News

Facebook Data Harvesting

‘Utterly horrifying’: ex-Facebook insider says covert data harvesting was routine

Sandy Parakilas says numerous companies deployed these techniques – likely affecting hundreds of millions of users – and that Facebook looked the other way

Sandy Parakilas in San Francisco
 Sandy Parakilas in San Francisco. ‘It has been painful watching. Because I know that they could have prevented it.’ Photograph: Robert Gumpert

Hundreds of millions of Facebook users are likely to have had their private information harvested by companies that exploited the same terms as the firm that collected data and passed it on to Cambridge Analytica, according to a new whistleblower.

Sandy Parakilas, the platform operations manager at Facebook responsible for policing data breaches by third-party software developers between 2011 and 2012, told the Guardian he warned senior executives at the company that its lax approach to data protection risked a major breach.

“My concerns were that all of the data that left Facebook servers to developers could not be monitored by Facebook, so we had no idea what developers were doing with the data,” he said.

Parakilas said Facebook had terms of service and settings that “people didn’t read or understand” and the company did not use its enforcement mechanisms, including audits of external developers, to ensure data was not being misused.

Parakilas, whose job was to investigate data breaches by developers similar to the one later suspected of Global Science Research, which harvested tens of millions of Facebook profiles and provided the data to Cambridge Analytica, said the slew of recent disclosures had left him disappointed with his superiors for not heeding his warnings.

“It has been painful watching,” he said, “because I know that they could have prevented it.”

Read the full story at www.theguardian.com

Ransomware in targeted attacks

Ransomware’s popularity has attracted the attention of cyber criminal gangs; they use these malicious programs in targeted attacks on large organizations in order to steal money. In late 2016, we detected an increase in the number of attacks, the main goal of which was to launch an encryptor on an organization’s network nodes and servers. This is due to the fact that organizing such attacks is simple, while their profitability is high:

  • The cost of developing a ransom program is significantly lower compared to other types of malicious software.
  • These programs entail a clear monetization model.
  • There is a wide range of potential victims.

Ransomware’s popularity has attracted the attention of cyber criminal gangs; they use these malicious programs in targeted attacks on large organizations in order to steal money. In late 2016, we detected an increase in the number of attacks, the main goal of which was to launch an encryptor on an organization’s network nodes and servers. This is due to the fact that organizing such attacks is simple, while their profitability is high:

  • The cost of developing a ransom program is significantly lower compared to other types of malicious software.
  • These programs entail a clear monetization model.
  • There is a wide range of potential victims.

Today, an attacker (or a group) can easily create their own encryptor without making any special effort. A vivid example is the Mamba encryptor based on DiskCryptor, an open source software. Some cybercriminal groups do not even take the trouble of involving programmers; instead, they use this legal utility “out of the box.”

DiskСryptor utility

The model of attack looks like this:

  1. Search for an organisation that has an unprotected server with RDP access.
  2. Guess the password (or buy access on the black market).
  3. Encrypt a node or server manually.

Related image

Notification about encrypting the organization’s server

The cost to organize such an attack is minimal, while the profit could reach thousands of dollars. Some partners of well-known encryptors resort to the same scheme. The only difference is the fact that, in order to encrypt the files, they use a version of a ransom program purchased from the group’s developer.

However, true professionals are also active on the playing field. They carefully select targets (major companies with a large number of network nodes), and organize attacks that can last weeks and go through several stages:

  1. Searching for a victim
  2. Studying the possibility of penetration
  3. Penetrating the organization’s network by using exploits for popular software or Trojans on the infected network nodes
  4. Gaining a foothold on the network and researching its topology
  5. Acquiring the necessary rights to install the encryptor on all the organization’s nodes/servers
  6. Installing the encryptor

Read the full story at SecureList.com

Ransomware – What you need to know!

Ransomware is an extremely high risk cybersecurity threat that security industry experts worldwide, expect to grow significantly this year and beyond.

Ransomware is essentially malicious software that gives a hacker the ability to lock you out of your business by encrypting mission critical files on individual computers or across entire networks.

Ransomware is an extremely high risk cybersecurity threat that security industry experts worldwide, expect to grow significantly this year and beyond.

Ransomware is essentially malicious software that gives a hacker the ability to lock you out of your business by encrypting mission critical files on individual computers or across entire networks.

Cybersecurity Research on Ransomware

According to one a recent cybersecurity research report more than 8 million samples of ransomware were active in the second quarter of 2016.

It is critical now more than ever, that businesses and their staff are properly educated to mitigate this growing threat.

Ransomware can cost you a lot more than money.
Ransomware can cost you a lot more than money. How long could you survive if your business was locked out of its critical systems?

The minute the attacker gains access, files and folders can be encrypted that can only be released, usually by paying huge sums of money – hence ransom.

There are a few key points to note about ransomware enterprise attacks:

  1. The attacker typically has a list of the file extensions that they are going to encrypt. These files tend to be essential to business operations.
  2. Reverse-engineering the encryption (“cracking”) the files, is virtually impossible without the original encryption key. The attackers are the only people who will have the original encryption key.
  3. Unintentional human error due to a lack of cybersecurity education is one of the top reasons that hackers are able to infiltrate a network or computer.

What Precautions Can Businesses Take?

Ransomware can work its way into a computer, server, or network from practically any source. Popular modes of entry include:

  • Unsafe, un-validated, or fake websites.
  • Emails and email attachments that employees open from unknown recipients.
  • Clicking on malicious links that are embedded within social media posts, instant messenger chats, or emails.

Ransomware Tactics:

One of the best tactics to avoid ransomware attacks is to ensure that your employees are educated about the potential dangers.

From teaching employees to never click on a suspicious embedded links, to showing them how to spot fake emails, or webpages. Education is paramount to protecting your business and data assets. In addition to employee education, company-sensitive, confidential, and important files should be securely backed up in an unconnected and secure storage facility.

By taking the latter precaution you can mitigate the bargaining power of a hacker using ransomware.

Final Thoughts

Ransomware can be used by domestic and international hackers at any point in time, unless businesses take the steps needed to protect their vital data and computer systems.

Education, secure data storage, and working with a top cybersecurity company can help businesses to avoid the costly repercussions of a ransomware attack.

 

5 Reasons Consultants Should Blog

Most consultants know they should have a website. But I get asked all the time by those new to consulting whether or not they should have a blog.

My answer is yes, but with a couple of caveats.

If you’re going to start a blog make sure you have something to say. And be sure you can keep it up.

This advice goes for all companies…

There’s nothing worse than setting up a blog, connecting it to your website, posting a couple of articles…and then months go by and there’s no new content.

Certainly it’s not good for your image. Imagine a prospective client checking out your website, clicking on ‘Blog’ and then seeing that your last post was 6 months ago.

Ouch! That aint pretty.

Aight, so now we’ve explored the dark side of blogs and what you should consider before starting one.

But how about the positives, you ask? There are many:

1. Search Engine Love – Search engines such as Google love content from blogs. Especially when it comes out consistently. If you put up even a short post every couple of days or weeks your blog and therefore website traffic will climb.

2. You The Expert – You’re a pro right? Of course you are. Writing about your experience, sharing stories, consulting case studies, etc is a great way to demonstrate your expertise and become known as an authority.

3. Get Found – As you publish your posts you’ll start being found in the search engines by people looking for information on the topic you’ve written on. This is a great way to get contacted by potential consulting clients.

4. Easy to Get Started – Setting up a blog is eeeaasssy! Seriously. Even if you don’t have one technical bone in your body, you can pay someone through a service like Elance or oDesk to help you setup your blog. Yeah, it might cost you $100 but it’s worth it. You can also look at services like WordPress.org, WordPress.com and Posterous – which all make getting a blog setup a real snap.

5. No Genius Required – There’s a myth out there that you need to be a talented and prolific writer to have a blog. That’s definitely not the case. I was nowhere near an A+ student in writing during my school days. That didn’t stop me from writing advertisements and direct mail copy for billion dollar companies and that certainly hasn’t stopped me from blogging and writing for you.

As long as you can devout some time each week or so to writing a post for your blog the benefits far outweigh the risks.

If you’d like more information about blogs and blogging ask us in the comments below.