Pay cash rather than use a card at the pump, an Office 365 voicemail scam, patch your printers and a problem with Kaspersky Antivirus.
Welcome to Cyber Security Today. It’s Friday August 16th. I’m Howard Solomon, contributing reporter on cyber security for ITWorldCanada.com.
To hear the podcast click on the arrow below:
 |
 |
 |
Paying for gasoline in cash isn’t as fast as using a credit or debit card, but in the U.S. it may be the right thing to do. That’s because criminals are still able to compromise the card readers on gas pumps and skim the data off of the back of cards. According to a column this week by security reporter Brian Krebs, the latest pump skimmers use Bluetooth to wirelessly relay stolen card data and PIN numbers to the thieves in a nearby car. So the U.S. secret service has been working with university researchers to develop a Bluetooth scanner that will identify compromised gas pumps. In a test of the solution, 64 skimmers were found at 1,185 gas stations across six states. One problem is that in the U.S. gas companies are slow to adopt readers that accept credit and debit cards with a special chip that can’t be copied. So instead they read the data on the back of the card from the black stripe, which can be copied. One way to avoid being a victim is to use pumps with the latest security technology. The card readers on these pumps are horizontal, and the keypads are metal and not plastic.
There’s no shortage of tricks criminals use to get you to open a malicious email. Here’s the latest from a security firm called Avanan: Users of Microsoft Office 365 get emailed a notification they have a new voicemail message. To hear it, click on an attachment which has a file name with an HTML or .htm extension. If you do, you’re infected. Yout get sent to a new page asking for your username and password login, which the criminal captures. To avoid being victimized, be suspicious of any email with an HTML or .htm attachment.
UPDATE: Microsoft gave us this statement on Aug 21, after this piece was published: “Microsoft Office 365 Advanced Threat Protection detected this phishing campaign, and is capable of handling the “meta refresh” technique” used in this attack. “Microsoft Office 365 Advanced Threat Protection was able to correctly detect the malicious html files as well as the emails as phishing.” Any claim that customers were not protected is false, Microsoft said.
Users of Kaspersky Antivirus products should note the software does something that can help hackers track you. When you go to a web page Kaspersky adds a unique identifying number to the page to see if it’s on a list of suspicious and phishing web addresses. However, a security researcher says that could allow you to be tracked. Notified of the problem, last month Kaspersky updated it software so the number it adds is the same for everyone and not unique to each subscriber. However, that could still identify you as a Kaspersky user, which might be useful to a hacker. There’s a way to turn this feature off. Go to settings→ additional→ network→ and then un-check traffic processing box. However, that may interfere with some Kaspersky safeguard capabilities.
Attention IT administrators: If your organization has Internet-connected printers, make sure they have the latest security patches. Researchers at the security firm NCC Group tested a wide range of printers and found a number had vulnerabilities including machines from Xerox, Lexmark. Brother and Kyocera and Ricoh. These have been fixed, so update the software now. And those of you with home printers are reminded to periodically look for updated printer software as well.
In Wednesday’s podcast I reminded you to make sure to install the latest security updates for Windows. This is another reminder, because the patches fix some serious vulnerabilities.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening.