Stay away from parcel notice texts, Microsoft urges companies to install a patch and customer information of millions up for sale.
Welcome to Cyber Security Today. It’s Monday November 2nd. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com. To hear the podcast click on the arrow below:
 |
 |
 |
Smartphone users should be careful if they get a text message about an unexpected package delivery. Security firm Kaspersky says a cybercriminal has recently been sending out messages primarily to Americans saying “Your parcel has been sent out. Please check and accept it.” If Android users click on the link, up pops a message saying your browser is out of date and needs to be updated. Click on that link and instead of a browser fix you download malware. Then the malware can use your phone to send bad texts to others, steal your contact list and ultimately steal your username and password. The scam works a little different with an iPhone. Click on the first link and you’ll get sent to a page that looks like an Apple ID login page, where the site tries to steal your username and password. Remember, think carefully before clicking on links in texts and emails from unknown senders. If possible, go to into your settings and disable the installation of apps from third parties.
Someone is selling stolen databases from 17 companies with 34 million customer records on a hacker forum. They includes names, email addresses, some scrambled passwords and other information. The news site Bleeping Computer reports victim companies are in sectors like finance, restaurants and schools in the U.S., the United Kingdom Mexico, Brazil and other countries. The biggest customer database was from RedMart, an online grocery service based in Singapore. It appears all of the databases were stolen this year.
Here’s another example of organizations that aren’t doing enough to make sure employees properly secure data sent to cloud storage systems. Florida’s Martin County backs up data. That’s good. It sends some backup data off-site to an Amazon S3 storage bucket. That’s also good. But one collection of files was left unsecured and open to anyone on the Internet who knew how to access it. That’s bad. The discovery was made by researchers at the security firm UpGuard. Some of the data was described as sensitive, including email addresses of county staff who had access to the IT systems, and six people who worked for the supervisor of elections. There were also scrambled passwords. An attorney for the county told the Gizmodo news site that the data was obsolete. Doesn’t matter. It should have been secured.
Microsoft has issued another warning to IT administrators to install a security patch to Windows Server and all domain controllers. This fixes a big vulnerability in Active Directory. The Directory controls which resources employees can log into, a capability called Netlogon. In August Microsoft issued a patch to plug the Netlogon vulnerability, which could allow a hacker to steal the password to the domain controllers that verify users logging in. Microsoft says it is still hearing that this vulnerability is being exploited by hackers on systems that have not been patched.
By the way, a lot of individuals or organizations around the world may not have patched Windows with a fix Microsoft issued as far back as March. A security researcher from the Czech Republic says a scan of the Internet suggests 103,000 PCs have still not installed the fix for a bug called SMBGhost.
Once a month you should check with Windows Update to make sure the latest patches have been downloaded. The best time is the second Tuesday of the month, when Microsoft releases the latest security fixes.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cybersecurity professionals.
Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening.