Phone scam to scare Canadians, email Post Office scam hits the U.S., get ready for holiday online sales and more
Welcome to Cyber Security Today. It’s Friday November 15th. I’m Howard Solomon, contributing reporter on cyber security for ITWorldCanada.com. To hear the podcast click on the arrow below:
 |
 |
 |
Attention Canadians: There’s a new voicemail scam going on. The recorded woman’s voice claims to be from the legal department of Service Canada, saying you are being sued by the Justice Department regarding your Social Insurance number. Then you’re asked to press a number on your phone to speak to an agent. Ignore this call. If you have call display, write the call number down and have it blocked on your phone. And report this and any other phone scam to your phone provider or the National Do Not Call List 1-866-580-3625.
Speaking of impersonation, security firm Proofpoint has found what appears to be a new criminal gang sending email to businesses pretending to be the U.S. Post Office. The hook is an infected Microsoft Word attachment. Victims who click on the document see a letter with logos from the Post Office and a security company called RSA that says the letter been encoded. It asks the victim to Enable Editing and Enable Content so they can see the message. This is a mistake. Do it and malware gets downloaded. The email address of the sender looks real, but it’s fake: If it’s from “uspsdelivery-service[.]com”, delete it.
The gang is doing a similar version of the scam in Germany and Italy, sending attachments with letters that have copies of real logos that appear to come from either from the tax department or an Internet provider.
Attention users of Symantec Endpoint Protection antivirus products: Make sure you’re running the latest version. A vulnerability has been found. A patch was issued on October 22nd. If you haven’t updated the software since then, do it now.
Does your company sell consumer products online? If so, I hope that weeks or months ago your Web site and e-commerce processor were checked for vulnerabilities in preparation for Black Friday, Cyber Monday and the following holiday sale season. Criminals have been doing some preparation. According to a security firm called PerimeterX, as far back as September automated bots run by gangs have been probing Web sites with test credit cards. They’re looking to see if the stolen or phony credit cards they have are valid for stealing products. This is now mid-November. It’s probably too late for e-commerce suppliers to do a major update of their systems, but they do need to increase their monitoring of suspicious behavior. One tipoff: The online purchaser goes to checkout without anything in a shopping cart. What’s going on is the criminal wants to see if they have a valid credit card. If you haven’t done so recently, hire a consultant to test your site for possible fraudulent payment problems.
Companies fight like hell with competitors. However, that attitude won’t help fight cyber criminals. At a conference I was at this week in Toronto, Canadian companies were urged by an official from the Bank of Canada to share more threat intelligence. They also need to do more test exercises, not only individually but across industries. What happens, for example, if several banks, phone companies, transport companies or power providers in a region are simultaneously hit by malware and forces them temporarily offline? Companies have to tell IT staff that cyber security is an area to collaborate and not compete on. How’s your company doing?
Finally, Android users can set up their devices to automatically send notifications when security updates are available from the manufacturer or the Google Play store, or they can check manually. Either way, this is something users need to pay attention to. I’m telling you this because a serious vulnerability has been found by security company Check Point Software in the Qualcomm processor chips used by a number of companies like Samsung, Sony, HTC and Pixel. Without getting too technical, the processor has a way to make sure the operating system, apps and data are protected from attack. If exploited the vulnerability could break the protection. Manufacturers are in the middle of pushing out security updates now. So, regularly make sure your Android smart phone or tablet has application and manufacturer updates.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.