Cybersecurity News
A Seattle-based startup called Privacy Labs recently unveiled a device that allows everyday consumers to send and receive email, as well as utilize contacts and calendar services, from their own personal web domain.
The device, dubbed “Helm,” was born out of the belief that “everyone should have the right to their online lives,” according to co-founder and CEO Giri Sreenivas. Instead of storing information in the cloud, information is stored and encrypted in the device.
“...
If you were one of the 30 million Facebook users whose data was accessed by unauthorized third parties, then Facebook has its own version of encouraging news. The hackers were spammers who wanted your money, not foreign agents trying to influence your vote. Congratulations?
A new report by the Wall Street Journal says that, according to Facebook, the hackers were linked to a digital marketing company that specializes in deceptive advertising. People familiar with Faceboo...
Sort By
When Microsoft and Sony released new, updated versions of their popular game consoles within days of each other last month, gamers around the world were in seventh heaven. So, it seems, were hackers.
Cyber security firm Kaspersky Lab has been measuring the hacking attempts against the new Playstation 4 and Xbox One units – as well as other game platforms – and has seen a surge, coinciding with the late November releases.
Globally, the company estimates an aver...
These days, when you get ready to swipe your card at a big box store, a thought may flash through your mind – “sure hope my data is safe.”
After all, Target, Home Depot, Neiman Marcus and Michaels, among others, have seen their systems breached by hackers in the recent past.
But do you have the same worries about transactions with your church, or other nonprofits? A cybersecurity firm says you should.
TechSoup, an oganization that makes software and techn...
Hackers and identity thieves are increasingly focused on mobile computing. With so many smartphones and tablets now in use, mobile is increasingly becoming how consumers use the web.
Criminals also like the fact that many mobile devices have little or no security protection – not on the device itself and not on the data that is stored in the cloud.
Mobile data can be stored both places and security experts say both need strong protection. Chris Rancourt, an editor at NextAdvisor.com, says consumers who use an online backup service to store and share their data in the cloud need to be especially careful.
“When you put your information on the cloud, you get this extra level of security with their encryption,” Rancourt said. “Most services now use encryption but some are stronger than others.”
Increasingly popular
Cloud storage and backup services have become increasingly popular. They store data off-site, protecting it from a catastrophic computer crash or other physical damage. They also make it accessible from other computers in other locations.
“Pretty much any information you can upload to the cloud – pictures, documents, videos. And all that information can be encrypted and stored safely inside your cloud or online back-up service,” Rancourt said. “The backup services that we use provide coverage for Apple, Android – pretty much the whole spectrum.”
Rancourt suggests picking a backup service with very robust encryption. One service that falls into that category, he says, is SpiderOak. There is one security feature, in particular, that he likes.
'Zero-knowledge' security
“They have this policy where no one in their company will know your password,” he said. “If you lose your password they can't go in and retrieve it for you. It's really up to you, which makes the security a lot stronger, but at the same time you have to be responsible for your own stuff.”
Absent-minded consumers can run the risk of losing everything if they forget or lose their password. Writing it down in several secure places, however, might be all the insurance policy you need.
Sugarsync is another secure backup service. With Sugarsync, you can safely store important files and then sync them across an unlimited number of computers. If the data is updated on one computer, it's also updated on the rest.
Mozy is a low-cost cloud storage service. The company's backup plans start with one computer per subscription, but it can sync up with other computers that aren't part of the plan.
First line of defense
The best feature of these companies' backup services may be the sophisticated encryption. Rancourt says it provides a great first line of defense.
“For companies like SpyderOak you actually have to have an encryption key in order to decode the information and read it as something legible,” he said. “Most services have something like that as well.”
But hackers are resourceful individuals. Suppose they get access to your cloud and your encrypted information by stealing or finding your lost device. It might look like gibberish at first, but given a few hours, it's just possible some hackers might be able to crack the encryption. That's why you need a second level of defense – remote wipe.
If your device is lost or stolen, remote wipe will still give you access to all your files and documents from another computer but allow you to block access on the missing device. You can even delete files.
“Let's say you keep all your bank information on your cloud,” Rancourt said. “Someone can actually hack in there and steal your identity.”
It should go without saying that you should have robust security features on your hardware as well. Getting a strong mobile security package for your smartphone or tablet will reduce the risks from lost or stolen devices.
Hackers and identity thieves are increasingly focused on mobile computing. With so many smartphones and tablets now in use, mobile is increasingly becoming how consumers use the web.
Criminals also like the fact that many mobile devices have little or no security protection – not on the device itself and not on the data that is stored in the cloud.
Mobile data can be stored both places and security experts say both need strong protection. Chris Rancourt, an editor a...
News that over 1,000 accounts at online ticket-seller StubHub have been hacked should serve to remind you of this important online safety rule: don't use the same password across multiple accounts.
The Associated Press first reported on Tuesday that “cyber thieves” managed to fraudulently access more than 1,000 StubHub accounts, and buy themselves tickets in the legitimate accountholders' names.
As hacks go, a mere thousand compromised accounts in a company as large as StubHub sounds like pretty small potatoes. Why was the damage so limited?
According to StubHub spokesman Glenn Lehrman, the thieves never broke into the StubHub customer database. Instead, they got customers' login and password information from other sources, either hacking into different retail databases or even putting keylogging software or other forms of malware on user's computer.
The thieves presumably know how commonplace is it for people to use the same passwords (and sometimes even login names) across multiple accounts, so if thieves have, for example, the password you use for your email, bank account, favorite web-discussion forum or any other password-protected thing you do, they'll also try plugging that password into your other accounts on the off-chance it will work. Where over 1,000 StubHub customers are concerned, it did.
News that over 1,000 accounts at online ticket-seller StubHub have been hacked should serve to remind you of this important online safety rule: don't use the same password across multiple accounts.
The Associated Press first reported on Tuesday that “cyber thieves” managed to fraudulently access more than 1,000 StubHub accounts, and buy themselves tickets in the legitimate accountholders' names.
As hacks go, a mere thousand compromised accounts in a company as...
Pretty much any collection of online security tips will remind you not to use the same password across multiple accounts, and this week's news that scammers have managed to hijack and steal points from large numbers of Starwood Preferred Guest loyalty accounts offers another example of why.
Security blogger Brian Krebs reported today that he'd personally heard complaints from two of his readers whose SPG accounts had been hijacked. As Krebs diplomatically explained: &ldq...
American Uber users beware: Customers from all over the country are complaining that their Uber accounts were charged for trips they never took – in many instances, charged for trips they couldn't possibly have taken – which strongly suggests that those Uber accounts were hacked.
On the other hand, representatives for Uber say they investigated and found no signs indicating a security breach – and added, “This is a good opportunity to remind people to use strong and uniq...
If you get an email from LinkedIn saying you need to reset your password, it's real. The social networking site has reported a data breach in which an undisclosed number of passwords were compromised.
"Members that have accounts associated with the compromised passwords will notice that their LinkedIn account password is no longer valid," Vincente Silveira, a LinkedIn director, wrote on the company's blog. "These members will also receive an email from LinkedIn with instructions on how to reset their passwords."
Silveira stresses there will not be any links contained in the email that informs you that you must reset your password. However, once you follow the initial step request password assistance, then you will receive an email from LinkedIn with a password reset link.
Regardless of whether you receive an email, it would be prudent to immediately change the password on your LinkedIn account.
"It is worth noting that the affected members who update their passwords and members whose passwords have not been compromised benefit from the enhanced security we just recently put in place, which includes hashing and salting of our current password databases," Silveira wrote.
A ConsumerAffairs sentiment analysis of about 2.5 million comments posted to social media finds that the news knocking LinkedIn from an overall approval rating of close to 80% to a 24% negative rating.
While the hack attack wasn't the only negative to emerge in the analysis, it was by far the largest, as shown in this chart:
How it happened
Silveira did not say how the data breach occurred, only that an investigation was underway. Chester Wisniewski, Senior Security Advisor at Sophos Canada, wrote in his blog that it is imperative that LinkedIn also determine whether email addresses, often a user name, were also compromised. LinkedIn has more than 161 million members who use the site to expand their business and professional contacts.
About 6.5 million passwords have been posted online and the company says some of them do appear to be LinkedIn passwords. Others appear to be passwords for eHarmoney accounts, security experts say.
EHarmoney said a "small fraction" of its member passwords had been compromised and that it is investigating. Meanwhile, it said affected passwords have been reset.
If you get an email from LinkedIn saying you need to reset your password, it's real. The social networking site has reported a data breach in which an undisclosed number of passwords were compromised.
"Members that have accounts associated with the compromised passwords will notice that their LinkedIn account password is no longer valid," Vincente Silveira, a LinkedIn director, wrote on the company's blog. "These members will also receive an email from LinkedIn with instructions on how ...
The massive ransomware attack that struck the world late last week was a stark reminder that we live in a world where criminals are more powerful and have extended their reach.
Here's another reminder if you needed one: credit and debit card fraud alerts are up 15% from 2015.
In a new report, CreditCards.com says 31% of adult consumers have received a fraud alert about suspicious activity on their credit card, while 25% have received a similar alert about their debit card...
While you were watching adult videos on the internet, a hacker who collects Bitcoin was secretly recording a double-screened video, and he’s now preparing to send it to your family and coworkers.
No, not really. But hackers are using stolen passwords to convince strangers online that that’s the case. In emails to unsuspecting victims, the hackers claim that they placed malware on pornography sites to make secret recordings of both the visitor and the site.
The hackers beg...
Cybersecurity is a growing concern for both consumers and industry, but a new report from Symantec, a cybersecurity firm, is raising the alarm to a whole new level.
The firm, which produces the Norton consumer security products, says a group of hackers now has the potential ability to take control of electric power grids in the U.S. and Europe.
Symantec has identified the group as Dragonfly, saying it has been active in the last two years in attacks on electric power comp...
Many consumers are making it too easy for identity thieves, according to a new report from AARP.
The survey of adults found many don't even take basic steps such as monitoring their online bank accounts, using strong and unique passwords, or setting up a security freeze on their credit reports.
Only 43 percent of adults were found to have online access to their bank accounts, which allows them to regularly monitor activity. The rest -- 57 percent -- must wait until the mo...
Facebook took another uppercut to its jaw on Wednesday when Apple removed the Facebook-owned virtual private network (VPN) app from its App Store. The reason? Simply that Onavo failed to comply with the App Store’s privacy guidelines.
Facebook may only have itself to blame. In June of this year, Apple updated its App Store guidelines to explicitly ban "[collecting] information about which other apps are installed on a user’s device for the purposes of analytics or advert...
A new malware called CamuBot has been uncovered with its first attack centered on Brazilian bank customers.
The malware hides in plain sight, acting as if it’s the user’s bank-required end-user security module and mimicking the bank’s online persona all the way down to the bank’s logo.
According to researchers with IBM’s X-Force team, CamuBot was first discovered on August 28 after showing up in an attack on business-class banking customers in Brazil. It was IBM that dubb...
Yahoo’s email woes continue to grow, and this time it involves Google.
Before Google made changes to its privacy standards in late 2017, emails that were sent from Yahoo Mail accounts to Gmail accounts may have been unlawfully scanned or catalogued. Those Yahoo Mail users may be eligible for compensation of up to $5,000 courtesy of a class action lawsuit.
This new privacy wrinkle comes on the heels of a recent report that almost 200 million Yahoo inboxes were scanned for ...
Hotel guests at a well-known Chinese hotel chain are now victims of a security breach.
Despite China’s efforts to crack down on cybersecurity, a hacker is now selling the data of 130 million hotel guests for eight Bitcoin ($56,000) on a Chinese Dark Web forum. Chinese media reported the data breach after several cybersecurity groups saw the forum’s ads.
The hacker noted that he got the data from Huazhu Hotels Group Ltd. As one of China’s largest hotel chains, the company ...