Watch those Amazon buckets, bad Android apps and keep an eye on your payment card statement
Welcome to Cyber Security Today. It’s Friday July 12th. I’m Howard Solomon, contributing reporter on cyber security for ITWorldCanda.com.
 |
 |
 |
Companies aren’t tough enough on employees who are careless with corporate data. That’s one of the lessons I conclude from a report by security company RiskIQ into the company data employees are storing in Amazon’s cloud storage service called S3. Why do employees put data there? Because in some cases S3 buckets are a good place for processing data with computing power staff can’t get hold off inside their firms. The danger? If the buckets aren’t protected and left open on the Internet, criminals can get in and steal the data. Just as bad, says this report, is that criminals are finding S3 buckets that have particular files they can change and infect company websites. If that website is an e-commerce site, the infection allows criminals to steal customer credit card data. And that’s exactly what’s happening. RiskIQ believes a credit-card stealing gang called Magecart has infected thousands of web sites this way. So, if you use Amazon S3 buckets, make sure the data is secure.
Check with your IT department and ask how to do it. And if you’re an IT administrator, make sure you create rules for staff to handle data, and that everyone in the company understands and follows them. Here’s a link to the report and protection advice.
There’s another warning about the risks of downloading mobile apps and games from unknown developers. Security vendor Check Point Software has discovered new Android malware distributed from an app store called 9Apps that pretends to be from Google. The malware claims to be Google Update, but instead installs modules that display ads on smart phones. Then criminals get money from advertising exchanges. The report estimates 25 million devices have been infected. While most victims are in India, Indonesia and Arabic and speaking countries, it has also been seen in the U.S., the United Kingdom and Australia. While this particular campaign comes from malware in the 9Apps store, Check Point says it also found 11 similar apps that were snuck into the Google Play store. They appear to be games. All have been removed from Google Play, but not before two were downloaded 10 million times.
On Wednesday I told you about a security risk Mac users could have with the Zoom video conferencing app. Hackers can trick them into joining a meeting and then use the video camera to record. Zoom issued a partial fix. Now Apple is also helping solve this with an update that removes a part of the app that can cause the problem. And next week Zoom says it will release an update that allows users to turn off video by default so a hacker can’t secretly record what they’re doing.
Finally, another warning to watch your payment card statements. CBC News reports that some Canadians have discovered debit charges for hundreds of dollars on their statements made to the Spotify music service. The thing is, these people don’t have Spotify accounts. It isn’t clear if a Spotify employee did this, or a mischievous hacker is opening accounts, perhaps trying to embarrass Spotify. Banks will reverse these unauthorized charges. But you have to watch your statements.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening.