The post Your Mac Is Not Virus Proof. It Never Has Been. appeared first on Cyber Security Plus.

Two-factor authentication, the added security step that requires people enter a code sent to their phone or email, has traditionally worked to keep usernames and passwords safe from phishing attacks.

However, security experts have demonstrated an automated phishing attack that can cut through that added layer of security—also called 2FA—potentially tricking unsuspecting users into sharing their private credentials.

The attack was first demonstrated at the Hack in the Box Security Conference in Amsterdam last month. A video of the presentation was posted on YouTube on June 2, bringing renewed attention to how hackers are getting better at penetrating extra layers of security, despite people using stronger tools, like 2FA.

The hack employs two tools, called Muraena and NecroBrowser, which work in tandem to automate the attacks. The two tools work together like the perfect crime duo. Think of Muraena as the clever bank robber, and NecroBrowser as the getaway driver.

Muraena intercepts traffic between the user and the target website, acting as a proxy between the victim and a legitimate website. Once Muraena has the victim on a phony site that looks like a real login page, users will be asked to enter their login credentials, and 2FA code, as usual. Once the Muraena authenticates the session’s cookie, it is then passed along to NecroBrowser, which can create windows to keep track of the private accounts of tens of thousands of victims.

A demonstration of the attack was also released on GitHub, an open source coding site, to provide developers an opportunity to see how it works.

Amit Sethi, senior principal consultant at Synopsys, who was not affiliated with the presentation, says that while attacks against 2FA have been demonstrated in the past, these tools “make one of these attacks easier to execute for lower-skilled attackers.”

Despite this hack, 2FA is still considered a best security practice—far better than the alternative of simply relying on a username and strong password, according to security experts.

“Of course this does not mean that people should not worry,” says Sethi. “We now need to be even more diligent about detecting phishing attempts.”

The researchers, and Sethi, both say that universal second factor is a strong solution, when available. A U2F key is a secondary, physical device that can be plugged into a computer port as an additional way of verifying a person’s identity after they enter their username or password.

If that’s not an option, Sethi also says being vigilant can help thwart potential 2FA phishing attacks. That includes not clicking on links in suspicious emails, checking the a web address in the browser before entering credentials, and avoiding entering sensitive information when using public Wi-Fi.

“If you suspect that your credentials for a website have been compromised, act quickly to change your password, and report the event to the website

The post Hackers Can Now Bypass Two-Factor Authentication With a New Kind of Phishing Scam appeared first on Cyber Security Plus.

As a parent, you have young ones to monitor at all times – not to mention the rest of the household. Being full-time manager of your child’s online activity can feel like a big chore. But we all know that it is necessary.

While we know that it is necessary, did you know that parental controls can go beyond a few websites or Netflix accounts? You can set up parental controls on your entire WiFi network (and you need to).

Here’s why:

Why you need parental controls on your home WiFi network

There are three key reasons to set up parental controls on your home WiFi network:

1. Controlling devices and content access
2. Setting time limits on daily Internet usage
3. Customisation for your home network

Setting up parental controls on your home WiFi helps you monitor your child’s (and their friends’) online content access as well as device usage. With parental controls set on your entire WiFi network, you control everything.

Overall, these settings let you know exactly what everyone is doing on your network and when (because you customized it!).

Here’s how to set them up:

How to set up parental controls on your home WiFi network

Setting up parental controls for your WiFi network is easier than you might think. Often you can just log into your account and configure your router with the parental control settings.

Since your router is the centre of your entire network, you can filter the web for any or all devices that are connected through it. This means you can control your child’s computer, smartphone, tablet, gaming console, you name it.

If your router does not have these settings by default, consider investing in a newer model that does. This will make WiFi security much easier on your part.

The post Why You Should Setup Parental Control On Your Home Network appeared first on Cyber Security Plus.

The BBC, British Airways, Aer Lingus and Boots are among the companies whose staff have been affected by the MoveIt data breach.

And more organisations are expected to issue staff warnings, as the extent of the breach is discovered.

But what action can those caught up in mass hacks take?

Don’t panic

In the early stages of an attack such as this, the most pressing advice is aimed at the organisations.

Hackers are not interested in going after individuals – it is too time consuming and they care about one thing only, getting paid.

And they will probably send ransom demands to the organisations breached, asking for the cryptocurrency Bitcoin.

“The important message to organisations right now is not to panic, to install the security patch and not to pay the criminals,” former National Cyber Security Centre lead Prof Ciaran Martin says.

But once an organisation has been breached, the hackers have the upper hand.

• Should paying hacker ransoms be banned?
• Study: UK firms most likely to pay hacker ransoms

And the criminals thought to be responsible for the MoveIt hack are notoriously ruthless with their extortion techniques.

Don’t pay

The hackers often take time to consider their extortion tactics.

“Some prior incidents involving these criminals have seen victims not contacted until weeks after data was stolen – so if you don’t hear from them in the coming days, you are not in clear,” Mandiant Intelligence senior manager Kimberly Goody says.

The group, thought to be based in Russia, will then contact a company email address, demanding payment not to publish the stolen data online, Mandiant research suggests.

These demands are usually in the seven- or eight-figure range, Mandiant experts say, but there have been ones over $35m (£28m).

And law enforcement agencies around the world advise organisations not to pay, as it fuels the growth of these criminal gangs.

Be suspicious

For individuals, the advice is also not to panic but to be suspicious.

If your organisation refuses to pay the criminals, there is a good chance they will publish the data on the dark web or try to sell it to other hackers.

But there are many steps between that and you losing money.

“There really is an important message not to panic, as it’s very unlikely that organisations have been storing data like full bank details which can lead directly to sort of financial harm,” Prof Martin told BBC Radio 4’s Today programme.

And although some organisations, such as British Airways, say some staff bank details have been stolen, this was highly unlikely to lead to individuals’ bank accounts being drained.

The risk, experts say, is from secondary attacks, where hackers use the details they have to trick victims into revealing more details.

So the advice is to look out for suspicious emails and phone calls – particularly ones about the hack.

Don’t log in

In a typical scam, individual victims might receive a message claiming to be from their organisation, asking them to log in and verify their account because “fraudulent activity has taken place”.

Things to look out for, experts say, include:

• official-sounding messages about “resetting passwords”, “receiving compensation”, “scanning devices” or “missed deliveries”
• emails full of “tech speak”, designed to sound more convincing
• being urged to act immediately or within a limited timeframe

The MoveIt breach is likely to become more serious as other companies discover they have been hacked – but, experts say, data stolen in previous hacks has been published in an obscure corner of the dark web, with little consequence to individuals.

The post MoveIt hack: What action can data-breach victims take? appeared first on Cyber Security Plus.