Scam of the day – February 4, 2017 – Hotel suffers ransomware attack

Ransomware is  a type of malware that gets unwittingly downloaded on to a company’s, institution’s, government agency’s or individual person’s computer, which when downloaded encrypts the data of the victim.  The victim is then told to either pay a ransom, generally in bitcoins within a short period of time, or the hacker will destroy the data.

In a new twist on the ransomware story, the computer system of the Seehotel Jaegerwirt hotel in Austria became infected with ransomware that controlled the electronic key system for the hotel which creates the cards used as keys for each hotel room preventing the hotel from issuing new keys.  Faced with an inability of their newly  arrived guests to access their rooms, the hotel quickly acquiesced to the demands of the hackers and paid a bitcoin ransom of approximately $1,600 to the hackers who then gave them back control over their systems.  Interestingly, a spokesman for the hotel said that when the hotel rooms are refurbished in the future, the hotel intends to revert back to old-style door locks and actual keys in order to avoid problems such as this in the future.

Ransomware has become one of the most common and effective cybercrimes in the last year, successfully targeting individuals and a wide range of companies including law firms, accounting firms and even police departments. According to the United States Justice Department, ransomware attacks quadrupled last year to more than 4,000 per day.  As big a problem as ransomware was last year, I predict it will be much worse in 2017.

TIPS

The key to not becoming a victim of a ransomware attack is to prevent it in the first place.  Generally, the malware is installed unwittingly by victims when they are lured through phishing and spear phishing emails to click on links infected with the malware.  Never click on links in emails or text messages regardless of how legitimate they may appear until you have verified that it is legitimate.  You should also install anti-phishing software.

It is also important to not only have anti-malware software installed on all of your electronic devices, but to make sure that you update the security software with the latest security patches and updates.  Many victims of ransomware have fallen victim to strains of ransomware for which there are already security software available to thwart it.   Finally, always back up your computer’s data daily, preferably in two different ways in order to protect your data in the event you do become a victim of ransomware.

Scam of the day – January 24, 2017 – Utility bill scams

Scams regarding payments of utility bills are occurring with greater frequency now that Winter has arrived.  The Nebraska Public Service Commission is warning consumers about a number of these scams, but these scams are certainly not limited to Nebraska.

In one version of the scam, potential victims receive telephone calls purportedly from their utility company informing them of a special company promotion for which they are eligible.  They just need to provide some personal information.

In another version, potential victims are called on the phone and told that their utility service will be terminated for non-payment unless they pay by credit card over the phone.

In a third version of this scam, potential victims receive an email that has a link to take them to their bill.

All of these are scams.  In the first, there is no special promotion and the victim ends up providing personal information that leads to identity theft.  In the second, the victim is coerced into giving their credit card information to a scammer and in the third, merely by clicking on the link to go to the phony bill, the victim ends up downloading keystroke logging malware or ransomware that can lead to identity theft or worse.

TIPS

You can never be sure when you get an email or a telephone call if it is really from a legitimate source.  Email addresses can be hacked to appear legitimate and even if you have Caller ID, a scammer can use a technique called “spoofing” to make it appear that the call is from a legitimate caller.

Trust me, you can’t trust anyone.  Never provide personal or financial information to anyone in response to a telephone call, text message or email until you have independently confirmed that the communication was legitimate.  In the case of a utility bill, merely call the number on the back of your bill and you will be able to confirm whether or not the communication was legitimate.  Also, never click on links unless you have confirmed that they are legitimate.  The risk is too great.

Scam of the day – January 22, 2017 – College falls victim of ransomware

Ransomware, as regular readers of Scamicide know, is  a type of malware that gets unwittingly downloaded on to a company’s, institution’s, government agency or individual person’s computer, which when downloaded encrypts the data of the victim.  The victim is then told to either pay a ransom, generally in bitcoins within a short period of time, or the hacker will destroy the data.

The latest public victim of ransomware is the Los Angeles Valley Community College District which recently paid a $28,000 bitcoin ransom after ransomware locked the campus’ computer network along with its email and voicemail systems.  After paying the ransom, the code was delivered to the school enabling them to regain their files and control over their email and voicemail systems.

Ransomware has become one of the most common and effective cybercrimes in the last year, successfully targeting individuals and a wide range of companies including law firms, accounting firms and even police departments. As big a problem as ransomware was last year, I predict it will be much worse in 2017.

TIPS

The key to not becoming a victim of a ransomware attack is to prevent it in the first place.  Generally, the malware is installed unwittingly by victims when they are lured through phishing and spear phishing emails to click on links infected with the malware.  Never click on links in emails or text messages regardless of how legitimate they may appear until you have verified that it is legitimate.  You should also install anti-phishing software.

It is also important to not only have anti-malware software installed on all of your electronic devices, but to make sure that you update the security software with the latest security patches and updates.  Many victims of ransomware have fallen victim to strains of ransomware for which there are already security software available to thwart it.   Finally, always back up your computer’s data daily, preferably in two different ways in order to protect your data in the event you do become a victim of ransomware.

Scam of the day – January 19, 2017 – W-2 scam

We have just come out of the holiday season which is, perhaps, the biggest time of the year for scams and now we are entering the income tax season which probably runs a close second when it comes to scams.

Employers are now sending out W-2 forms to employees which are necessary for the employees to complete their income tax returns.  Many employers will send an email to employees about obtaining their W-2s online and scammers are taking advantage of this by sending emails that appear to come from the potential victim’s employee which contain a link to be used to view and then print the victim’s W-2.  However, when scammers send these phishing emails they are seeking the username and password of the victim which will be provided to the scammer when the victim clicks on the link and provides this information when prompted.  This can lead to identity theft.  In another variation of this scam, merely by clicking on the link, the victim downloads keystroke logging malware that will steal all the information in the victim’s computer and use it to make the person a victim of identity theft.  In yet another variation of the scam, clicking on the link will download dangerous ransomware.

TIPS

Employers will generally not include a link in legitimate emails to access their W-2 forms online.  Instead they will instruct the employee to go directly to this information at the appropriate department within the employer using their username and password separately.    Even if your employer were to provide a link in such a legitimate email, you could never be sure that the email was from your employer so you should not click on the link.  It is better to independently go to the department of your employer that has this information.

Scam of the day – December 19, 2016 – Android Super Mario Run scam

Super Mario Run is presently the most popular game in the App Store for iPhones and other Apple devices. Unfortunately, for those of you with Android devices, Nintendo has not yet created an Android Application Package version of Super Mario Run although scammers are indicating throughout the Internet that they have free Android versions of Super Mario Run that you can download.  This is a total scam. Sometimes a leaked version of a game is leaked before it is officially launched, however, in this instance, Nintendo hasn’t created one yet so there is nothing to leak.  Anytime you download an Android version of Super Mario Run, you are running the risk of downloading attached malware that can be used to steal your identity or bring other dangers such as ransomware.

TIPS

Free apps loaded with malware present a tremendous danger.  The best thing you can do is to stay with sources such as the App Store or Google Play that you know are legitimate when looking for apps.  Although neither of these companies are perfect when it comes to investigating apps to make sure they are legitimate and not filled with malware, they both do a pretty good job of vetting apps before they are made available to the public.

December 18, 2016 – Steve Weisman’s latest column for USA Today

Looking ahead to the new year and the challenges it will present in regard to cybersecurity, here is my latest column from USA Today in which I present my predictions for the world of cybersecurity for 2017.  Although it may seem a bit daunting, there are steps we can all take to protect ourselves and I will describe those in my next column.

http://www.usatoday.com/story/money/columnist/2016/12/17/think-cyberthreats-bad-now-theyll-get-worse-2017-spear-phishing-etc/95262574/

Scam of the day – November 30, 2016 – San Francisco commuter rail system hacked

Late on November 25th, the San Francisco Municipal Transportation Agency (SFMTA), which operates the municipal rail system in San Francisco, referred to as “Muni” was hacked when an SFMTA employee unwittingly clicked on a link in a phishing email and downloaded ransomware that locked and encrypted all of the SFMTA computer systems.  The hacker, who is thought to be Iranian, demanded a ransom of 100 bitcoins which is approximately $73,000 or he would destroy the data.  The SFMTA is refusing to pay the ransom and has indicated that it has backed up the encrypted data which, it says will be restored shortly.

Meanwhile, according to security research Brian Krebs, a white hat hacker hacked into the email of the original hacker and managed to take over the original extortionist’s email account by answering the extortionists security question.  The email account provided evidence that the hacker had been active in installing ransomware and obtaining ransom payments from numerous companies.

TIPS

There are a number of lessons for all of us as individuals to learn from this incident.  First and foremost is to install and maintain good security software including software that will help defend you against phishing emails.  However, no security software is totally effective against phishing emails, so you never click on links in any email unless you have absolutely confirmed that the email is legitimate.  Second, you should back up all of your data either in the cloud or on a portable USB hard drive to protect yourself from the danger of ransomware. Finally, in regard to security questions, which when answered give someone the ability to change your password, you should use a nonsensical answer to the question so it cannot be guessed or obtained through research about you.  For instance, if the question is what is your mother’s maiden name, you might make the answer “firetruck.”  You will remember it because it is so silly, but no one will be able to guess it by going through online data bases or social media.

Scam of the day – October 7, 2016 – Kim Kardashian robbery leads to 2,400% increase in scams

It was only four days ago that I warned you about scams linked to popular celebrities listed in security software company McAfee’s list of the ten most dangerous celebrities on the Internet.  These are people whose popularity is exploited by identity thieves and hackers who lure unsuspecting people through links in emails, social media and text messages relating to these celebrities to malware filled websites where they unknowingly download ransomware or keystroke logging malware that enables the identity thieves to steal all of the personal information from the victim’s computer, laptop, smartphone or other electronic device and use that information to make the person a victim of identity theft.  Whenever something or someone is of great interest to the public, scammers promptly capitalize on that interest to lure people into falling prey to online scams that promise to provide photos or information about the person or event and so it has been with the ten million dollar Paris jewel robbery of Kim Kardashian.  According to security software company, Norton, online scams related to Kim Kardashian increased by a startling 2,400% in just the first twenty-four hours following the robbery.  Emails, text messages and social media posting promising news about the robbery have been used to lure people into clicking on malware infested links. As an indication of the wide popularity of Kim Kardashian, these scams are appearing in English, French and German.

TIPS

Never click on links or download attachments unless you are absolutely sure that they are legitimate.  Merely because it appears that a friend is passing them on to you does not make them legitimate.  Your friend’s email or smartphone could have been hacked or your friend could unwittingly be passing on malware.  As for celebrity news, you should have a healthy mistrust of websites with which you are not entirely familiar.  If the information promised is legitimate, it will be able to be found in trustworthy news websites.  Finally make sure that you keep all of your electronic devices secure with anti-malware and anti-virus software and keep your security software current with the latest security patches.

Scam of the day – September 4, 2016 – The dangers to you from your kids on your computer

If you are a parent of young children or even not so young children, you certainly have noticed how comfortable your children are with computers.  In fact, they are often too comfortable.  When we become victims of malware such as keystroke logging malware that steals the data from your computer and uses it to make you a victim of identity theft or ransomare which destroys your data unless you pay a ransom, the culprit is usually someone who clicked on a phishing or spear phishing link in an email or went to an infected website and unwittingly downloaded the malware.  Yet children, using the family computer, often do not think about these dangers, such as when they click on links for free music or video games.

TIPS

The first step, of course is to educate your children as to the dangers found on computers and the Internet, but there are a number of other steps you should be taking, as well such as:

  1.  Set up your computer with limited user accounts for your children that, in theory, will prevent them from downloading software or changing the settings on your computer.
  2.  Use the parental control features found in your computer called Family Safety in Windows 8 and Windows 10.
  3.  Don’t store sensitive personal information on your computer.  This is a good rule for all of us whether or not you have children.  Encrypt sensitive data and store it on a USB external hard drive that is not connected to the Internet.  This is particularly important in protecting your computer from ransomware.
  4. Don’t let your kids know your passwords and security questions to your computer or accounts.

Finally, as Murphy’s Law instructs us, what can go wrong, will go wrong, so have your children use their own computer that is not connected to yours so even if they falter and do unwittingly download malware, your computer and the information contained therein will not be in danger.

Scam of the day – August 18, 2016 – Major data breach at health care provider

Recently a Ukranian hacking group called “Pravyy Sector” managed to hack into the server of the Central Ohio Urology Group, which includes twenty-four clinics and posted online literally hundreds of thousands of files that included massive amounts of personal information that could be exploited for identity theft and other illegal purposes.  While you may not be a patient of Central Ohio Urology Group and therefore may not consider this to be a serious matter, but it is very serious because it is just another example of the pervasive lack of security in the health care industry.

As I warned everyone in my USA Today column in which I made my cyberpredictions for 2015, the health care industry is tremendously vulnerable to data breaches and we can expect these data breaches to continue.  Here is a link to that column.  http://www.usatoday.com/story/money/personalfinance/2014/12/20/cyber-hack-data-breach/20601043/

An audit of health care companies and insurers showed that more than 81% of these companies have suffered a data breach in the last two years alone and that number only relates to the data breaches that have been discovered.  There may have been more that remain undiscovered.   The health care industry is the perfect storm for data breaches.  It is a highly digitized industry that has massive amounts of personal information that it shares with numerous offices and institutions and yet has not, in many instances instituted the necessary security precautions to protect the information stored.

The potential consequences of medical company data breaches can be tremendous to affected individuals.  The medical records of an identity thief accessing your medical insurance can become intermingled with your medical records such that you can mistakenly receive improper treatment, such as a potentially deadly blood transfusion of the wrong blood type.  Other information such as your Social Security number which may be stored by a health care provider can be stolen and used for purposes of more traditional identity theft. Finally, the vulnerability of the computer systems of health care providers has made them prime targets for successful ransomware attacks.

TIPS

The health care industry has got to recognize that it is a prime target of hackers and identity thieves.  Encryption of all data should be the rule and not the exception for health care providers.  Authorization authentication to access records from both on-site and particularly off-site should be enhanced.  As for us as the patients, we should limit the amount of personal information given to health care providers if they do not have a need for it.  Health care providers do not need our Social Security numbers.  Don’t give it to them.  We also should demand that they institute better data security measures.