Cyber Security

 

How to keep yourself safe.

It is important to safeguard yourself from potential online schemes. Review the list of recent online schemes and learn out you can protect yourself.

How to Protect Yourself from...

Select an item below for more information.

BITB another reason for MFA

In the past we have provided examples on many of the different types of phishing attacks that exist and showed how to identify them. Most of the examples we have provided revolved around email and how to identify a possible phishing attempt. While email is one of the most popular ways of phishing, it is not the only way.

Recently a previously novel method of phishing has become more prominent and it is almost impossible to spot. This type of phishing is called a Browser in the Browser (BITB) attack. When you visit a website and choose to login with Facebook, Google, or Microsoft, you are using Single Sign On (SSO) . A BITB attack uses a fake website and takes advantage of SSO to capture your login credentials unknowingly.

A BITB phishing attack can mimic a legitimate webpage without the user even knowing. This means all of the normal ways we identify phishing (hovering over links, bad grammar, misspelled URL) do not necessarily work with BITB. The attack uses the normal login behavior of SSO by presenting a popup window to enter credentials. Once the user submits their credentials they are in the hands of the attacker.

The good news is there are ways to beat this attack. First of all when searching for a website make sure you avoid clicking on links that say AD next to them. Using a password manager may also help as it will not populate a password for the fake login. The best defense is to use Multi Factor Authentication (MFA). With MFA, even if the attackers get your username and password they do not have access to your second form of identification that is required to complete the login process.

Phishing Safety on Mobile

Recent Trend

Smartphones have made it increasingly easy for us to have access to all of our information at the drop of a hat. Emails, instant messaging, texts, phone calls, all in a one-stop-shop; however, this ease of access has a downside. With quick access to our emails, we are more susceptible to phishing attacks that hit us with sensationalized content to spur us to click links. Cable bill suddenly ten times your normal rate? Missed a potentially important shipment? Someone just logged into your account? All of these strike us with a sense of urgency and spur us to knee-jerk click. We want to figure out what is happening, but this puts our information at risk. Do not worry though, there are some steps that you can take while on a smartphone to protect yourself and your data.

How to Safeguard Yourself

Be calm. If an email says URGENT, uses a lot of capital letters to point out that SUDDEN actions are going to be taken unless you IMMEDIATELY respond, then the attacker is trying to trick you into acting first and thinking second. Look for these senses of urgency and think twice before clicking.

Be aware. On most mobile email systems, you are able to tap on or near the name to reveal who the email is from. Look to see if there are any misspellings of common organization names. Zero’s instead of O’s, hyphenated addons like .com-help.ru, or even blatantly wrong names could be an indicator it’s not a real email.

Be sure. Some email apps allow you to tap and hold on a link in an email to give you a full preview of where the link goes. A pop-up window will show you what the full URL is. If the link says it’s taking you to Google in the email, but is actually taking you to g00gle.com-security.ez then it is a phishing attempt. If your email app or phone does not allow this, check the email on your computer so that you can hover over the link instead.

Be safe. If you are receiving a notice from a shipping company, an online store, or a phone or internet company, you can always validate that the information is truly theirs by going directly to their website to verify the information. You can write down a tracking, billing, or order number and visit their website to see if it is a real charge or notice.

With these few steps, you and your information will be safer from the bad guys.

Social Media Apps Security

Social media has created a way for people to share what they are doing, important life updates, and sharing funny things or breaking news. With the far reach that it has, bad guys have learned ways to collect your data without you even being aware of the dangers.

Recent Trend

A recent trend is the inclusion of apps and connected sessions on social media accounts. You can use them to stay logged into a game or another app across multiple devices, or even use it to create a fun little picture for your profile; however, these connections could have serious security issues tied in with them.

One such trend was to create a family based on who you interacted with on the social media platform, creating a unique and fun way to connect with your friends. What wasn’t clear to most until further inspection was that the app also took a few extra liberties with permissions the user granted.

  • The first was that it allowed the ability to see your follower list as well as follow accounts on your behalf. This had a two-prong approach - first it allowed the app creators to circumvent the “private” account settings to see what was being posted from accounts as well as see a list of followers.
  • Secondly, it allowed the creator to use the website settings to follow another account, and in private by muting the account in an attempt to cover its tracks.

It took a savvy user to realize that they had a list of new followers not connected to their normal trend, and then upon closer inspection of their own account to see the muted account that they had no recollection of ever dealing with.

How to Safeguard Yourself

The best way to safeguard yourself from data collection like this is to review app permissions before granting them access to features on your account.

  • Question why an app that simply changes your profile pic needs access to your follower list or to be able to tweet and follow accounts on your behalf. If something seems to be amiss, don’t allow it access.
  • Next, review your account regularly to make sure that there are no odd posts or people you don’t recognize on your timeline or follower list. By removing these accounts and posts, you have taken steps to secure your account if anything goes wrong.
  • Third, be wary of popular trends. They may seem innocent at first, but it takes very little effort for a viral campaign to generate loads of data for bad guys to collect and sell or misuse themselves.

Antivirus and Antimalware

What is the difference?

The terms virus and malware are often used to explain common software threats to computers, but are they the same thing? The answer to this question is a little complicated. While a virus is a type of malware, not all malware is considered a virus.

Malware is an umbrella term used to explain any software designed to harm your computer. Viruses on the other hand are a specific type of malicious software that can spread and self replicate to other programs. So while both terms describe software intended to harm your computer, they are not the same. Since they are not the same we must take different approaches to protect our devices from each of them.

This is where antivirus and antimalware programs come into play. Both are designed to protect your computer against malicious software, but they do not function in the same way. Antivirus tools are designed around the idea of preventing known viruses from ever making it onto your device. Whereas, antimalware tools are geared towards identifying unknown threats and the removal of malicious software that may have already made its way onto your computer.

How to Protect Yourself

The real question comes down to whether you need both antivirus and antimalware protection, and the answer is yes. Some antivirus programs are designed to accomplish both tasks, but not all are. So you need to be aware of the level of protection being provided by your antivirus software. If your antivirus does not provide antimalware protection, you should add the additional protection of an antimalware program. Keep in mind, to ensure your software provides the best protection possible it needs to be updated regularly. You can also check with your Internet Service Provider to see if they offer free antivirus software.

Common Email Phishing Attempts

Recent Trend

We've probably all received them at one point or another - the dreaded "You've been locked out of your account" emails. Most likely you are familiar with the Nigerian Prince scam that has been around since the 90's, but would you believe that this email scam still traps people for over half-a-million dollars yearly? Phishing attempts through email are extremely profitable for cyber criminals and a nightmare for the business world. Having well-educated employees (and students) is nothing less than critical in providing a front-line defense against such attacks.

Top 10 very common phishing emails; each may have several variants or the wording may be different, but the subject is usually similar. See if you recognize any of the following:

  1. "We've Issued a Refund"
  2. "A Delivery Attempt Was Made"
  3. "We've Detected Unusual Sign-In Activity"
  4. "Urgent Action Required"
  5. "Thank You For Your Purchase"
  6. "Your Information Has Been Compromised"
  7. "We've Locked Your Account"
  8. "Please Change Your Password"
  9. "Update Your Billing Information"
  10. "You've Appeared in a Search This Week"

How to Protect Yourself

Your best defense against falling victim to one of these misleading emails is knowledge and a bit of common sense.

For example, “We’ve locked your account…” Is there any reason why it would be locked? Did you recently attempt to login and forget your password somewhere? If not, then why would you get that email?

“A delivery attempt was made…” This one is a little more tricky because at some point or another, most individuals order products and get them in the mail. Ask yourself - did I recently order something that I’m expecting? Is there a reason someone would send me a gift? Again, if your situation doesn’t call for it, why would you believe the email?

“We’ve issued a refund…” If you haven’t returned a product or bought anything that needed to be returned, then why would you be receiving a refund?

These 10 email phishing attempts come in many varieties and there are many more out there with different subjects. All are attempts at making you react on impulse and click a link or make you give out information that you really don’t need to do. Best option? Just delete the email without opening it. If you do open it, hover over any links in the address area, subject area, or body (but DON’T click)...does the address that shows up at the bottom of your screen look legitimate? Does it reflect the company’s name that is implied in the email? Is there a secure “https:” at the beginning of the address? The old adage, “if it sounds too good to be true, it probably is” also works here. If it doesn’t look or feel right, it probably isn’t! Be safe and delete or if you’re still unsure you could always call the company being represented; if it’s a legitimate email they should be able to confirm what you’re seeing. Stay smart and stay safe!

What's That Link?

Recent Trend

Links inside emails don’t always go where they say they’re really going. Emails can be made so that the text says one thing (for example saying the link will go to the Baker website), but instead actually lead you to somewhere completely different. This is very dangerous, especially if the link brings you to a login page. There are a few extra precautions you can take in order to protect yourself from these crafty attacks.

How to Protect Yourself

Hover over it. If you hover over a link or a picture inside the email, you are able to see where the clickable is actually taking you. This is displayed at the bottom of the page. Make sure that the website matches where you think it should be going.

When in doubt, don’t click it! If you know where you are supposed to go to make an account change or check the status of an online order, go directly to the website yourself. Navigate to the webpage using your browser and not the link in the email.

Heed the prompts. Gmail, along with other services, will sometimes prompt you if they feel the link is unsafe. Take notice of where the prompt warns that you might be going. This isn’t a guaranteed pop-up, but it is a second chance to get out safely.

In Gmail, the pop-up looks like this:

  • If it looks off, be wary. Let’s say you clicked the link. That’s okay - it happens. There’s still a chance it might not be too late if the link had malicious intent. Suppose the email asked you to log into your Baker account, but the website doesn’t look right. Close the browser window and do not enter your credentials.
  • Help! I clicked the link, and I entered my username and password! Don’t panic, accidents happen. Please report the incident to [email protected] so that assistance can be provided. Our IT staff can help safeguard your account and minimize any damages that may have occurred from the incident. The sooner you notify them, the less impact the phishing attack has on both you and Baker College. If it was on a personal account, close the window you’re in and go directly to your account’s website to change your password. Use a new password that hasn’t been used before, and remember - the best security is to keep each password unique.
  • “Hover, Doubt, Heed.” - With these simple steps, you’re on your way to keeping your information safe and secure from phishing attempts!

Cyber Security Awareness

Safety Security Best Practices

Baker College's Cyber Awareness Committee has assembled this informative PDF document to help raise awareness of Cyber Security among Faculty, Staff, and Students.

View Safety Security Best Practices

 

 


View the Baker College  Best Practices for Wireless BYOD (Bring Your Own Device)

Baker College Wireless Guide