A report on mobile malware gives insight into recent attack trends, how a LinkedIn con works and is your airline spying on you?
Welcome to Cyber Security Today. It’s Wednesday Feb. 27th. I’m Howard Solomon, contributing reporter on cyber security and privacy for ITWorldCanda.com. To hear the podcast, click on the arrow below:
 |
 |
 |
It’s an ever-changing digital world. And criminals are adapting to every defensive move companies make to protect themselves. That’s the conclusion of a new report on mobile malware from security vendor McAfee. As big app markets like the Apple and Google Play stores get better at finding and deleting malicious apps, criminals are increasingly bypassing stores and delivering bad apps directly to you. So, McAfee points out, they’re spreading malware by sending SMS text messages with links they hope you’ll click on that will lead to downloading malware. Or, in the case of the popular online game Fortnite, creating a fake app. Another trick is creating a fake app that looks like one from your bank. Sometimes, however, crooked developers create Android apps that appear legit so they can get into the Google Play store, but under the covers download malware. Finally, the report notes that many Internet-connected devices like smart speakers, locks and surveillance cameras have weak security that can be attacked.
So, what do you need to do? First, don’t download apps from unknown sources. That means be suspicious of text or email messages with links. Be sure of where those messages come from before clicking. Research the app developer. Also remember that comment sections in blogs or forums can be exploited by criminals who leave poisoned links to fake websites.
Are you flying on American or Singapore Airlines? Take a good look at the entertainment screen on the seat ahead of you. Is there a round circle that looks like a camera lens? It is. BuzzFeed News says it was told by American Airlines the cameras have never been activated. Singapore Airlines said the cameras came with some screens when they were bought, and they have been disabled. Have you seen seat screen cameras on any other airlines? Let us know — and let the airline know if you don’t like it.
Sometimes you can’t believe everything you read on the Internet. Take LinkedIn resumes. According to a report from security vendor Proofpoint, an attacker who created a fake profile on LinkedIn has been using it as a cover to send malware to companies. After first getting in touch with a target about a possible job, the attacker sends a follow-up email with an attachment, supposedly with a job description, or a link. The link goes to a web page that looks like a hiring company, but leads to making the victim download a document with malware that allows the attacker into the victim’s computer. Some victims are targeted specifically, for example people who work in banks investigating money laundering. Your defence is to be suspicious of messages from strangers, and be very careful with every attached document and link you get.
Finally, there’s an early report of a new strain of ransomware. According to Bleeping Computer, it has been seen infecting Linux servers and websites, although it may work with Windows. As with any ransomware, backups are essential. Also server administrators have to make sure they lock down servers, limit who has access to them and make sure those who do have access use multifactor authentication for logging in. That way if a criminal has the password it still doesn’t give them access to a device.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals.
Cyber Security Today can be heard Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon
