Login
The US government's Cybersecurity and Infrastructure Security Agency (CISA) warns that Russian spies who gained access to Microsoft's email system were able to steal sensitive data, including authentication details and that immediate remedial action is required by affected agencies.β¦
Some conversations on social media can get β¦ heated. Some can cross the line into harassment. Or worse.Β
Harassment on social media has seen an unfortunate rise in recent years. Despite platforms putting in reporting mechanisms, policies, and even using AI to detect and remove harmful speech, people are seeing more and more harassment on social media.Β
Yet even as it becomes more prevalent, nothing about it is usually. Or acceptable. No, you canβt prevent social media harassment. Yet you can protect yourself in the face of these attacks.Β
In 2023, research showed that 52% of American adults said they experienced harassment at some point online. Thatβs up from 40% in 2022. Also in 2023, 33% said they experienced it in the last year, a jump of 10% from 2022.iΒ
The same trend follows for teens, where 51% of them said they experienced harassment in the past year, compared to 36% in the year prior.iiΒ
Earlier research conducted in the U.S. tracked a significant rise in harassment online between 2014 and 2020. This included the doubling or the near doubling of the most severe forms of online harassment.iiiΒ
Our own research in 2022 also noted a rise of another kind β worry about online harassment. Globally, 60% of children said they were more worried that year about social media harassment (cyberbullying) compared to the year prior. Their parents showed yet more concern, with 74% of them more worried that year about their child being harassed than the last.ivΒ
Stats are one thing, yet behind each figure stands a victim. Harassment takes a hard toll on its victims β emotional, financial, and sometimes physical. That becomes clear the moment you look at the forms it can take.Β
Social media harassment includes:Β
It includes other acts, such as:Β
In practice, the results can get ugly. Scanning press releases from various state attorneys general, youβll find unflinching accounts of harassment. Like a targeted, three-year cyberstalking campaign against a victim and that personβs parents, coworkers, siblings, and court-mandated professionals.v Another, where the harasser attempted to defame his victim through a fake LinkedIn profile β and further doxed his victim by publicly posting source code the victim had written worth millions of dollars.viΒ
All of this serves as a reminder. Harassment can quickly turn into a crime.Β
The unfortunate fact remains that you canβt prevent social media harassment. Some people simply find themselves driven to do it. You can take several steps to shield yourself from attackers and deny them the info they need to fuel their attacks.Β
Secure your accounts.Β
Account security should be a high priority for you, your loved ones, and anyone else. Thatβs especially true during periods of harassment. Every account you have should be secured with a complex password β at least 12 to 14 characters long, with numbers, capital letters, lowercase letters,β―and symbols. And with two-factor authentication.Β
Two-factor authenticationβ―is especially important when it comes to account security. The reason is simple: a lot of harassers are tech-savvy, and enjoy taking over a victimβs account to make offensive comments in their name and damage their reputation.Β
Two-factor authentication prevents account takeovers like this. It requires a user to know the password and username for an account, along with another way they can prove they are who they say they are. Often that involves a code sent to their smartphone that they can use to verify their identity. At McAfee, we recommend you use two-factor authentication on any account that offers it.Β
Control who can follow you.Β
Social media platforms offer plenty of ways you can lock down your privacy, even as you remain βsocialβ on them to some degree. Our Social Privacy Manager can help you be as private as you like. It helps you adjust more than 100 privacy settings across your social media accounts in only a few clicks, so your personal info is only visible to the people you want to share it with. By making yourself more private, you deny a potential harasser an important source of info about you, in addition to your friends, family, and life overall.Β
Limit what you share online.Β
Limit how much info you share about yourself on social media websites. Addresses, phone numbers, and locations shouldnβt be shared in posts and shouldnβt be included in biographies. Attackers can use this type of info to make false threats and, in some cases, falsify crimes to elicit a police response β this is a technique called βSWATTINGβ and itβs quite serious.viiΒ Β
In some instances, harassers gather info about their victims on data brokers or βpeople finderβ sites. Some of this info can get pretty detailed, and these sites will sell it to anyone. You can clean up that info, however. Our Personal Data Cleanup scans data broker sites and shows you which ones are selling your personal info. It also provides guidance on how you can remove your data from those sites β or remove it for you, depending on your plan.Β
Report the harassment to the social media platform.Β
If you find yourself targeted, donβt respond. Thatβs what the harasser wants. Use your social media platformβs tools to block and then report the harasser. Many platforms have web pages dedicated to harassment that walk you through the process.Β Β
Report harassment to the authorities.β―Β
First off, if you feel that you are in immediate danger, contact your local authorities for help.Β
In many cases, harassment is illegal. Slander, threats, damage to your professional reputation, doxing, and many of the examples mentioned earlier can amount to a crime. There are options for victims, legally speaking. If you feel a harassment campaign has crossed the line, then itβs time to contact the authorities. Bring proof of harassment. Take screenshots of everything and submit them as part of your complaint.Β
Talk with trusted family members and friends.Β
Weβve seen just how damaging and painful harassment can be. Let trusted people in your life know whatβs happening. Lean on them for support. And have them help you find any resources you might need in the wake of harassment, such as counseling or even legal assistance. You might find this tough to do, yet realize that youβre not at fault here. Any ugliness youβre dealing with comes from the hands of a harasser. Not yours. Close family and friends will recognize this.
[i] https://www.adl.org/resources/report/online-hate-and-harassment-american-experience-2023Β
[ii] https://www.adl.org/resources/report/online-hate-and-harassment-american-experience-2023Β
[iii] https://www.pewresearch.org/internet/2021/01/13/the-state-of-online-harassment/Β
[vii] https://www.theguardian.com/technology/2016/apr/15/swatting-law-teens-anonymous-prank-call-policeΒ
Β
The post How to Protect Yourself From Social Media Harassment appeared first on McAfee Blog.
This issue is applicable only to PAN-OS 10.2, PAN-OS 11.0, and PAN-OS 11.1 firewalls with the configurations for both GlobalProtect gateway and device telemetry enabled.
No patch yet, apply mitigations. Actively exploited.
Several French municipal governments' services have been knocked offline following a "large-scale cyber attack" on their shared servers.β¦
Apple has made a significant change to the wording of its threat notifications, opting not to attribute attacks to a specific source or perpetrator, but categorizing them broadly as "mercenary spyware."β¦
The commander of the US Space Force (USSF) has warned that America risks losing its dominant position in space, and therefore on Earth too.β¦
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) said today it is investigating a breach at business intelligence company Sisense, whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset any credentials and secrets that may have been shared with the company, which is the same advice Sisense gave to its customers Wednesday evening.
New York City based Sisense has more than a thousand customers across a range of industry verticals, including financial services, telecommunications, healthcare and higher education. On April 10, Sisense Chief Information Security Officer Sangram Dash told customers the company had been made aware of reports that βcertain Sisense company information may have been made available on what we have been advised is a restricted access server (not generally available on the internet.)β
βWe are taking this matter seriously and promptly commenced an investigation,β Dash continued. βWe engaged industry-leading experts to assist us with the investigation. This matter has not resulted in an interruption to our business operations. Out of an abundance of caution, and while we continue to investigate, we urge you to promptly rotate any credentials that you use within your Sisense application.β
In its alert, CISA said it was working with private industry partners to respond to a recent compromise discovered by independent security researchers involving Sisense.
βCISA is taking an active role in collaborating with private industry partners to respond to this incident, especially as it relates to impacted critical infrastructure sector organizations,β the sparse alert reads. βWe will provide updates as more information becomes available.β
Sisense declined to comment when asked about the veracity of information shared by two trusted sources with close knowledge of the breach investigation. Those sources said the breach appears to have started when the attackers somehow gained access to the companyβs Gitlab code repository, and in that repository was a token or credential that gave the bad guys access to Sisenseβs Amazon S3 buckets in the cloud.
Customers can use Gitlab either as a solution that is hosted in the cloud at Gitlab.com, or as a self-managed deployment. KrebsOnSecurity understands that Sisense was using the self-managed version of Gitlab.
Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.
The incident raises questions about whether Sisense was doing enough to protect sensitive data entrusted to it by customers, such as whether the massive volume of stolen customer data was ever encrypted while at rest in these Amazon cloud servers.
It is clear, however, that unknown attackers now have all of the credentials that Sisense customers used in their dashboards.
The breach also makes clear that Sisense is somewhat limited in the clean-up actions that it can take on behalf of customers, because access tokens are essentially text files on your computer that allow you to stay logged in for extended periods of time β sometimes indefinitely. And depending on which service weβre talking about, it may be possible for attackers to re-use those access tokens to authenticate as the victim without ever having to present valid credentials.
Beyond that, it is largely up to Sisense customers to decide if and when they change passwords to the various third-party services that theyβve previously entrusted to Sisense.
Earlier today, a public relations firm working with Sisense reached out to learn if KrebsOnSecurity planned to publish any further updates on their breach (KrebsOnSecurity posted a screenshot of the CISOβs customer email to both LinkedIn and Mastodon on Wednesday evening). The PR rep said Sisense wanted to make sure they had an opportunity to comment before the story ran.
But when confronted with the details shared by my sources, Sisense apparently changed its mind.
βAfter consulting with Sisense, they have told me that they donβt wish to respond,β the PR rep said in an emailed reply.
Update, 6:49 p.m., ET: Added clarification that Sisense is using a self-hosted version of Gitlab, not the cloud version managed by Gitlab.com.
Also, Sisenseβs CISO Dash just sent an update to customers directly. The latest advice from the company is far more detailed, and involves resetting a potentially large number of access tokens across multiple technologies, including Microsoft Active Directory credentials, GIT credentials, web access tokens, and any single sign-on (SSO) secrets or tokens.
The full message from Dash to customers is below:
βGood Afternoon,
We are following up on our prior communication of April 10, 2024, regarding reports that certain Sisense company information may have been made available on a restricted access server. As noted, we are taking this matter seriously and our investigation remains ongoing.
Our customers must reset any keys, tokens, or other credentials in their environment used within the Sisense application.
Specifically, you should:
β Change Your Password: Change all Sisense-related passwords on http://my.sisense.com
β Non-SSO:
β Replace the Secret in the Base Configuration Security section with your GUID/UUID.
β Reset passwords for all users in the Sisense application.
β Logout all users by running GET /api/v1/authentication/logout_all under Admin user.
β Single Sign-On (SSO):
β If you use SSO JWT for the userβs authentication in Sisense, you will need to update sso.shared_secret in Sisense and then use the newly generated value on the side of the SSO handler.
β We strongly recommend rotating the x.509 certificate for your SSO SAML identity provider.
β If you utilize OpenID, itβs imperative to rotate the client secret as well.
β Following these adjustments, update the SSO settings in Sisense with the revised values.
β Logout all users by running GET /api/v1/authentication/logout_all under Admin user.
β Customer Database Credentials: Reset credentials in your database that were used in the Sisense application to ensure continuity of connection between the systems.
β Data Models: Change all usernames and passwords in the database connection string in the data models.
β User Params: If you are using the User Params feature, reset them.
β Active Directory/LDAP: Change the username and user password of users whose authorization is used for AD synchronization.
β HTTP Authentication for GIT: Rotate the credentials in every GIT project.
β B2D Customers: Use the following API PATCH api/v2/b2d-connection in the admin section to update the B2D connection.
β Infusion Apps: Rotate the associated keys.
β Web Access Token: Rotate all tokens.
β Custom Email Server: Rotate associated credentials.
β Custom Code: Reset any secrets that appear in custom code Notebooks.
If you need any assistance, please submit a customer support ticket at https://community.sisense.com/t5/support-portal/bd-p/SupportPortal and mark it as critical. We have a dedicated response team on standby to assist with your requests.
At Sisense, we give paramount importance to security and are committed to our customersβ success. Thank you for your partnership and commitment to our mutual security.
Regards,
Sangram Dash
Chief Information Security Officerβ
In a world where digital communication dominates, the art of scamming has evolved into a sophisticated game of deception. A recent story in The Cut featured a seasoned personal finance journalist falling prey to an Amazon scam call and being duped out of a staggering $50,000. The story serves as a stark reminder that anyone, regardless of their expertise or background, can become a victim of vishing. Short for βvoice phishing,β vishing is a form of cybercrime where scammers use phone calls to deceive individuals into revealing personal or financial information.Β
Contrary to common belief, itβs not just the elderly or technologically naive who fall victim to such schemes. One national survey found that only 15% of Gen Z and 20% of millennials express concern about falling victim to financial fraud. However, the Federal Trade Commission paints a different picture, indicating that younger adults are over four times more likely to report losing money to fraud than older adults. This dissonance highlights the need for heightened awareness and education across all age groups.Β
Vishing is a form of fraud that exploits the trust we place in phone calls. It operates through various strategies, all aimed at tricking victims. For example, wardialing involves automated systems dialing phone numbers to find vulnerable targets. VoIP, or Voice over Internet Protocol, allows scammers to make calls over the internet, often making it harder to trace them.Β Β
Caller ID spoofing is another tactic where scammers manipulate the caller ID to display a trusted or familiar number, tricking recipients into answering. These techniques create a false sense of legitimacy, making it difficult for individuals to distinguish between real and fraudulent calls.Β Β
Vishing exploits trust and naivety to obtain sensitive information or conduct unauthorized transactions. Humans have always been vulnerable to scams, but the abundance of personal data available on the dark web, obtained from various data breaches and leaks, has significantly heightened the threat. For example, LinkedIn experienced a data breach in 2021 that exposed data from 700 million users on a dark web forum.Β
A data breach like that presents scammers with a treasure trove of details about potential victims, enabling them to personalize their attacks with alarming precision. By incorporating specific details gleaned from these data sources, scammers can craft convincing narratives and establish a false sense of trust and credibility with their targets. Consequently, even individuals who exercise caution in safeguarding their personal information may find themselves vulnerable to vishing scams.Β Β
As a result, individuals must remain vigilant and adopt comprehensive security practices. Familiarizing oneself with the telltale signs of a scam call is the first line of defense. Be wary of:Β Β
If an unsolicited call seems suspicious, hang up the phone. Verify the callerβs legitimacy through independent channels, such as contacting the organization directly using a trusted phone number. In addition to recognizing signs of scam calls, implementing call-blocking technologies or screening unknown numbers can reduce exposure to potential scams. McAfee Mobile Securityβs call blocker feature can be employed to diminish the volume of incoming calls.Β
The alarming reality is that vishing knows no bounds and can affect any age or demographic. The unfortunate ordeal of the seasoned journalist losing $50,000 serves as a sobering reminder of the perils lurking behind seemingly innocuous phone calls. Vishing demands vigilance and awareness. Security software and apps can significantly increase the overall security of your phone by detecting and preventing various threats, such as malware, phishing attempts, and unauthorized access to sensitive information.Β
By adopting proactive measures, we can fortify our defenses against vishing scams and safeguard our financial well-being. Stay informed, stay vigilant, and stay protected.Β
Β
The post A Finance Journalist Fell Victim to a $50K Vishing Scam β Are You Also at Risk? appeared first on McAfee Blog.
Hospitals β despite being places where people implicitly expect to have their personal details kept private β frequently use tracking technologies on their websites to share user information with Google, Meta, data brokers, and other third parties, according to research published today.β¦
Itβs one thing to claim leadership in cloud security; itβs another to have that leadership acknowledged by industry experts. Thatβs why weβre thrilled to announce our recent recognition by Frost & Sulβ¦ Read more on Cisco Blogs
Exclusive Taxi software biz iCabbi recently fixed an issue that exposed the personal information of nearly 300,000 individuals via an unprotected database.β¦
Intel CPU cores remain vulnerable to Spectre data-leaking attacks, say academics at VU Amsterdam.β¦
In todayβs digital landscape, distinguishing between legitimate communications and phishing attempts can feel like navigating a labyrinth blindfolded. Phishing is a deceptive tactic where cybercriminals use fraudulent emails, texts, or messages to trick individuals into revealing sensitive information or clicking on malicious links. And letβs not forget its crafty sibling, βsmishingβ β the text message iteration of this digital charade.Β
Now that most brands and even government agencies communicate with consumers via text or email, itβs hard to know whether a message is legit or not. Consider the United States Postal Service, which should be solely focused on dependable package delivery, yet is frequently tasked with warning individuals against clicking on links from unsolicited messages impersonating the postal service.Β
Many people are concerned that theyβll unwittingly open an official-looking email or text only to become victims of a scam. Fortunately, there are steps you can take to educate yourself and establish safeguards against phishing and smishing attempts.Β
Here are five steps for staying cyber savvy and protecting yourself from phishing scams:Β
In a world where even simple emails and text messages can harbor malevolent intent, itβs crucial to fortify yourself with knowledge and vigilance. Using multifactor authentication and learning how to spot scam messages will help you avoid scams. If you want additional protection, our AI-powered Scam Protection scans text messages and alerts users or filters out the text if it detects a scam link. The software also blocks links from scam emails, texts, and social media messages in the event you accidentally click one. Itβs not always easy to spot phishing scams, but we can help by providing that first β and second lineΒ of defense.Β Β
The post Stay Cyber Savvy: Your 5-Step Guide to Outsmarting Phishing Scams appeared first on McAfee Blog.
FreshRSS 