Inflation benefits scam aimed at Canadians, a warning for Fortinet administrators and more.
Welcome to Cyber Security Today. It’s Wednesday, November 30th, 2022. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com.
 |
 |
 |
Cyber crooks are trying to take advantage of a government of Canada promise to help businesses and people meet rising inflation. Researchers at Kaspersky said this week they discovered 40 web domains with pages that looks like a Canadian government web site — complete with the Canadian flag — offering an anti-inflation benefit. Victims are asked to enter income tax, payroll or business information to calculate what they might be entitled to. Those who do are sending that information not to the government but to crooks. The Canadian government actually did announce an anti-inflation Affordability Plan in June, so this scam could have been going on for months. However, the government doesn’t have website to calculate what you might get. Around the world crooks regularly run government benefits scams. Pandemic-related scams are common. So are income tax return scams. These usually start with people getting emails or text messages that appear to come from governments. If you get one, don’t click on the link. Always go to a government web site by typing in an address you know is authentic.
Threat actors are selling access to compromised Fortinet network security products. That’s the word from researchers at Cyble, who say attackers are taking advantage of an unpatched vulnerability in products using the FortiOS operating system. In particular they are going after organizations using Fortinet’s VPN. It’s vital network and security administrators with Fortinet products install the latest security updates.
Baseboard management controllers are part of motherboards that enable IT administrators to remotely monitor low-level system operations of computers. Commonly found in servers, these baseboard controllers are increasingly being used in operational technology and internet of things devices for industrial equipment. So any vulnerabilities can be used by hackers to cause serious damage. I’m telling you this because researchers at Nozomi Networks have discovered 13 holes in some baseboard management controllers made by a network appliance manufacturer called Lanner. Lanner has issued updated firmware to fix the vulnerabilities. Regardless of whether your IT or OT environment has Lanner equipment, this is another reminder to IT administrators to forbid internet access to servers and other equipment unless it’s needed — and when it is needed, remote access should require protection like a VPN.
Facebook’s parent company Meta Platforms has been fined the equivalent of US$277 million by Ireland’s privacy commission for not adequately protecting users personal information. This follows the discovery last year of a file of personal data of over 500 million people stolen by hackers by scraping users’ profiles. The Irish privacy commission was acting on behalf of the European Union. According to The Hacker News, that scraping capability has been removed.
Acer is working on a firmware update to address a vulnerability in some models of Aspire and Extensa laptops. If it isn’t fixed an attacker could make changes to the Secure Boot settings and do nasty things. The update will be available on the Acer Support website or on the Windows update site.
Crooks are taking advantage of a challenge game on TikTok to spread malware. The game is called an “Invisible Challenge,” where a person films themself naked using a special video effect called “Invisible Body.” The effect removes the person’s body from the video, making a blurred contour. But according to researchers at Checkmarx, crooks have created videos with links to an “unfilter” that supposedly remove the TikTok filters. Don’t fall for this lure. What happens is you download malware that steals passwords as well as personal information of Discord subscribers.
Finally, today is National Computer Security Day. I know, we just had Cyber Security Awareness Month in October. But Computer Security Day was created in 1988 by the Association of Computing Machinery after a worm was discovered in the computer system of Cornell University. So for those of you doing penance for not doing enough last month, think today about how to be safer on your computer at home and at work. At home that means making sure devices — including routers — have safe passwords, being careful before clicking on links in emails and texts, creating safe passwords on sites you go to, having a different password for every site you subscribe to, using a password manager to keep track of your passwords and enabling multifactor authentication to protect your login accounts. And in case you’re losing track, Data Privacy Week starts January 24th, Safer Internet Day is February 7th, National Clean Out Your Computer Day is February 13th — and there’s Backup Day, World Password Day …. I don’t make this up.
That’s it for now Remember links to details about podcast stories are in the text version at ITWorldCanada.com.
Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.