Google erases bad Chrome extensions, Wells Fargo customers get attacked and Netgear router owners warned.
Welcome to Cyber Security Today. It’s Friday June 19th. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.
 |
 |
 |
Google has prevented 111 bad Chrome extensions from running in its browser, 79 of which had been available from its Chrome store. That’s after discovery of the malicious apps by a security firm called Awake Security. Extensions are utilities that promise to make your web surfing easier, such as secure web searching. In this case once installed the malicious extensions took screenshots, read data stored in the Windows clipboard, harvested identification or login credential tokens stored in cookies and grabbed user keystrokes including passwords. These extensions were downloaded 32 million times from the Chrome store alone — and they were offered in other places as well. If downloaded by business and government employees onto office computers those organizations are at risk. The suspicion is many of these bad extensions were created or managed by one group which has been slurping up stolen data. The lesson here is just because something is offered in the Chrome store — or Google’s Android Play store — doesn’t mean it’s safe. See if it’s reviewed independently. Be particularly wary of extensions and apps that are new and have only recent reviews in the online store.
Customers and employees of Wells Fargo are being warned of an email scam that pretends to come from the financial institution’s security team. According to security company Abnormal Security, the message says they are being sent a new digital security key to protect their account from identity theft and fraud. It asks them to open the attachment with a mobile device. Ironically, clicking on the attachment led to a fake login pager where usernames, passwords and PIN numbers could be copied for — you guessed it, identity theft and fraud. There was at least one give-away that this is fake: While the subject line said “Message from Wells Fargo Security Centre,” the sender’s email address was obviously not from Wells Fargo. Another tip-off is why would you be asked to open an attachment only on a mobile device? Probably because security on mobile devices isn’t as good as a desktop computer.
Owners of Netgear routers should look for security updates after being warned by two researchers of a vulnerability that could allow the devices to be hacked. That would allow an attacker to get into the computers of the owners and steal data. A researcher estimates 79 models of Netgear routers going back to 2007 are affected. Netgear has been notified. However, users should remember that manufacturers usually only update recent models. Owners of any router should regularly check the manufacturer’s website to see if firmware updates are available. If a model is no longer supported it’s time to get a new one.
I recently mentioned that the Zoom videoconferencing service had decided to offer end-to-end encryption only for paying customers. End to end encryption offers the best protection against someone hacking your video call. After protests the company has changed its mind. Soon the free service will be updated to have end to end encryption as well.
Finally, if you’re having printing problems after installing this month’s Windows update, Microsoft this week released fixes that may solve the problem. They’re available at the Microsoft Update Catalog web site.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cybersecurity professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.