Smart TV Security Becoming an Issue

 

If you have a Smart TV in your company conference room, break room, or spread throughout your offices as a perk for deserving employees, you may have allowed hacks, breaches, and privacy issues into your business. In December, the FBI’s Portland office issued a warning about Smart TVs that should concern everyone who owns one. It seems that the features that make these TVs Smart also make them excellent portals for malware, so you need to be concerned about Smart TV Security.

Essentially, a Smart TV is a TV with an internet connection and the ability to install “Apps” (Netflix, Disney+, etc.) to view certain content. Many of these TVs now also include microphones to receive verbal requests for programming (“Play Game of Thrones on HBO”) and cameras to help identify who is watching so that the TV can suggest new shows.

Why Are Smart TVs Dangerous?

So what is so dangerous about a Smart TV?

It used to be that television was one-way communication. An antenna signal came in, and it was displayed on the screen. These days, Smart TVs are actually powerful internet-connected computers, sending massive amounts of data in both directions.

And since Smart TVs are actually computers, they are open to a whole host of problems that other kinds of computers have. If you are at all familiar with cybersecurity, you are well aware of how bad the news is regarding cybercrimes, viruses, trojans, ransomware, device hacking, cyberespionage, and other security issues. The good news about conventional PCs is that these computers have an army of companies working to protect you against all of those problems. The bad news about your Smart TV is that there is no such army.

Your Smart TV -- whether it's a Vizio, Samsung, Sony, LG or other brand -- usually has one and only one company working on Smart TV security to protect that device and those who use it, and that’s the manufacturer. That makes it extremely likely that the Smart TV’s security is not as strong as it should be. Also at issue is that Smart TV manufacturers are very slow to react to any new cybersecurity issues, as their firmware is usually updated very infrequently, if at all.

Combine that with the fact that many of these Smart TVs have cameras and microphones, and you have a perfect recipe for cyber-stalking. If a hacker gets control of your Smart TV in your conference room, they could watch and listen in on your company meetings and easily steal confidential information.

Apps Can Make Smart TVs More Dangerous

Many Smart TVs use a proprietary operating system, but some are based on Linux and Android technology, which makes them especially vulnerable. For example, Smart TVs with Amazon’s Fire TV technology are based on Android. They are capable not only of loading apps for all the services and networks you know and love at home, but programmers can write other apps for them that promise they’ll do one thing, and don’t tell you that they’ll be doing something else, too.

And most people, when downloading these apps, rarely check to see what kinds of security holes they might be opening up. For example, a popular “Downloader” app on Amazon’s Fire TV platform grants the app the following permissions:

• Access information about networks
• Access information about Wi-Fi networks
• Open network sockets
• Read from External Storage
• Write to External Storage
• Sending in-app billing requests and managing in-app billing transactions

Many of these permissions are things that any good cybersecurity expert would not permit on a PC, but are nearly powerless to prevent on a Smart TV.

The Bottom Line on Smart TV Security

With Smart TV Security, you need to depend on the manufacturer to protect you, and that’s just not their primary purpose. As a result, there’s no antivirus, no anti-malware, no group policies, and no way to lock down the TVs to prevent the loading of dangerous apps. So what can you do?

• First, if you’re going to have Smart TVs in the office, make sure you isolate them onto their own network. That way, if someone installs a rogue app that can access your entire network, there will be very little for it to see, and very little damage that it can do.
• Second, for any of the services on the TV, create an email address specifically for these accounts. That way, if the email credentials are breached, there is no valuable company data to be stolen.
• Third, cover the camera with tape and the microphone with some material or device especially made for this purpose. This will help to prevent you from being watched and listened to.
• Fourth, if you don’t need a Smart TV, don’t buy one. A large, commercial-quality video monitor might be all you need for your corporate presentations.

Whatever you do, don’t ignore the fact that any new device that you invite into your office network has the potential to harm you and your company. And if you don’t have the time or know-how to do this yourself, call Digital Uppercut. We specialize in Cyber Security and work with these issues all the time. Smart TV security isn’t the only threat to your company. Contact us today online, or call us at 213-398-8771 and let’s talk about the security of your company.

The Danger of Browser Extension Malware

 

Cyber criminals are always looking for new ways to get their malicious code onto your computers. Usually, malware gets onto your PC via executable files, JavaScript code, and VB scripts within MS Office Applications. But there is another method that most Antivirus and other security software just aren’t ready or able to identify and trap for you: Browser Extensions. And if you think for a moment about how much of your working day is spent within a browser window, you can imagine how much of what you do could be tracked, snooped, breached, stolen or damaged by browser extension malware.

Why Target Browser Extensions?

How much time do you spend in your browser compared to just one or two years ago? If you’re a user of Office 365 or Google’s G Suite or Gmail, the answer is probably a lot. Microsoft has been moving its products from single-purchase licenses to cloud-based subscriptions for years, and Microsoft, Google, Salesforce, Netsuite, QuickBooks, Dropbox, Box.com and thousands of other web-based applications have us spending more time in our browsers than ever before.

And when you consider that we also access banks, investment, and even government resources via the web, it’s easy to see how being able to spy on what we do in our browsers can be very valuable to a cybercriminal.

Browser extensions allow them to do that.

Couple these threats with the fact that even though most good IT policies limit the installation of executable software by individual users, too many IT companies still allow individual users to install browser extensions without limit.

What Harm Can Browser Extension Malware Do?

Let’s start with keyloggers, which can track every button-press and mouse click on your computer. That means credentials for all your online resources, including your email, company intranet, accounting system, banks, and cloud-based storage, can be accessed by cybercriminals. Armed with your login information, the damage could be unending.

A cyber-criminal with access to corporate email accounts can use social engineering to send emails to other corporate personnel asking them to supply other network credentials, or even re-route pending vendor payments to the criminal’s bank accounts.

The access could be used to infect a network with Ransomware, possibly forcing the payment of tens or hundreds of thousands of dollars in ransom.

Your client, vendor, prospect or patient lists could be stolen, resulting in huge fines or criminal penalties imposed not on the cyber-criminal, but on you and your company.

The list of ways you and your company could be harmed is truly endless.

How Extension Malware Gets Onto Your Computer

So how could browser extension malware actually get on your computer? Most browser extensions are legitimate and benign, but others created by unknown developers can carry malware or create security holes that let malware or prying eyes in. So while you think you found a very useful plugin to solve a problem or simplify a task for you, what you don’t know is that the extension’s real purpose is something far more sinister.

Some cybercriminals purchase browser extension businesses from legitimate developers, then add their own malicious code, infecting all existing users with their new malware. Others simply hack into a browser extension’s programming environment and implant malicious code there, where it may be distributed by a legitimate company without its knowledge.

Visiting an infected website can also force the installation of an extension onto your browser.

Can You Protect Yourself From Browser Extension Malware?

One of the reasons that browser extension malware is so bad is that it often goes undetected for a period of time. Most security systems don’t check for it, or do a very poor job of looking for it. Often, a malicious extension will act benignly immediately after installation in order to be trusted, resulting in endpoint protection systems allowing it to be installed. It’s only later that the danger is discovered. Monitoring systems like our state-of-the-art SIEM system will then notice if the extension tries to send stolen data to some known bad place, but even this might be too late to prevent the actual breach.

At Digital Uppercut, we seldom rely on a single method for protecting our clients. That’s why, in addition to all of our other security systems, we further protect our clients by creating strict group policies that prevent the installation of any browser extensions by individual users. All browser extensions are reviewed, and their installation is centrally controlled.

Get Protected

Is your IT staff actively protecting you from browser extension malware? If you don’t know, you should ask. And if they don’t give you the answer you are looking for, call us and request a consultation. Let’s work together to protect you and your company from malware and cyber-criminals of all kinds. Use our contact form or call us at 213-398-8771.

How Many Hackers Are Targeting You Right Now?

 

If you read about cybersecurity at all, you have seen articles that claim that you are being hacked today -- even right now. To demonstrate the point, companies like SonicWall and FireEye put up global cyber-attack threat maps, showing how many hacks are happening right now, where the hacks originate, and where the targets are.

“But those are OTHER companies getting hacked…Not mine,” you think. “Maybe other companies are a target, but not MY company!”

But what if that weren’t true? Would it take a Cyber Attack Threat Map of YOUR company to show you that you are under siege right now? And if you saw such a map, and it showed how many hackers were attacking you right now, what would you do?

How Our Cyber Attack Threat Map Helped Two Clients

Two of our clients got their answers just last week. Their Cyber Attack Threat Map showed that one of their employees’ email accounts was being accessed from the Philippines. We contacted our client, who confirmed that the employee was not on vacation. We promptly changed the password for this employee’s email and began investigating how her data was compromised.

Another client’s Cyber Attack Threat Map showed access from Russia. Again, we contacted our client, who confirmed that the employee—who actually spoke Russian—was not overseas. So we changed the user’s password and locked down the account. Two days later, this account was again accessed from Russia. Our investigation revealed that the client had an unauthorized Russian-language email app on his phone, which was either insecure or was purposely sharing its user data with hackers. The employee has since stopped using the app.

If only certain people’s accounts in your organization are being attacked -- as with these two stories -- there’s a good chance their data was exposed and is available on the Dark Web. But the data there could be the result of a breach 6 months ago or longer. But when you have a Cyber Attack Threat Map system, you can know within hours that your data has been compromised.

What is a Cyber Attack Threat Map?

If you’re older than 50, you might remember a movie with Matthew Broderick called War Games. In the climax of the movie, you see a huge electronic map on a wall that shows the flight path of nuclear weapons around the world. Cyber attack threat maps look similar to that, but thankfully report on cyber attacks rather than nuclear weapons.

While this is comforting on a global scale, if your company is one being targeted by an aggressive hacker, you are still wise to be nervous, because unless you are extremely well protected, those hacks are going to become successful at some point.

That’s because many of those hack attempts are automated, which means that there is literally zero cost to trying to attack you and thousands of companies just like you. If you are unprotected, they will eventually be successful.

Why A Threat Map Should Be Part Of Your Security Plan

The main method by which your company will be hacked is through email. Hackers try desperately to gain access to your email server because once they do, they can send out fake emails to direct your staff to make financial transactions that end up in the hacker’s pocket. They can also install viruses across your network, malware, ransomware and more.

That’s why protecting your email is one of the most important parts of your cybersecurity plan.

Most email servers have moved to the cloud with services such as Office 365 and G Suite. While both of these systems have security tools built in, they can be expensive, weak and require frequent maintenance. So, it is difficult to know how many hackers are attacking you, or to guard against hacking attempts. As a result, phishing attempts and malware can still get in.

That’s why some companies try to use an email gateway. But those devices sit outside your cloud-based email and can only see inbound emails. That means they can’t see the emails and files shared among your internal users. They also can’t detect failed login attempts, typical of attempted hacks, or insider threats.

But our tools do all of that, giving you a clear picture of where your threats are coming from, whether that’s outside of your company or from inside.

We can even go beyond email because our tools also connect to and monitor your cloud-based storage and sharing systems, such as OneDrive, SharePoint, Box, Dropbox, and Google Drive.

How Many Hackers Are Attacking You Now?

If you are like most business owners or are responsible for your company’s IT, you are concerned about these issues. You also probably don’t have any idea how many hackers are attacking you. That’s why we make it so easy to get protected. Give us a call at Digital Uppercut at 213-398-8771, or contact us online, and let’s talk about a Threat Map and next-level protection for your email, cloud storage, and your entire business.

FBI Says Ransomware Threat Getting Worse Fast

 

In the wake of several high-profile ransomware attacks targeting state and local governments, healthcare and transportation companies, and even IT companies, the FBI recently issued a public service announcement about the growing ransomware threat.  The FBI says that individual ransomware attacks have remained consistently high, but they are becoming more targeted and costly, causing combined ransomware losses to increase sharply. Many companies fall victim to ransomware due to a lack of preparedness, cybersecurity awareness training, up-to-date software, and proper backups.

The ransomware threat is real, so what does the FBI say to do if you are attacked by Ransomware? According to an article on SiliconAngle, the FBI “...does not advocate paying a ransom, in part because it does not guarantee an organization will regain access to its data,” which is a valid concern.

How To Protect Yourself From Ransomware Threats and Attacks

Of course, at Digital Uppercut, we advocate taking steps to prevent your company from suffering the effects of a Ransomware attack in the first place...something that too few companies tend to do, often because of the costs involved. However, compared to the costs of business interruption, loss of customers, potential complications and lawsuits due to the business interruption, PLUS the cost of the ransom itself, protecting yourself is an extremely inexpensive and simpler alternative.

Your protections should include:

• Patch Management, to keep your software updated to patch known vulnerabilities
• Web Filtering, which blocks damage from known bad websites
• Advanced Email Filtering, with links wrapped and attachments sandboxed.
• Advanced Endpoint Protection, to stop known and unknown threats in their tracks
• Awareness Training, so that your entire staff can help identify and prevent malware. 
• Encryption of both your local folders and files, as well as cloud-based data.
• Security Operations Center so that a team of experts continually watches over your network security.
• SIEM, continuous real-time automated monitoring of your security logs
• Complete Backups, with encryption, multiple copies, cloud backups, physical offsite backups, and more, so that if (after getting through all of the above), you actually suffer a Ransomware attack, your data can be quickly and easily restored without having to pay a penny of Ransom.
• Ransomware Guarantee, also to be used only in case all else fails, to help restore your company to health. We offer a $1,000,000 Ransomware Guarantee.

What If You’re Not Prepared And You Get Hit By Ransomware

Companies sometimes come to us after being hit by a Ransomware attack. When they do, we assess their resources and review the prior steps they’ve taken to prevent the attack. We especially look at the backup systems they have installed and how well they are running (or ran). That’s because our first choice is to restore the data from known good backups.

However, sophisticated ransomware not only encrypts live data on the network but also seeks out and encrypts backup files it finds. In a recent Digital Uppercut blog post about a “ransomware horror story,” we wrote about ransomware that not only disabled the backup systems but also deleted all backup files—including those stored in the cloud—weeks before encrypting the company’s data. This left the attacked companies with no alternative but to pay the ransom.

Knowing that things like this happen to unprepared companies that ignore the ransomware threat, the FBI also said in their PSA that they understand that “when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers,” and acknowledge that sometimes paying the ransom is the only alternative.

But they also warn that paying the ransom proves to the criminals that their tactics work, and makes them (and others) eager to attack more companies.

What Should You Do Now?

When the FBI says the Ransomware threat is getting worse fast, you would be wise to believe them. If you read the list above and didn’t think to yourself that you’ve done all of that to protect your company, then you are at risk. It’s never too early to secure your company’s resources, but it can quickly become too late.

Ransomware threats are growing, ransomware itself is getting more effective, and ransomware authors are getting more clever every day. That means the right time to begin protecting yourself is now. Call Digital Uppercut at 213-398-8771 or contact us online anytime. We’ll set up a time to assess what you’ve done so far, leverage what you’ve got, and fill in the gaps to ensure you are protected against ransomware.

Fileless and Zero-Day Attacks

 

Many computer users think that if they have a good Anti-Virus program running on their computer, their computers will be safe from hacks and threats. IT security professionals have long known this is not the case, but two new types of attacks are now proving it more often than ever. They are called Fileless and Zero-Day attacks. They happen FAST, and the damage can be huge. Here’s what they are and how they work.

What are Fileless Attacks

Most users think that computer attacks happen when you open a virus-infected file of some sort. Your antivirus software is designed to catch such attacks, and many of them do a very good job. But these days, attacks can be embedded within a web page you visit with your browser. In other words, no actual file download is required, which is where the term “Fileless” comes from.

Some antivirus programs scan web pages as you open them, but they generally work based on a set of rules or “signatures” that have been previously detected by the antivirus developers. Once the developers receive reports of a new virus (whether in a file or fileless), they analyze it, determine what’s different about it that caused it not to be detected by their existing virus definitions, and then they add this “signature” to the list of definitions. But that takes time... time you might not have to spare to protect yourself from a new attack.

The time between when a virus is released and when it is fixed can be days, weeks, or months, leaving computers vulnerable.

Many fileless attacks exploit newly discovered flaws in computer programs. For example, Microsoft Office has an entire macro language built into it. This language (and the code that runs it) is often updated, and if someone discovers a newly-added flaw in any of it, they can write some code that can exploit that flaw and attack your computer. And it’s not just new software that can be the source of a Zero-Day attack. Flaws are found all the time in older software, too.

That means that data can be corrupted, files can be deleted, and files can even be held for ransom.

Similar Zero-Day attacks can occur within web browsers and other web applications, revealing passwords, personal information, browsing history, cookie access, and more. None of this is good for you or your company.

What Are Zero-Day Attacks

A Zero-Day attack is one where a software flaw is discovered and immediately exploited. Generally speaking, it’s the software author's job to patch and fix their own software. If Microsoft is told about a bug in their software, they’ll go through a lengthy process to fix it. First, they need to determine whether the problem really exists. Then they need to figure out under what circumstances the flaw happens. If they’re successful in doing so, they need to determine where in the software the flaw was introduced and then write new code to fix it.

But they’re not done yet. Now they need to test this new software to make sure that it actually fixed the problem...and also that the new fix didn’t cause any new problems. This process can take weeks or months, depending on the software's complexity and the severity of the flaw.

So, a Zero-Day attack is one that exploits a flaw in software before the software publisher has had a chance to fix it.

Are These Attacks Really A Problem?

In a word, YES. The Ponemon Institute, which conducts independent research on privacy, data protection and information security policy, says that Fileless and Zero-Day attacks have increased by nearly 20% over the last year, and these attacks have hit about two-thirds of all enterprise-level organizations. The average cost of these attacks for enterprises is about $440 per endpoint (computer).

But what’s more significant to you is that the cost for Small to Medium-sized Businesses (SMB’s) is almost double that, about $763 per incident. And it’s only going to get worse.

How To Guard Against Fileless and Zero-Day Attacks

So if antivirus software and other file-based detection techniques can’t guard against these attacks, what can you do about them?

Computer Weekly says that “The report reveals that nearly half of all malware detected eluded basic antivirus (AV) systems, requiring a combination of legacy signature-based detection techniques and proactive behavioral detection to catch malware variants missed by signature-based detection.”

In other words, companies like yours need to increase the attention and investment you make in defending against malware such as Fileless and Zero-Day attacks. And that means you’ll need to start using tools that aren’t looking for “signatures” in the malware, but that instead look at their behavior on your computer system and network. If you find software that scans a database or registry for usernames and passwords, or that connects to and sends data to overseas servers, or that seeks to encrypt your files, then it's probably a sign that the software should be stopped.

There are hundreds, if not thousands, of different actions that malware can attempt, and behavior-based security software watches for them.

Protect Yourself And Your Company

What’s your best solution to defend against Fileless and Zero-Day attacks like these? First, always be careful when using new resources, websites and software. Second, call Digital Uppercut. We are cybersecurity experts and can configure your computers and network to minimize the likelihood of any attack. And in the event an attack is ever successful against your company, our disaster recovery solutions can help you get back to work in your business in no time. Call Digital Uppercut at 213-398-8771 for a security or IT evaluation, or contact us today here.

Security Problems for Chrome and Gmail Users

 

A recent change to Google’s Chrome browser is making us and other online security experts nervous. That’s because a new “feature” that Google introduced with Chrome version 69 to make users' online experience easier may leave those same users vulnerable to security problems they didn’t expect. These security problems with Chrome, Gmail, and other Google services are also affecting IT and Security companies like Digital Uppercut, as we now have to protect our clients from this new issue.

What Google Sync Does For Chrome Users

If you’re a Chrome user, you know that you can log into Chrome so that the browser stores your passwords and form-fill data, among other things. This is a convenience for Chrome users because they no longer need to remember complex passwords for their online accounts or enter the same personal information into online forms.

This feature also allows users to log into browsers on other devices, including mobile phones, and have all of the same stored information sync to those devices through the Chrome browser as well.

Before, the user had to explicitly log into Chrome to enable this sync feature, called Google Sync.

Google’s Change to Chrome 69

 

The red arrow above indicates that this user is logged into Chrome. The Yellow arrow shows this user logged into Google Docs -- a separate login.

Up to now, logging into other Google services, such as Gmail, Google Docs, Google Analytics and Google Ads, was separate from logging into Google Chrome. Google’s change to Chrome causes the user to be logged into Chrome when they log into these (and any other Google service), to also be logged into Chrome.

And so now, users on shared computers who are logging into specific Google services -- and then logging out of those services -- remain logged into Chrome unless they explicitly log out of the browser as well.

Here’s Where The Security Problems for Chrome Happen

So that means that when a second user sits at this shared computer, they may have access to the first user’s passwords. Would you like to log in to Fred’s bank? No problem. Just sit at his computer once he’s gone and visit his bank’s website. If Fred has saved his bank password, Chrome will offer to enter it into the form for you, after which you’ll have access to his accounts.

It’s very easy to imagine how bad this problem can get...but it gets worse.

Of course, it’s bad news if we’re talking about Fred’s personal bank account, but what if it’s your company’s bank account?

And not only are Fred’s business and personal passwords available to the next user, but so is Fred’s other personally identifiable information (PII), as well as your company’s private data. Want to know Fred’s social security number? No problem. Just visit a new bank and open a new account. When they ask you for Fred’s SSN, Google will happily give it to you. Google’s new security problem makes identity theft easier than ever.

How Google Sync Makes This Problem Worse

Google Sync, on its very own, poses problems, too. When Google Sync is enabled, your and your company’s information is stored in Google’s cloud data stores. If that data is eventually breached -- which is entirely likely one day -- so is your company’s data.

It also poses problems because some users use the same Google Chrome account for both home and business browsing. As a result, they may be storing business passwords in their personal Chrome accounts, effectively going right around any protections that you, your IT company, and your policies might be trying to enforce. And the problem gets multiplied into possible HIPAA violations if this problem ends up giving access to medical records and other PII.

Protect Yourself And Your Company

What’s your best solution to deal with security problems for Chrome and other vulnerabilities like this? The first step is to find out whether you are experiencing this or any other hacks, weaknesses or vulnerabilities. They can come not only from new software and services but also from old, outdated ones. So one of the very first things we do with any new client of our IT or Network Security Services is perform a security audit to identify issues like this that you might not even be aware of.

Once we find the vulnerabilities, we can set policies on your network or create rules on your firewalls or software to block such activity. And we go further by installing monitors to catch a variety of new issues that we can’t even imagine yet.

That’s why you should call Digital Uppercut. We are cybersecurity experts and do this kind of work for businesses like yours every day. Not only are we effective at finding and resolving security problems for Chrome and similar issues, but we are also backed by a Million-Dollar Ransomware Guarantee in case your network is ever attacked, and your data is held for ransom. Call Digital Uppercut at 213-398-8771 for a security or IT evaluation, or contact us today here.

Cold Boot Attack Unlocks Sensitive Data

 

We’re taught to believe that strong passwords, encryption, firewalls and other digital security measures will help keep our computers safe from hackers. Now comes a threat that reminds us that not all dangers are digital in nature. Sometimes, nothing short of locking up your computers will help to prevent them from being hacked using the "cold boot attack."

What Is A Cold Boot Attack

This attack lets hackers steal data that briefly remains in memory after a computer is shut down. Modern computers come with a safeguard, developed by the Trusted Computer Group (TCG), that overwrites the contents of RAM when a computer is restored, preventing the prior data from being read.

A Finnish company named F-Secure has developed a way to override this security measure, allowing a digital thief to access the sensitive data. The tactic involves getting physical access to the computer, opening up the case, plugging in a USB thumb drive, and manipulating the chips with a special device.

The Cold Boot Attack is not easy to do, but if someone is well-trained, it can be done on almost any computer, including Macs and PCs. Apple recommends that users set a Firmware password to secure their computers better. F-Secure recommends that companies configure their computers to not allow sleep mode, but to instead only allow users to either hibernate or shut down their computers. While neither of these steps will absolutely prevent a cold boot attack by someone who knows how to do it, they will help.

Protect Yourself And Your Company

What’s your best solution to hacks like this? First, physically secure your computers, especially after hours or while traveling on business. Second, call Digital Uppercut. We are cybersecurity experts and can configure your computers to minimize the risk of any attack. And in the event an attack is ever successful against your company, our disaster recovery solutions can help you get back to work in your business in no time. Call Digital Uppercut at 213-398-8771 for a security or IT evaluation, or contact us today here.