Colonial Pipeline facing $1,000,000 fine for poor recovery plans

By Paul Ducklin
How good is your cybersecurity? Are you making the same mistakes as lots of other people? Here's some real-life advice...

Ransomware Deals Deathblow to 157-year-old College

By Nate Nelson
Why a private college that stayed in business for 157 years had to close after the combo of COVID-19 and ransomware proved too much.

Novel ‘Nerbian’ Trojan Uses Advanced Anti-Detection Tricks

By Elizabeth Montalbano
The stealthy, feature-rich malware has multistage evasion tactics to fly under the radar of security analysis, researchers at Proofpoint have found.

Malware Builder Leverages Discord Webhooks

By Nate Nelson
Researchers discovered a simple malware builder designed to steal credentials, then pinging them to Discord webhooks.

Threat Actors Use Telegram to Spread ‘Eternity’ Malware-as-a-Service

By Elizabeth Montalbano
An account promoting the project—which offers a range of threat activity from info-stealing to crypto-mining to ransomware as individual modules—has more than 500 subscribers.

Are You Playing A Role In Protecting Your Online Privacy?

By Alex Merton-McCann

Like most things in life, online privacy is a 2-way street. As consumers, we expect the companies we deal with online to manage and safeguard our data to a super professional level however we also have a role to play here too. So, this Privacy Awareness Week (PAW), let’s focus on what we can do to ensure our personal information is kept as secure, and private as possible. 

Privacy Awareness Week 

There’s nothing like a dedicated ‘week’ to renew our focus and in my opinion, this year’s PAW does just that. This year’s theme is – The Foundation of Trust – we all have a role to play, a great reminder of how it’s up to all of us to ensure we manage online privacy. There’s no doubt that managing our privacy is low on the to-do list for many. And I get it – we’re all strapped for time, and we don’t ever think privacy breaches will affect us. Well, my friends, I’m here to tell you that privacy breaches do happen. Identity theft is a reality of living life online. In fact, in 2020/21, nearly 155,000 Aussies had their identities stolen and they were the cases that were reported. But the good news is that if you take a proactive approach, you can minimise the risk of this ever happening. 

What You Can Do to Protect Your Online Privacy 

Believe it or not, most of your privacy action plan involves small steps that are, I promise, relatively painless. The most important thing here is that you need to commit to doing them. The last thing you want is to spend months dealing with the fallout from having your identity stolen. It’s exhausting, stressful, and absolutely worth avoiding. 

Without further ado, here’s your action plan: 

1. Passwords 

Strong and complex passwords are essential to keeping your online information tight. Ideally, a password should have between 8-10 characters and be a combination of letters – both lower and uppercase, numbers and symbols. Each online account should also have its own password too – which is a very overwhelming concept! Consider using a password manager such as McAfee’s TrueKey to help generate and manage passwords.   

2. Conduct An Audit of Your (and Your Kids’) Privacy Settings 

Ensure all the family checks their social media accounts to ensure they are set to private. This will mean that only their chosen friends can see their private information. Each social media platform will have its own ‘help’ page which provides specific steps on how to do this.  

3. Use Public Wi-Fi With Caution 

If you are serious about your online privacy, then you need to use public Wi-Fi sparingly. Unsecured public Wi-Fi is a very risky business. Anything you share could easily find its way into the hands of cybercriminals. So, avoid sharing any sensitive or personal information while using public Wi-Fi. If you travel regularly, consider investing in a VPN. A VPN (Virtual Private Network) encrypts your activity which means your login details and other sensitive information is protected. A great insurance policy!  

4. Use 2-Factor Authentication 

Adding an additional layer of security to protect yourself when accessing your online accounts is another great way of guarding your online privacy. Turn on two-factor authentication for Google, Dropbox, Facebook and whatever other site offers it. For those new to this option, this means that in addition to your password, you will need to provide another form of identification to ensure you are who you say you are. Most commonly, this is a code sent to your mobile phone or generated by a smartphone app. 

5. Consider a Search Engine that Doesn’t Track Your Every Move Online 

Most web surfers rely on Google for their searching but why not use a search engine that doesn’t collect and store the information? And there are loads of more ‘privacy focussed’ options to choose from. Check out DuckDuckGo, that doesn’t profile users or track or sell your information to third parties. 

6. Protect Your Digital Life 

Comprehensive security protection software is an easy way to help firm up your online privacy too as it does a great job of keeping malicious software (malware) at bay. Malware can wreak absolute havoc: from installing pop ups to scanning for personal information. And if you’re likely to click dodgy links (we’re all human after all), then this is a no brainer! Super-duper security software will also guard you against viruses and online threats, direct you away from risky websites and dangerous downloads and protect your smartphones and tablets too, it can also back up your files. McAfee’s LiveSafe protection software comes with a 100% guarantee to protect you against viruses. 

So, this Privacy Awareness week, please take the time to ensure you are doing all you can to nail your online privacy. And of course, please get your kids involved too. Do your research and find some stories of ‘real life’ people who have had their identity stolen to share around the dinner table because identity theft can absolutely happen to anyone! 

Till next time, 

Stay Safe! 

Alex 😊  

The post Are You Playing A Role In Protecting Your Online Privacy? appeared first on McAfee Blog.

Aussie Children Have 2nd Highest Rate of Cyberbullying, Time To Focus on Digital Parenting

By Alex Merton-McCann

Whether it was bush fires, Covid, floods, or the Ukraine conflict, the news agenda over the last two years has been jam-packed. So, when McAfee released the findings of their first Global Connected Family Study, it was clear to me that connecting safely online needs to make it back into the news. 

Over 15,000 parents and 12,000 children aged 10-18 from 10 countries (including Australia) were interviewed for the study with the goal of finding out how families both connect and protect themselves online. So, let me share with you the results that need to spring us into action. 

  • Aussie children report the 2nd highest rate of cyberbullying (24%) out of the 10 countries surveyed. US children reported the highest rate. The average for all countries was 17%. 
  • Aussie parents are not completely aware of what’s happening in their children’s digital lives with just 20% nominating that their child had experienced cyberbullying while in fact 24% had experienced it. 
  • Children want to feel safe online and 73% of those surveyed look to their parents more than any other resource for help however parents are struggling to deliver. 
  • Parents are more inclined to protect their daughters online than their sons. Girls aged 10-14 were more likely to have parental controls on their PCs/laptops in almost every country surveyed. 
  • Children and teens want their privacy online and more than half (59%) will take steps to actively hide their online activity from hiding their browsing history to omitting details about what they are doing online. 

What Can We Do About It? 

I’m the first to admit that being a digital parent can be incredibly overwhelming. Staying abreast of the latest trends, apps and social media platforms can seem like a full-time job! And let’s not forget the latest threats and risks too. But findings, like the ones above, do have a way of shaking up priorities and do serve to provide clarity on where we need to focus our attention as parents.  

So, let’s break it down into 5 steps that you can take to ensure you are minimising the negativity and risks your kids may experience online: 

1. Check Your Family’s Communication Culture 

Without a doubt, one of the best things you can do for your family is create a culture where honest and genuine communication is a feature of everyday life. If your kids know they can confide in you, no matter what the problem is, then they are far more likely to come to you before a problem such as cyberbullying can feel unsolvable.  

2. Commit to Understanding Your Kids’ Online World 

It’s impossible to set boundaries and appreciate the risks in the digital world, if you don’t really know what your kids are dealing with. You may have little natural interest in joining Kik, Snapchat or Instagram but if you kids use it – then you know what you need to do! And if your kids can see that you are more actively involved online and using similar platforms, they will be more likely to come to you if they experience a problem. 

3. Introduce A Family Technology Contract 

In my opinion, one of the biggest causes of issues online is the fact that children are given internet-enabled devices that require adult levels of maturity and problem-solving skills. But let’s keep it real – that horse has bolted – most of our kids have phones in their pockets! So, the best way of managing this is to introduce a family technology contract.  

Now this can be as simple or complex as you feel is necessary for your tribe. You may want to insist on just a few rules such as not sharing passwords with friends, seeking permission before downloading apps, and always being kind online. You could simply write these on a piece of paper and have your kids sign it. Whatever works for you but remember, the research is showing that our kids are looking to us to help keep them safe online, so include as much here as you think your kids need. And of course, these need to be age-appropriate. I love this one for under 5’s from our eSafety Commissioner and this one is great for tweens and teens from The Modern Parent. 

4. Talk Cyberbullying (And Empathy) With Your Kids 

Bullying has existed long before the internet was even a word so unfortunately, it isn’t going anywhere. But coupled with the intensity and very public nature of the online world, it can be devastating. In my opinion, the key to cyberbullying is prevention. So, ensuring your kids know they can come to you with any problem, having a tight connection with your child so you can pick when things are ‘off’ and arming them with a basic cyber safety toolkit (not sharing passwords, privacy settings on, being kind online & having time away from devices) is essential.  

One of the ways we can also keep our kids from making mistakes online is by teaching them empathy. If kids haven’t developed empathy, then they make decisions based solely on their own desires – without any consideration for others. Many experts believe that it is the absence of empathy that leads directly to bullying.   

So, be a role model and start weaving the good old saying ‘do unto others as you would like them to do to you’ into your family dialogue.  

5. Consider Parental Controls & Protection Software 

The research findings are very clear: our kids want us to take charge of their online safety. So, let’s get technology working for us so we can keep them safe. 

Parental controls are not the silver bullet but when they are used in conjunction with proactive parenting then they can be transformative. McAfee’s Safe Family offers parents the ability to monitor device activity, limit screentime, block apps, and filter websites. This is a great way of teaching boundaries and limits while also giving yourself peace of mind that your kids are as safe as possible. 

Investing in comprehensive protection software for your (and your kid’s) devices is another way of adding a layer of protection to their online world. Comprehensive security software like McAfee’s Total Protection will protect against dangerous downloads, viruses, malware, online threats, and visits to risky websites. It will also encrypt the files on your computer and help manage your passwords! A complete no-brainer!!  

So, please don’t be overwhelmed and don’t even aim to be the perfect digital parent! Break it down and do the best you can because protecting our kids online needs to be a top priority. So, as soon as possible – check your family communication, take some time to understand your kids’ online world, put a digital contract in place, talk a little, and use some parental controls. But please do not forget about the power of role modeling. As parents, we are our kids’ biggest influencers so it might just be time for you to up your own digital safety game too!! 

Till next time. 

Stay safe everyone! 

The post Aussie Children Have 2nd Highest Rate of Cyberbullying, Time To Focus on Digital Parenting appeared first on McAfee Blog.

Can Parental Controls Can Help You Create Good Habits?

By Alex Merton-McCann

Molding and shaping our kids while we can is every parent’s dream. When kids are young – and sweet! – they are far more inclined to take on board our advice and lovingly imposed rules. Oh, how I miss those days!! And in a nutshell – that’s what a good set of parental controls can do for you and your kids. In my opinion, parental controls can absolutely help you create good habits but it’s essential that they are accompanied by an invested parent who’s keen to help their kids navigate the online world. 

What Can Parental Controls Do? 

With Aussie kids spending at least 5 hours online a day, it’s no secret that they can be exposed to a broad range of people, websites and themes – some potentially quite disturbing. And with most kids sporting an internet-connected phone plus a laptop, there’s no limit to what they can access – and usually when you aren’t around. 

I like to think of parental controls as another way of helping establish healthy habits and good decision-making strategies with your kids. For example, if you have told your kids there is no screen time before bed, then you are able to use Parental Controls to make that a reality. And if you have agreed that they are able to use only certain apps or social media platforms then Parental Controls can also make this happen by blocking access if they deviate. I believe that over time, these routines, and boundaries simply become part of your child’s day-to-day life and become good habits. 

McAfee’s Parental Controls, called Safe Family, can also let you view your kids’ activity online and let you know where your kids are at all times. How good??    

Doesn’t It Take Just 21 Days To Form A Habit? 

While it’s commonly believed that it takes just 21 days to form a habit, courtesy of Dr Maxwell Maltz in the 1960’s, more up-to-date research shows that it could take considerably longer. In fact, research conducted in 2010 by Health Psychology Researcher Philippa Lally at The University College in London shows that it takes around 2 months or 66 days to be precise to make a new habit stick! 

And while I love the idea that we could help our kids adopt new positive habits in just 2 months, I think we need to keep it real. Fear of missing out (FOMO) coupled with the lure of their shiny devices might mean that it takes a little more than 66 days to make a change, particularly if you are trying to modify their current usage as opposed to starting from scratch. 

Nothing Replaces The Role Of Being A Proactive Digital Parenting 

There is no-one that better understands just how time poor parents can be. Having spent the last 20 plus years rearing 4 boys and working, I feel like I’ve earnt the time poor t-shirt! So, understandably, many parents feel like they just don’t have the ‘band with’ to take on much more so digital parenting is often put in the too hard basket. And I totally get it!    

But using parental controls without some knowledge of your kids’ digital world, is a little like filling your car with petrol but not worrying about the oil. It will eventually be a problem! 

My Top 3 Digital Parenting Non-Negotiables 

So, I’m going to break it down for you. Digital parenting doesn’t have to be overwhelming, particularly if you break it down. So, in a quest to keep it simple, here are 4 things you can do to up your digital parenting game: 

1. As Soon as Your Kids Start Using Devices, Start Talking Cybersafety 

The day your child picks up a device is the day you start talking about cybersafety. If this is when they are 18 months of age, then that’s when you start. Always ensure the messages are age-appropriate and keep them simple. You could start with:  

  • “Remember, daddy/mummy chooses the game” 
  • “Let’s keep your name private online.” To help with this, why not create an online nickname for them? 
  • “Make sure you’re sitting near (mum/dad/nana) when you are using the iPad.” 

And when your kids get older, weave in more age-appropriate messages, such as: 

  • “Online friends aren’t real friends” 
  • “If you wouldn’t do it in person then don’t do it online” 
  • “Think before you post” 

Knitting cybersafety messages into your family dialogue needs to also become automatic. Talk about it just like you would sun safety or road safety. And why not share stories around the dinner table about your own online experiences or even relevant news stories to engage them in a dialogue. 

2. Create a Family Digital Contract 

I love the idea of a clear contract between parents and kids that details your expectations about their online behaviour and technology use. It’s a great way of developing a set of guidelines that will help them navigate the risks associated with being online. Now, this agreement should definitely be a family exercise so ensure your kids are invested in the process too. If you want a starting point, check out this one from The Modern Parent here 

3. Commit to Understanding Your Child’s Digital World 

Taking some time to understand how your child spends their time online is the best way of truly understanding the risks and challenges they face. So, join ALL the social media platforms your kids are on, play their games and download their messaging apps. You will develop a better understanding of how to manage privacy settings and the language/online culture that is a big part of your child’s life. And the best part – if they know you understand their world, I have no doubt that you will develop a little ‘tech cred’ which mean that they will be more likely to come to you with any issues or problems that may face online. Awesome! 

Get Technology Working for You 

There is some amazing technology available that makes this digital parenting thing a heck of a lot easier and that includes Parental Controls. McAfee’s Safe Family is a comprehensive parental controls solution that lets you monitor and block apps and websites, manage screen time, see where your kid’s devices are at all times, and more, giving you peace of mind in an ever-mobile world. The perfect partner to an invested parent! 

Parental Controls can be an awesome way of helping your kids establish positive habits around their tech use, but they are even more impactful when combined with an invested parent who has got a good handle on the online world. So, by all means, invest in Parental Control software but also commit to ramping up your digital parenting game – it’s the best way to help set up your kids for a safe and positive experience online. And isn’t that every digital parent’s dream! 

Take Care 

Alex 😊 

The post Can Parental Controls Can Help You Create Good Habits? appeared first on McAfee Blog.

April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell

By Sagar Tiwari
Researchers say a GitHub proof-of-concept exploitation of recently announced VMware bugs is being abused by hackers in the wild.

DOJ Says Doctor is Malware Mastermind

By Nate Nelson
The U.S. Department of Justice indicts middle-aged doctor, accusing him of being a malware mastermind.

US Government says: Patch VMware right now, or get off our network

By Paul Ducklin
Find and patch. Right now. If you can't patch, get it off the network. Right now! Oh, and show us what you did to comply.

Snake Keylogger Spreads Through Malicious PDFs

By Elizabeth Montalbano
Microsoft Word also leveraged in the email campaign, which uses a 22-year-old Office RCE bug.

Fronton IOT Botnet Packs Disinformation Punch

By Sagar Tiwari
Fronton botnet has far more ability than launching DDOS attack, can track social media trends and launch suitable propaganda.

Poisoned Python and PHP packages purloin passwords for AWS access

By Paul Ducklin
More supply chain trouble - this time with clear examples so you can learn how to spot this stuff yourself.

Verizon Report: Ransomware, Human Error Among Top Security Risks

By Elizabeth Montalbano
2022’s DBIR also highlighted the far-reaching impact of supply-chain breaches and how organizations and their employees are the reasons why incidents occur.

Link Found Connecting Chaos, Onyx and Yashma Ransomware

By Nate Nelson
A slip-up by a malware author has allowed researchers to taxonomize three ransomware variations going by different names.

Cybergang Claims REvil is Back, Executes DDoS Attacks

By Elizabeth Montalbano
Actors claiming to be the defunct ransomware group are targeting one of Akami’s customers with a Layer 7 attack, demanding an extortion payment in Bitcoin.

What & Who You Know: How to get a job in cybersecurity with no experience

By Mary Kate Schmermund

When contemplating a career change within a different industry, it can be challenging to know where to start. As the world continues to change, many people are wondering how to transition into cybersecurity without experience. Business leaders at Cisco Secure and Duo Security who changed careers, along with recruiting professionals, provided insights for prospective candidates curious about the cybersecurity and tech industries. Learn their top 10 tips for getting a job in cybersecurity.

1. Discern what drives you professionally.

If passion, innovation, kindness and growth are on your list, Cisco Secure is worth checking out. When Kelly Davenport, manager of the Global Knowledge and Communities team, first connected with folks at Duo, she was “amazed at how nice and excited everyone seemed. I almost thought it seemed too good to be true. But then, when I started working here I realized everyone here really is that nice and smart and good at what they do. I was waiting for that to change, but it’s for real.”

Cisco Secure Talent Acquisition Lead Jeff Edwards shares, “Our senior level folks want fulfilling work. The work we’re doing and products we’re putting out are exciting, new and cutting edge. This is the stuff that’s going to change how we work in the future.”

2. Develop a game plan.

For those looking to get into cybersecurity with no experience, Edwards suggests, “Pay attention to the jobs posted on cybersecurity career pages and the skills they’re asking for. That lets you know how long a process your career change may take. If you’re switching careers into tech it’s all out there to be able to discern, “Hey, where do I need to focus my efforts to put me in contention for these roles?”’

3. Identify how your skills transfer to cybersecurity.

Cisco Women in Cybersecurity recently hosted a virtual session, Career Journeys Are Not Always a Straight Road – Your Journey Is Your Story, featuring CX Cloud Compliance Leader Deborah Sparma.

Sparma shared, “No matter where you are and have a new goal to break into, see what can transfer. Who knew that theater could transfer to working in a tech company? Who knew that working as a vet tech could lead me into corporate America? The variety of expertise has taught me that there is always room to grow and skills that can be transferred from one role to the next no matter how disparate they may be. For example, my experience in theater has made me a better speaker and presenter.”

Davenport, who was a journalist and librarian before making the switch to health care IT and then Duo, advises, “Figure out the core skills that you have and what job titles and words are used in other industries. Talk about the things you already know how to do, because every industry has its own jargon and that can feel like a barrier until you figure out how to translate it.” Cisco provides a list of common job titles and the experience and certifications needed for key cybersecurity roles.

She continues, “I had no idea what customer enablement was before I joined Duo. I did not know that was a job, and no one would’ve told me that. But it turns out that being a librarian, knowing how to organize things, having worked with the public, being a journalist who can write and create accurate, complex information on a deadline, and then understanding the technology of making something user centered and how people want to consume that information in different formats in different points in time, based on their needs, all of those were things that I knew and had experience in. And so, it was just discovering the opportunities that were already out there but were called something different than I knew about.

4. Take stock of what you already know.

Davenport’s advice for those wanting to enter cybersecurity: “A lot of professions want that super specialist, and we definitely have people who are those people, but I’ve seen Duo hire people from a lot of different backgrounds, and the additional perspective that they come in with and the fresh ideas is what keeps us innovative and what makes it a really fun and interesting place to work.

She elaborates: “From a journalism background, the level of responsibility that you have as a journalist to be fair and accurate, and the ethics that you learn that are integral to that profession, were super helpful and important coming into any kind of customer-facing role where you’re used to being accountable. You have really high standards for yourself, and that translates into being able to hold those high standards for what customers expect, too.”

For journalists in particular, she says, “I would just like to give a shout out to folks in journalism who are wondering, maybe their career path is taking them in a different direction. (…) you have so many valuable skills that, if you are interested in a career in tech, there’s a lot of opportunities because of some of those things like I talked about earlier. The experience of working on deadline, that accountability and responsibility that you take and the ethics of what you do, those all translate. And so, those are all totally portable to a new context.”

5. Determine if you need additional cybersecurity training or certification.

Edwards states, “Start researching all the top cybersecurity companies and what products they offer and then take it another level down: What programs and software are they using? Are there different classes I need to take or certifications I need to get?”

Cisco offers top-notch cybersecurity training and security certifications. Also available are Cisco Certified CyberOps training videos and connection with those learning new cybersecurity skills through the Security Certifications Community and CyberOps Certifications Community.

6. Seek out companies that recognize the importance of having different backgrounds.

Sparma highlights, “I believe a lot in teams. We all have skill sets that can complement each other no matter where we are in our career. I know I don’t know it all. I lean on the teams and people around me.”

Davenport reports, “Your experiences are going to give you a fresh perspective that’s actually really valued by the people who maybe came from that industry. Having that diversity of experiences and viewpoints is really celebrated more so here than pretty much any other place I’ve worked. My advice would be to trust that you can learn a totally new industry, and that the experiences that you’re coming with are really valuable.

Duo Security Lead Recruiter Shannon Curran affirms, “We’ve spoken with many candidates who don’t come from the cybersecurity space.” She says that telling that story in your resume and throughout the application, interview and hiring process allows recruiters to understand why you’d be a match and that kindness goes a long way.

7. Recognize what you can learn.

When starting at Duo Security, Davenport shares, “I came in pretty fresh. I knew that I was going to be doing this intensive onboarding program. We have technical trainers who we work with, so that we’re customer-ready. And so, I knew coming in that I would have a lot of support. I felt like, ‘Okay, I’m embracing the unknown and I’m going to learn a bunch of new things, but I’m going to have this great team that’s going to help me learn, is going to teach me.’ And that worked out pretty well.”

“Trust that you can learn, trust that the experiences you’re coming in with are valuable and are going to give you a fresh perspective, and that you will have the support to learn and grow, even if you’re changing industries.” —Manager of Duo Global Knowledge and Communities team Kelly Davenport

A culture of learning helps. Sparma says, “I’m always learning. Cisco especially has all the trainings out there that we can take. Invest in yourself, in learning, and don’t be afraid to ask.”

8. Use previous skills to learn in a new environment.

Davenport took this approach: “Because I’m a writer, I would go to our classes where we’re learning about the product. And then I would write my own summary in my own words, to describe what I was learning. I’d run that by my teacher and say, ‘Okay, am I on the right track?’ And that really helped me metabolize what I was learning and get that feedback in a way that worked for me as a learner.”

9. Get the inside scoop and through the door with a referral.

Maintaining a strong network can ease the career change process in terms of learning about the cybersecurity industry from people working in it and in terms of referrals. Marketing Specialist Julie Kramer says, “Try to find a networking partner in the company and ask for references for networking purposes. For example, if I have a friend who knows me that works at Cisco and they’re like, ‘Hey, do you mind referring me?’ I’d be happy to give them a referral.”

Sparma said, “Working in technology wasn’t even an option I considered when I started college…I broke into a new career but I had my background working in hospitals, working at the insurance company…someone knew me, knew my personality, helped me get that role… At Cisco, I had applied at other roles where I had a one-to-one fit. This one stretches me, but I could bring a lot to the table at the same time and still grow. That’s what energizes me.”

You never know how your network may come in handy throughout your career. In 2012, Edwards’ very first manager called him with one question: “Hey, do you want to come work at Cisco?”

10. Find and keep mentors.

Sparma’s first mentor “shepherded me. She took me under her wing, supported my wish to go back to school, encouraged me to get certification in something I didn’t know existed. I didn’t know what a mentor was at first, and it didn’t dawn on me until after I’d moved on in my career and traveled around the world that I realized I got there because of my first mentor. What does get difficult is everyday meetings, deliverables, timeframes — sometimes you just have to make it a point to make sure that you invest in yourself and keep that promise to yourself and keep your mentoring relationships going. I’ve had different mentors at Cisco and you can have multiple mentors along the way.” Employee Resource Organizations are another great place to find those mentors or mentor others.

“Find a mentor for support, guidance, knowledge, and motivation. Then pay it forward and mentor others. You can always bring something to the table.” —CX Cloud Compliance Leader Deborah Sparma

Sparma continues, “One of the first things they asked me to do when I started at Cisco was find a mentor. Cisco also allows people to shadow colleagues to learn what they do, network, and for knowledge transfer. We all can benefit from each other.”

Join us      

To learn more about Cisco Secure and Duo Security and how you can apply your skills, passion, and experience to cybersecurity, check out our open roles.


We’d love to hear what you think. Ask a Question, Comment Below, and Stay Connected with Cisco Secure on social!

Cisco Secure Social Channels

Instagram
Facebook
Twitter
LinkedIn

New 'GoodWill' Ransomware Forces Victims to Donate Money and Clothes to the Poor

By Ravie Lakshmanan
Cybersecurity researchers have disclosed a new ransomware strain called GoodWill that compels victims into donating for social causes and provide financial assistance to people in need. "The ransomware group propagates very unusual demands in exchange for the decryption key," researchers from CloudSEK said in a report published last week. "The Robin Hood-like group claims to be interested in
❌