A Linux alert, negligent executives and another warning to QNAP users.
Welcome to Cyber Security Today. It’s Friday, April 30. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.
 |
 |
 |
Security professionals with Linux systems in their infrastructure should start looking for evidence their servers have been compromised. This is because a company called 360 Netlab has discovered a piece of malware that creates a backdoor into 64-bit Linux systems. It may have been around for at least the last three years. The malware, dubbed RotaJakiro, is capable of stealing data. It uses a lot of tricks, including multiple encryption algorithms, to hide.
Cyberattackers target executives. Yet many don’t take cybersecurity seriously. A study released this week by a security company called BlackCloak offers some proof. It tried to see if the email accounts of executives of 15 top video game makers were vulnerable What it found was many of their passwords were being sold on criminal marketplaces. Over 60 per cent of the passwords were associated with their work or with personal email addresses, and therefore easy to guess. One-third of the executives reused the same password or roots of the same password many times. This isn’t bad if they use multi-factor authentication. But there are ways around MFA.
There’s more: The home Wi-Fi networks of some executives were insecure because they used the default password that came with the router. Many of their personal devices didn’t have antivirus software, and a quarter of the devices of the executives had malware.
The point of the exercise was that video game companies have valuable software code worth stealing and holding for ransom. Access to corporate assets like that may come through password hacks. But the lesson is also the same for corporate executives of all types of organizations: You are targets. Tighten your personal as well as your corporate password security.
Washington has generously extended the U.S. income tax filing to May 17th. For hackers that means an extra two weeks for scams. That’s not good, because according to research by a firm called Abnormal Security, the volume of income tax-related email scams is already up 400 per cent over last year. So beware of email messages with subject titles like “Claim your free tax credit today,” “Reconciliation of your tax refund,” and messages that seem to come from well-known software tax preparers. Check the senders’ email address carefully. Also note that this year tax scammers are targeting executives and managers a lot. In fact some scams pretend to be text or voice messages from executives to employees asking them to click on a link. What many scams want are email or bank login passwords.
Last week I warned organizations and individuals that use QNAP network-attached storage devices to make sure the latest security patches were installed. That’s because a ransomware campaign was taking advantage of vulnerabilities. Well, yesterday QNAP issued an alert about a second ransomware group that is targeting the devices. Again, it is urging users to install the latest security updates. The company also says for even better protection don’t connect the storage device to the internet unless necessary. When you do, use a trusted virtual private network or the myQNAPcloud link.
Finally, don’t forget later today the Week In Review edition of the podcast will be available, with guest commentator Dinah Davis. Ransomware, a device used by police to get data from smartphones and password security will be the topics discussed. Listen on your way home, or on the weekend.
Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening.