Login
Waiting in the checkout line. Waiting to fall asleep. Waiting for your boring work call to finally end.
When you find yourself in these situations, do you usually have your phone in hand? And does it usually include scrolling through videos on TikTok? You’re far from alone! The app has 150 million users in the United States and more than a billion daily users worldwide.1
However, governments around the world believe that while you’re exploring the world through short-form video, unscrupulous characters are lurking in the background collecting your personal data. Here’s the real story behind TikTok bans and what they mean for you and your online privacy.
TikTok is owned by ByteDance, a Chinese company. Much of the data privacy unease surrounding TikTok is ByteDance’s opacity in their data mining practices. It’s unknown how much data it collects on users and what it does with that information. Since the Chinese government has a hand in many of the businesses based in the country, it’s unclear if the government is party to the mined data. Because many countries are tense politically with China, some governments are being cautious about limiting ByteDance’s access to personal information and potentially government secrets.
So far, various countries have banned TikTok from the work phones of government employees, including the United States, Australia, Canada, Taiwan, and various European Union members.2 India completely banned the app in the country in 2020. Various other countries with strict limits on self-expression have also attempted to forbid their citizens from accessing TikTok.
Montana became the first state to ban TikTok in May 2023. The governor cited “protecting Montanans’ personal and private data” as the reason behind the new bill, which is set to go into effect in January 2024.3
For the general population, bans of TikTok on government-issued devices will not affect your access to the platform Even for government employees, this just means that you can’t access the app from your work phone, laptop, or tablet. On your own time and your personal devices, you can still scroll to your heart’s content.
Montana’s TikTok bill could pick up steam with other states claiming to protect the PII of their citizens; however, the Montana law and any similar ones that may arise are likely to be scrutinized as a violation of freedom of speech. As of now, it’s unclear whether the bill – and future ones like it – will be invalidated due to a violation of the First Amendment.
How these TikTok bans and the news headlines may affect you is that they emphasize the necessity of social media best practices and guarding your personally identifiable information (PII) more closely.
Because it’s unclear how much and with whom TikTok is gathering and sharing your data, it’s best to play it safe and limit the amount you reveal about yourself on the app. Here are a few tips to give you peace of mind and improve your online privacy:
This is a good practice on any social media platform. Geo-tagging is a function where the app uses GPS to track your location and then publish it alongside your post. This feature may put your personal safety at risk, since stalkers can use the geotag, context clues, and video background to guess at your location.
TikTok, Facebook, Instagram, and gaming apps depend on advertisers’ dollars to make money. To provide users with the most relevant ads (and improve their chances of making a sale), companies gather information about you and build a profile based on your online comings and goings. Most apps that allow tracking must ask your permission first to do so. Always uncheck this box and disable ad tracking, because there’s no guarantee that the PII the ad company collects will stay a secret. Did you know that 98% of people have their personal information up for sale on the internet? Personal Data Cleanup is an excellent tool to erase your private details from the internet and keep it out of the hands of strangers.
Oversharing on social media may leave you vulnerable to social engineering schemes. This happens when a scammer gathers details about you and then tailor-makes a scam that’s likely to get your attention. For example, if your social media profiles make it clear that you’re an animal lover, a scammer may write a heartfelt post about needing donations to save their beloved pet.
A virtual private network (VPN) scrambles your online traffic, making it very difficult for someone to digitally eavesdrop on you or pinpoint your location. Plus, a VPN works on any device, not just desktops. So, while you scroll on a computer, tablet, or smartphone, a VPN can keep your internet traffic a secret.
Don’t worry: TikTok – the constant companion in times of boredom, transit, and when you’re in need of a laugh – isn’t going anywhere anytime soon. For the general population in most parts of the world, the app is staying put.
However, just because it’s not banned doesn’t mean that it’s 100% safe for your online privacy. Keep our tips in mind the next time you scroll through or post. To fully cover your bases and give you peace of mind, partner with McAfee+ Ultimate. This all-in-one service includes unlimited VPN for all your devices, Personal Data Cleanup, and more.
Laugh, cry, learn, and explore the world through TikTok with confidence in the security of your online privacy!
1TikTok, “Celebrating our thriving community of 150 million Americans”
2Associated Press, “Here are the countries that have bans on TikTok”
3CNN, “Montana governor bans TikTok”
The post Why Are Some Countries Banning TikTok? appeared first on McAfee Blog.
When you wind up with mobile spyware, you may wind up with a stalker on your phone.
In its most malicious forms, mobile spyware can steal information like text messages and photos, capture passwords as you tap them in, secretly turn on your microphone or camera for recording, and track your movements using GPS.
Figuratively speaking, it’s like going about your day with a stalker peering over your shoulder.
If that doesn’t sound creepy enough, it can get worse. More than just providing attackers with a live feed of your activity, spyware can record and archive your actions. From there, it can “phone home,” meaning it sends stolen information back to cybercriminals so they can hoard it for later use.
That stolen information can lead to identity fraud and theft, such as when a cybercriminal raids your existing bank accounts, sets up entirely new lines of credit in your name, or impersonates you in several other ways. In darker scenarios, stolen photos, files, and information can lead to blackmail and harassment.
Without question, a case of mobile spyware can get serious quite quickly. Yet, it is highly preventable when you know how it can end up on your phone—and the steps you can take to keep that from happening.
Malicious apps. They account for much of mobile spyware today.
Whether they’re downloaded from a third-party app store or even from Google Play or Apple’s App Store, the ruse remains the same: a malicious app poses as legitimate app. These apps may present themselves as games, wallpapers, productivity apps, exercise apps, utility apps, and even security apps. Instead, they’re loaded with spyware.
Google Play does its part to keep its virtual shelves free of malware-laden apps with a thorough submission process as reported by Google and through its App Defense Alliance that shares intelligence across a network of partners, of which we’re a proud member. Further, users also have the option of running Play Protect to check apps for safety before they’re downloaded.
Apple’s App Store has its own rigorous submission process for submitting apps. Likewise, Apple deletes hundreds of thousands of malicious apps from its store each year.
Yet, bad actors find ways to sneak malware into the store. Sometimes they upload an app that’s initially innocent and then push malware to users as part of an update. Other times, they’ll embed malicious code such that it only triggers once it’s run in certain countries. They will also encrypt malicious code in the app that they submit, which can make it difficult for reviewers to sniff out.
Unique to Android phones, Android gives people the option to download apps from third-party app stores. These stores may or may not have a thorough app submission process in place. As a result, they can be far less secure than Google Play. Moreover, some third-party app stores are fronts for organized cybercrime gangs, built specifically to distribute malware, making third-party download that much riskier.
Someone can install it directly.
In this case, a bad actor needs physical access to your phone. If they know the passcode or if the phone is unlocked, they can tamper with the phone’s settings and install the spyware themselves. This requires access, time, and effort, yet some bad actors certainly take this approach.
Surprisingly, we’ve also seen cases where malware comes pre-installed on phones. A recent case estimated that some 9 million smartphones had spyware installed in them somewhere along the supply chain. Reportedly, the spyware could steal personal information from the phone or possibly take it over entirely for a short stretch of time.
You can spot signs of tampering on an Android phone by heading to Settings and searching for “Install Unknown Apps.” If you see any sources that you didn’t set to the “On” position or a third-party website you don’t recognize, it indicates that apps from outside official app stores could have been installed in the device. Such apps are generally riskier than apps from official sources like Google Play. While not an outright indication of spyware, you should set those to “Off.”
On an iPhone, directly installing spyware takes a bit more effort. Typically, it requires “jailbreaking” the phone. This process tampers with the operating system and removes software restrictions so the iPhone can access third-party app stores and download unapproved apps. Both are highly risky activities and the reason why Apple’s iOS enforces such restrictions in the first place.
Put plainly, “jailbreaking” is not safe.
In the hands of bad actors, they can install an app called “Cydia” on a jailbroken iPhone. Cydia is an unapproved app store that offers potentially dangerous modifications and apps. If you spot Cydia on your iPhone, it’s certain sign of tampering.
Not long ago, you could often see or even feel if your smartphone was infected with spyware. It could run hot, like it was left out on blanket at the beach, because the spyware ate up computing cycles while it ran in the background. It could drain batteries or lead to sluggish performance. That’s not always the case anymore. Spyware has become leaner and more efficient in recent years, so cybercriminals can better mask their attacks.
Some signs that are better indicators of spyware include:
Whether through your phone’s data connection or through a Wi-Fi connection, unexpected increases in usage could be a sign that your phone is communicating with a third party.
A phone infected with spyware may communicate your activity to a third party, rather than to the legitimate login. The legitimate site or service never receives the first login attempt, forcing you to log in again.
This may be a sign that a cybercriminal already hacked your password, logged in under your name, and then changed the password to one of their own. (Note that this could also be a sign of a compromised or stolen password and not necessarily a sign of spyware.)
Some types of spyware can gain administration-level privileges to your phone and drop its defenses, leaving you yet more vulnerable.
Above we mentioned how cybercriminals use spyware to gain login credentials to banks and credit cards, and even steal personal items like files and photos. If you spot any unusual activity or find yourself threatened with demands, it’s possible that spyware could be a possible cause among others.
Along with installing security software, keeping your phone’s operating system up to date can greatly improve your security. Updates can fix vulnerabilities that hackers rely on to pull off their malware-based attacks. It’s another tried and true method of keeping yourself safe—and for keeping your phone running great too.
As mentioned above, Google Play has measures in place to review and vet apps to help ensure that they are safe and secure. Third-party sites may very well not, and they may intentionally host malicious apps as part of a front. Further, Google is quick to remove malicious apps from their store once discovered, making shopping there safer still.
Check out the developer—have they published several other apps with many downloads and good reviews? A legit app typically has quite a few reviews, whereas malicious apps may have only a handful of (phony) five-star reviews. Lastly, look for typos and poor grammar in both the app description and screenshots. They could be a sign that a hacker slapped the app together and quickly deployed it.
Yet better than combing through user reviews yourself is getting a recommendation from a trusted source, like a well-known publication or from app store editors themselves. In this case, much of the vetting work has been done for you by an established reviewer. A quick online search like “best fitness apps” or “best apps for travelers” should turn up articles from legitimate sites that can suggest good options and describe them in detail before you download.
Another way hackers weasel their way into your device is by getting permissions to access things like your location, contacts, and photos—and they’ll use malicious apps to do it. If an app asks for way more than you bargained for, like a simple puzzle game that requests access to your camera or microphone, it might be a scam. On Android, recent spyware usually requests REQUEST_IGNORE_BATTERY_OPTIMIZATIONS permission to execute the malicious behavior in the background. If you see behaviors like these, delete the app.
Remove old, unused, and underused applications that could be future vectors of attacks.
Along this line, we’ve seen where mobile applications change ownership (whether they get sold or others take over its operations), and the new owners don’t have the same standard operating procedures as the founders.
As mentioned above, some bad actors will install spyware on phones themselves. However, this requires access, time, and effort to pull off. Locking your phone and always keeping it close can help prevent bad actors from infecting your phone this way.
Comprehensive online protection software can secure your phone in the same ways that it secures your laptops and computers. Installing it can protect your privacy, keep you safe from attacks on public Wi-Fi, and automatically block unsafe websites and links, just to name a few things it can do.
The post Mobile Spyware—How You Can Keep Stalkers Off Your Phone appeared first on McAfee Blog.
If you’re a parent of a teen, there’s a good chance that Instagram is the culprit behind a good chunk of their screen time. However, woven into the stream of reels, stories, selfies, and Insta-worthy moments, are potential risks to your child’s privacy and safety.
According to a recent Pew Research Center report, 62 percent of teens use Instagram, making it the third most popular social media platform after YouTube and TikTok. Teens use the photo and video-sharing platform to share their creativity, connect with friends, and get updates on their favorite celebrities and influencers.
Instagram’s format makes it easy for kids (and adults!) to spend hours using filters and stickers, commenting, liking posts, and counting likes. But all this fun can take a turn if kids misuse the platform or fail to take the risks seriously.
Whether your child is new to Instagram or a seasoned IG user, consider pausing to talk about the many aspects of the platform.
Here are a few critical topics to help you kick off those conversations.
Acknowledging the impulsive behavior and maturity gaps unique to the teen years is essential. Do you feel like you are repeating yourself on these topics? That’s okay—it means you are doing it right. Repetition works. Advise them: Sharing too many personal details online can set them up for serious privacy risks, including identity theft, online scams, sextortion, or cyberbullying. Also, oversharing can negatively influence potential schools and employers who may disapprove of the content teens choose to share online.
Suggestion: Sit down together and review Instagram’s privacy settings to limit who can see your child’s content. Please encourage them to use strong passwords and two-factor authentication to secure accounts. Also, advise them to think twice before posting something and warn them about the risks of sharing intimate photos online (even with friends), as they can be easily shared or stolen. Now may be the time if you’ve never considered adding security software to protect your family devices. McAfee+ provides all-in-one privacy, identity, and device protection for families. It includes helpful features, including identity monitoring, password manager, unlimited VPN, file shredding, protection score, and parental controls. The software has updated features to include personal data cleanup and credit monitoring and reporting to protect kids from identity theft further.
This acronym stands for Fear of Missing Out. This word came from the subtle undercurrent of emotions that can bubble up when using social media. It’s common for kids to feel anxious or even become depressed because they think they are being excluded from the party. FOMO can lead them to spend too much time and money on social media, neglect their family or school responsibilities, or engage in risky behaviors to fit in with or impress others.
Suggestion: Help your child understand that it’s normal to sometimes have FOMO feelings. Please encourage them to focus on their strengths and to develop fulfilling hobbies and interests offline. To reduce FOMO, encourage your child to take breaks from social media. Also, install software to help you manage family screen time.
Akin to FOMO, comparing oneself to others is an ever-present reality among teens that is only amplified on Instagram. According to several reports, Instagram’s photo-driven culture and photo filters that enhance facial and body features can make teens feel worse about their bodies and increase the risk of eating disorders, depression, and risky behaviors. Girls, especially, can develop low self-esteem, comparing themselves to unrealistic or edited images of celebrities, influencers, or friends. Social comparison can also lead to the fixation on getting more likes, followers, or comments on their posts.
Suggestion: Create a safe space for your teen to discuss this topic with you. Help them understand the differences between Instagram life and real life. Help them be aware of how they feel while using Instagram. Encourage them to follow accounts that inspire and uplift them and unfollow accounts that spark feelings of comparison, jealousy, or inferiority.
Hurtful events that impact teens, such as gossip, rumor spreading, peer pressure, criticism, and conflict, can increase in online communities. If your child posts online, they can receive mean or sexual comments from people they know and strangers (trolls). Cyberbullying can surface in many ways online, making kids feel anxious, fearful, isolated, and worthless.
Suggestions: Keep up on how kids bully one another online and check in with your child daily about what’s happening in their life. Encourage them not to respond to bullies and to block and report the person instead. Also, if they are getting bullied, remind them to take and store screenshots. Such evidence can be helpful if they need to confide with a parent, teacher, or law enforcement.
Understanding how to discern true and false information online is becoming more complicated daily. In the McAfee 2023 Threat Predictions: Evolution and Exploitation, experts predict that AI tools will enable more realistic and efficient manipulation of images and videos, which could increase disinformation and harm the public’s mental health. Understanding online content is a great way to help your kids build their confidence and security on Instagram and other networks.
Suggestion: Encourage critical thinking and guide kids to use fact-checking tools before believing or sharing content that could be fake and using ethical AI frameworks. Remind them of their digital footprints and how the things they do online can have long-lasting consequences.
It’s important to remember that all social networks come with inherent dangers and that Instagram has taken a number of steps to reduce the potential risks associated with its community by improving its security features and safety rules for kids. Remember, nothing protects your child like a solid parent-child relationship. As a parent or caregiver, you play a critical role in educating your child about their digital well-being and privacy. Working together, as a family, your child will be equipped to enjoy the good stuff and avoid the sketchy side of the digital world.
The post Instagram Safety for Kids: Protecting Privacy and Avoiding Risks appeared first on McAfee Blog.
The time has come. Your kids are chafing at the bit to get on social media and you can no longer hold them back. But you’re terrified. ‘What if they say the wrong thing? What if they meet some unsavoury types or worst case, what if they get bullied?’ I hear you – everything you are concerned about is completely normal and totally valid. But this is not the time to put your head in the sand people, tempting as it is.
So, make yourself a cuppa. I’m going to run you through the basics so you can get your offspring (and yourself) through this quite significant moment in the best shape possible.
Ah, such a tricky question!! While there is no specific Aussie law that dictates the minimum age kids need to be to join social media, most social media platforms require their users to be 13 years old to set up an account. This is a result of a US federal law, the Children’s Online Privacy Protection Act (COPPA) , which affects any social media platform that US citizens can join. So, therefore it affects nearly all social media platforms worldwide.
But let’s keep it real – most kids join before they are 13. Some do with the consent of their parents, but many don’t. So, if your kids are consulting you on their move into social media, then pat yourself on the back. You’ve done a great job in keeping the lines of communication open and staying relevant. But if yours just charged ahead without involving you (like some of mine did) then it’s still not too late to be part of their journey.
In my opinion, there is no simple answer. A one size fits all approach doesn’t work here. Some kids mature faster than their peers, others may have a bigger dose of emotional intelligence and instinctively understand the ramifications of poor online behaviour. Some kids are more resilient and robust while others are more sensitive. There are so many things to consider when advising but ultimately, this is your call as a parent.
This is where many of us can come unstuck because it can feel so overwhelming knowing where to start. But don’t worry – I’ve got you. I’m going to give you 5 things that you can action that will make a huge difference to your kids’ online safety. And these strategies are relevant to all of us parents – regardless of whether your kids are new to social media or old hands!
I can’t stress enough just how important it is to have real conversations with your kids about all aspects of their lives, including the digital part. Asking them what they do online, why they like a certain app and who they play online games with are just some of the ways of starting a conversation. I am also a fan of sharing details of your online life with them too. Whether its sharing new apps with my kids, funny posts, or relevant news articles, I think if I regularly demonstrate that I get social media then I generate a little ‘tech cred’. And when you’ve got ‘tech cred’, they are more likely to come to you when things aren’t going swimmingly. And that’s exactly what we want as parents!
I love the idea of a clear contract between parents and kids that details your expectations about their online behaviour and technology use. It’s a great way of developing a set of guidelines that will help them navigate some of the risks and challenges associated with being online. Now, this agreement should be a family exercise so ensure your kids are invested in the process too. If you want a starting point, check out this one from The Modern Parent here.
Without a doubt, one of the most powerful ways to stay safe online is to ensure you have super duper passwords for each of your online accounts. So, take some time to ensure your kids have got this covered. Every online account needs its own individual password that should have no link to your child’s name, school, family, or favourite pet. I’m a big fan of a crazy sentence – I find they are easier to remember. If you include at least one capital letter, a few numbers, and symbols then you’re doing well. Password managers can be a great way of remembering and also generating complex passwords. These can be a godsend when your list of online accounts grows. All you need to do is remember the master password. How good!
And ensure they know to NEVER share passwords. Tell them that passwords are like toothbrushes – never to be shared! That always worked with my boys!
Unless you are proactive, privacy settings on social media platforms will remain on the default setting which usually means public. Now, this means that anyone who has access to the internet can view the posts and photos that you share whether you want them to or not. Now, this is not ideal for anyone but particularly not a young tween who is trying to find their feet online.
So, take some time to help your kids turn activate the privacy settings on all their online accounts. Turning their profile to private will give them more control over who can see their content and what people can tag them in.
There is some amazing technology that can really help you, help your kids stay safe. Installing security software on your kids’ devices is essential. McAfee+, McAfee’s new ‘all in one’ privacy, identity and device protection is a fantastic way to ensure all your family members are protected online. It features identity monitoring and a password manager but also an unlimited VPN, a file shredder, protection score and parental controls. A complete no brainer!
My absolute hope is that your kids’ social media career is smooth sailing. However, with four kids of my own, I know that curveballs and challenges are often inevitable. But if you’ve developed an open line of communication with your kids and possibly even generated a little ‘tech cred’, then it is likely they will reach out to you if things go awry.
Depending on the issue they are experiencing, you may just need to talk them through the situation. Perhaps they need help understanding they should have expressed something in a less inflammatory way or that they may be over-reacting to a comment. It may be helpful for you to work with them to develop an action plan or formulate a response to someone who is perhaps being a bit tricky.
But if they have experienced behaviour that you consider to be unacceptable, then you may need to take further action. I always recommend taking screen shots of concerning behaviour online. These may be important if you need to take further action down the track. Once you’ve taken screen shots, then block the person who is causing your child grief. You can also report the behaviour to the social media platform. If the perpetrator goes to the same school as your child, then I would approach the school and ask them to assist. If the situation is super serious, you can always report it to the Office of our ESafety Commissioner in Australia or the Police who can both work with social media platforms.
Congratulations! You have completed the basic course in social media parenting. I know letting them go can feel quite terrifying, but I know that if you cover off the basics and keep talking to them, then you’re setting them up for success online.
Over to you now, mum and dad!
Good luck!
Alex
The post 5 Minute Parent’s Guide to Social Media appeared first on McAfee Blog.
Everyone loves a great deal when they shop online. Until they discover it’s a rip-off.
Social media ads for vintage wear. Website ads for home entertainment gear. Search ads for handbags. Some of these ads aren’t what they seem. Instead of leading you to deals on a trustworthy ecommerce site, the ads take you to a bogus page designed to steal your money and personal info.
Unfortunately, it happens. And one global report estimated that online shoppers lost $41 billion to fraud in 2022. How do scammers pull it off? With the same tools that legitimate businesses use.
Let’s look at how they do it and how you can steer clear of their tricks.
Many of today’s scammers work in organized fashion. They oversee large cybercrime operations that run much like a business. They employ web designers, coders, marketing teams, and customer call centers that mimic a genuine online retailer. Which makes sense. The more they can look and act like the real thing, the more likely they can lure victims into their online stores.
Smaller bands of scammers get in on this action as well. Just as a small business can easily create an online store with any number of off-the-shelf services and solutions, so can a couple of scammers.
In this way, scammers large and small can readily create a professional-looking website, create effective ads to drive traffic to it, and collect financial information from there.
Yet, some scammers don’t steal financial information outright. They might indeed ship you the goods, but they won’t be the goods you ordered. They’re counterfeit. And it might be part of a large-scale operation that exploits child workers.
Whether they’re out to steal your money or sell you knockoff goods, online shopping scams tend to ramp up around gift-giving seasons. They’ll bait shoppers with hard-to-find items, tout steep discounts on other popular items, and otherwise play into the rush of holiday gift buying. Yet they crop up year-round as well. Really, any time you shop is a time to be on the lookout for them.
This is a great piece of advice to start with. Directly typing in the correct address for online stores and retailers is a prime way to avoid scammers online. In the case of retailers that you don’t know much about, the U.S. Better Business Bureau (BBB) asks shoppers to do their research. Ensure that the retailer has a good reputation. The BBB makes that easier with a listing of retailers you can search by typing in their name.
Also in the U.S., you can visit the website of your state’s Secretary of State. There you can search for the business in question, learn when it was founded, if it’s still active, or if it exists at all. For businesses based in a state other than your own, you can visit that state’s Secretary of State website for information. For a state-by-state list of Secretaries of State, you can visit the Secretary of State Corporate Search page here.
For a listing of businesses with international locations, organizations like S&P Global Ratings and the Dun and Bradstreet Corporation can provide background information.
Never heard of that retailer before? See when they launched their website. A relatively new site might be a sign that it’s part of a scam.
A quick visit to the ICANN (Internet Corporation for Assigned Names and Numbers) website can show you certain background information for any website you type in. Given how quickly and easily scammers can register and launch a website, this kind of information can help you sniff out a scam.
Of course, it might also indicate a new business that’s entirely legitimate, so a little more digging is called for. That’s where reviews come in. Aside from the resources listed above, a simple web search of “[company name] reviews” or “[company name] scam” can help you find out if the retailer is legit.
3. Look for the lock icon in your browser when you shop.
Secure websites begin their addresses with “https,” not just “http.” That extra “s” stands for “secure,” which means that it uses a secure protocol for transmitting sensitive info like passwords, credit card numbers, and the like over the internet. It often appears as a little padlock icon in the address bar of your browser, so double-check for that. If you don’t see that it’s secure, it’s best to avoid making purchases on that website.
4. Pay with a credit card instead of your debit card.
Credit cards offer fraud protections that debit cards don’t. Another key difference: when fraud occurs with a debit card, you fight to get your money back—it’s gone straight out of your account. With a credit card, the issuer fights to get their money back. They’re the ones who take the financial hit.
Additionally, in the U.S., the Fair Credit Billing Act offers the public protection against fraudulent charges on credit cards. The act gives citizens the power to dispute charges over $50 for goods and services that were never delivered or otherwise billed incorrectly. Note that many credit card companies have their own policies that improve upon the Fair Credit Billing Act as well. However, debit cards aren’t afforded the same protection under the Act. Avoid using a debit card while shopping online and use your credit card instead.
Two-factor authentication is an extra layer of defense on top of your username and password. It adds a one-time-use code to access your login procedure, typically sent to your smartphone by text or call. Together, that makes it tougher for a crook to hack your account. If any of your accounts support two-factor authentication, the few extra seconds it takes to set up is more than worth the big boost in protection you’ll get.
Public Wi-Fi in coffee shops and other public locations can expose your private surfing to prying eyes because those networks are open to all. A virtual private network (VPN) encrypts your browsing, shopping, and other internet traffic. That makes it secure from bad actors who try to intercept your data on public Wi-Fi, which can include your passwords and credit card numbers.
A complete suite of online protection software like McAfee+ can offer layers of extra security while you shop. It includes web browser protection that can block malicious and questionable links that might lead you down the road to malware or a phishing scam— along with a password manager that can create and securely store strong, unique passwords.
Social media has made it easier for sellers large and small to reach customers online. It’s made it easier for scammers to reach victims too.
If you’re on social media, you’ve certainly seen your share of ads. Some are from companies and retailers you know and trust. Yet more are from names you’ve likely never heard of. They might be legitimate businesses, yet they might be fronts for a convincing-looking scam.
These ads end up on social media the same way ads from legitimate businesses do, by way of social media ad platforms. Social media companies created these platforms so advertisers can reach millions of individual users based upon their age group, hobbies and interests, past purchases, and so on.
For example, a scammer might target younger shoppers with an interest in retro fashion. From there, the scammer can narrow that down to target people who live in metropolitan areas who like 1980s memorabilia. The scammers then create an ad that takes that audience to a phony website loaded with bogus t-shirts, coats, and bags.
All of it costs relatively little. A small ad budget of a few hundred dollars can give scammers exposure to millions of potential victims.
The best way to avoid getting stung by these sites is to do your homework. Seek out the company’s track record. Look for reviews. And if you’re unsure, take a pass. Don’t shop with that company.
Shopping scams can look and feel rather sophisticated today. With a host of low-cost and easy-to-use tools for publishing and advertising online, scammers of all sizes can create bogus shopping experiences that look convincing.
So buyers be wary. Before you click or tap on that ad, do some research. Determine if the company is legitimate, if it’s had complaints waged against it, and how those complaints were resolved. And always use your credit card. It offers the best consumer protections you have in the event you do end up getting scammed.
The post Steer Clear of Rip-offs: Top Tips for Safer Online Shopping appeared first on McAfee Blog.
Three seconds of audio is all it takes.
Cybercriminals have taken up newly forged artificial intelligence (AI) voice cloning tools and created a new breed of scam. With a small sample of audio, they can clone the voice of nearly anyone and send bogus messages by voicemail or voice messaging texts.
The aim, most often, is to trick people out of hundreds, if not thousands, of dollars.
Our recent global study found that out of 7,000 people surveyed, one in four said that they had experienced an AI voice cloning scam or knew someone who had. Further, our research team at McAfee Labs discovered just how easily cybercriminals can pull off these scams.
With a small sample of a person’s voice and a script cooked up by a cybercriminal, these voice clone messages sound convincing, 70% of people in our worldwide survey said they weren’t confident they could tell the difference between a cloned voice and the real thing.
Cybercriminals create the kind of messages you might expect. Ones full of urgency and distress. They will use the cloning tool to impersonate a victim’s friend or family member with a voice message that says they’ve been in a car accident, or maybe that they’ve been robbed or injured. Either way, the bogus message often says they need money right away.
In all, the approach has proven quite effective so far. One in ten of people surveyed in our study said they received a message from an AI voice clone, and 77% of those victims said they lost money as a result.
Of the people who reported losing money, 36% said they lost between $500 and $3,000, while 7% got taken for sums anywhere between $5,000 and $15,000.
Of course, a clone needs an original. Cybercriminals have no difficulty sourcing original voice files to create their clones. Our study found that 53% of adults said they share their voice data online or in recorded notes at least once a week, and 49% do so up to ten times a week. All this activity generates voice recordings that could be subject to hacking, theft, or sharing (whether accidental or maliciously intentional).
Consider that people post videos of themselves on YouTube, share reels on social media, and perhaps even participate in podcasts. Even by accessing relatively public sources, cybercriminals can stockpile their arsenals with powerful source material.
Nearly half (45%) of our survey respondents said they would reply to a voicemail or voice message purporting to be from a friend or loved one in need of money, particularly if they thought the request had come from their partner or spouse (40%), mother (24%), or child (20%).
Further, they reported they’d likely respond to one of these messages if the message sender said:
These messages are the latest examples of targeted “spear phishing” attacks, which target specific people with specific information that seems just credible enough to act on it. Cybercriminals will often source this information from public social media profiles and other places online where people post about themselves, their families, their travels, and so on—and then attempt to cash in.
Payment methods vary, yet cybercriminals often ask for forms that are difficult to trace or recover, such as gift cards, wire transfers, reloadable debit cards, and even cryptocurrency. As always, requests for these kinds of payments raise a major red flag. It could very well be a scam.
In conjunction with this survey, researchers at McAfee Labs spent two weeks investigating the accessibility, ease of use, and efficacy of AI voice cloning tools. Readily, they found more than a dozen freely available on the internet.
These tools required only a basic level of experience and expertise to use. In one instance, just three seconds of audio was enough to produce a clone with an 85% voice match to the original (based on the benchmarking and assessment of McAfee security researchers). Further effort can increase the accuracy yet more. By training the data models, McAfee researchers achieved a 95% voice match based on just a small number of audio files.
McAfee’s researchers also discovered that that they could easily replicate accents from around the world, whether they were from the US, UK, India, or Australia. However, more distinctive voices were more challenging to copy, such as people who speak with an unusual pace, rhythm, or style. (Think of actor Christopher Walken.) Such voices require more effort to clone accurately and people with them are less likely to get cloned, at least with where the AI technology stands currently and putting comedic impersonations aside.
The research team stated that this is yet one more way that AI has lowered the barrier to entry for cybercriminals. Whether that’s using it to create malware, write deceptive messages in romance scams, or now with spear phishing attacks with voice cloning technology, it has never been easier to commit sophisticated looking, and sounding, cybercrime.
Likewise, the study also found that the rise of deepfakes and other disinformation created with AI tools has made people more skeptical of what they see online. Now, 32% of adults said their trust in social media is less than it’s ever been before.
A lot can come from a three-second audio clip.
With the advent of AI-driven voice cloning tools, cybercriminals have created a new form of scam. With arguably stunning accuracy, these tools can let cybercriminals nearly anyone. All they need is a short audio clip to kick off the cloning process.
Yet like all scams, you have ways you can protect yourself. A sharp sense of what seems right and wrong, along with a few straightforward security steps can help you and your loved ones from falling for these AI voice clone scams.
For a closer look at the survey data, along with a nation-by-nation breakdown, download a copy of our report here.
The survey was conducted between January 27th and February 1st, 2023 by Market Research Company MSI-ACI, with people aged 18 years and older invited to complete an online questionnaire. In total 7,000 people completed the survey from nine countries, including the United States, United Kingdom, France, Germany, Australia, India, Japan, Brazil, and Mexico.
The post Artificial Imposters—Cybercriminals Turn to AI Voice Cloning for a New Breed of Scam appeared first on McAfee Blog.
Maybe you know that sinking feeling all too well. “Where did I leave my phone?”
The minutes pass as you search around the house, then you head into the garage to look between the driver’s seat and console of your car. No luck. So it’s back into the house where you turn over every couch cushion. Still nothing. Maybe panic is too strong a word, but you’re starting to get a little worried.
Then comes the relief. You found it.
But what if your smartphone really was lost? Or worse yet, stolen?
Not a pretty thought. But you can put protections in place that can help you recover your phone—or remotely erase it if it indeed gets lost for good. A few up-front steps is all it takes.
Preparation is everything. If your phone gets lost or stolen, you’ll want to act quickly. You’ll also want the reassurance that you have measures in place that can help you find it, recover it, or even erase it as needed. These steps can get you set up so you exactly that.
Locking your phone is one of the most basic smartphone security measures you can take. Trouble is, few of us do it.
Our recent global research showed that only 56% of adults said that they protect their smartphone with a password, passcode, or other form of lock. In effect, an unlocked phone is an open book to anyone who finds or steals a phone. It gives them unfettered access to everything on it.
And that likely includes:
Now, imagine that into the wrong hands. That might lead to financial fraud, identity theft, and even more egregious crimes like stalking and extortion. Not to mention doxing, which involves maliciously posting someone else’s photos, files, and information online for all to see.
Setting up a lock screen is easy. It’s a simple feature found on iOS and Android devices. iPhones and Androids have an auto-lock feature that will lock your phone after a certain period of inactivity. Keep this time on the low end, one minute or less, to help prevent unauthorized access.
We suggest using a PIN or passcode rather than using a gesture to unlock your phone. They’re more complex and secure. Researchers proved as much with a little “shoulder surfing” test. They looked at how well one group of subjects could unlock a phone after observing the way another group of subjects unlocked it.
They found that that “Six-digit PINs are the most elusive attacking surface where a single observation leads to only 10.8% successful attacks, improving to 26.5% with multiple observations. As a comparison, six-length Android patterns, with one observation, suffered 64.2% attack rate and 79.9% with multiple observations.”
Biometric locks like fingerprints and facial IDs are a practical option as well. Yet they present some security issues. With effort, fingerprints can get copied, such as by lifting them off a pane of glass or other things you touch. Facial ID can open a phone even when the owner’s eyes are closed. Again with some effort, a thief or bad actor can open the phone by placing it by the sleeping owner’s face. Note that these are more extreme cases, yet you should be aware of them when determining how you lock your phone.
Another powerful tool you have at your disposal is the find my phone feature made possible thanks to GPS technology. The “find my” feature can help you pinpoint your phone if your lost or stolen phone has an active data or Wi-Fi connection and has its GPS location services enabled. Even if the phone gets powered down or loses its connection, it can guide you to its last known location.
Setting up this feature is easy. Apple offers a comprehensive web page on how to enable and use their “Find My” feature for phones (and other devices too). Android users can get a step-by-step walkthrough on Google’s Android support page as well.
Back up your stuff in the cloud.
Thanks to cloud storage, you might be able to recover your photos, files, apps, notes, contact information, and more if your phone is lost or stolen. Android owners can learn how to set up cloud backup with Google Drive here, and iPhone users can learn the same for iCloud here.
Here come a couple of acronyms. IMEI (International Mobile Equipment Identity) or MEID (Mobile Equipment Identifier) are two types of unique ID numbers assigned to smartphones. Find yours and write it down. In case of loss or theft, your mobile carrier, police department, or insurance provider might ask for the information to assist in its return or reimbursement for loss.
Beyond digital security measures, plenty of loss and theft prevention falls on you. Treat your phone like the desirable item it is. That’s a big step when it comes to preventing theft.
And by close, we mean on your person. It’s easy to leave your phone on the table at a coffeeshop, on a desk in a shared workspace, or on a counter when you’re shopping. Thieves might jump on any of these opportunities for a quick snatch-and-grab. You’re better off with your phone in your pocket or zipped up in a bag that you keep close.
Enterprising thieves will find a way. They’ll snatch your bag while you’re not looking. Or they might even slice into it with a knife to get at what’s inside, like your phone.
Keep your bag or backpack close. If you’re stopping to grab a bite to eat, sling the handles through a chair leg. If you have a strong metal carabiner, you can use that too. Securing your bag like that can make it much tougher for a thief to walk by and swipe it. For extra security, look into a slash-resistant bag.
Thieves will also look for an easy mark. People who appear a little distracted, lost, or even dozing off. Aside from securing your bags, keep an eye on your surroundings. Look at people and smile, walk with purpose, and generally put across an air of confidence. Behavior like this sends a clear signal to thieves—you’re aware. That might be enough for them to pass you up.
If you have a credit card and ID holder attached to the back of your phone, you might want to remove your cards from it. That way, if your phone gets snatched, those important cards won’t get snatched as well. Take a pass on keeping things in your back pocket. Use your front pocket where it’s much more difficult for a thief to pick your pocket.
In the event of your phone getting lost or stolen, a combination of device tracking, device locking, and remote erasing can help protect your phone and the data on it.
Different device manufacturers have different ways of going about it. But the result is the same—you can prevent others from using your phone, and even erase it if you’re truly worried that it’s in the wrong hands or gone for good. Apple provides iOS users with a step-by-step guide, and Google offers up a guide for Android users as well.
Apple’s Find My app takes things a step further. Beyond locating a lost phone or wiping it, Find My can also mark the item as lost, notify you if you’ve left it behind, or trigger a sound to help you locate it. (A huge boon in that couch cushion scenario!) Drop by Apple’s page dedicated to the Find My app for more details on what you can do on what devices, along with instructions how.
With preparation and prevention, you can give yourself reassurance if your phone gets lost or stolen. You have plenty of recovery options, in addition to plenty of ways to prevent bad actors from getting their hands on the sensitive info you keep on it.
The post “Where Did I Leave My Phone?” Protecting Your Phone from Loss and Theft appeared first on McAfee Blog.
If you were to ask me what I consider to be the most attractive attribute in a person, it would be kindness but only closely followed by a sense of humour. There’s something about somebody who can tell a funny story that I just love. And humour can be a great bonding experience for us humans. Laughing over a funny video or sharing a hilarious story is pure friendship gold! But humour can often be murky territory online.
One of my favourite things about being a mum of boys is the jokes. My boys can make me laugh till I cry. And the jokes and banter they share amongst themselves warms my heart. Sometimes it feels like slapstick comedy other times its brutal and direct and often a little cheeky. Over the years, ‘safe’ boundaries have been developed for their banter so that no-one gets hurt. But it hasn’t always been perfect. It takes a certain level of maturity and a healthy dose of empathy to know where to draw the line with your humour and, unfortunately, not everyone gets this right.
All friends will joke around with each other, and our tweens and teens are no exception. Whether it’s sharing comments on funny memes or TikTok’s or leaving witty comments on each other’s online posts, online banter can be quite the demonstration of friendship and connection.
But sometimes it is hard to tell if someone is just having fun or trying to ridicule or make fun of another online. Without being able to see someone’s face and read their body language in person, the joker’s intention can often be ambiguous. It may be laughed off with a ‘just kidding’ or ‘relax, you’re too serious’. And so, here we are in the grey area. One of the most common questions I am asked by parents is how to differentiate between jokes and cyberbullying online. And my answer is simple.
If you feel hurt by a joke or think others are laughing at you (instead of with you) then the joke has gone too far. Yes, we all have different levels of sensitivity but if you are offended then it’s time to take some action. Now, if it continues after asking for it to stop and you are still feeling upset then this is bullying.
It really is simple – a joke is intended to be humorous without causing harm whereas bullying is intended to cause harm to others. And, of course jokes can sometimes go too far but in most cases an apology and an explanation can remedy any hurt.
Navigating friendships when you’re in thick of being a teenager can be really tough for some kids particularly those who aren’t as mature or worldly as others. Kids who are a little younger or less experienced with life may feel that they are on the outskirts of their social group. And in my experience, this can be a tough place to be. Regardless of how many times we tell our kids that being popular or accepted doesn’t matter, when you’re 15 it really can. So, if your shy 15-year-old receives a joking message from a kid at school (who he’d like to be friends with) that upsets him, do you need to take action? Or will it jeopardise any chance your child might have to be friends with this child?
I always like to give a person the benefit of the doubt. So, my advice here would be to continue to monitor the situation. If your child receives additional messages that upset him, then he needs to ask the ‘joker’ to stop. Some kids would be OK to manage this themselves while others might need some help. If they need help, I suggest contacting the school or sporting club that your kids have in common and asking them to intervene. Do not contact the child directly yourself.
One of the best things you can do for your kids is ensure they know what to do if they are on the receiving end of behaviour online that they find upsetting. Even if it doesn’t qualify as cyberbullying, having an action plan can empower them. Here’s what I suggest:
It’s often hard to know when to get involved in your teens’ battles. At the end of the day, our job is to help our kids grow into independent adults. But when your gut tells you things are not right then it’s time to start investigating. Insomnia, anxiety, refusing to go to school and a change in the way they use their devices, are all signs they maybe on the receiving end of aggressive online behaviour. And remember, you know your kids better than anyone!
Till Next Time
Stay Safe Online
Alex
The post Is My Child Being Cyberbullied Or Is It Just Banter? appeared first on McAfee Blog.
Concerned about ransomware? McAfee stops it dead in its tracks.
Newly published findings from the independent labs at AV-TEST show that McAfee’s antivirus technology performs best. In recent tests, it detected and blocked top forms of ransomware sooner than the entire field of nine other antivirus technologies.
In their lab setting, AV-TEST used emails loaded with ransomware attachments to test the defenses of computers. Ransomware is a type of malware that infects a network or a device and then typically encrypts the files, data, and apps stored on it, digitally scrambling them so the proper owners can’t access them, often using sophisticated methods of cryptography that are nearly impossible to undo. AV-TEST used ten different forms of ransomware, each one employing the latest techniques. Only McAfee detected and blocked ransomware at its earliest stage—right when it first arrived by email.
Put in practical terms, McAfee eliminated the ransomware threat the moment it spotted it.
Other antivirus software wasn’t so quick. They only detected the ransomware when the user clicked and activated the ransomware. Some antivirus allowed one or two attacks to fully succeed—encrypting files with ransomware as a result.
McAfee earned a perfect score of 30/30 points possible in this battery of ransomware tests, earning it the distinction of AV-Test’s “Advanced Certified” certificate.
This follows earlier recognition where McAfee was awarded “Best Protection” by AV-Test in March of this year.
Note that while AV-Test used McAfee Total Protection in its tests, McAfee uses the same antivirus technology across all our online protection software. That includes all our McAfee+ products, McAfee Total Protection, McAfee LiveSafe, McAfee Internet Security, McAfee AntiVirus Plus, and McAfee Small Business Security.
For more about ransomware, what it looks like, how it acts, and how you can protect yourself from it, check out our Ransomware Security Guide. It’s part of our broader Security Series, which covers topics from safer online shopping to your privacy on social media and more.
Learn more about our award-winning antivirus here—plus even more features that can protect your privacy and identity as well.
The post Independent Lab Tests Show that McAfee Stops Malware Dead in Its Tracks appeared first on McAfee Blog.
Ping, it’s a scammer!
The sound of an incoming email, text, or direct message has a way of getting your attention, so you take a look and see what’s up. It happens umpteen times a week, to the extent that it feels like the flow of your day. And scammers want to tap into that with sneaky phishing attacks that catch you off guard, all with the aim of stealing your personal information or bilking you out of your money.
Phishing attacks take several forms, where scammers masquerade as a legitimate company, financial institution, government agency, or even as someone you know. And they’ll come after you with messages that follow suit:
You can see why phishing attacks can be so effective. Messages like these have an urgency to them, and they seem like they’re legit, or they at least seem like they might deal with something you might care about. But of course they’re just a ruse. And some of them can look and sound rather convincing. Or at least convincing enough that you’ll not only give them a look, but that you’ll also give them a click too.
And that’s where the troubles start. Clicking the links or attachments sent in a phishing attack can lead to several potentially nasty things, such as:
However, plenty of phishing attacks are preventable. A mix of knowing what to look for and putting a few security steps in place can help you keep scammers at bay.
How you end up with one has a lot to do with it.
There’s a good chance you’ve already seen your share of phishing attempts on your phone. A text comes through with a brief message that one of your accounts needs attention, from an entirely unknown number. Along with it is a link that you can tap to follow up, which will send you to a malicious site. In some cases, the sender may skip the link and attempt to start a conversation with the aim of getting you to share your personal information or possibly fork over some payment with a gift card, money order, rechargeable debit card, or other form of payment that is difficult to trace and recover.
In the case of social media, you can expect that the attack will come from an imposter account that’s doing its best to pose as one of those legitimate businesses or organizations we talked about, or perhaps as a stranger or even someone you know. And the name and profile pic will do its best to play the part. If you click on the account that sent it, you may see that it was created only recently and that it has few to no followers, both of which are red flags. The attack is typically conversational, much like described above where the scammer attempts to pump you for personal info or money.
Attacks that come by direct messaging apps will work much in the same way. The scammer will set up a phony account, and where the app allows, a phony name and a phony profile pic to go along with it.
Email gets a little more complicated because emails can range anywhere from a few simple lines of text to a fully designed piece complete with images, formatting, and embedded links—much like a miniature web page.
In the past, email phishing attacks looked rather unsophisticated, rife with poor spelling and grammar, along with sloppy-looking layouts and images. That’s still sometimes the case today. Yet not always. Some phishing emails look like the real thing. Or nearly so.
Case in point, here’s a look at a phishing email masquerading as a McAfee email:
There’s a lot going on here. The scammers try to mimic the McAfee brand, yet don’t quite pull it off. Still, they do several things to try and be convincing.
Note the use of photography and the box shot of our software, paired with a prominent “act now” headline. It’s not the style of photography we use. Not that people would generally know this. However, some might have a passing thought like, “Huh. That doesn’t really look right for some reason.”
Beyond that, there are a few capitalization errors, some misplaced punctuation, plus the “order now” and “60% off” icons look rather slapped on. Also note the little dash of fear it throws in at the top of the email with mention of “There are (42) viruses on your computer.”
Taken all together, you can spot many email scams by taking a closer look, seeing what doesn’t feel right, and then trusting you gut. But that asks you to slow down, take a moment, and eyeball the email critically. Which people don’t always do. And that’s what scammers count on.
Similar ploys see scammers pose as legitimate companies and retailers, where they either ask you to log into a bogus account page to check statement or the status of an order. Some scammers offer links to “discount codes” that are instead links to landing pages designed steal your account login information as well. Similarly, they may simply send a malicious email attachment with the hope that you’ll click it.
In other forms of email phishing attacks, scammers may pose as a co-worker, business associate, vendor, or partner to get the victim to click a malicious link or download malicious software. These may include a link to a bogus invoice, spreadsheet, notetaking file, or word processing doc—just about anything that looks like it could be a piece of business correspondence. Instead, the link leads to a scam website that asks the victim “log in and download” the document, which steals account info as a result. Scammers may also include attachments to phishing emails that can install malware directly on the device, sometimes by infecting an otherwise everyday document with a malicious payload.
Email scammers may also pose as someone you know, whether by propping up an imposter email account or by outright hijacking an existing account. The attack follows the same playbook, using a link or an attachment to steal personal info, request funds, or install malware.
While you can’t outright stop phishing attacks from making their way to your computer or phone, you can do several things to keep yourself from falling to them. Further, you can do other things that may make it more difficult for scammers to reach you.
The content and the tone of the message can tell you quite a lot. Threatening messages or ones that play on fear are often phishing attacks, such angry messages from a so-called tax agent looking to collect back taxes. Other messages will lean heavy on urgency, like the phony McAfee phishing email above that says your license has expired today and that you have “(42)” viruses. And during the holidays, watch out for loud, overexcited messages about deep discounts on hard-to-find items. Instead of linking you off to a proper ecommerce site, they may link you to a scam shopping site that does nothing but steal your money and the account information you used to pay them. In all, phishing attacks indeed smell fishy. Slow down and review that message with a critical eye. It may tip you off to a scam.
Some phishing attacks can look rather convincing. So much so that you’ll want to follow up on them, like if your bank reports irregular activity on your account or a bill appears to be past due. In these cases, don’t click on the link in the message. Go straight to the website of the business or organization in question and access your account from there. Likewise, if you have questions, you can always reach out to their customer service number or web page.
When scammers contact you via social media, that in of itself can be a tell-tale sign of a scam. Consider, would an income tax collector contact you over social media? The answer there is no. For example, in the U.S. the Internal Revenue Service (IRS) makes it quite clear that they will never contact taxpayers via social media. (Let alone send angry, threatening messages.) In all, legitimate businesses and organizations don’t use social media as a channel for official communications. They have accepted ways they will, and will not, contact you. If you have any doubts about a communication you received, contact the business or organization in question directly and follow up with one of their customer service representatives.
Some phishing attacks involve attachments packed with malware like the ransomware, viruses, and keyloggers we mentioned earlier. If you receive a message with such an attachment, delete it. Even if you receive an email with an attachment from someone you know, follow up with that person. Particularly if you weren’t expecting an attachment from them. Scammers will often hijack or spoof email accounts of everyday people to spread malware.
On computers and laptops, you can hover your cursor over links without clicking on them to see the web address. Take a close look at the addresses the message is using. If it’s an email, look at the email address. Maybe the address doesn’t match the company or organization at all. Or maybe it looks like it almost does, yet it adds a few letters or words to the name. This marks yet another sign that you may have a phishing attack on your hands. Scammers also use the common tactic of a link shortener, which creates links that almost look like strings of indecipherable text. These shortened links mask the true address, which may indeed be a link to scam site. Delete the message. If possible, report it. Many social media platforms and messaging apps have built-in controls for reporting suspicious accounts and messages.
On social media and messaging platforms, stick to following, friending, and messaging people who you really know. As for those people who contact you out of the blue, be suspicious. Sad to say, they’re often scammers canvassing these platforms for victims. Better yet, where you can, set your profile to private, which makes it more difficult for scammers select and stalk you for an attack.
How’d that scammer get your phone number or email address anyway? Chances are, they pulled that information off a data broker site. Data brokers buy, collect, and sell detailed personal information, which they compile from several public and private sources, such as local, state, and federal records, plus third parties like supermarket shopper’s cards and mobile apps that share and sell user data. Moreover, they’ll sell it to anyone who pays for it, including people who’ll use that information for scams. You can help reduce those scam texts and calls by removing your information from those sites. Our Personal Data Cleanup scans some of the riskiest data broker sites and shows you which ones are selling your personal info.
Online protection software can protect you in several ways. First, it can offer safe browsing features that can identify malicious links and downloads, which can help prevent clicking them. Further, it can steer you away from dangerous websites and block malware and phishing sites if you accidentally click on a malicious link. And overall, strong virus and malware protection can further block any attacks on your devices. Be sure to protect your smartphones in addition to your computers and laptops as well, particularly given all the sensitive things we do on them, like banking, shopping, and booking rides and travel.
Once phishing attacks were largely the domain of bogus emails, yet now they’ve spread to texts, social media, and messaging apps—anywhere a scammer can send a fraudulent message while posing as a reputable source.
Scammers count on you taking the bait, the immediate feelings of fear or concern that there’s a problem with your taxes or one of your accounts. They also prey on scarcity, like during the holidays where people search for great deals on gifts and have plenty of packages on the move. With a critical eye, you can often spot those scams. Sometimes, a pause and a little thought is all it takes. And in the cases where a particularly cagey attack makes its way through, online protection software can warn you that the link you’re about to click is indeed a trap.
Taken all together, you have plenty of ways you can beat scammers at their game.
The post How to Avoid Phishing Attacks on Your Smartphones and Computers appeared first on McAfee Blog.
It’s no secret that when it comes to social networks, teen preferences can change dramatically from year to year. That holds with Twitter. Even though the social network has seen a dip in use overall, Twitter has proven its staying power among certain communities, and that includes teens.
According to a 2022 Pew Center Study, 23 percent of teens online use Twitter (down from 33 percent in 2014-15). Because of Twitter’s loyal fanbase, it’s important for tweeting teens as well as parents, and caregivers to understand how to engage safely on the fast-moving platform.
Many teens love the public aspect of Twitter. They see it as a fun place to connect with friends and stay up to date on sports, school news, memes, online trends and challenges, and popular culture. However, because the platform’s brief, 140–280-word format is so distinct from other popular networks such as TikTok, YouTube, and Snapchat, the online etiquette and ground rules for engagement are also distinct.
As fun as Twitter content is to share and consume, the platform still comes with hidden risks (as do all social networks).
Here’s a guide to help your family understand safe Twitter use and still have fun on this unique social network.
This is likely one of the most important phrases you can convey to your child when it comes to using Twitter. Every word shared online can have positive or negative repercussions. Twitter’s fast-moving, ticker-like feed can tempt users to underestimate the impact of an impulsive, emotionally charged tweet. Words—digital words especially—can cause harm to the reputation of the person tweeting or to others.
For this reason, consider advising your kids to be extra careful when sharing their thoughts or opinions, retweeting others, or responding to others’ tweets. We all know too well that content shared carelessly or recklessly online can affect future college or career opportunities for years to come.
There’s little more important these days than protecting your family’s privacy. Every online risk can be traced to underestimating the magnitude of this single issue.
It’s never too early or too late to put the right tools in place to protect your family’s privacy online. While Twitter has privacy and reporting features designed to protect users, it’s wise to add a comprehensive identity and privacy protection solution to protect your family’s devices and networks.
Kids get comfortable with their online communities. This feeling of inclusion and belonging can lead to oversharing personal details. Discuss the importance of keeping personal details private online reminding your kids to never share their full name, address, phone number, or other identity or location-revealing details. This includes discerning posting photos that could include signage, school or workplace logos, and addresses. In addition, advise family members not to give away data just because there’s a blank. It’s wise to only share your birthday month and day and keep your birth year private.
When is the last time you reviewed social media account settings with your child? It’s possible that, over time, your child may have eased up on their settings. Privacy settings on Twitter are easy to understand and put in place. Your child’ can control their discoverability, set an account to be public or private, and protect their tweets from public search. It’s easy to filter out unwanted messages, limit messages from people you don’t follow, and limit who can see your Tweets or tag you in photos. It’s also possible to filter the topics you see.
Respecting others is foundational to engaging on any social network. This includes honoring the beliefs, cultures, traditions, opinions, and choices of others. Cyberbullying plays out in many ways on Twitter and one of those ways is by subtweeting. This vague form of posting is a form of digital gossip. Subtweeting is when one Twitter user posts a mocking or critical tweet that alludes to another Twitter user without directly mentioning their name. It can be cruel and harmful. Discuss the dangers of subtweeting along with the concept of empathy. Also, encourage your child to access the platform’s social media guidelines and know how to unfollow, block, and report cyberbullies on Twitter.
Maintaining a strong parent-child bond is essential to your child’s mental health and the first building block of establishing strong online habits. Has your child’s mood suddenly changed? Are they incessantly looking at their phone? Have their grades slipped? An online conflict, a risky situation, or some type of bullying may be the cause. You don’t have to hover over your child’s social feeds every day, but it’s important to stay involved in their daily life to support their mental health. If you do monitor their social networks, be sure to check the tone and intent of comments, captions, and replies. You will know bullying and subtweeting when you see it.
We love to quote Spiderman’s uncle Ben Parker and remind families that “with great power comes great responsibility” because it sums up technology ownership and social media engagement perfectly. The more time kids spend online, the more comfortable they can become and the more lapses in judgment can occur. Consider discussing (and repeating often) that social media isn’t a right, it’s a privilege that carries responsibility and consequences.
The FBI estimates there are approximately 500,000 predators active online each day and that they all have multiple profiles. Anonymous, catfish, and fake accounts abound online wooing even the savviest digital native into an unsafe situation. Engaging on any social network can expose kids to a wide array of possible dangers including scammers, catfishes, and predators. Scams and predator tactics continue to get more sophisticated. For this reason, it’s important to candidly talk about online predator awareness and the ever-evolving tactics bad actors will go to deceive minors online.
Twitter continues to attract tweens and teens who appreciate its brevity and breaking news. While navigating online safety and social media can be daunting for parents, it’s critical to stay engaged with your child and understand their digital life. By establishing an open flow of communication and regularly discussing privacy and appropriate online behavior, you can create a culture of openness in your family around important issues. We’re rooting for you!
The post How to Protect Your Family’s Privacy on Twitter: A Guide for Parents and Kids appeared first on McAfee Blog.
There are plenty of phish in the sea.
Millions of bogus phishing emails land in millions of inboxes each day with one purpose in mind—to rip off the recipient. Whether they’re out to crack your bank account, steal personal information, or both, you can learn how to spot phishing emails and keep yourself safe.
And some of today’s phishing emails are indeed getting tougher to spot.
They seem like they come from companies you know and trust, like your bank, your credit card company, or services like Netflix, PayPal, and Amazon. And some of them look convincing. The writing and the layout are crisp, and the overall presentation looks professional. Yet still, there’s still something off about them.
And there’s certainly something wrong with that email. It was written by a scammer. Phishing emails employ a bait-and-hook tactic, where an urgent or enticing message is the bait and malware or a link to a phony login page is the hook.
Once the hook gets set, several things might happen. That phony login page may steal account and personal information. Or that malware might install keylogging software that steals information, viruses that open a back door through which data can get hijacked, or ransomware that holds a device and its data hostage until a fee is paid.
Again, you can sidestep these attacks if you know how to spot them. There are signs.
Let’s look at how prolific these attacks are, pick apart a few examples, and then break down the things you should look for.
<h2>Phishing attack statistics—the millions of attempts made each year.
In the U.S. alone, more than 300,000 victims reported a phishing attack to the FBI in 2022. Phishing attacks topped the list of reported complaints, roughly six times greater than the second top offender, personal data breaches. The actual figure is undoubtedly higher, given that not all attacks get reported.
Looking at phishing attacks worldwide, one study suggests that more than 255 million phishing attempts were made in the second half of 2022 alone. That marks a 61% increase over the previous year. Another study concluded that 1 in every 99 mails sent contained a phishing attack.
Yet scammers won’t always cast such a wide net. Statistics point to a rise in targeted spear phishing, where the attacker goes after a specific person. They will often target people at businesses who have the authority to transfer funds or make payments. Other targets include people who have access to sensitive information like passwords, proprietary data, and account information.
As such, the price of these attacks can get costly. In 2022, the FBI received 21,832 complaints from businesses that said they fell victim to a spear phishing attack. The adjusted losses were over $2.7 billion—an average cost of $123,671 per attack.
So while exacting phishing attack statistics remain somewhat elusive, there’s no question that phishing attacks are prolific. And costly.
<h2>What does a phishing attack look like?
Nearly every phishing attack sends an urgent message. One designed to get you to act.
Some examples …
When set within a nice design and paired some official-looking logos, it’s easy to see why plenty of people click the link or attachment that comes with messages like these.
And that’s the tricky thing with phishing attacks. Scammers have leveled up their game in recent years. Their phishing emails can look convincing. Not long ago, you could point to misspellings, lousy grammar, poor design, and logos that looked stretched or that used the wrong colors. Poorly executed phishing attacks like that still make their way into the world. However, it’s increasingly common to see far more sophisticated attacks today. Attacks that appear like a genuine message or notice.
Case in point:
Say you got an email that said your PayPal account had an issue. Would you type your account information here if you found yourself on this page? If so, you would have handed over your information to a scammer.
We took the screenshot above as part of following a phishing attack to its end—without entering any legitimate info, of course. In fact, we entered a garbage email address and password, and it still let us in. That’s because the scammers were after other information, as you’ll soon see.
As we dug into the site more deeply, it looked pretty spot on. The design mirrored PayPal’s style, and the footer links appeared official enough. Yet then we looked more closely.
Note the subtle errors, like “card informations” and “Configuration of my activity.” While companies make grammatical errors on occasion, spotting them in an interface should hoist a big red flag. Plus, the site asks for credit card information very early in the process. All suspicious.
Here’s where the attackers really got bold.
They ask for bank “informations,” which not only includes routing and account numbers, but they ask for the account password too. As said, bold. And entirely bogus.
Taken all together, the subtle errors and the bald-faced grab for exacting account information clearly mark this as a scam.
Let’s take a few steps back, though. Who sent the phishing email that directed us to this malicious site? None other than “paypal at inc dot-com.”
Clearly, that’s a phony email. And typical of a phishing attack where an attacker shoehorns a familiar name into an unassociated email address, in this case “inc dot-com.” Attackers may also gin up phony addresses that mimic official addresses, like “paypalcustsv dot-com.” Anything to trick you.
Likewise, the malicious site that the phishing email sent us to used a spoofed address as well. It had no official association with PayPal at all—which is proof positive of a phishing attack.
Note that companies only send emails from their official domain names, just as their sites only use their official domain names. Several companies and organizations will list those official domains on their websites to help curb phishing attacks.
For example, PayPal has a page that clearly states how it will and will not contact you. At McAfee, we have an entire page dedicated to preventing phishing attacks, which also lists the official email addresses we use.
Not every scammer is so sophisticated, at least in the way that they design their phishing emails. We can point to a few phishing emails that posed as legitimate communication from McAfee as examples.
There’s a lot going on in this first email example. The scammers try to mimic the McAfee brand, yet don’t pull it off. Still, they do several things to try to act convincing.
Note the use of photography and the box shot of our software, paired with a prominent “act now” headline. It’s not the style of photography we use. Not that people would generally know this. However, some might have a passing thought like, “Huh. That doesn’t really look like what McAfee usually sends me.”
Beyond that, there are a few capitalization errors, some misplaced punctuation, and the “order now” and “60% off” icons look rather slapped on. Also note the little dash of fear it throws in with a mention of “There are (42) viruses on your computer …”
Taken all together, someone can readily spot that this is a scam with a closer look.
This next ad falls into the less sophisticated category. It’s practically all text and goes heavy on the red ink. Once again, it hosts plenty of capitalization errors, with a few gaffes in grammar as well. In all, it doesn’t read smoothly. Nor is it easy on the eye, as a proper email about your account should be.
What sets this example apart is the “advertisement” disclaimer below, which tries to lend the attack some legitimacy. Also note the phony “unsubscribe” link, plus the (scratched out) mailing address and phone, which all try to do the same.
This last example doesn’t get our font right, and the trademark symbol is awkwardly placed. The usual grammar and capitalization errors crop up again, yet this piece of phishing takes a slightly different approach.
The scammers placed a little timer at the bottom of the email. That adds a degree of scarcity. They want you to think that you have about half an hour before you are unable to register for protection. That’s bogus, of course.
Seeing any recurring themes? There are a few for sure. With these examples in mind, get into the details—how you can spot phishing attacks and how you can avoid them altogether.
Just as we saw, some phishing attacks indeed appear fishy from the start. Yet sometimes it takes a bit of time and a particularly critical eye to spot.
And that’s what scammers count on. They hope that you’re moving quickly or otherwise a little preoccupied when you’re going through your email or messages. Distracted enough so that you might not pause to think, is this message really legit?
One of the best ways to beat scammers is to take a moment to scrutinize that message while keeping the following in mind …
Fear. That’s a big one. Maybe it’s an angry-sounding email from a government agency saying that you owe back taxes. Or maybe it’s another from a family member asking for money because there’s an emergency. Either way, scammers will lean heavily on fear as a motivator.
If you receive such a message, think twice. Consider if it’s genuine. For instance, consider that tax email example. In the U.S., the Internal Revenue Service (IRS) has specific guidelines as to how and when they will contact you. As a rule, they will likely contact you via physical mail delivered by the U.S. Postal Service. (They won’t call or apply pressure tactics—only scammers do that.) Likewise, other nations will have similar standards as well.
Scammers also love urgency. Phishing attacks begin by stirring up your emotions and getting you to act quickly. Scammers might use threats or overly excitable language to create that sense of urgency, both of which are clear signs of a potential scam.
Granted, legitimate businesses and organizations might reach out to notify you of a late payment or possible illicit activity on one of your accounts. Yet they’ll take a far more professional and even-handed tone than a scammer would. For example, it’s highly unlikely that your local electric utility will angrily shut off your service if you don’t pay your past due bill immediately.
Gift cards, cryptocurrency, money orders—these forms of payment are another sign that you might be looking at a phishing attack. Scammers prefer these methods of payment because they’re difficult to trace. Additionally, consumers have little or no way to recover lost funds from these payment methods.
Legitimate businesses and organizations won’t ask for payments in those forms. If you get a message asking for payment in one of those forms, you can bet it’s a scam.
Here’s another way you can spot a phishing attack. Take a close look at the addresses the message is using. If it’s an email, look at the email address. Maybe the address doesn’t match the company or organization at all. Or maybe it does somewhat, yet it adds a few letters or words to the name. This marks yet another sign that you might have a phishing attack on your hands.
Likewise, if the message contains a web link, closely examine that as well. If the name looks at all unfamiliar or altered from the way you’ve seen it before, that might also mean you’re looking at a phishing attempt.
Online protection software can protect you from phishing attacks in several ways.
For starters, it offers web protection that warns you when links lead to malicious websites, such as the ones used in phishing attacks. In the same way, online protection software can warn you about malicious downloads and email attachments so that you don’t end up with malware on your device. And, if the unfortunate does happen, antivirus can block and remove malware.
Online protection software like ours can also address the root of the problem. Scammers must get your email address from somewhere. Often, they get it from online data brokers, sites that gather and sell personal information to any buyer—scammers included.
Data brokers source this information from public records and third parties alike that they sell in bulk, providing scammers with massive mailing lists that can target thousands of potential victims. You can remove your personal info from some of the riskiest data broker sites with our Personal Data Cleanup, which can lower your exposure to scammers by keeping your email address out of their hands.
In all, phishing emails have telltale signs, some more difficult to see than others. Yet you can spot them when you know what to look for and take the time to look for them. With these attacks so prevalent and on the rise, looking at your email with a critical eye is a must today.
The post How to Spot Phishing Emails and Scams appeared first on McAfee Blog.
Authored by: Anandeshwar Unnikrishnan
In recent GULoader campaigns, we are seeing a rise in NSIS-based installers delivered via E-mail as malspam that use plugin libraries to execute the GU shellcode on the victim system. The NSIS scriptable installer is a highly efficient software packaging utility. The installer behavior is dictated by an NSIS script and users can extend the functionality of the packager by adding custom libraries (dll) known as NSIS plugins. Since its inception, adversaries have abused the utility to deliver malware.
NSIS stands for Nullsoft Scriptable Installer. NSIS installer files are self-contained archives enabling malware authors to include malicious assets along with junk data. The junk data is used as Anti-AV / AV Evasion technique. The image below shows the structure of an NSIS GULoader staging executable archive.
The NSIS script, which is a file found in the archive, has a file extension “.nsi” as shown in the image above. The deployment strategy employed by the threat actor can be studied by analyzing the NSIS script commands provided in the script file. The image shown below is an oversimplified view of the whole shellcode staging process.
The file that holds the encoded GULoader shellcode is dropped on to victim’s disc based on the script configuration along with other data. Junk is appended at the beginning of the encoded shellcode. The encoding style varies from sample to sample. But in all most all the cases, it’s a simple XOR encoding. As mentioned before, the shellcode is appended to junk data, because of this, an offset is used to retrieve encoded GULoader shellcode. In the image, the FileSeek NSIS command is used to do proper offsetting. Some samples have unprotected GULoader shellcode appended to junk data.
A plugin used by the NSIS installer is nothing but a DLL which gets loaded by the installer program at runtime and invokes functions exported by the library. Two DLL files are dropped in user’s TEMP directory, in all analyzed samples one DLL has a consistent name of system.dll and name of the other one varies.
The system.dll is responsible for allocating memory for the shellcode and its execution. The following image shows how the NSIS script calls functions in plugin libraries.
The system.dll has the following exports as shown the in the image below. The function named “Call” is being used to deploy the shellcode on victim’s system.
The implementation of the exception handling by the Operating System provides an opportunity for the adversary to take over execution flow. The Vectored Exception Handling on Windows provides the user with ability to register custom exception handler, which is simply a code logic that gets executed at the event of an exception. The interesting thing about handling exceptions is that the way in which the system resumes its normal execution flow of the program after the event of exception. Adversaries exploit this mechanism and take ownership of the execution flow. Malware can divert the flow to the code which is under its control when the exception occurs. Normally it is employed by the malware to achieve following goals:
The GuLoader employs the VEH mainly for obfuscating the execution flow and to slow down the analysis. This section will cover the internals of Vectored exception handling on Windows and investigates how GUloader is abusing the VEH mechanism to thwart any analysis efforts.
The Handler routine is of the type PVECTORED_EXCEPTION_HANDLER. Further checking the documentation, we can see the handler function takes a pointer to _EXCEPTION_POINTERS type as its input as shown in the image below.
The _EXCEPTION_POINTERS type holds two important structures; PEXCEPTION_RECORD and PCONTEXT. PEXCEPTION_RECORD contains all the information related to exception raised by the system like exception code etc. and PCONTEXT structure holds CPU register (like RIP/EIP, debug registers etc.) values or state of the thread captured when exception occurred.
Vectored Handler in GULoader
The GULoader sets the trap flag to trigger single stepping intentionally to detect analysis. The handler code gets executed as discussed before, a block of code is executed based on the exception code. If the exception is single stepping, status code is 0x80000004, following actions take place:
EIP Calculation Logic Summary
| Trigger via interrupt instruction (INT3) | eip=((ReadByte(eip+1)^0x1A)+eip) |
| Trigger via Single Stepping(PUSHFD/POPFD) | eip=((ReadByte(eip+2)^0x1A)+eip) |
*The value 0x1A changes with samples
Detecting Abnormal Execution Flow via VEH
Below image shows this the carefully laid out code to detect analysis.
One interesting feature seen in GULoader shellcode in the wild is runtime padding. Runtime padding is an evasive behavior to beat automated scanners and other security checks employed at runtime. It delays the malicious activities performed by the malware on the target system.
The following images show the egg location validity checks performed by GULoader. The values 0xB8 and 0xC3 are checked by using proper offsets from the egg location.
In the second stage of the infection chain, the GULoader performs anti-analysis and code injection. Major anti-analysis vectors are listed below. After making sure that shellcode is not running in a sandbox, it proceeds to conduct code injection into a newly spawned process where stage 3 is initiated to download and deploy actual payload. This payload can be either commodity stealer or RAT.
Whenever GULoader invokes a Win32 api, the call is sandwiched between two XOR loops as shown in the image below. The loop prior to the call encoded the active shellcode region where the call is taking place to prevent the memory from getting dumped by the security products based on event monitoring or api calls. Following the call, the shellcode region is decoded again back to normal and resumes execution. The XOR key used is a word present in the shellcode itself.
This section covers the process undertaken by the GUloader to decode the strings at the runtime.
The first byte/word is reserved to hold the size of the encoded bytes. Below shows a 12 byte long encoded data being written to memory.
Later, the first word gets replaced by the first word of the actual encoded data. Below image shows the buffer after replacing the first word.
The encoded data is fully recovered now, and malware proceeds to decode it. For decoding the simple XOR is employed, and key is present in the shellcode. The assembly routine that does the decoding is shown in the image below. Each byte in the buffer is XORed with the key.
The result of the XOR operation is written to same memory buffer that holds the encoded data. A final view of the memory buffer with decoded data is shown below.
The image shows the decoding the string “psapi.dll”, later this string is used in fetching the addresses of various functions to employ anti-analysis.
The stage 2 culminates in code injection, to be specific GULoader employs a variation of the process hollowing technique, where a benign process is spawned in a suspended state by the malware stager process and proceeds to overwrite the original content present in the suspended process with malicious content, later the state of the thread in the suspended process is changed by modifying processor register values like EIP and finally the process resumes its execution. By controlling EIP, malware can now direct the control flow in the spawned process to a desired code location. After a successful hollowing, the malware code will be running under the cover of a legit application.
The variation of hollowing technique employed by the GULoader doesn’t replace the file contents, but instead injects the same shellcode and maps the memory in the suspended process. Interestingly, GULoader employs an additional technique if the hollowing attempt fails. More details are covered in the following section.
Listed below Win32 native APIs are dynamically resolved at runtime to perform the code injection.
After memory allocation, it writes itself into remote process via NtWriteVirtualMemory as discussed above. GULoader shellcodes taken from the field are bigger in size, samples taken for this analysis are all greater than 20 mb. In samples analyzed, the buffer size allocated to hold the shellcode is 2950000 bytes. The below image shows the GuLoader shellcode in the memory.
The RVA is added to the base address of the newly allocated memory in the CasPol.exe process to obtain new VA which can be used in the remote process. The new VA is written into EIP and EBX field in the thread context structure of the CasPol.exe process retrieved via ZwGetContextThread. Below image shows the modified context structure and value of EIP.
Finally, by calling ZwSetContextThread, the changes made to the CONTEXT structure is committed in the target thread of CasPol.exe process. The thread is resumed by calling NtResumeThread. The CasPol.exe resumes execution and performs stage 3 of the infection chain.
The GULoader shellcode resumes execution from within a new host process, in this report, analyzed samples inject the shellcode either into the same process spawned as a child process or caspol.exe. Stage3 performs all the anti-analysis once again to make sure this stage is not being analyzed. After all checks, GUloader proceeds to perform stage3 activities by decoding the encoded C2 string in the memory as shown in the image below. The decoding method is the same as discussed before.
Later the addresses of following functions are resolved dynamically by loading wininet.dll:
The below image shows the response from the content delivery network (cdn) server where the final payload is stored. In this analysis, a payload of size 0x2E640 bytes is sent to the loader. Interestingly, the first 40 bytes are ignored by the loader. The actual payload starts from the offset 40 which is highlighted in the image.
The cdn server is well protected, it only serves to clients with proper headers and cookies. If these are not present in the HTTP request, the following message is shown to the user.
The first step in decoding the the downloaded final payload by the GUloader is generating a quasi key which will be later used in decoding the actual key embeded in the GULoader shellcode. The encoded embeded key size is 371 bytes in analysed sample. The process of quasi key generation is as follows:
The embedded key in the GULoader shellcode is of the size 371 bytes as discussed before. The quasi key is used to decode the embeded key as shown in the image below.
The decoded 371 bytes of embeded key is shown below in the image below.
A byte level decoding happens after embeded key is decoded in the memory. Each byte of the downloaded data is XORed with the key to obtain the actual data, which is a PE file. The decoded data is overwritten to the same buffer used to download the decoded data.
The final decoded PE file residing in the memory is shown in the image below:
Finally, the loader loads the PE file by allocating the memory with RWX permission in the stage3 process, based on analyzing multiple samples it’s either the same process in stage 2 as the child process, or casPol.exe. The loading involved code relocation and IAT correction as expected in such a scenario. The final payload resumes execution from within the hollowed stage3 process. Below malware families are usually seen deployed by the GULoader:
Below image shows the injected memory regions in stage3 process caspol.exe in this report.
The role played by malware loaders popularly known as “crypters” is significant in the deployment of Remote Administration Tools and stealer malwares that target consumer data. The exfiltrated Personal Identifiable Information (PII) extracted from the compromised endpoints are largely collected and funneled to various underground data selling marketplaces. This also impacts businesses as various critical information used for authentication purposes are getting leaked from the personal systems of the user leading to initial access on the company networks. The GuLoader is heavily used in mass malware campaigns to infect the users with popular stealer malware like Raccoon, Vidar, and Redline. Commodity RATs like Remcos are also seen delivered in such campaign activities. On the bright side, it is not difficult to fingerprint malware specimens used in the mass campaigns because of the volume its volume and relevance, detection rules and systems can be built around this very fact.
| Win32 API |
| RtlAddVectoredExceptionHandler |
| NtAllocateVirtualMemory |
| DbgUIRemoteBreakIn |
| LdrLoadDll |
| DbgBreakPoint |
| EnumWindows |
| Nt/ZwSetInformationThread |
| EnumDeviceDrivers |
| GetDeviceDriverBaseNameA |
| MsiEnumProductsA |
| MsiGetProductInfoA |
| TerminateProcess |
| ExitProcess |
| NtSetContextThread |
| NtWriteVirtualMemory |
| NtCreateSection |
| NtMapViewOfSection |
| NtOpenFile |
| NtSetInformationProcess |
| NtClose |
| NtResumeThread |
| NtProtectVirtualMemory |
| CreateProcessInternal |
| GetLongPathNameW |
| Sleep |
| NtCreateThreadEx |
| WaitForSingleObject |
| TerminateThread |
| CreateFileW |
| WriteFile |
| CloseHandle |
| GetFileSize |
| ReadFile |
| ShellExecuteW |
| SHCreateDirectoryExW |
| RegCreateKeyExA |
| RegSetValueExA |
| OpenSCManagerA |
| EnumServiceStatusA |
| CloseServiceHandle |
| NtQueryInformationProcess |
| InternetOpenA |
| InternetSetOptionA |
| InternetOpenUrlA |
| InternetReadFile |
| InternetCloseHandle |
889fddcb57ed66c63b0b16f2be2dbd7ec0252031cad3b15dfea5411ac245ef56
59b71cb2c5a14186a5069d7935ebe28486f49b7961bddac0a818a021373a44a3
4d9cdd7526f05343fda35aca3e0e6939abed8a037a0a871ce9ccd0e69a3741f2
c8006013fc6a90d635f394c91637eae12706f58897a6489d40e663f46996c664
c69e558e5526feeb00ab90efe764fb0b93b3a09692659d1a57c652da81f1d123
45156ac4b40b7537f4e003d9f925746b848a939b2362753f6edbcc794ea8b36a
e68ce815ac0211303d2c38ccbb5ccead144909d295230df4b7a419dfdea12782
b24b36641fef3acbf3b643967d408b10bf8abfe1fe1f99d704a9a19f1dfc77e8
569aa6697083993d9c387426b827414a7ed225a3dd2e1e3eba1b49667573fdcb
60de2308ebfeadadc3e401300172013be27af5b7d816c49696bb3dedc208c54e
23458977440cccb8ac7d0d05c238d087d90f5bf1c42157fb3a161d41b741c39d
The post GULoader Campaigns: A Deep Dive Analysis of a highly evasive Shellcode based loader appeared first on McAfee Blog.
Authored By Anuradha
McAfee Labs has recently observed a new wave of phishing attacks. In this wave, the attacker has been abusing server-parsed HTML (SHTML) files. The SHTML files are commonly associated with web servers redirecting users to malicious, credential-stealing websites or display phishing forms locally within the browser to harvest user-sensitive information.
SHTML Campaign in the field:
Figure 1. shows the geological distribution of McAfee clients who detect malicious SHTML files.
Figure 1. McAfee Client Detection of SHTML
Attackers victimize users by distributing SHTML files as email attachments. The sentiments used in such phishing emails include a payment confirmation, invoice, shipment etc., The email contains a small thread of messages to make the recipient more curious to open the attachment.
Figure 2. Email with SHTML attachment
Analysis:
When the SHTML attachment is clicked, it opens a blurred fake document with a login page in the browser as shown in Figure 3. To read the document, however, the user must enter his/her credentials. In some cases, the email address is prefilled.
Figure 3. Fake PDF document
Figure 4. Fake Excel document
Figure 5. Fake DHL Shipping document
Attackers commonly use JavaScript in the SHTML attachments that will be used either to generate the malicious phishing form or to redirect or to hide malicious URLs and behavior.
Figure 6. SHTML with JavaScript code
Below is the code snippet that shows how the blurred background image is loaded. The blurred images are taken from legitimate websites such as:
https://isc.sans.edu
https://i.gyazo.com
Figure 7. Code to load blurred image
Abusing submission form service:
Phishing attacks abuse static form service providers to steal sensitive user information, such as Formspree and Formspark
Formspree.io is a back-end service that allows developers to easily add forms on their website without writing server-side code, it also handles form processing and storage. It takes HTML form submissions and sends the results to an email address.
The attackers use the formpsree.io URL as an action URL which defines where the form data will be sent. Below Figure 8. shows the code snippet for action URL that works in conjunction with POST method.
Figure 8. Formspree.io as action URL with POST method
When the user enters the credentials and hits the “submit” button, the data is sent to Formspree.io. Subsequently, Formspree.io forwards the information to the specified email address. Below Figure 9. shows the flow of user submission data from webpage to attacker email address.
Figure 9. Flow of user submission data
Known malicious forms may be blocked, preventing the form submission data from being sent to the attacker. Below Figure 10. shows the Form blocked due to suspected fraudulent activity.
Figure 10. Form Blocked
To prevent the user from recognizing that they’ve just been phished, the attacker redirects the user’s browser to an unrelated error page that is associated to a legitimate website.
Below Figure 11. shows the redirected webpage.
Figure 11. Redirected webpage
To conclude, phishing is a form of social engineering in which attackers trick people into disclosing confidential information or installing malware. It is a widespread and pervasive problem. This blurry image phishing scam uses simple basic HTML and JavaScript code, but it can still be effective. A blurry image is enough to trick many users into believing the email as legitimate. To stay protected, users should keep their system up-to-date and refrain from clicking links and opening SHTML attachments that comes through email from untrusted sources.
IOCs
McAfee customers are protected against this phishing campaign.
|
||||||||||||||||||||
| Type | Value | Product | Detected |
| shtml(Adobe) | 0a072e7443732c7bdb9d1f3fdb9ee27c | Total Protection and LiveSafe | HTML/Phishing.qz |
| shtml(Excel) | 3b215a37c728f65c167941e788935677 | Total Protection and LiveSafe | HTML/Phishing.rb |
| shtml(DHL) | 257c1f7a04c93a44514977ec5027446c | Total Protection and LiveSafe | HTML/Phishing.qz |
The post New Wave of SHTML Phishing Attacks appeared first on McAfee Blog.
Authored by By Yashvi Shah
McAfee Labs have identified an increase in Wextract.exe samples, that drop a malware payload at multiple stages.
Wextract.exe is a Windows executable file that is used to extract files from a cabinet (.cab) file. Cabinet files are compressed archives that are used to package and distribute software, drivers, and other files. It is a legitimate file that is part of the Windows operating system, and it is located in the System32 folder of the Windows directory. However, like other executable files, it can be vulnerable to exploitation by malicious actors who might use it as a disguise for malware.
Some common ways that malicious actors use a fake or modified version of wextract.exe include:
McAfee Labs collected malicious wextract.exe samples from the wild, and its behavior was analyzed.
This blog provides a detailed technical analysis of malicious “wextract.exe” that is used as a delivery mechanism for multiple types of malwares, including Amadey and Redline Stealer. It also provides detailed information on the techniques used by the malware to evade detection by security software and execute its payload. Once the malware payloads are executed on the system, they establish communication with a Command and Control (C2) server controlled by the attacker. This communication allows the attacker to exfiltrate data from the victim’s system, including sensitive information such as login credentials, financial data, and other personal information.
Figure 1: Characteristic of the file
The file is a 32-bit Portable Executable file, which is 631.50 Kb in size. The original name of the file is WEXTRACT.EXE.MUI. The file description is “Самоизвлечение CAB-файлов Win32”, written in Russian, and means “Self-Extracting Win32 CAB Files”. The legal copyright mentions Microsoft Corporation. A lot of static strings of this file were found to be written in Russian.
Normally, the resource section (.rsrc) contains resources used by the program, such as icons, bitmaps, strings, and dialog boxes. Attackers leverage the resource section of a PE file to improve the success of their attacks by evading detection, enhancing persistence, and adding functionality.
The resource section of this sample has multiples files, out of which CABINET resource holds 75.75% of the total file, which makes the said resource suspicious.
Figure 2: Resources in the file
A CAB (Cabinet) file is a compressed archive file format that is often used to compress and package multiple files into a single file for distribution or installation. A CAB file in the resource section of a PE file can be used for various purposes such as storing additional program files or data, including language-specific resources, or compressing and storing commonly used resources to reduce the size of the executable.
The CABINET holds two executables, cydn.exe and vona.exe.
Figure 3: CABINET in resource section
Likewise, under RCDATA, there is another attribute called “RUNPROGRAM”, which starts cydn.exe. RUNPROGRAM in the resource section of a malware file typically refers to a resource that contains instructions for the malware to execute a specific program or command. When the malware is executed, it will load the resource containing the “RUNPROGRAM” command and attempt to execute the specified program or command. This technique is often used by malware authors to execute additional malicious programs or commands on the infected system. For example, the “RUNPROGRAM” resource may contains instructions to download and execute additional malware, or to launch a malicious script or command that can perform various malicious activities such as stealing sensitive data, creating backdoors, or disabling security software.
Figure 4: RUNPROGRAM attribute stating “cydn.exe”
Like RUNPROGRAM, POSTRUNPROGRAM also holds the instruction to run the executable after RUNPROGRAM is executed. Hence, once cydn.exe is executed, vona.exe will be executed.
Figure 5: POSTRUNPROGRAM stating “vona.exe”
Once WEXTRACT.exe is executed, both cydn.exe and vona.exe is dropped in the TEMP folder. The TEMP folder is a commonly used location for malware to store temporary files and other data, as it is typically writable by any user account and is not usually subject to strict security restrictions. This can make it easier for the malware to operate without raising suspicion or triggering security alerts.
Figure 6: Files dropped in TEMP folder
The file showed high file ratio of the resource section, with the entropy of 7.810. Entropy is a measure of the randomness or unpredictability of the data in the file. It is often used as an indicator of whether a file is likely to be malicious or not.
In the case of a PE file, high entropy can indicate that the file contains a significant amount of compressed or encrypted data, or that it has been obfuscated or packed in a way that makes it more difficult to analyze. This can be a common technique used by malware authors to evade detection by antivirus software.
Figure 7: File ratio and entropy of the resource section
Like the previous file, cydn.exe also had two executables archived in its resource section, named aydx.exe and mika.exe. The “RUNPROGRAM” attribute commands to run aydx.exe and the “POSTRUNPROGRAM” attribute commands to execute mika.exe once aydx.exe is executed. These files are also dropped in TEMP folder.
Figure 8: aydx.exe and mika.exe packed in resource section
Figure 9: Executables dropped in another TEMP folder
The order of file execution is as follows: First, Wextract.exe and cydn.exe, which have already been discussed, are followed by aydx.exe, and then by mika.exe and vona.exe.
Figure 10: Execution flow
Aydx.exe is a 32-bit Portable Executable file, which is 405Kb and is compiled in C/C++. Once executed, it attempts to make a request to IP address: 193.233.20.7.
Figure 11: Malware trying to connect to IPv4
This IP address is linked with Redline Stealer connecting on port number 4138.
Analysis of mika.exe
Mika.exe is 32-bit Portable Executable, complied in .NET and is just 11 KB in size. The original name of the file is “Healer.exe”. This exe file makes no internet activity but does something in the target machine which assists malwares from further stages to carry out their execution.
The intent of mika.exe is to turn off Windows Defender in all possible ways. Once mika.exe was executed, this is how the Defender settings of the system looked like:
Figure 12: Real-time protection turned off
This setting was irreversible and couldn’t be turned back to on via settings of Windows. Following this, logs from Procmon were analyzed and there were entries regarding Windows defender, such as:
Figure 13: Procmon logs
To validate this, Registry was analysed and all the changes were found there. The changes in Registry were found to be in exact order as of Procmon logs. In Windows, the registry is a hierarchical database that stores configuration settings and options for the operating system, as well as for applications and devices. It is used to store information about the hardware, software, user preferences, and system settings on a Windows computer. Following keys are added under Real-Time Protection:
Figure 14: Keys added in Registry
By doing so malware is restricting all the normal users from turning the Windows Defender on. When attackers disable Windows Defender through the registry, the change is likely to persist even if the user or administrator tries to re-enable it through the Windows Defender settings. This allows the attacker to maintain control over the system for a longer period. This supports malwares of further stages to easily execute themselves without any hinderances. This can be leveraged by all the malwares, regardless of their correspondence to this very campaign.
Vona.exe, a variant of the Amadey malware family, is compiled in C/C++ and is 236 KB in size. This is the last file to be executed from the current cluster. When executed, a highly extensive process tree quickly appeared.
Figure 15: Process tree of vona.exe
An immediate child process of vona.exe is mnolyk.exe, another Amadey component, is dropped in a folder in TEMP folder.
Figure 16: mnolyk.exe dropped in TEMP folder
Mnolyk.exe makes active connections to IP addresses 62.204.41.5 and 62.204.41.251
Malicious DLLs are downloaded from 62.204.41.5, which are executed later in the campaign. The target was made to search for two different DLLs, namely cred.dll and clip.dll.
Figure 17: Malicious dlls downloaded
From 62.204.41.251, various exe files are downloaded to the TEMP folder, and later executed. Exes downloaded are:
fuka.exe
Figure 18: fuka.exe
nikas.exe
Figure 19: nikas.exe
igla.exe
Figure 20: igla.exe
nocr.exe
Figure 21: nocr.exe
lebro.exe
Figure 22: lebro.exe
Following the execution of mnolyk.exe, a series of schtasks.exe and cacls.exe were executed.
The command line for schtasks.exe is “C:\Windows\System32\schtasks.exe” /Create /SC MINUTE /MO 1 /TN mnolyk.exe /TR “C:\Users\test\AppData\Local\Temp\5eb6b96734\mnolyk.exe” /F
So, the entire command line “schtasks.exe /Create /SC MINUTE /MO 1 /TN” would create a scheduled task that runs once every minute. The name of the task specified is the path to mnolyk.exe.
There were several instances of cacls.exe created. One of them is explained here along with its parameter. The command line is “CACLS ”mnolyk.exe” /P “test:R” /E”
So, the entire command line “CACLS mnolyk.exe /P test:R /E” would grant the “test” user or group “Read” permission to the “mnolyk.exe” file. Hence the user “test” can neither write nor delete this file. If in place of “/P test:R”, “/P test:N” was mentioned, which is mentioned in one of the command line, it would give “None” permission to the user.
Fuka.exe
Fukka.exe, a variant of the Redline Stealer malware family, is 175 KB and is compiled in .NET. The original name of the file is Samarium.exe. It shows some network activity with IP 193.233.20.11.
Figure 23: Network activity of fuka.exe
Nikas.exe
Nikas.exe is 248 KB executable file compiled in C/C++. It disables automatic updates for Windows and checks the status of all the sub-fields of Real-Time Protection that were previously changed by mika.exe. No network activity was found during replication.
Igla.exe
Igla.exe is 520 KB file, compiled in C/C++. The original name of the file is WEXTRACT.EXE.MUI. Like we saw in cydn.exe, this PE has also two more exes packed in its resource section, bvPf.exe and cmkmka.exe. Once igla.exe is executed, bvPf.exe is executed, followed by cmkmka.exe.
Figure 24: RUNPROGRAM attribute in igla.exe
Figure 25: POSTRUNPROGRAM attribute in igla.exe
bvPf.exe
bvPf.exe is 306 KB in size and is compiled in C/C++. The original filename is nightskywalker.exe. The file is dropped in a folder in TEMP folder of the system.
The exe has tried connecting to 193.233.20.11, but server did not respond, and no communication took place.
cmkmka.exe
cmkmka.exe is 32-bit PE file, 283.5 KB in size. It further launches AppLaunch.exe which communicates to C2.
It communicates to the IP address: 176.113.115.17 which is an active C2 for Redline Stealer and connects to the port 4132.
Figure 26: Data exfiltration
The blue-colored content in the data indicates the information being transmitted from the Command and Control (C2) server, which is providing instructions to the malware regarding the specific data that needs to be retrieved along with their corresponding paths. These paths include user profiles of different web browsers, various crypto wallet paths, and other related data.
As a response, all the data residing at the specified paths is sent back to the C2 server of the malware. This includes all the profiles of different web browsers, information related to crypto wallets, and even user-related data from the Windows operating system. This process allows the C2 server to collect a vast amount of sensitive information from the infected system, which could be exploited by the attackers for malicious purposes.
Nocr.exe
Nocr.exe, a component of Redline Stealer, is a 175 KB .NET binary. The original name of the file is Alary.exe. It communicates to the IP address 176.113.115.17.
Lebro.exe
Lebro.exe, a component of Amadey, is a 235 KB file, compiled in C/C++. Lebro.exe is responsible for executing nbveek.exe, which is a next stage of the malware. The file is again dropped in TEMP folder.
Figure 27: Dropping another executable in TEMP folder
The hashes of lebro.exe and nbveek.exe are same, they are the same binaries, hence it is Amadey. It is connecting to IP 62.204.41.88.
Figure 28: Network activity of nbveek.exe
The target system executes a php file, and the content of file includes the command to download another exe called setupff.exe. This exe is downloaded to the TEMP folder.
Before setupff.exe is executed, again the series of schtasks.exe and cacls.exe are executed which were seen previously also. The same parameters were passed for nbveek.exe as they were for mnolyk.exe.
Setupff.exe
Setupff.exe is compiled in C/C++ and is 795 KB. The file could not execute and threw Windows error.
Later, another instance of setupff.exe was created which further invokes multiple instances of rundll32.exe. Here, the two dlls downloaded by mnolyk.exe, clip64.dll and cred64.dll, are executed through rundll32.exe. McAfee Labs detects these dlls to be Amadey maware.
The network activity shows the dll to be connecting to 62.204.41.88. This dll again starts exfiltrating data to C2:
Figure 29:Data exfiltration
To conclude, the threat posed by the multi-stage attack that drops the Amadey botnet, and subsequently Redline Stealer, is significant and requires constant vigilance from both consumers and security professionals. By using the Amadey botnet as a delivery mechanism for other malware, attackers can leverage these same capabilities to evade detection and maintain persistence on infected computers. They can use Amadey to drop a wide range of malware, such as spyware, ransomware, and trojans, which can be used for a variety of malicious purposes, such as stealing sensitive information, encrypting files for ransom, or taking control of a computer for use in a larger botnet. Our analysis of various samples of this attack has revealed that the Amadey botnet distributes malware from multiple families and is not restricted to Redline Stealer alone.
At McAfee, we are committed to providing our customers with robust and effective antivirus and anti-malware solutions that can detect and protect against threats like the Amadey botnet and other malware families. Our security software uses a combination of signature, machine learning, threat intelligence and behavioral-based detection techniques to identify and stop threats before they can cause damage.
| File Type | SHA-256 | Product | Detection |
| .exe | 80fed7cd4c7d7cb0c05fe128ced6ab2b9b3d7f03edcf5ef532c8236f00ee7376 | Total Protection and LiveSafe |
Downloader-FCND Lockbit-FSWW PWS-FDON |
| .exe | d8e9b2d3afd0eab91f94e1a1a1a0a97aa2974225f4f086a66e76dbf4b705a800 | Total Protection and LiveSafe |
PWS-FDON Lockbit-FSWW |
| .exe | 1d51e0964268b35afb43320513ad9837ec6b1c0bd0e56065ead5d99b385967b5 | Total Protection and LiveSafe | Lockbit-FSWW |
| .exe | 850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38 | Total Protection and LiveSafe | PWS-FDON |
| .exe | 6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116 | Total Protection and LiveSafe | Downloader-FCND |
| .exe | 6cbcf0bb90ae767a8c554cdfa90723e6b1127e98cfa19a2259dd57813d27e116 | Total Protection and LiveSafe | Downloader-FCND |
| .exe | 8020580744f6861a611e99ba17e92751499e4b0f013d66a103fb38c5f256bbb2 | Total Protection and LiveSafe | AgentTesla-FCYU |
| .exe | 021ae2fadbc8bc4e83013de03902e6e97c2815ab821adaa58037e562a6b2357b | Total Protection and LiveSafe | Lockbit-FSWW |
| .exe | aab1460440bee10e2efec9b5c83ea20ed85e7a17d4ed3b4a19341148255d54b1 | Total Protection and LiveSafe | Lockbit-FSWW |
| .exe | 54ce28a037eea87448e65bc25f8d3a38ddd4b4679516cc59899b77150aa46fcc | Total Protection and LiveSafe | GenericRXVK-HF |
| .exe | 0cca99711baf600eb030bbfcf279faf74c564084e733df3d9e98bea3e4e2f45f | Total Protection and LiveSafe | AgentTesla-FCYU |
| .exe | ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b | Total Protection and LiveSafe | Downloader-FCND |
| .exe | ad1d5475d737c09e3c48f7996cd407c992c1bb5601bcc6c6287eb80cde3d852b | Total Protection and LiveSafe | Downloader-FCND |
| .exe | d40d2bfa9fcbf980f76ce224ab6037ebd2b081cb518fa65b8e208f84bc155e41 | Total Protection and LiveSafe | GenericRXVJ-QP |
| .dll | cdd4072239d8a62bf134e9884ef2829d831efaf3f6f7f71b7266af29df145dd0 | Total Protection and LiveSafe | PWS-FDOE |
| .dll | 10ee53988bcfbb4bb9c8928ea96c4268bd64b9dfd1f28c6233185e695434d2f8 | Total Protection and LiveSafe | Trojan-FUUW |
| .dll | 3492ed949b0d1cbd720eae940d122d6a791df098506c24517da0cc149089f405 | Total Protection and LiveSafe | Trojan-FUUW |
| IPv4 | 193.233.20.7 | ||
| IPv4 | 62.204.41.5 | ||
| IPv4 | 62.204.41.251 | ||
| IPv4 | 193.233.20.11 | ||
| IPv4 | 176.113.115.17 | ||
| IPv4 | 62.204.41.88 |
The post Deconstructing Amadey’s Latest Multi-Stage Attack and Malware Distribution appeared first on McAfee Blog.
I’m betting you have WhatsApp on your phone. Or, if you don’t – I’m quite sure a member of your family would. As the most popular messaging app in the world with 2 billion active monthly users, it’s clearly a favourite for many of us who want to keep in contact with both our Apple and Android friends in a safe and encrypted fashion.
My relationship with WhatsApp was a slow burn. I discovered it a few years back when it became apparent that group messages to a close cluster of girlfriends weren’t being received by my Android pals. WhatsApp solved that problem instantly. But then over several years, I realized it solved quite a few other pesky problems namely expensive and tricky phone calls when travelling overseas and my frustration at not being able to send a message to a large group of people. I became a fan girl!
But it hasn’t always been smooth sailing for WhatsApp users, over the years there have been scams including the 10th birthday scam where users were offered the chance to win 1000GB of free data and most recently the ‘mum and dad’ scam. There was also a wave of controversy in 2021, when new WhatsApp owner, Meta, introduced a new Privacy Policy which had a swathe of users concerned that it would share data with Facebook. Many of us threatened not to sign however if we didn’t – we couldn’t use it! So, we all agreed, somewhat reluctantly in the name of convenience and moved on.
WhatsApp’s default end-to-end encryption sets it apart from other messaging apps and is another one of my favourite features. But what does that actually mean? In short, it means that your messages can only be read on the recipient’s phone. Likewise, video and audio calls can only be answered by the intended receiver. WhatsApp encrypts every message sent on its platform which means the only people who can decode it are the sender and the receiver. WhatsApp can’t access anything you share and nor could a hacker if they were to intercept a message. Love end-to-end encryption!
But this doesn’t mean that there are no risks using WhatsApp. Like all online platforms, staying ahead of the risks is the smartest way of ensuring you have the best experience. And there are several steps you can take to stay ahead of the threats on WhatsApp. Here are my top tips:
Keeping your WhatsApp software up to date is essential as updates will almost always include fixes or ‘patches’ for new vulnerabilities and threats. Why not automate them to ensure that this happens? This means you won’t be at risk if you forget to update the software yourself.
Never ever share personal data or crucial financial information on the app, in case your device ends up in the wrong hands or it becomes infected with spyware or malware. And this goes for any app – keep your personal information nice and tight.
To prevent your device from becoming compromised by malicious software, ensure your device has some super-duper mobile security software. McAfee’s Mobile Security software, available for both iOS and Android, will protect devices of all types from cyberthreats.
As anyone can message anyone on WhatsApp, it’s inevitable you may receive some random or suspicious looking messages. Always err on the side of caution and do not respond to direct messages from people you don’t know. If you receive a promotional offer from a company that is quite tempting, go directly to their website to confirm. Scammers will often send out 1000’s of emails with a tempting offer and link to a malicious website in the hope that someone will ‘bite’. Don’t be caught in a phishing scam!
Enabling 2 factor authentication is one the best ways to secure your WhatsApp account and ensure a hacker can’t download your account on their phone. Without your 6-digit pin number, a hacker can’t get into your account, even if they get their hands on the SMS code they need to activate your account on another device. And it takes 30 seconds to set up!
If you haven’t set up your 6-digit pin, then you are at risk at being ‘socially hacked’. This is how it works: a hacker, who has hijacked one of your friend’s accounts, will message you asking for the 6-digit code that’s just been sent to your account. They will say it’s meant for them. And as you ‘know’ this person, you are likely to send that code straight through without even questioning them. But in fact, the 6-digit code in question has been requested by the hacker for your account, so the minute you share it – you will be immediately locked out! So, never ever share your 6-digit code with anyone. No-one will ever have a legitimate reason to request it.
But please don’t let these risks put you off this fantastic messaging app. I’m a big believer in understanding the challenges so you can prepare yourself, go ahead and enjoy! And I haven’t even touched on some of the more fun aspects of the app – the stickers & the status updates – they can be quite the conversation starter! So go ahead and enjoy but just make sure you’ve done your homework!!
Stay safe everyone!
Alex
The post How To Be Safe On WhatsApp appeared first on McAfee Blog.
Some of the strongest passwords you can use are the ones you don’t have to remember. Strange as that may sound, it’s true, if you use a password manager. A password manager creates and securely stores strong, unique passwords for each of your accounts—and does all the remembering for you. And remembering is the root of the problem when it comes to insecure passwords. Consider how many passwords you have across all your accounts. Then consider the old passwords for accounts and online forums you no longer use, along with all the times you created a password for an online store that you only shopped at once or twice. All those passwords, it’s too much to keep track of, let alone manage. And that leads to insecure passwords. Simple passwords. Or passwords that get used again and again across several accounts. Hackers count on that. They love it when people use simple passwords, reuse passwords, grab passwords out of the dictionary, or base their passwords on their pet names that a hacker can easily glean from a victim’s social media posts. They also love “brute force” tools that help them break into accounts by quickly feeding account logins with thousands of potential passwords in minutes. So when you make your life easier with simple or reused passwords, you make life easier for hackers too. That’s where a password manager comes in. It makes life easy for you to stay secure while still making it tough on hackers—particularly tough with strong, unique passwords for each of your accounts that can you update on a regular basis, which offers some of the strongest protection you have against hackers hijacking your accounts.
First up, let’s look at password practices in general while keeping a few things in mind. Hackers will look for the quickest payday. In some cases they’ll work with a long list of accounts that they’re trying to break into. If a password on that list proves difficult to crack they’ll move on to the next in the hope that it’ll have a poor password that they can easily crack. It’s a sort of hacker economics. There’s often little incentive for them to spend extra time on a strong password when there are plenty of weak ones in the mix. So what do poor passwords look like? Here are a few examples:
On the flip side, here’s what a strong password looks like:
Long, complex, unique, and updated, all described as above—how do you manage all that without creating a string of gobbledygook that you’ll never remember? You can do so with a passphrase. A phrase will give you those 12 or more characters mentioned above, and with a couple extra steps, can turn into something quite unique and complex. Here’s a three-step example:
Now you have a password that you can remember with a little practice, one that still challenges the tools that hackers use for cracking passwords.
When you consider the number of accounts you need to protect, creating strong, unique passwords for each of your accounts can get time consuming. Further, updating them regularly can get more time consuming still. That’s where a password manager comes in. A password manager does the work of creating strong, unique passwords for your accounts. These will take the form of a string of random numbers, letters, and characters. They will not be memorable, but the manager does the memorizing for you. You only need to remember a single password to access the tools of your manager. A strong password manager also stores your passwords securely. Ours protects your passwords by scrambling them with AES-256, one of the strongest encryption algorithms available. Only you can decrypt and access your information with the factors you choose. Additionally, our password manager uses MFA—you’ll be verified by at least two factors before being signed in.
Whether it’s the passwords you’ve created or the master password for your password manager, consider making an offline list of them. This will protect access to your accounts if you ever forget them. Be sure to store this list in a safe, offline place—recognizing that you want to protect it from physical theft. A locking file cabinet is one option and a small fireproof safe yet more secure. A password manager is just part of your password security solution. For example, you’ll also want to use comprehensive online protection software to prevent you from following links in phishing attacks designed to steal your account login information. The same goes for malicious links that can pop up in search. Online protection software can steer you clear of those too. In some cases, bad actors out there will simply shop on the dark web for username and password combos that were stolen from data breaches. An identity monitoring service such as our own can alert you if your information ends up there. It can monitor the dark web for your personal info, including email, government IDs, credit card and bank account info, and more. Ours provides early alerts and guidance for the next steps to take if your data is found on the dark web, an average of 10 months ahead of similar services.
A password manager takes the pain out of passwords. It creates strong, unique passwords for every account you have. That includes banking, social media, credit cards, online shopping, financial services, or what have you. The entire lot of it. And remember, remembering is the thing with passwords. Hackers hope you’ll get lazy with your passwords by creating simple ones, reusing others, or some combination of the two because that makes it easier to remember them. That’s the beauty of a password manager. It does the remembering for you, so you simply go on your way as you go online. Safely.
The post The Strongest Passwords and the Best Way to Create (and Remember) Them appeared first on McAfee Blog.
We all know that our phones know a lot about us. And they most certainly know a lot about where we go, thanks to the several ways they can track our location.
Location tracking on your phone offers plenty of benefits, such as with apps that can recommend a good restaurant nearby, serve up the weather report for your exact location, or connect you with singles for dating in your area. Yet the apps that use location tracking may do more with your location data than that. They may collect it, and in turn sell it to advertisers and potentially other third parties that have an interest in where you go and what you do.
Likewise, cell phone providers have other means of collecting location information from your phone, which they may use for advertising and other purposes as well.
If that sounds like more than you’re willing to share, know that you can do several things that can limit location tracking on your phone—and thus limit the information that can potentially end up in other people’s hands.
As we look at the ways you can limit location tracking on your phone, it helps to know the basics of how smartphones can track your movements.
For starters, outside of shutting down your phone completely, your phone can be used to determine your location to varying degrees of accuracy depending on the method used:
Now here’s what makes these tracking methods so powerful: in addition to the way they can determine your phone’s location, they’re also quite good at determining your identity too. With it, companies know who you are, where you are, and potentially some idea of what you’re doing there based on your phone’s activity.
Throughout our blogs we refer to someone’s identity as a jigsaw puzzle. Some pieces are larger than others, like your Social Security number or tax ID number being among the biggest because they are so unique. Yet if someone gathers enough of those smaller pieces, they can put those pieces together and identify you.
Things like your phone’s MAC address, ad IDs, IP address, device profile, and other identifiers are examples of those smaller pieces, all of which can get collected. In the hands of the collector, they can potentially create a picture of who you are and where you’ve been.
What happens to your data largely depends on what you’ve agreed to.
In terms of apps, we’ve all seen the lengthy user agreements that we click on during the app installation process. Buried within them are terms put forth by the app developer that cover what data the app collects, how it’s used, and if it may be shared with or sold to third parties. Also, during the installation process, the app may ask for permissions to access certain things on your phone, like photos, your camera, and yes, location services so it can track you. When you click “I Agree,” you indeed agree to all those terms and permissions.
Needless to say, some apps only use and collect the bare minimum of information as part of the agreement. On the other end of the spectrum, some apps will take all they can get and then sell the information they collect to third parties, such as data brokers that build exacting profiles of individuals, their histories, their interests, and their habits.
In turn, those data brokers will sell that information to anyone, which can be used by advertisers along with identity thieves, scammers, and spammers. And as reported in recent years, various law enforcement agencies will purchase that information as well for surveillance purposes.
Further, some apps are malicious from the start. Google Play does its part to keep its virtual shelves free of malware-laden apps with a thorough submission process as reported by Google and through its App Defense Alliance that shares intelligence across a network of partners, of which we’re a proud member. Android users also have the option of running Play Protect to check apps for safety before they’re downloaded. Apple has its own rigorous submission process for weeding out fraud and malicious apps in its store as well.
Yet, bad actors find ways to sneak malware into app stores. Sometimes they upload an app that’s initially clean and then push the malware to users as part of an update. Other times, they’ll embed the malicious code so that it only triggers once it’s run in certain countries. They will also encrypt malicious code in the app that they submit, which can make it difficult for reviewers to sniff out. These apps will often steal data, and are designed to do so, including location information in some cases.
As far as cell phone service providers go, they have legitimate reasons for tracking your phone in the ways mentioned above. One is for providing connectivity to emergency service calls (again, like 911 in the U.S.), yet others are for troubleshooting and to ensure that only legitimate customers are accessing their network. And, depending on the carrier, they may use it for advertising purposes in programs that you may willingly opt into or that you must intentionally opt out of.
We each have our own comfort level when it comes to our privacy. For some, personalized ads have a certain appeal. For others, not so much, not when it involves sharing information about themselves. Yet arguably, some issues of privacy aren’t up for discussion, like ending up with a malicious data-stealing app on your phone.
In all, you can take several steps to limit tracking on your smartphone to various degrees—and boost your privacy to various degrees as a result:
There’s no way around it. Using a smartphone puts you on the map. And to some extent, what you’re doing there as well. Outside of shutting down your phone or popping into Airplane Mode (noting what we said about iPhones and their “Find My Network” functionality above), you have no way of preventing location tracking. You can most certainly limit it.
For yet more ways you can lock down your privacy and your security on your phone, online protection software can help. Our McAfee+ plans protect you against identity theft, online scams, and other mobile threats—including credit card and bank fraud, emerging viruses, malicious texts and QR codes. For anyone who spends a good portion of their day on their phone, this kind of protection can make life far safer given all the things they do and keep on there.
The post How to Limit Location Tracking on Your Phone appeared first on McAfee Blog.
Imagine that you want to pull up a certain file on your computer. You click on the file and suddenly a notice flashes on your screen saying your computer is compromised and to get your files back, you need to pay up. This is known as ransomware, a nasty type of malware that is no longer reserved for multimillionaires and corporations. Cybercriminals are holding hostage computer files and sensitive personal documents of ordinary people for their own financial gain.
Here’s everything you need to know about how ransomware makes it on to your devices and seven digital safety habits you can start today to prevent it from happening to you.
Ransomware infects connected devices – smartphones, laptops, tablets, and desktops – when the device owners unknowingly click on links or popups that have malicious software embedded within them.
Phishing attempts are a common vehicle for spreading ransomware. The cybercriminal veils their malicious links in emails, texts, or social media direct messages that urge a quick response and threaten dire consequences. For example, a phisher may impersonate a bank and demand the innocent recipient click on a link to recover a large sum of money. Instead, the link directs not to an official bank website, but to a malware download page. From there, the ransomware software takes hold and allows the cybercriminal to stalk and lock your most important files.
If a cybercriminal reaches out to you and notifies you that they have your files hostage, do not engage with them and never pay the ransom. Even if you do pay the ransom, there’s no guarantee that the criminal will release your files. They’re a criminal after all, and you cannot trust them. Giving in and paying ransoms bolsters the confidence of cybercriminals that their schemes are successful, thus they’ll perpetuate the scam.
Remain calm and immediately disconnect your ransomware-infected device from the Wi-Fi. This will prevent the program from jumping from one device to another device connected to the same network. Then, on another device, visit the No More Ransom Project. This initiative, supported by McAfee, has a repository of advice and code that may rid your device of the malicious program. Additionally, report the event to the Cybersecurity & Infrastructure Security Agency. An agent may be able to help you unlock your device or advise you on how to proceed.
The best way to prepare for ransomware is to prevent it from happening in the first place. These seven online habits are a great way to keep your devices and the valuable personally identifiable information they store from falling into the hands of cybercriminals.
A cybercriminal has no leverage if your device doesn’t house anything of value. Back up your most important files every few months, either to the cloud or save them onto a hard drive. This way, if you do get a ransomware infection, you can wipe your device and reinstall your files from the backup. Backups protect your data, and you won’t be tempted to reward the malware authors by paying a ransom.
When updating your credentials, you should always ensure that your password is strong and unique. It’s dangerous to reuse the same password across accounts because all it takes to put your accounts at risk is for one data breach to leak your password onto the dark web. It’s nearly impossible to memorize all your different password and username combinations, so entrust a password manager to store them for you.
Two or multi-factor authentication provides an extra layer of security, as it requires multiple forms of verification to enter an online account. For instance, you’ll be asked to verify your identity through a one-time code sent to a cellphone or to answer a security question in tandem with a correct password. This additional step in the login process deters ransomware plots because if you store your important documents behind a multi-factor authentication-protected cloud program, the criminal has nothing of value to hold hostage.
Don’t click on links or respond to emails, social media direct messages, and texts from people you don’t know. This is important since phishers often trick people into downloading malware and ransomware software through disguised links.
Using a security extension on your web browser is one way to browse more safely. McAfee WebAdvisor, for instance, alerts you when you’ve ventured onto risky sites that could harbor malware. Websites that claim to have free TV shows, movies, and software are among the riskiest.
Public Wi-Fi networks – like those at libraries, coffee shops, hotels, and airports – are often not secure. Since anyone can log on, you can’t always trust that everyone on the network has good intentions. Cybercriminals often hop on public networks and digitally eavesdrop on the devices connected to it. So, you can either avoid public Wi-Fi altogether and only access the internet through 5G, or you can enable a virtual private network. A VPN is a truly private network that encrypts your internet traffic, making you completely anonymous online.
Don’t ignore your devices’ notifications to update your software. Keeping your software up to date is an excellent way to deter cybercriminals from forcing their way onto your device. Software updates usually include critical security patches that close any holes that a ransomware plot could squeeze through.
To boost your peace of mind, opt for an extra layer of security with a solution like McAfee+ Ultimate, which includes up to $25,000 in ransomware coverage. McAfee+ Ultimate also includes a VPN, password manager, and safe browsing extension to keep your online comings and goings private.
The post 7 Tips to Protect Your Devices and Private Information from Ransomware appeared first on McAfee Blog.
Authored by Dexter Shin
Minecraft is a popular video game that can be played on a desktop or mobile. This is a sandbox game developed by Mojang Studios. Players create and break apart various kinds of blocks in 3-dimensional worlds and they can select to enjoy Survivor Mode to survive in the wild or Creative Mode to focus on being creative.
Minecraft’s popularity has led to many attempts to recreate similar games. As a result, there are so many games with the same concept as Minecraft worldwide. Even on Google Play, we can easily search for similar games. McAfee Mobile Research Team recently discovered 38 games with hidden advertising. These HiddenAds applications discovered on the Google Play Store and installed by at least 35 million users worldwide, have been found to send packets stealthily for advertising revenue in bulk.
McAfee, a member of the App Defense Alliance, focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem. reported the discovered apps to Google, which took prompt action and the apps are no longer available on Google Play. Android users are protected by Google Play Protect, which can warn users of identified malicious apps on Android devices, and McAfee Mobile Security detects this threat as Android/HiddenAds.BJL. For more information, and to get fully protected, visit McAfee Mobile Security.
They were officially uploaded to Google Play under various titles and package names. Many games have already been downloaded by users, including apps with 10M+ downloads.
Figure 1. 10M+ downloaded app being one of them
Also, because they can play the game, users can’t notice the large amount of advertising packets being generated on their devices.
Figure 2. Game screen that can be played
After the game is running, the user can play without any problems in the block-based world, only like Minecraft-type games. However, advertisement packets of various domains continuously occur on the device. For example, the four packets shown in the picture are questionable packets generated by the ads libraries of Unity, Supersonic, Google, and AppLovin. Unfortunately, nothing is displayed on the game screen.
Figure 3. Continuous advertising packets
What’s even more interesting is the initial network packets of these games. The structure of the initial packet is very similar. All domains are different. But using 3.txt as the path is equivalent. That is, packets in the form of https://(random).netlify.app/3.txt commonly occur first. The picture below is an example of the first packet extracted from three different apps.
Figure 4. Similarity of the initial packet form
This threat has been detected in various countries around the world. Indicated by our telemetry, the threat has been most prominently detected in the United States, Canada, South Korea, and Brazil.
Figure 5. Users around the world who are widely affected
As we featured in the McAfee 2023 Consumer Mobile Threat Report, one of the most accessible content for young people using mobile devices is games. Malware authors are also aware of this and try to hide their malicious features inside games. Not only is it difficult for general users to find these hidden features, but they can easily trust games from official stores such as Google Play.
We first recommend that users thoroughly review user reviews before downloading applications from the store. And users should install security software on their devices and always keep up to date.
| Package Name | Application Name | SHA256 |
GooglePlay
Downloads |
| com.good.robo.game.builder.craft.block | Block Box Master Diamond | 300343e701afddbf32bca62916fd717f2af6e8a98fd78cc50d11f1154971d857 | 10M+ |
| com.craft.world.fairy.fun.everyday.block | Craft Sword Mini Fun | 72fa914ad3460f9e696ca2264fc899cad20b06b640a7adf8cfe87dd0ea19e137 | 5M+ |
| com.skyland.pet.realm.block.rain.craft | Block Box Skyland Sword | d15713467be2f60b2bc548ddb24f202eb64f2aed3fb8801daec14e708f5cee5b | 5M+ |
| com.skyland.fun.block.game.monster.craft | Craft Monster Crazy Sword | cadbc904e77feaaf4294d218808f43d50809a87202292e78b0e6a3e164de6851 | 5M+ |
| com.monster.craft.block.fun.robo.fairy | Block Pro Forrest Diamond | 08429992bef8259e3011af36ad9d3c2a61b8df384860fd2a007a32a1e4d634af | 1M+ |
| com.cliffs.realm.block.craft.rain.vip | Block Game Skyland Forrest | 34ef407f2bedfd8485f6a178f14ee023d395cb9b76ff1754e8733c1fc9ce01fb | 1M+ |
| com.block.builder.build.clever.craft.boy | Block Rainbow Sword Dragon | 23aa3cc9481591b524a442fa8df485226e21da9d960dc5792af4ae2a096593d5 | 1M+ |
| com.fun.skyland.craft.block.monster.loki | Craft Rainbow Mini Builder | 88fa7de264c5880e65b926df4f75ac6a2900e3718d9d3576207614e20f674068 | 1M+ |
| com.skyland.craft.caves.game.monster.block | Block Forrest Tree Crazy | 010c081e5fda58d6508980528efb4f75e572d564ca9b5273db58193c59987abf | 1M+ |
| com.box.block.craft.builder.cliffs.build | Craft Clever Monster Castle | 11c5e2124e47380d5a4033c08b2a137612a838bc46f720fba2a8fe75d0cf4224 | 500K+ |
| com.block.sun.game.box.build.craft | Block Monster Diamond Dragon | 19ad0dc40772d29f7f39b3a185abe50d0917cacf5f7bdc577839b541f61f7ac0 | 500K+ |
| com.builder.craft.diamond.block.clever.robo | Craft World Fun Robo | 746e2f552fda2e2e9966fecf6735ebd5a104296cde7208754e9b80236d13e853 | 500K+ |
| com.block.master.boy.craft.cliffs.diamond | Block Pixelart Tree Pro | 25b22e14f0bb79fc6b9994faec984501d0a2bf5573835d411eb8a721a8c2e397 | 500K+ |
| com.fun.block.everyday.boy.robo.craft | Craft Mini Lucky Fun | 9fdddf4a77909fd1d302c8f39912a41483634db66d30f89f75b19739eb8471ff | 500K+ |
| com.builder.craft.block.sun.game.mini | Block Earth Skyland World | b9284db049c0b641a6b760e7716eb3561e1b6b1f11df8048e9736eb286c2beed | 500K+ |
| com.dragon.craft.world.pixelart.block.vip | Block Rainbow Monster Castle | d6984e08465f08e9e39a0cad8da4c1e405b3aa414608a6d0eaa5409e7ed8eac1 | 500K+ |
| com.craft.vip.earth.everyday.block.game | Block Fun Rainbow Builder | f3077681623d9ce32dc6a9cbf5d6ab7041297bf2a07c02ee327c730e41927c5f | 500K+ |
| com.block.good.mini.craft.box.best | Craft Dragon Diamond Robo | e685fb5a426fe587c3302bbd249f8aa9e152c1de9b170133dfb492ed5552acc9 | 500K+ |
| com.lucky.robo.craft.loki.block.good | Block World Tree Monster | 06c3ba10604c38006fd34406edd47373074d57c237c880a19fb8d3f34572417d | 100K+ |
| com.caves.robo.craft.dragon.block.earth | Block Diamond Boy Pro | 122406962c303eaeb9839d767835a82ae9d745988deeef4c554e1750a5106cf0 | 100K+ |
| com.tree.world.city.block.craft.crazy | Block Lucky Master Earth | e69fe06cb77626be76f2c92ad4229f6eb04c06c73e153d5424386a1309adbd15 | 100K+ |
| com.game.skyland.craft.monster.block.best | Craft Forrest Mini Fun | e5fc2e6e3749cb4787a8bc5387ebb7802a2d3f9b408e4d2d07ee800056bb3e16 | 100K+ |
| com.everyday.vip.caves.house.block.craft | Craft Sword City Pro | 318165fd8d77a63ca221f5d3ee163e6f2d6df1f2df5c169aca6aca23aef2cf25 | 100K+ |
| com.cell.rain.block.craft.loki.fairy | Block Loki Monster Builder | 4f22be2ce64376f046ca180bd9933edcd62fd36f4a7abc39edf194f7170e2534 | 100K+ |
| com.block.good.sun.boy.craft.fun | Block Boy Earth Mini | 3b0cf56fb5929d23415259b718af15118c44cf918324cc62c1134bf9bc0f2a00 | 100K+ |
| com.fairy.builder.sun.skyland.craft.block | Block Crazy Builder City | 537638903f31e32612bddc79a483cb2c7546966cca64c5becec91d6fc4835e22 | 100K+ |
| com.monster.house.good.block.earth.craft | Craft Sword Vip Pixelart | 5f85f020eb8afc768e56167a6d1b75b6d416ecb1ec335d4c1edb6de8f93a3cad | 100K+ |
| com.block.best.boy.craft.sword.cell | Block City Fun Diamond | 698544a913cfa5df0b2bb5d818cc0394c653c9884502a84b9dec979f8850b1e7 | 100K+ |
| com.crazy.clever.city.block.caves.craft | Craft City Loki Rainbow | ba50dc2d2aeef9220ab5ff8699827bf68bc06caeef1d24cb8d02d00025fcb41c | 100K+ |
| com.cliffs.builder.craft.block.lucky.earth | Craft Boy Clever Sun | 77962047b32a44c472b89d9641d7783a3e72c156b60eaaec74df725ffdc4671b | 100K+ |
| com.lucky.best.block.game.diamond.craft | Block City Dragon Sun | ac3d0b79903b1e63b449b64276075b337b002bb9a9a9636a47fdd1fb7a0fe368 | 100K+ |
| com.build.craft.boy.loki.master.block | Craft Loki Forrest Monster | a2db1eba73d911142134ee127897d5857c521135a8ee768ae172ae2d2ee7b1d4 | 100K+ |
| com.build.lokicrafts.master.forest | Lokicraft: Forrest Survival 3D | 0f53996f5e3ec593ed09e55baf1f93d32d891f7d7e58a9bf19594b235d3a8a84 | 50K+ |
| com.sun.realm.craft.lucky.dragon.block | Craft Castle Sun Rain | 1e74e73bc29ce1f55740e52250506447b431eb8a4c20dfc75fd118b05ca18674 | 50K+ |
| com.block.craft.vip.sun.game.box | Craft Game Earth World | 7483b6a493c0f4f6309e21cc553f112da191b882f96a87bce8d0f54328ac7525 | 50K+ |
| com.rain.crazy.lucky.pro.block.craft | Craft Lucky Castle Builder | de5eb8284ed56e91e665d13be459b9a0708fa96549a57e81aa7c11388ebfa535 | 50K+ |
| com.JavaKidz.attacksnake | Craftsman: Building City 2022 | e19fcc55ec4729d52dc0f732da02dc5830a2f78ec2b1f37969ee3c7fe16ddb37 | 50K+ |
| com.skyland.house.block.craft.crazy.vip | Craft Rainbow Pro Rain | a7675a08a0b960f042a02710def8dd445d9109ca9da795aed8e69a79e014b46f | 50K+ |
The post HiddenAds Spread via Android Gaming Apps on Google Play appeared first on McAfee Blog.
Social media platforms often get a hard time by us parents. But a recent announcement by TikTok of industry first screen time limits might just be enough to win you over. On March 1, the social media platform announced that it will automatically impose a 60-minute daily screen time limit to every account belonging to a user that is under the age of 18. How good??
I hear what you’re thinking – maybe we can cross TikTok off our list of social media platforms that we need to get our head around? But no, my friends – not so fast! Tik Tok’s new screen time limits are all about parental involvement – which is why I am a fan! So, buckle-up because if you have an under 18 on TikTok (and you’re committed to their digital well-being) then my prediction is that you’ll soon know more about this social media platform than you even thought was possible!
Over the coming weeks, every account that belongs to an under 18-year-old will automatically be set to a 60-minute daily screen time limit. Once they’ve clocked up an hour of scrolling, teens will be asked to enter a passcode, which TikTok will supply, to keep using the platform. TikTok refers to this as an ‘active decision’.
So, clearly this isn’t quite the silver bullet to all your screen time worries as teens can choose to opt out of the 60-minute limits. But if they do choose to opt out and then spend more than 100 minutes a day on the platform, they will be prompted to set a daily screen time limit. ‘Will that actually do anything?’ – I hear you say. Well, in the first month of testing this approach, TikTok found that this strategy resulted in a 234% increase in the use of its screen time management tools – a move in the right direction!
But here’s the part I love the most: TikTok offers Family Pairing which allows you to link your child’s account to yours. And as soon as you enable Family Pairing, your teen is no longer in control of their own screen time.
Now, don’t get me wrong – I am not a fan of the authoritarian approach when it comes to all things tech. I do prefer a consultative ‘let’s work together’ vibe. However, TikTok’s move to involve parents in making decisions about their child’s screen time means that families will need to talk digital wellbeing more than ever before and here’s why…
Within the Family Pairings settings, parents are able to set screen time limits based on the day of the week which means homework and holidays can be worked around. There is also a dashboard that shows your child’s screen time usage, the number of times the app was opened plus a breakdown of time spent during the day and night. Now, with all this control and information, you’ll be in quite the powerful position so be prepared to be sold hard by your teen on many the benefits of TikTok!
For years I have been a fan of creating a Family Digital Contract which means you get to outline your family’s expectations around technology use. Now the agreement can include time spent online, the sites that can be visited and even the behaviour you expect of your child when they are online. So, if your kids are avid TikTok users then I highly recommend you do this ASAP. Check out the Family Safety Agreement from the Family Online Safety Institute as a starting point but I always recommend tailoring it to suit the needs of your own tribe.
But let’s keep it real – your kids are not always going to comply, remember how you pushed the boundaries when you were young?? And that’s OK if they understand why their actions weren’t ideal and you have a suitable level of confidence that they will get back on track. However, if you have concerns that they need an additional level of structure to ensure their digital wellbeing remains intact then that’s when TikTok’s Family Pairing can work a treat!
It’s no secret that social media can be incredibly captivating, possibly even addicting, for so many. And it’s not just TikTok – Instagram, Facebook even Twitter has all been designed to give us regular hits of dopamine with each scroll, like and post. And while I know that parental controls are only one part of the solution, they can be very handy if you need to bring your tween’s usage under control.
But when all is said and done, please remember that the strength of your relationship with your child is the best way of keeping them safe online and their wellbeing intact. If your kids know that they can come to you about any issue at all – and that you will always have their back – then you’re winning!!
So, be interested in their life – both online and offline – ask questions – who do they hang with? How do they spend their time? And remember to share your online experience with them too – get yourself a little ‘tech’ cred – because I promise they will be more likely to come to you when there is a problem.
‘Till next time – keep talking!!
Alex
The post What Parents Need To Know About TikTok’s New Screen Time Limits appeared first on McAfee Blog.
Authored by Dexter Shin
McAfee Mobile Research Team found an Android banking trojan signed with a key used by legitimate apps in South Korea last year. By design, Android requires that all applications must be signed with a key, in other words a keystore, so they can be installed or updated. Because this key can only be used by the developer who created it, an application signed with the same key is assumed to belong to the same developer. That is the case of this Android banking trojan that uses this legitimate signing key to bypass signature-based detection techniques. And these banking trojans weren’t distributed on Google Play or official app stores until now. This threat had been disclosed to the company that owns the legitimate key last year and the company has taken precautions. The company has confirmed that they have replaced the signing key and currently, all their legitimate apps are signed with a new signing key.
While tracking the Android banking trojan Fakecalls we found a sample using the same signing key as a well–known app in Korea. This app is developed by a reputable IT services company with extensive businesses across various sectors, including but not limited to IT, gaming, payment, and advertising. We confirmed that most of the malicious samples using this key pretend to be a banking app as they use the same icon as the real banking apps.
Figure 1. Malware and legitimate app on Google Play
Domains verified last August when we first discovered the samples are now down. However, we investigated URLs related to this malware and we found similar ones related to this threat. Among them, we identified a phishing site that is still alive during our research. The site is also disguised as a banking site.
Figure 2. A phishing page disguised as a Korean banking site
We also found that they updated the domain information of this web page a few days before our investigation.
So we took a deeper look into this domain and we found additional unusual IP addresses that led us to the Command and control(C2) server admin pages used by the cybercriminals to control the infected devices.
Figure 3. Fakecalls Command and control(C2) admin pages
When we check the APK file structure, we can see that this malware uses a packer to avoid analysis and detection. The malicious code is encrypted in one of the files below.
Figure 4. Tencent’s Legu Packer libraries
After decrypting the DEX file, we found some unusual functionality. The code below gets the Android package information from a file with a HTML extension.
Figure 5. Questionable code in the decrypted DEX file
This file is in fact another APK (Android Application) rather than a traditional HTML file designed to be displayed in a web browser.
Figure 6. APK file disguised as an HTML file
When the user launches the malware, it immediately asks for permission to install another app. Then it tries to install an application stored in the “assets” directory as “introduction.html”. The “introduction.html” is an APK file and real malicious behavior happens here.
Figure 7. Dropper asks you to install the main payload
When the dropped payload is about to be installed, it asks for several permissions to access sensitive personal information.
Figure 8. Permissions required by the main malicious application
It also registers several services and receivers to control notifications from the device and to receive commands from a remote Command and Control server.
Figure 9. Services and receivers registered by the main payload
By contrast, the malware uses a legitimate push SDK to receive commands from a remote server. Here are the complete list of commands and their purpose.
| Command name | Purpose |
| note | sms message upload |
| incoming_transfer | caller number upload |
| del_phone_record | delete call log |
| zhuanyi | set call forwarding with parameter |
| clear_note | delete sms message |
| assign_zhuanyi | set call forwarding |
| file | file upload |
| lanjie | block sms message from specified numbers |
| allfiles | find all possible files and upload them |
| email_send | send email |
| record_telephone | call recording on |
| inout | re-mapping on C2 server |
| blacklist | register as blacklist |
| listener_num | no function |
| no_listener_num | disable monitoring a specific number |
| rebuild | reset and reconnect with C2 |
| deleteFile | delete file |
| num_address_list | contacts upload |
| addContact | add contacts |
| all_address_list | call record upload |
| deleteContact | delete contacts |
| note_intercept | intercept sms message from specified numbers |
| intercept_all_phone | intercept sms message from all |
| clear_date | delete all file |
| clear_phone_contact | delete all contacts |
| clear_phone_record | delete all call log |
| per_note | quick sms message upload |
| soft_name | app name upload |
Cybercriminals are constantly evolving and using new ways to bypass security checks, such as abusing legitimate signing keys. Fortunately, there was no damage to users due to this signing key leak. However, we recommend that users install security software on their devices to respond to these threats. Also, users are recommended to download and use apps from the official app stores.
McAfee Mobile Security detects this threat as Android/Banker regardless of the application, is signed with the previously legitimate signing key.
Indicators of Compromise
| SHA256 | Name | Type |
| 7f4670ae852ec26f890129a4a3d3e95c079f2f289e16f1aa089c86ea7077b3d8 | 신한신청서 | Dropper |
| 9e7c9b04afe839d1b7d7959ad0092524fd4c6b67d1b6e5c2cb07bb67b8465eda | 신한신청서 | Dropper |
| 21ec124012faad074ee1881236c6cde7691e3932276af9d59259df707c68f9dc | 신한신청서 | Dropper |
| 9621d951c8115e1cc4cf7bd1838b8e659c7dea5d338a80e29ca52a8a58812579 | 신한신청서 | Dropper |
| 60f5deb79791d2e8c2799e9af52adca5df66d1304310d1f185cec9163deb37a2 | 보안인증서 | Banker |
| 756cffef2dc660a241ed0f52c07134b7ea7419402a89d700dffee4cc6e9d5bb6 | 보안인증서 | Banker |
| 6634fdaa22db46a6f231c827106485b8572d066498fc0c39bf8e9beb22c028f6 | 보안인증서 | Banker |
| 52021a13e2cd7bead4f338c8342cc933010478a18dfa4275bf999d2bc777dc6b | 보안인증서 | Banker |
| 125772aac026d7783b50a2a7e17e65b9256db5c8585324d34b2e066b13fc9e12 | 보안인증서 | Banker |
| a320c0815e09138541e9a03c030f30214c4ebaa9106b25d3a20177b5c0ef38b3 | 보안인증서 | Banker |
| c7f32890d6d8c3402601743655f4ac2f7390351046f6d454387c874f5c6fe31f | 보안인증서 | Banker |
| dbc7a29f6e1e91780916be66c5bdaa609371b026d2a8f9a640563b4a47ceaf92 | 보안인증서 | Banker |
| e6c74ef62c0e267d1990d8b4d0a620a7d090bfb38545cc966b5ef5fc8731bc24 | 보안인증서 | Banker |
Domains:
The post Fakecalls Android Malware Abuses Legitimate Signing Key appeared first on McAfee Blog.
Authored by Lakshya Mathur and Sriram P
McAfee Intelligence observed a huge spike in extortion email frauds over the past month. The intent of these fraudulent activities is to intimidate individuals into paying a specified amount of money as a ransom.
Figure 1 shows the number of blackmail emails received over a month recently.
Figure 1 – Stats for 20 February 2023 – 23rd March 2023
In this blog, we’ll delve into frauds that are becoming increasingly common in the digital age. We’ll first define what these frauds are and provide examples to help readers better understand the nature of these frauds. Additionally, we’ll explore how these frauds are on the rise, highlighting the reasons behind this trend and the impact it has on individuals.
Finally, we’ll provide practical advice to help consumers protect themselves from these types of attacks. This will include a discussion of some of the most effective measures individuals can take to safeguard their personal and financial information from fraudsters.
Extortion emails are a type of scam where cybercriminals send threatening messages to individuals or organizations—demanding payment in exchange for not releasing sensitive or embarrassing information. These emails typically claim that the sender has compromising information, such as private photos or personal data, and threaten to share it with the recipient’s friends, family, or the public unless a payment is made. The payment is usually asked in the form of cryptocurrency, such as Bitcoin in the recent spam, which is difficult to trace and can be transferred quickly and anonymously. The goal of these emails is to scare the recipient into paying the demanded amount, even though there might not be any compromising information to release.
Scammers use different scareware sentiments like bad internet browsing habits, hacking for Wi-Fi, and hacking of networks because of hardware vulnerabilities. We’ll now examine various illustrations of extortion emails and analyze scammers’ strategies to intimidate victims into providing payment. By presenting various real-life examples, we can demonstrate how scammers use scareware tactics to manipulate and intimidate their victims into complying with their demands. By instilling fear, the scammers hope to provoke a sense of urgency in the victim, increasing the likelihood that they will pay the demanded ransom.
Figure 2 – Extortion fraud Example 1
Figure 2 is an illustration of a typical extortion email that scammers use to exploit their victims. In this instance, the scammer is claiming to have gained unauthorized access to the victim’s account through a security vulnerability in a Cisco router. The scammer is then threatening to expose embarrassing information about the victim unless a payment of $1,340 is made.
The payment is demanded through a Bitcoin wallet address that the scammer has provided. In this example, the scammer has obfuscated the Bitcoin wallet address by adding spaces between the characters, which is a tactic used to make it harder to track the payment. Now, let us examine another instance of extortion emails.
Figure 3 – Extortion fraud example 2
Figure 3 is another example of an extortion email that scammers use to trick and manipulate their victims. In this case, the attacker is claiming to have gained unauthorized access to the victim’s accounts and has deployed trojans and viruses on the victim’s system. The scammer is also blackmailing the victim by alleging that they have explicit adult content about the victim and the victim’s web browsing history. The purpose of this is to instill fear and provoke a sense of urgency in the victim.
Like the previous example, the scammer has provided a Bitcoin wallet address for the victim to make a ransom payment of $950. Additionally, the attacker has explained that the virus they’ve deployed is undetectable by antivirus software because they’ve used drivers that update the virus every few hours.
Cryptocurrency tools are the most common way these scammers ask for a ransom. They use this tactic because it is difficult to trace and can be sent quickly and anonymously to other platforms. We noticed that scammers were demanding ransom payments through Bitcoin wallets. So, we tried to gather statistics on the number of unique Bitcoin wallets we came across in the past month.
Figure 4 – Unique Bitcoin Stats for 20th February 2023 – 23rd March 2023
We checked these Bitcoin addresses to see what their transactions activities are and their reputation on the blockchain and Bitcoin abuse database. Below are some snapshots of the transaction of these addresses.
Figure 5 – Bitcoin received, and abuse report count for Bitcoin address
As illustrated in Figure 5, it is clear that the Bitcoin addresses mentioned in these extortion emails have numerous abuse reports against them. Additionally, some ransom payments have been received through these addresses. Our intelligence also collected weekly trends on how much money they had within them.
Figure 6 – Total Amount received (US Dollars) in that week
Figure 6 shows that the amount of money received in these Bitcoin addresses is increasing weekly. This implies that scammers are successfully extorting money from more consumers.
If you receive extortion emails, follow the steps outlined below.
Despite advancements in technology, extortion frauds continue to increase as seen in this blog. However, the best defense against such scams is to remain calm, and informed, and to make others aware of such frauds. By following the steps mentioned above, such as not responding to or paying any ransom demands, keeping your system and software updated, using strong passwords, and being wary of unusual emails or links, you can protect yourself from falling victim to these frauds. It is important to stay vigilant and to report any questionable activity to the appropriate authorities. By taking these precautions, you can help prevent yourself and others from becoming victims of extortion fraud.
The post Extortion Fraud is Still on the Rise appeared first on McAfee Blog.
Ransomware. Even the name sounds scary.
When you get down to it, ransomware is one of the nastiest attacks a hacker can wage. They target some of our most important and precious things—our files, our photos, and our information stored on our devices. Think about suddenly losing access to all of them and being forced to pay a ransom to get access back. Worse yet, paying the ransom is no guarantee the hacker will return them.
That’s what a ransomware attack does. Broadly speaking, it’s a type of malware that infects a network or a device and then typically encrypts the files, data, and apps stored on it, digitally scrambling them so the proper owners can’t access them. Only a digital key can unlock them—one that the hacker holds.
Nasty for sure, yet you can take several steps that can greatly reduce the risk of it happening to you. Our recently published Ransomware Security Guide breaks them down for you, and in this blog we’ll look at a few reasons why ransomware protection is so vital.
The short answer is pretty bad—to the tune of billions of dollars stolen from victims each year. Ransomware targets people and their families just as explained above. Yet it also targets large organizations, governments, and even companies that run critical stretches of energy infrastructure and the food supply chain. Accordingly, the ransom amounts for these victims climb into the millions of dollars.
A few recent cases of large-scale ransomware attacks include:
Who’s behind such attacks? Given the scope and scale of them, it’s often organized hacking groups. Put simply, these are big heists. It demands expertise to pull them off, not to mention further expertise to transfer large sums of cryptocurrency in ways that cover the hackers’ tracks.
As for ransomware attacks on people and their families, the individual dollar amounts of an attack are far lower, typically in the hundreds of dollars. Again, the culprits behind them may be large hacking groups that cast a wider net for individual victims, where hundreds of successful attacks at hundreds of dollars each quickly add up. One example: a hacker group that posed as a government agency and as a major retailer, which mailed out thousands of USB drives infected with malware.
Other ransomware hackers who target people and families are far less sophisticated. Small-time hackers and hacking groups can find the tools they need to conduct such attacks by shopping on the dark web, where ransomware is available for sale or for lease as a service (Ransomware as a Service, or RaaS). In effect, near-amateur hackers can grab a ready-to-deploy attack right off the shelf.
Taken together, hackers will level a ransomware attack at practically anyone or any organization—making it everyone’s concern.
Hackers have several ways of getting ransomware onto one of your devices. Like any other type of malware, it can infect your device via a phishing link or a bogus attachment. It can also end up there by downloading apps from questionable app stores, with a stolen or hacked password, or through an outdated device or network router with poor security measures in place. And as mentioned above, infected storage devices provide another avenue.
Social engineering attacks enter the mix as well, where the hacker poses as someone the victim knows and gets the victim to either download malware or provide the hacker access to an otherwise password-protected device, app, or network.
And yes, ransomware can end up on smartphones as well.
Smartphone ransomware can encrypt files, photos, and the like on a smartphone, just as it can on computers and networks. Yet other forms of mobile ransomware don’t have to encrypt data to make the phone unusable. The “Lockerpin” ransomware that has struck some Android devices in the past would change the PIN number that locked the phone. Other forms of lock screen ransomware would simply paste a warning over the home screen with a “pay up, or else” message.
Still, ransomware isn’t as prevalent on smartphones as it is on computers, and there are several reasons why. For the most part, smartphone ransomware relies on people downloading malicious apps from app stores. Both Google Play and Apple’s App Store both do their part to keep their virtual shelves free of malware-laden apps with a thorough submission process, as reported by Google and Apple.
Yet, bad actors find ways to sneak malware into the stores. Sometimes they upload an app that’s initially clean and then push the malware to users as part of an update. Other times, they’ll embed the malicious code so that it only triggers once it’s run in certain countries. They will also encrypt malicious code in the app that they submit, which can make it difficult for reviewers to sniff out.
Further, Android allows users to download apps from third-party app stores that may or may not have a thorough app submission process in place, which can make them more susceptible to hosting malicious apps. Moreover, some third-party app stores are actually fronts for organized cybercrime gangs, built specifically to distribute malware.
The people behind these attacks play on one of your greatest fears—that those important and precious things on your device might be gone forever. Yet with a backup, you have little to fear. You can simply restore any data and files that may have come under attack. Consider using a reputable cloud storage service that you protect with a strong, unique password. Similarly, you can back up your data locally on an external drive that you keep disconnected from your network and stored in a secure location. So while a backup won’t prevent an attack, it can most certainly minimize any threat or damage from one.
Ransomware attackers use phishing emails, bogus direct messages in social media, and texts to help install malware on your device. Many of these messages can look quite legitimate, like they’re coming from a brand you know, a financial institution, or even the government. The links embedded in those messages will take you to some form of malicious website where you’re prompted to download a phony file or form—which is actually malware. Similarly, some phishing emails will simply send malware to the recipient in the form of a malicious attachment that masquerades as a legitimate document like an invoice, spreadsheet, or shipping notice.
This provides your first line of defense. Online protection software includes several features that can stop a ransomware attack before it takes root:
That list is just for starters. Our Ransomware Security Guide goes even deeper on the topic.
It gets into the details of what ransomware looks like and how it works, followed by the straightforward things you can do to prevent it, along with the steps to take if the unfortunate ends up happening to you or someone you know.
Ransomware is one of the nastiest attacks going, because it targets our files, photos, and information, things we don’t know where we’d be without. Yet it’s good to know you can indeed lower your risk with a few relatively steps. Once you have them in place, chances are a good feeling will come over you, the one that comes with knowing you’ve protected what’s precious and important to you.
The post How To Prevent Ransomware appeared first on McAfee Blog.
It’s important to note that the only time your communications are encrypted is when they’re in transit. They’re otherwise plain as day to see or hear. Thus, anyone who can open your phone can tap the app and access them (provided you don’t lock your phone or the WhatsApp app itself). And like any other message or photo that you send over the internet, nothing prevents the recipient from sharing your message with others by taking a screenshot or simply forwarding a photo to someone else.
With that, no form of messaging is 100% private. Not WhatsApp. Not other messaging apps like it, with or without encryption. If you want to keep something entirely private, whether it’s a photo or a message, don’t send it over the internet.
Generally no, yet understanding the specifics calls for diving into their privacy policy.
Once again, WhatsApp does not view your messages or listen to your calls. It only temporarily stores messages on their servers in the case of a few exceptions. As of April 2023, its policy states:
We do not retain your messages in the ordinary course of providing our Services to you. Instead, your messages are stored on your device and not typically stored on our servers. Once your messages are delivered, they are deleted from our servers.
In some cases, undelivered messages are kept in encrypted form on WhatsApp’s servers for up to 30 days or until the message is delivered. Also, WhatsApp may store media that you forward in a message temporarily in encrypted form on their servers to aid in more efficient delivery of additional forwards.
Facebook (now known as Meta) purchased WhatsApp in 2014. Today, as one of the companies that falls under the Meta umbrella, WhatsApp “[R]eceives information from, and shares information with, the other Meta Companies.” Per WhatsApp’s privacy policy:
WhatsApp must receive or collect some information to operate, provide, improve, understand, customize, support, and market our Services, including when you install, access, or use our Services.
Also per its privacy policy, WhatsApp (and Meta) uses that information:
We use information we have (subject to choices you make and applicable law) to operate, provide, improve, understand, customize, support, and market our Services.
What does WhatsApp collect specifically? That may include location information if you’re using location-based services in the app. It may also include location information even if you aren’t using those services.
In addition to location information, it may also include the following:
Why does WhatsApp collect this information? The company may use it for the “safety, security, and integrity” of the app experience. It may use that information for marketing purposes as well. (Think targeted ads.) Likewise, WhatsApp may share this information with select third parties for the same purposes.
So while WhatsApp may not know what’s in your messages, it potentially knows a great deal about you—like where you are, how you’re using their app, and for how long. And if you have a Facebook account, that may extend to your interests, what ads you’ve clicked on, which ones led to purchase, along with all the other information that Facebook knows about you.
This is the “value exchange” that we talk about in our blogs so often, where you gain the value of using a free app in exchange for something else, typically personal information that is used for marketing purposes. By agreeing to the terms of the user agreement you clicked when you first installed the app, you became a legally binding participant in this exchange.
For starters, you can keep a thief or snoop from getting into your phone altogether by setting a screen lock with a PIN, facial recognition, or gesture lock. Surprisingly, from our recent global research found that only 56% of adults said that they protect their smartphone with some form of a screen lock. If you find yourself among them, consider making a change. Locking your phone offers terrific peace of mind in the event your phone gets lost or stolen.
Additionally, WhatsApp also allows you to create a PIN for accessing the app itself. You can find this setting in Settings > Account > Two-Step verification. With both in place, you can effectively double-lock WhatsApp. As with any PIN, never give it out to anyone. Sharing it could compromise your security.
WhatsApp has a setting that sends a notification in the event your security PIN code changes. If you have the app installed on multiple devices, you will need to enable it on those devices as well for it to work. You can enable this setting in Settings > Account > Security Notifications.
A quick trip to Settings > Privacy can limit what other WhatsApp users see and know about you. In that menu, you’ll see that you have several privacy options:
Setting these to “My Contacts” will prevent the broader WhatsApp user base from seeing this information about you. That includes potential spammers and scammers, thus taking this step can make you more private. So just in the same way we recommend that you set your social media accounts to “friends and family only,” we recommend doing the same here.
Although WhatsApp can determine your location by other means, you can limit it from locating you with pinpoint accuracy by disabling location services for the app.
On an iOS device, you can do that by going into Settings > Privacy & Security > Location Services and then scrolling down until you find WhatsApp. From there, you can disable its permissions with a tap.
For Android, on your phone’s home screen, find the WhatsApp icon, then touch and hold it. Tap “App Info,” then “Permissions” then “Location.” Finally, select “Deny.”
As it is on so many platforms today, scammers abound. WhatsApp is no different, where scammers spin up bogus accounts and attempt to start conversations with other users. The way they go about it varies. They may try to kindle a romance scam, they may masquerade as a business representative, or even pose as a tax collector or other government official. The aim is always the same, though. They want to steal your personal information or trick you into forking over your money. Don’t take chances. Don’t talk to strangers.
Other scammers will send messages with malicious links. Just as you shouldn’t follow links or open files from strangers in other apps, don’t do open them on WhatsApp either. Those links are simply gateways to scam sites and malware.
If you back up your WhatsApp message histories in the cloud with Apple or Google, they are not encrypted. Once again, you can encrypt them while they are in transit by using “End-to-End Encrypted Backup,” but the histories themselves are not encrypted when they are stored in the cloud.
For those who are particularly privacy-conscious, the idea of their messages, plus any attached photos and messages, being stored without encryption may give them pause. Even if that is in a relatively secure cloud service such as Apple’s or Google’s. Yet the risk of data breaches remains, as does the risk of a bad actor gaining access to one’s cloud account, such as through a stolen password.
So, for an increased degree of privacy and security, you may want to consider disabling cloud backup for your WhatsApp messages.
Comprehensive online protection software can protect your phone in the same ways that it protects your laptops and computers. Installing it can protect your privacy, keep you safe from attacks on public Wi-Fi, and automatically block unsafe websites and links (like the ones that might come to you in a spammy WhatsApp message), just to name a few things it can do. In all, given how much of our lives center around our phone—shopping, finances, splitting a dinner bill with friends, and so on, protecting your phone and the things you do on it makes sense.
There’s a good chance you’ve experienced that moment of panic—the moment when you think you’ve really lost your phone, followed by the deep relief when you finally find it. But what happens if your phone ends up getting lost or stolen? A combination of device tracking, device locking, and remote erasing can help protect your phone and the data on it.
Different device manufacturers have different ways of going about it, but the result is the same—you can you’re your phone, prevent others from using it, and even erase it if you’re truly worried that it’s in the wrong hands or simply gone for good. Apple provides iOS users with a step-by-step guide, and Google offers up a guide for Android users as well.
WhatsApp is indeed quite private when it comes to messages and voice communications when they are transmitted between people—yet not so much when it comes to other data that the app collects while you’re using it.
While much of that data collection occurs thanks to the terms of its user agreement and privacy policy, you can take a few steps to limit it to a degree. You can take yet more steps that can make the time you spend on WhatsApp more secure as well.
As with any free app, using it involves some sort of value exchange. Understanding what information the app does and does not collect can help you determine if that value exchange is right for you.
The post How Private is WhatsApp Really? Staying Safer While Using the App. appeared first on McAfee Blog.
Authored by SangRyol Ryu
McAfee’s Mobile Research Team discovered a software library we’ve named Goldoson, which collects lists of applications installed, and a history of Wi-Fi and Bluetooth devices information, including nearby GPS locations. Moreover, the library is armed with the functionality to perform ad fraud by clicking advertisements in the background without the user’s consent. The research team has found more than 60 applications containing this third-party malicious library, with more than 100 million downloads confirmed in the ONE store and Google Play app download markets in South Korea. While the malicious library was made by someone else, not the app developers, the risk to installers of the apps remains.
McAfee Mobile Security detects this threat as Android/Goldoson and protects customers from this and many other mobile threats. McAfee is a member of the App Defense Alliance focused on protecting users by preventing threats from reaching their devices and improving app quality across the ecosystem. We reported the discovered apps to Google, which took prompt action. Google has reportedly notified the developers that their apps are in violation of Google Play policies and fixes are needed to reach compliance. Some apps were removed from Google Play while others were updated by the official developers. Users are encouraged to update the apps to the latest version to remove the identified threat from their devices.
Top 9 applications previously infected by Goldoson on Google Play
The Goldoson library registers the device and gets remote configurations at the same time the app runs. The library name and the remote server domain varies with each application, and it is obfuscated. The name Goldoson is after the first found domain name.
Remote configuration contains the parameters for each of functionalities and it specifies how often it runs the components. Based on the parameters, the library periodically checks, pulls device information, and sends them to the remote servers. The tags such as ‘ads_enable’ or ‘collect_enable’ indicates each functionality to work or not while other parameters define conditions and availability.
A response of remote configuration
The library includes the ability to load web pages without user awareness. The functionality may be abused to load ads for financial profit. Technically, the library loads HTML code and injects it into a customized and hidden WebView and it produces hidden traffic by visiting the URLs recursively.
Collected data is sent out periodically every two days but the cycle is subject to change by the remote configuration. The information contains some sensitive data including the list of installed applications, location history, MAC address of Bluetooth and Wi-Fi nearby, and more. This may allow individuals to be identified when the data is combined. The following tables show the data observed on our test device.
Google Play considers the list of installed apps to be personal and sensitive user data and requires a special permission declaration to get it. Users with Android 11 and above are more protected against apps attempting to gather all installed apps. However, even with the recent version of Android, we found that around 10% of the apps with Goldoson have the permission “QUERY_ALL_PACKAGES” that allows them to access app information.
Likewise, with Android 6.0 or higher, users may be asked for permissions such as Location, Storage, or Camera at runtime. If user allows the location permission, the app can access not only GPS data but also Wi-Fi and Bluetooth device information nearby. Based on BSSID (Basic Service Set Identifier) and RSSI (Received Signal Strength Indicator), the application can determine the location of the device more accurately than GPS, especially indoors.
A demo of runtime permission request
The infected applications come from various Android application stores. More than 100 million downloads have been tracked through Google Play. After that, ONE store, Korea’s leading app store, follows with about 8 million installations.
As applications continue to scale in size and leverage additional external libraries, it is important to understand their behavior. App developers should be upfront about libraries used and take precautions to protect users’ information. McAfee Mobile Security products can also help detect threats and protect you from not only malware but also unwanted programs. For more information, visit our McAfee Mobile Security.
| Package Name | Application Name | GooglePlay Downloads |
GP Status |
| com.lottemembers.android | L.POINT with L.PAY | 10M+ | Updated* |
| com.Monthly23.SwipeBrickBreaker | Swipe Brick Breaker | 10M+ | Removed** |
| com.realbyteapps.moneymanagerfree | Money Manager Expense & Budget | 10M+ | Updated* |
| com.skt.tmap.ku | TMAP – 대리,주차,전기차 충전,킥보 … | 10M+ | Updated* |
| kr.co.lottecinema.lcm | 롯데시네마 | 10M+ | Updated* |
| com.ktmusic.geniemusic | 지니뮤직 – genie | 10M+ | Updated* |
| com.cultureland.ver2 | 컬쳐랜드[컬쳐캐쉬] | 5M+ | Updated* |
| com.gretech.gomplayerko | GOM Player | 5M+ | Updated* |
| com.megabox.mop | 메가박스(Megabox) | 5M+ | Removed** |
| kr.co.psynet | LIVE Score, Real-Time Score | 5M+ | Updated* |
| sixclk.newpiki | Pikicast | 5M+ | Removed** |
| com.appsnine.compass | Compass 9: Smart Compass | 1M+ | Removed** |
| com.gomtv.gomaudio | GOM Audio – Music, Sync lyrics | 1M+ | Updated* |
| com.gretech.gomtv | 곰TV – All About Video | 1M+ | Updated* |
| com.guninnuri.guninday | 전역일 계산기 디데이 곰신톡–군인 … | 1M+ | Updated* |
| com.itemmania.imiapp | 아이템매니아 – 게임 아이템 거래 … | 1M+ | Removed** |
| com.lotteworld.android.lottemagicpass | LOTTE WORLD Magicpass | 1M+ | Updated* |
| com.Monthly23.BounceBrickBreaker | Bounce Brick Breaker | 1M+ | Removed** |
| com.Monthly23.InfiniteSlice | Infinite Slice | 1M+ | Removed** |
| com.pump.noraebang | 나홀로 노래방–쉽게 찾아 이용하는 … | 1M+ | Updated* |
| com.somcloud.somnote | SomNote – Beautiful note app | 1M+ | Removed** |
| com.whitecrow.metroid | Korea Subway Info : Metroid | 1M+ | Updated* |
| kr.co.GoodTVBible | GOODTV다번역성경찬송 | 1M+ | Removed** |
| kr.co.happymobile.happyscreen | 해피스크린 – 해피포인트를 모으 … | 1M+ | Updated* |
| kr.co.rinasoft.howuse | UBhind: Mobile Tracker Manager | 1M+ | Removed** |
| mafu.driving.free | 스피드 운전면허 필기시험 … | 1M+ | Removed** |
| com.wtwoo.girlsinger.worldcup | 이상형 월드컵 | 500K+ | Updated* |
| kr.ac.fspmobile.cu | CU편의점택배 | 500K+ | Removed** |
| com.appsnine.audiorecorder | 스마트 녹음기 : 음성 녹음기 | 100K+ | Removed** |
| com.camera.catmera | 캣메라 [순정 무음카메라] | 100K+ | Removed** |
| com.cultureland.plus | 컬쳐플러스:컬쳐랜드 혜택 더하기 … | 100K+ | Updated* |
| com.dkworks.simple_air | 창문닫아요(미세/초미세먼지/WHO … | 100K+ | Removed** |
| com.lotteworld.ticket.seoulsky | 롯데월드타워 서울스카이 | 100K+ | Updated* |
| com.Monthly23.LevelUpSnakeBall | Snake Ball Lover | 100K+ | Removed** |
| com.nmp.playgeto | 게토(geto) – PC방 게이머 필수 앱 | 100K+ | Removed** |
| com.note.app.memorymemo | 기억메모 – 심플해서 더 좋은 메모장 | 100K+ | Removed** |
| com.player.pb.stream | 풀빵 : 광고 없는 유튜브 영상 … | 100K+ | Removed** |
| com.realbyteapps.moneya | Money Manager (Remove Ads) | 100K+ | Updated* |
| com.wishpoke.fanciticon | Inssaticon – Cute Emoticons, K | 100K+ | Removed** |
| marifish.elder815.ecloud | 클라우드런처 | 100K+ | Updated* |
| com.dtryx.scinema | 작은영화관 | 50K+ | Updated* |
| com.kcld.ticketoffice | 매표소–뮤지컬문화공연 예매& … | 50K+ | Updated* |
| com.lotteworld.ticket.aquarium | 롯데월드 아쿠아리움 | 50K+ | Updated* |
| com.lotteworld.ticket.waterpark | 롯데 워터파크 | 50K+ | Updated* |
| com.skt.skaf.l001mtm091 | T map for KT, LGU+ | 50K+ | Removed** |
| org.howcompany.randomnumber | 숫자 뽑기 | 50K+ | Updated* |
| com.aog.loader | 로더(Loader) – 효과음 다운로드 앱 | 10K+ | Removed** |
| com.gomtv.gomaudio.pro | GOM Audio Plus – Music, Sync l | 10K+ | Updated* |
| com.NineGames.SwipeBrickBreaker2 | Swipe Brick Breaker 2 | 10K+ | Removed** |
| com.notice.safehome | 안심해 – 안심귀가 프로젝트 | 10K+ | Removed** |
| kr.thepay.chuncheon | 불러봄내 – 춘천시민을 위한 공공 … | 10K+ | Removed** |
| com.curation.fantaholic | 판타홀릭 – 아이돌 SNS 앱 | 5K+ | Removed** |
| com.dtryx.cinecube | 씨네큐브 | 5K+ | Updated* |
| com.p2e.tia.tnt | TNT | 5K+ | Removed** |
| com.health.bestcare | 베스트케어–위험한 전자기장, … | 1K+ | Removed** |
| com.ninegames.solitaire | InfinitySolitaire | 1K+ | Removed** |
| com.notice.newsafe | 안심해 : 안심지도 | 1K+ | Removed** |
| com.notii.cashnote | 노티아이 for 소상공인 | 1K+ | Removed** |
| com.tdi.dataone | TDI News – 최초 데이터 뉴스 앱 … | 1K+ | Removed** |
| com.ting.eyesting | 눈팅 – 여자들의 커뮤니티 | 500+ | Removed** |
| com.ting.tingsearch | 팅서치 TingSearch | 50+ | Removed** |
| com.celeb.tube.krieshachu | 츄스틱 : 크리샤츄 Fantastic | 50+ | Removed** |
| com.player.yeonhagoogokka | 연하구곡 | 10+ | Removed** |
* Updated means that the recent application on Google Play does not contain the malicious library.
** Removed means the application is not available on Google Play as of the time of posting.
The post Goldoson: Privacy-invasive and Clicker Android Adware found in popular apps in South Korea appeared first on McAfee Blog.
What is a VPN (virtual private network)? And how can it make your time online more secure—and a little more private too? Here we’ll take a look at what a VPN is, what it has to offer, and how that benefits you.
A VPN is an app that you install on your device to help keep your data safe as you browse the internet. When you turn on your VPN app, your device makes a secure connection to a VPN server that routes internet traffic. Securely. This keeps your online activity private on any network, shielding it from prying eyes. So, while you’re on a VPN, you can browse and bank with the confidence that your passwords, credentials, and financial info are secure. If any malicious actors try to intercept your web traffic, they’ll only see garbled content thanks to your VPN’s encryption functionality.
Every internet connection is assigned a unique set of numbers called an IP address, which is tied to info such as geographic location or an Internet Service Provider (ISP). A VPN replaces your actual IP address to make it look like you’ve connected to the internet from the physical location of the VPN server, rather than your real location. This is just one reason why so many people use VPNs.
To change your IP address, you simply open your VPN app, select the server location you’d like to connect to, and you’re done. You’re now browsing with a new IP address. If you’d like to make sure your IP has changed, open a browser and search for “What’s my IP address” and then select one of the results.
An ideal case for using a VPN is when you’re using public Wi-Fi at the airport, a café, hotel, or just about any place where “free Wi-Fi” is offered. The reason being is that these are open networks, and any somewhat enterprising cybercriminal can tap into these networks and harvest sensitive info as a result. One survey showed that 39% of internet users worldwide understand public Wi-Fi is unsafe, yet some users still bank, shop, and do other sensitive things on public Wi-Fi despite the understood risks.
Further, you have your privacy to consider. You can use a VPN to help stop advertisers from tracking you. Searches you perform and websites you visit won’t be traced back to you, which can prevent advertisers from gleaning info about you and your online habits in general. Moreover, some ISPs collect the browsing history of their users and share it with advertisers and other third parties. A VPN can prevent this type of collection as well.
A VPN protects your search history through the secure connection you share. When you search for a website or type a URL into your navigation bar, your device sends something called a DNS request, which translates the website into the IP address of the web server. This is how your browser can find the website and serve its content to you. By encrypting your DNS requests, a VPN can hide your search habits and history from those who might use that info as part of building a profile of you. This type of info might be used in a wide variety of ways, from legitimately serving targeted ads to nefarious social engineering.
Note that a VPN is quite different and far, far more comprehensive than using “Private Mode” or “Incognito Mode” on your browser. Those modes only hide your search history locally on your device — not from others on the internet, like ISPs and advertisers.
No, a VPN can’t make you anonymous. Not entirely, anyway. They help secure what you’re doing, but your ISP still knows when you’re using the internet. They just can’t see what you’re doing, what sites you visit, or how long you’ve been on a site.
Apple’s Private Relay is similar to a VPN in that it changes your IP address so websites you visit can’t tell exactly where you are. It works on iOS and Macs as part of an iCloud+ subscription. Yet there is one important distinction: it only protects your privacy while surfing with the Safari browser.
Per Apple, it works like this:
When Private Relay is enabled, your requests are sent through two separate, secure internet relays. Your IP address is visible to your network provider and to the first relay, which is operated by Apple. Your DNS records are encrypted, so neither party can see the address of the website you’re trying to visit. The second relay, which is operated by a third-party content provider, generates a temporary IP address, decrypts the name of the website you requested, and connects you to the site. All of this is done using the latest internet standards to maintain a high-performance browsing experience while protecting your privacy.
Note that as of this writing, Apple Private Relay is not available in all countries and regions. If you travel somewhere where Private Relay isn’t available, it will automatically turn off and will notify you when it’s unavailable and once more when it’s active again. You can learn more about it here and how you can enable it on your Apple devices.
As mentioned above, Private Relay only works with Safari on iOS and macOS as part of an iCloud+ subscription. Even if you are using an Apple device, a VPN is still a good idea because it will protect the info that your device sends outside Safari — such as any info passed along by your apps or any other browsers you might use.
An unlimited VPN with bank-grade encryption comes as part of your McAfee+ subscription and provides the security and privacy benefits above with bank-grade encryption. Additionally, it turns on automatically any time you connect to an unsecured Wi-Fi network, which takes the guesswork out of when you absolutely need to use it.
In all, our VPN makes it practically impossible for cybercriminals or advertisers to access so that what you do online remains private and secure, so you can enjoy your time online with confidence.
The post How a VPN Can Make Your Time Online More Private and Secure appeared first on McAfee Blog.
The pop-up toaster as we know it first hit the shelves in 1926, under the brand name “Toastmaster.” With a familiar springy *pop*, it has ejected toast just the way we like it for nearly a century. Given that its design was so simple and effective, it’s remained largely unchanged. Until now. Thanks to the internet and so called “smart home” devices.
Toasters, among other things, are all getting connected. And have been for a few years now, to the point where the number of connected Internet of Things (IoT) devices reaches well into the billions worldwide—which includes smart home devices.
Businesses use IoT devices to track shipments and various aspects of their supply chain. Cities use them to manage traffic flow and monitor energy use. (Does your home have a smart electric meter?) And for people like us, we use them to play music on smart speakers, see who’s at the front door with smart doorbells, and order groceries from an LCD screen on our smart refrigerators—just to name a few ways we have welcomed IoT smart home devices into our households.
In the U.S. alone, smart home devices make up a $30-plus billion marketplace per year. However, it’s still a relatively young marketplace. And with that comes several security issues.
First and foremost, many of these devices still lack sophisticated security measures, which makes them easy pickings for cybercriminals. Why would a cybercriminal target that smart lightbulb in your living room reading lamp? Networks are only as secure as their least secure device. Thus, if a cybercriminal can compromise that smart lightbulb, it can potentially give them access to the entire home network it is on—along with all the other devices and data on it.
These devices make desirable targets for another reason. They can easily get conscripted into botnets, networks of hijacked computers and devices used to amplify Distributed Denial of Service (DDoS) attacks that organize the devices into an attacking host that can flood a target with so much traffic that it cannot operate. DDoS attacks can shut down websites, disrupt service and even choke traffic across broad swathes of the internet.
Remember the “Mirai” botnet attack of 2016, where hackers targeted a major provider of internet infrastructure? It ended up crippling traffic in concentrated areas across the U.S., including the northeast, Great Lakes, south-central, and western regions. Millions of internet users were affected, people, businesses, and government workers alike.
Another headline-maker was the Amazon Web Services (AWS) attack in 2020. AWS provides cloud computing services to millions of businesses and organizations, large and small. Those customers saw slowdowns and disruptions for three days, which in turn slowed down and disrupted the people and services that wanted to connect with them.
The Mirai and AWS stand out as two of the highest-profile DDoS attacks, yet smaller botnet attacks abound, ones that don’t make headlines. Still, they can disrupt the operations of websites, public infrastructure, and businesses, not to mention the well-being of people who rely the internet.
How do cybercriminals harness these devices for attacks? Well, as the case with many early IoT devices, the fault lies within the weak default passwords that many manufacturers employ when they sell these devices. These passwords include everything from “admin123” to the product’s name. The practice is so common that they get posted in bulk on hacking websites, making it easy for cybercriminals to simply look up the type of device they want to attack.
Complicating security yet further is the fact that some IoT and smart home device manufacturers introduce flaws in their design, protocols, and code that make them susceptible to attack. The thought gets yet more unsettling when you consider that some of the flaws were found in things like smart door locks.
The ease in which IoT devices can be compromised is a big problem. The solution, however, starts with manufacturers that develop IoT devices with security in mind. Everything in these devices will need to be deployed with the ability to accept security updates and embed strong security solutions from the get-go.
Until industry standards get established to ensure such basic security, a portion of securing your IoT and smart home devices falls on us, as people and consumers.
As for security, you can take steps that can help keep you safer. Broadly speaking, they involve two things: protecting your devices and protecting the network they’re on. These security measures will look familiar, as they follow many of the same measures you can take to protect your computers, tablets, and phones.
Many smart home devices use a smartphone as a sort of remote control, not to mention as a place for gathering, storing, and sharing data. So whether you’re an Android owner or iOS owner, use online protection software on your phone to help keep it safe from compromise and attack.
One issue with many IoT devices is that they often come with a default username and password. This could mean that your device and thousands of others just like it all share the same credentials, which makes it painfully easy for a hacker to gain access to them because those default usernames and passwords are often published online. When you purchase any IoT device, set a fresh password using a strong method of password creation, such as ours. Likewise, create an entirely new username for additional protection as well.
Online banks, shops, and other services commonly offer multi-factor authentication to help protect your accounts—with the typical combination of your username, password, and a security code sent to another device you own (often a mobile phone). If your IoT device supports multi-factor authentication, consider using it there too. It throws a big barrier in the way hackers who simply try and force their way into your device with a password/username combination.
Another device that needs good password protection is your internet router. Make sure you use a strong and unique password there as well to help prevent hackers from breaking into your home network. Also consider changing the name of your home network so that it doesn’t personally identify you. Fun alternatives to using your name or address include everything from movie lines like “May the Wi-Fi be with you” to old sitcom references like “Central Perk.” Also check that your router is using an encryption method, like WPA2 or the newer WPA3, which will keep your signal secure.
Older routers may have outdated security measures, which may make them more prone to attack. If you’re renting yours from your internet provider, contact them for an upgrade. If you’re using your own, visit a reputable news or review site such as Consumer Reports for a list of the best routers that combine speed, capacity, and security.
In addition to fixing the odd bug or adding the occasional new feature, updates often address security gaps. Out-of-date apps and devices may have flaws that hackers can exploit, so regular updating is a must from a security standpoint. If you can set your smart home apps and devices to receive automatic updates, even better.
Just as you can offer your guests secure access that’s separate from your own devices, creating an additional network on your router allows you to keep your computers and smartphones separate from IoT devices. This way, if an IoT device is compromised, a hacker will still have difficulty accessing your other devices on your primary network, the one where you connect your computers and smartphones.
Read trusted reviews and look up the manufacturer’s track record online. Have their devices been compromised in the past? Do they provide regular updates for their devices to ensure ongoing security? What kind of security features do they offer? And privacy features too? Resources like Consumer Reports can provide extensive and unbiased information that can help you make a sound purchasing decision.
As more and more connected devices make their way into our homes, the need to ensure that they’re secure only increases. More devices mean more potential avenues of attack, and your home networks is only as secure as the least secure device that’s on it.
While standards put forward by industry groups such as UL and Matter have started to take root, a good portion of keeping IoT and smart home devices secure falls on us as consumers. Taking the steps above can help prevent your connected toaster from playing its part in a botnet army attack—and it can also protect your network and your home from getting hacked.
It’s no surprise that IoT and smart home devices are raking in billions of dollars of years. They introduce conveniences and little touches into our homes that make life more comfortable and enjoyable. However, they’re still connected devices. And like anything that’s connected, they must get protected.
The post What is a Botnet? And What Does It Have to Do with Protecting “Smart Home” Devices? appeared first on McAfee Blog.
“Zero-day threat.” It may sound like the title of a hit film, yet it’s anything but.
It’s a previously unknown vulnerability that hackers can exploit to unleash unforeseen attacks on computers, smartphones, or networks—making essentially any connected device or system potentially susceptible to attack. After all, today’s devices and code are complex and riddled with dependencies. Even with testing, vulnerabilities can remain elusive, until developers or hackers eventually discover them.
The term “zero day” gets its name from the age of the threat, meaning that developers and security professionals have had “zero days” to address the threat, making it potentially quite damaging.
And it’s not uncommon for major zero-day threats to make the headlines:
Back in the early days of the internet, hackers typically released malware that was an annoyance, such as scrolling profanity across the screen or causing a malware-infected computer to crash. The examples above show how greatly that’s changed.
Today, hackers use malware to make a profit, whether by holding your device and data hostage, tricking you into revealing your personal information so the hacker can access your financial accounts, or by installing spyware that secretly steals information like passwords and account info while you use your device.
That’s what makes zero-day threats so dangerous for us today. Hackers can exploit zero-day vulnerabilities through different means, but traditionally web browsers have been the most common, due to their popularity. Attackers also send emails with attachments, or you might click a link in the body of an email that automatically downloads malware. All of these could now be putting you at risk.
Likewise, security measures have come a long way since the early days. In particular, the antivirus applications included with today’s comprehensive online protection software have technologies in place that directly combat zero-day threats—specifically artificial intelligence (AI) and machine learning (ML).
Without getting too technical about it, strong antivirus uses AI and ML to sniff out malware by looking at how an application or device is behaving and if that behavior looks suspicious based on past patterns. In other words, strong antivirus is smart. It can detect, block, and remove zero-day threats before they can do their damage.
So, just as hackers exploit zero-day vulnerabilities, you can thwart zero-day vulnerabilities with strong antivirus.
Today, McAfee registers an average of 1.1 million new malicious programs and potentially unwanted apps (PUA) each day, which makes zero-day protection an absolute boon for anyone who goes online—and online protection like ours offers some of the strongest antivirus protection you can get, as recognized by independent third-party labs.
Online protection software does a few other things for you as well when it comes to malware attacks:
Beyond using online protection software with strong antivirus, you can take a few more steps that will keep you safer still:
In addition to often providing new features and functionality, updates fix the vulnerabilities in your apps and operating systems, which strengthens your protection against malware.
The more software you have, the more potential vulnerabilities you have. By uninstalling old apps, you leave hackers with fewer avenues of attack. Take a look at your computers and smartphones. Delete the old apps you no longer use, along with any accounts and data associated with them as well. Another benefit is that this can potentially reduce your risk if the companies behind those apps get hit by a data breach.
This is a good rule of thumb in general, but it can definitely help you protect against zero-day attacks. The same holds true for email attachments. Never open them from unknown senders. And if you receive one from a friend, family member, or co-worker, take a quick second to confirm that they sent it. Some attackers masquerade as people we know, and in some cases hack their accounts so they can spread malware in their name.
As the number of apps and devices on the internet have seen explosive growth in recent years, so has the volume of malware—much of it zero-day threats that take advantage of newly discovered vulnerabilities. Hidden within millions and millions of lines of code, dependencies, and interactions, zero-day threats will remain the rule, rather than the exception.
However, antivirus technology has more than kept up, particularly by leaning on smart technologies that can detect zero-day threats before they become known threats. Using strong antivirus, as part of online protection software that contains even more security features still, remains an absolute best practice for anyone who spends any kind of time online.
The post What is a Zero-Day Threat? appeared first on McAfee Blog.
Ping, it’s a scammer!
The sound of an incoming email, text, or direct message has a way of getting your attention, so you take a look and see what’s up. It happens umpteen times a week, to the extent that it feels like the flow of your day. And scammers want to tap into that with sneaky phishing attacks that catch you off guard, all with the aim of stealing your personal information or bilking you out of your money.
Phishing attacks take several forms, where scammers masquerade as a legitimate company, financial institution, government agency, or even as someone you know. And they’ll come after you with messages that follow suit:
You can see why phishing attacks can be so effective. Messages like these have an urgency to them, and they seem like they’re legit, or they at least seem like they might deal with something you might care about. But of course they’re just a ruse. And some of them can look and sound rather convincing. Or at least convincing enough that you’ll not only give them a look, but that you’ll also give them a click too.
And that’s where the troubles start. Clicking the links or attachments sent in a phishing attack can lead to several potentially nasty things, such as:
However, plenty of phishing attacks are preventable. A mix of knowing what to look for and putting a few security steps in place can help you keep scammers at bay.
How you end up with one has a lot to do with it.
There’s a good chance you’ve already seen your share of phishing attempts on your phone. A text comes through with a brief message that one of your accounts needs attention, from an entirely unknown number. Along with it is a link that you can tap to follow up, which will send you to a malicious site. In some cases, the sender may skip the link and attempt to start a conversation with the aim of getting you to share your personal information or possibly fork over some payment with a gift card, money order, rechargeable debit card, or other form of payment that is difficult to trace and recover.
In the case of social media, you can expect that the attack will come from an imposter account that’s doing its best to pose as one of those legitimate businesses or organizations we talked about, or perhaps as a stranger or even someone you know. And the name and profile pic will do its best to play the part. If you click on the account that sent it, you may see that it was created only recently and that it has few to no followers, both of which are red flags. The attack is typically conversational, much like described above where the scammer attempts to pump you for personal info or money.
Attacks that come by direct messaging apps will work much in the same way. The scammer will set up a phony account, and where the app allows, a phony name and a phony profile pic to go along with it.
Email gets a little more complicated because emails can range anywhere from a few simple lines of text to a fully designed piece complete with images, formatting, and embedded links—much like a miniature web page.
In the past, email phishing attacks looked rather unsophisticated, rife with poor spelling and grammar, along with sloppy-looking layouts and images. That’s still sometimes the case today. Yet not always. Some phishing emails look like the real thing. Or nearly so.
Case in point, here’s a look at a phishing email masquerading as a McAfee email:
There’s a lot going on here. The scammers try to mimic the McAfee brand, yet don’t quite pull it off. Still, they do several things to try and be convincing.
Note the use of photography and the box shot of our software, paired with a prominent “act now” headline. It’s not the style of photography we use. Not that people would generally know this. However, some might have a passing thought like, “Huh. That doesn’t really look right for some reason.”
Beyond that, there are a few capitalization errors, some misplaced punctuation, plus the “order now” and “60% off” icons look rather slapped on. Also note the little dash of fear it throws in at the top of the email with mention of “There are (42) viruses on your computer.”
Taken all together, you can spot many email scams by taking a closer look, seeing what doesn’t feel right, and then trusting you gut. But that asks you to slow down, take a moment, and eyeball the email critically. Which people don’t always do. And that’s what scammers count on.
Similar ploys see scammers pose as legitimate companies and retailers, where they either ask you to log into a bogus account page to check statement or the status of an order. Some scammers offer links to “discount codes” that are instead links to landing pages designed steal your account login information as well. Similarly, they may simply send a malicious email attachment with the hope that you’ll click it.
In other forms of email phishing attacks, scammers may pose as a co-worker, business associate, vendor, or partner to get the victim to click a malicious link or download malicious software. These may include a link to a bogus invoice, spreadsheet, notetaking file, or word processing doc—just about anything that looks like it could be a piece of business correspondence. Instead, the link leads to a scam website that asks the victim “log in and download” the document, which steals account info as a result. Scammers may also include attachments to phishing emails that can install malware directly on the device, sometimes by infecting an otherwise everyday document with a malicious payload.
Email scammers may also pose as someone you know, whether by propping up an imposter email account or by outright hijacking an existing account. The attack follows the same playbook, using a link or an attachment to steal personal info, request funds, or install malware.
While you can’t outright stop phishing attacks from making their way to your computer or phone, you can do several things to keep yourself from falling to them. Further, you can do other things that may make it more difficult for scammers to reach you.
The content and the tone of the message can tell you quite a lot. Threatening messages or ones that play on fear are often phishing attacks, such angry messages from a so-called tax agent looking to collect back taxes. Other messages will lean heavy on urgency, like the phony McAfee phishing email above that says your license has expired today and that you have “(42)” viruses. And during the holidays, watch out for loud, overexcited messages about deep discounts on hard-to-find items. Instead of linking you off to a proper ecommerce site, they may link you to a scam shopping site that does nothing but steal your money and the account information you used to pay them. In all, phishing attacks indeed smell fishy. Slow down and review that message with a critical eye. It may tip you off to a scam.
Some phishing attacks can look rather convincing. So much so that you’ll want to follow up on them, like if your bank reports irregular activity on your account or a bill appears to be past due. In these cases, don’t click on the link in the message. Go straight to the website of the business or organization in question and access your account from there. Likewise, if you have questions, you can always reach out to their customer service number or web page.
When scammers contact you via social media, that in of itself can be a tell-tale sign of a scam. Consider, would an income tax collector contact you over social media? The answer there is no. For example, in the U.S. the Internal Revenue Service (IRS) makes it quite clear that they will never contact taxpayers via social media. (Let alone send angry, threatening messages.) In all, legitimate businesses and organizations don’t use social media as a channel for official communications. They have accepted ways they will, and will not, contact you. If you have any doubts about a communication you received, contact the business or organization in question directly and follow up with one of their customer service representatives.
Some phishing attacks involve attachments packed with malware like the ransomware, viruses, and keyloggers we mentioned earlier. If you receive a message with such an attachment, delete it. Even if you receive an email with an attachment from someone you know, follow up with that person. Particularly if you weren’t expecting an attachment from them. Scammers will often hijack or spoof email accounts of everyday people to spread malware.
On computers and laptops, you can hover your cursor over links without clicking on them to see the web address. Take a close look at the addresses the message is using. If it’s an email, look at the email address. Maybe the address doesn’t match the company or organization at all. Or maybe it looks like it almost does, yet it adds a few letters or words to the name. This marks yet another sign that you may have a phishing attack on your hands. Scammers also use the common tactic of a link shortener, which creates links that almost look like strings of indecipherable text. These shortened links mask the true address, which may indeed be a link to scam site. Delete the message. If possible, report it. Many social media platforms and messaging apps have built-in controls for reporting suspicious accounts and messages.
On social media and messaging platforms, stick to following, friending, and messaging people who you really know. As for those people who contact you out of the blue, be suspicious. Sad to say, they’re often scammers canvassing these platforms for victims. Better yet, where you can, set your profile to private, which makes it more difficult for scammers select and stalk you for an attack.
How’d that scammer get your phone number or email address anyway? Chances are, they pulled that information off a data broker site. Data brokers buy, collect, and sell detailed personal information, which they compile from several public and private sources, such as local, state, and federal records, plus third parties like supermarket shopper’s cards and mobile apps that share and sell user data. Moreover, they’ll sell it to anyone who pays for it, including people who’ll use that information for scams. You can help reduce those scam texts and calls by removing your information from those sites. Our Personal Data Cleanup scans some of the riskiest data broker sites and shows you which ones are selling your personal info.
Online protection software can protect you in several ways. First, it can offer safe browsing features that can identify malicious links and downloads, which can help prevent clicking them. Further, it can steer you away from dangerous websites and block malware and phishing sites if you accidentally click on a malicious link. And overall, strong virus and malware protection can further block any attacks on your devices. Be sure to protect your smartphones in addition to your computers and laptops as well, particularly given all the sensitive things we do on them, like banking, shopping, and booking rides and travel.
Once phishing attacks were largely the domain of bogus emails, yet now they’ve spread to texts, social media, and messaging apps—anywhere a scammer can send a fraudulent message while posing as a reputable source.
Scammers count on you taking the bait, the immediate feelings of fear or concern that there’s a problem with your taxes or one of your accounts. They also prey on scarcity, like during the holidays where people search for great deals on gifts and have plenty of packages on the move. With a critical eye, you can often spot those scams. Sometimes, a pause and a little thought is all it takes. You can stay one step ahead of scammers with the power of AI, our new McAfee Scam Protection can alert you when scam texts pop up on your device or phone. Removing the guessing and it can block risky sites if you accidentally follow a scam link in a text, email, social media, and more. And in the cases where a particularly cagey attack makes its way through, online protection software can warn you that the link you’re about to click is indeed a trap.
Taken all together, you have plenty of ways you can beat scammers at their game.
The post How to Protect Yourself From Phishing Scams appeared first on McAfee Blog.
Who else loves tax season besides accountants? Scammers.
It’s high time of year for online risks here in the U.S. with the onset of tax season, where scammers unleash all manner of scams aimed at taxpayers. The complexity, and even uncertainty, of filing a proper tax return can stir up anxieties like, Have I filed correctly, Did I claim the right deductions, Will I get audited, and Will I get stung with a tax penalty are just a few—and these are the very same anxieties that criminals use as the cornerstone of their attacks.
Yet like so many scams, tax scams give off telltale signs that they’re indeed not on the up-and-up. You have ways you can spot one before you get caught up in one.
In all, we’ve learned to watch our step with the Internal Revenue Service (IRS), so much so that receiving a notification from the IRS can feel like an unwanted surprise. Uh oh, did I do something wrong? However, in reality, less than 2% of returns get audited and most discrepancies or adjustments can get handled easily if addressed promptly.
Still, that wariness of the IRS makes for ripe pickings when it comes to hackers, who prey on people’s fear of audits and penalties. Common scams include email phishing attacks, phone calls from crooks posing as IRS agents, texts claiming there’s a problem with our tax software, and even robocalls that threaten jail time for unpaid back taxes. What’s more, fraudsters can take things a step further by committing identity theft and then filing tax claims in other people’s names.
With that, let’s dig into a list of the top scams winding up on our screens and phones during tax time.
Straight from the authority itself, the IRS publishes its Dirty Dozen, an annual list of the top tax season scams. Year-over-year, many of the same scams make the list, yet new ones continue to crop up as scammers try to take advantage of current events. A couple recent examples include email phishing scams centered around Employee Retention Credits, pandemic relief checks, and federal stimulus checks. Additionally, the IRS has warned filers about disinformation that circulates on social media, such as bogus advice that urges filers to alter their W-2 figures for a better refund. With new scams entering the mix every tax season, the Dirty Dozen offers plenty of good advice that can help you steer clear of scams.
We all know the annoyance of spammy phone calls, whether they’re for phony car warranties, tech support services, or debt collection agencies. During this time of year, you can add phony IRS agents and financial service providers to the list.
The stories that scammers will tell will vary, but they often share common themes:
Another thing they have in common: they each outright ask for money, personal information, and sometimes a combination of both. All of which is an indication of a scam.
For the record, per the IRS, it does not:
Also, per the IRS, they cannot revoke your driver’s license, business license, or immigration status. As noted above, scammers will often weave these threats into their stories. Those threats are entirely empty.
What will the IRS do? Generally, the IRS will first mail a notice to any taxpayer who owes taxes. In some instances, IRS collection employees may make an unannounced visit to your home and properly identify themselves with IRS-issued credentials and a federal ID card. In all cases, the revenue officer will only request required payments by cash, check, certified funds, or money order payable to “United States Treasury.”
As for scam calls that pose as financial services companies or tax preparers, ignore them. If you’re planning to work with a tax pro, do your research and work with a legitimate, accredited individual or organization. The IRS has a great resource that can get you started on your search with its “Directory of Federal Tax Return Preparers.” There you can get a list of qualified tax preparers that are verified by the IRS, which you can narrow down based on their accreditations and distance from your zip code.
Don’t fall for AI tax scams! With the rise of AI technology, it’s becoming harder to spot these fraudulent schemes. In the past, fake voices, accents, and grammar mistakes were obvious red flags. But now, scammers are using AI-generated voices that sound just like your neighbors. They’ll pose as the IRS, offering tax assistance or forgiveness. McAfee’s CTO, Steve Grobman warns that cyber-criminals are even cloning American accents to make their scams more convincing. Last month, McAfee detected over a million suspicious URLs related to tax scams. Protect yourself by using antivirus software and call-blocking apps. But be cautious of phishing attempts through texts, emails, and calls. Scammers may threaten you with back taxes or promise unrealistic zero-tax programs. Remember, the IRS never threatens or contacts you through phone, text, or email. They always send official letters by mail. And they never ask for payment in gift cards, Apple Pay, Crypto, Bitcoin, Venmo, or Zelle. Stay alert and keep your personal information and money safe! Watch the video below from Steve, discussing AI voice scams.
One way you can be sure that someone other than the IRS has reached you is if they contact you by text, messaging app, or social media. The IRS will not contact you in any of these ways. Ignore any such messages, and if your app or platform allows you to report messages or accounts as spam, do so. You can often do it with a simple click or tap.
Another increasingly popular scam on phones is the bogus account alert. The scammer may send a message that says Your account is on hold, or something like We’ve detected unusual activity. During most of the year, scammers will use these messages to pose as online payment platforms, banks, credit card companies, online stores, and streaming services.
Now during tax season, they’ll masquerade as IRS agents or popular tax software companies. Even though the names change, the game remains the same. The text or message will serve up a link so you can “correct the situation,” one that leads to a site that could steal your personal information or otherwise trick you into installing malware on your phone.
As always, don’t click these links. Report them if you can.
Phishing emails pull many of the same tricks that calls, texts, and direct messages do—you’ll simply find them in your inbox instead. The same rules for avoiding other IRS scams apply here. First, note that the IRS will never initiate contact with you via email. Nor will they send you emails about your tax refund or any other sensitive information.
In the past, the IRS has reported that phishing emails often send their victims to lookalike IRS sites that can appear quite convincing. There, victims either receive a prompt to enter their personal and financial information or to download a file that’s laden with malware. Other emails may include attachments, which may be loaded with malware as well.
Delete any such emails you receive. And if you have any concerns, contact your tax professional or the IRS directly. Also, the IRS asks people who receive scam emails to notify them at phishing@irs.gov. This helps the IRS track and prosecute scammers.
Imagine filing your return only to find out it’s already been filed.
A far more serious form of tax-related crime is identity theft, where a scammer uses the victim’s personal information and Social Security number to file a return in the victim’s name—and claim the refund. One particularly painful aspect of identity theft and taxes is that victims often find out only after it occurs or when it’s well underway. For example:
Other signs are related to employment, such as getting assigned an Employer Identification Number even though you didn’t request one, discovering that the IRS shows you received income from an employer you didn’t work for, or finding out that someone has claimed unemployment benefits in your name. Once again, both are signs of full-on identity theft where someone has assumed your identity.
The IRS states that you should always respond to any IRS notice, particularly if you believe it is in error. If you’ve already contacted the IRS about an identity theft issue, you can reach them at 800-908-4490 for further assistance.
Understand that if this form of identity theft occurs to you, it’s highly likely that the scammer has your Social Security number. Report that right away at https://www.ssa.gov/number-card/report-stolen-number if you think your number is being used by someone else.
Your Social Security number ranks at the very top of your most valuable personal information. It unlocks everything from driver’s licenses, photo identification, employment, insurance claims, and of course taxes. Act immediately if you think it’s been compromised.
One way to protect yourself from an identity thief from claiming a return in your name is to file yours before they do. As mentioned, many victims of identity theft find out they’ve been scammed when they receive an IRS notification that their tax claim has already been filed. Simply put, file early.
Another way you can help prevent someone from filing a return in your name is to request a six-digit Identity Protection PIN (IP PIN). Once you receive am IP PIN, the IRS will use it to verify your identity when you file by paper or electronically. It’s good for one calendar year, and you can generate a new one each year for your account. You can request an IP PIN at: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.
Also, be aware that scammers want your IP PIN as well. Phone calls, emails, or texts asking for it are scams. Outside of including it when filing your return, the IRS will never ask for it. If you are working with a tax professional, only provide it when it comes time to file.
Keeping tabs on your credit report and knowing if your personal information has been compromised in some way can help prevent tax fraud. Together, they can let you know if someone has stolen your identity or if you have personal info on the dark web that could lead to identity theft.
Our credit monitoring service can keep an eye on changes to your credit score, report, and accounts with timely notifications and guidance so you can take action to tackle identity theft.
Our identity monitoring service checks the dark web for your personal info, including email, government IDs, credit card and bank account info, and more—then provides alerts if your data is found on the dark web, an average of 10 months ahead of similar services.
If you fall victim to identity theft, having identity theft protection in place can provide significant relief, both financially and in terms of recovery. Our identity theft coverage & restoration support includes $1 million in funds if it’s determined that you’re a victim, which covers lawyer’s fees, travel expenses, and stolen funds reimbursement—while licensed recovery experts can help you repair your credit and identity. Considering the potential costs in both time and money, identity theft protection can speed and ease recovery.
How’d that scammer get your phone number or email address anyway? Chances are, they pulled that information off a data broker site. Data brokers buy, collect, and sell detailed personal information, which they compile from several public and private sources, such as local, state, and federal records, plus third parties like supermarket shopper’s cards and mobile apps that share and sell user data. Moreover, they’ll sell it to anyone who pays for it, including people who’ll use that information for scams.
You can help reduce those scam texts and calls by removing your information from those sites. Our Personal Data Cleanup scans some of the riskiest data broker sites and shows you which ones are selling your personal info. We also provide guidance on how you can remove your data from those sites and, with select plans, even manage the removal for you—while continuing to scan those sites in case your information reappears.
Comprehensive online protection software can help you on a number of counts. It warns you of suspicious links in emails and texts that could send you to malicious sites. It can further protect you from ransomware attacks, which IRS has also listed amongst its Dirty Dozen. And you can use it to monitor all your transactions across all your financial accounts in one place, which can spot any questionable activity. In all, tax time or otherwise, online protection software is always a strong security move.
A little stress and uncertainty can enter the picture during tax season, and scammers know it. In fact, they prey upon it. They concoct their scams around those feelings, hoping that you’ll take the bait and act quickly without taking the time to scrutinize what they’re saying and what they’re really asking you to do.
Keeping up to date on what the latest scams are, having a good sense of which ones get recycled every year, and putting protections in place can help you avoid getting stung by a scam during tax season.
For yet more information, visit the IRS Tax Scam and Consumer Alert site at: https://www.irs.gov/newsroom/tax-scams-consumer-alerts
The post How to Protect Yourself Against Tax Scams appeared first on McAfee Blog.
March is Women’s History Month and International Women’s Day, and at McAfee, we partnered with McAfee Women in Cyber Security (WISE) Community to organize opportunities to learn from each other, find inspiration in shared experiences, and forge new connections.
Speaker events throughout the month opened the door for discussions about inclusion and equity. With awareness, we can make a difference. Check out what we’ve been up to.
Team McAfee joined a discussion with McAfee leaders. The conversation focused on the challenges women often face and issues of equity. Panelists shared their personal experiences and learning, and we explored how we can embrace and advance equity in our workplace. We discussed what it means to be truly inclusive and how we can continuously improve — we all have a part to play.
Here are just a few snippets from the panelists on how we can embrace equity:
|
“Embracing equity requires action – be an ally and give everyone at the table a voice.”
- Jennifer Biry, Chief Financial Officer |
|
“We all have a responsibility to identify inequality. Speak up and give everyone a chance to be successful.”
– Vonny Gamot, VP of Sales |
|
“It takes all of us. Be aware of behaviors that prevent voices from being heard and then address it with honestly.”
– Steve Grobman, Chief Technology Officer |
|
“Not treating people equitably impacts people at their core.”
– Tina Muller, VP of Operations and Chief of Staff |
|
“If we are to make dent in equity, it’s up to men and women to clear a path.”
– Jeff Ryan, Chief People Officer |
|
“Our job doesn’t end with opportunities. It extends to providing the right support and tools.”
– Arati Sankhe, Sr Dir, Software Engineering |
Jacqueline Tame, Director of Government Affairs for PsiQuantum and senior advisor to the Chief Digital and AI Officer of the U.S. Department of Defense, joined Team McAfee to round-up the month. Jacqueline shared her personal and professional challenges, how she overcame them, and how they shaped her into the woman and professional she is today.
Binda Bhati, a human and organizational psychologist with over 20 years of experience, led a workshop about unconscious minimizers. She provided amazing insights on how women can identify and redefine their identities, combat imposter syndrome, and be more confident in their abilities.
McAfee continues to celebrate our women and reinforce our company-wide commitment of fostering an inclusive place to work beyond Women’s History Month. We’re proud of our record of supporting women in the workplace — including four years of pay parity — and we’ll continue to do our part to create a culture where everyone feels valued and respected.
The post From Workshops to Leader Panels: A Recap of Women’s History Month at McAfee appeared first on McAfee Blog.
Authored By Anandeshwar Unnikrishnan,Sakshi Jaiswal,Anuradha M
McAfee Labs has recently observed a new Malware campaign which used malicious OneNote documents to entice users to click on an embedded file to download and execute the Qakbot trojan.
OneNote is a Microsoft digital notebook application that can be downloaded for free. It is a note-taking app that allows collaboration across organizations while enabling users to embed files and other artifacts. It is installed by default in Microsoft Office 2021 and Microsoft 365.
Malicious Actors are always trying to find new ways in to infect their victims. Such as their shift to LNK files after Microsoft introduced a policy change disabled office macros by default. Due to a feature that allows users to attach files to OneNote documents it makes them a good alternative to LNK files as distribution vehicle to deploy their malware. This blog contains analysis on how OneNote documents are used malicious and two specific campaigns that made use of OneNote documents to download and execute the Qakbot malware.
Figure 1 shows the geo wise distribution of McAfee customers detecting malicious OneNote files.
Based on the telemetry from our endpoints we have identified the following threat families deployed through OneNote documents:
A holistic view of the phishing campaigns that weaponize OneNote document is shown in Figure 2 below. The malicious document is delivered in either zip files or ISO images to the target through phishing emails. We have observed that most of the malicious documents either have Windows batch script that invokes Powershell for dropping the malware on the system or Visual Basic scripts that does the same.
The generic theme of the email is invoice or legal related. These types of themes are more likely to be opened by the vicim. An example email body and attachment is shown in Figure 3 and 4.
To understand how the data is laid out in the file, we need to examine it at byte level. Taking a close look at OneNote document gives us an interesting observation as its magic bytes for the header is not a trivial one. Figure 5 shows the first 16 bytes of the document binary.
The first 16 bytes need to be interpreted as GUID value {7B5C52E4-D88C-4DA7-AEB1-5378D02996D3}. We can use the official documentation for OneNote specification to make sense of all the bytes and its structuring. Figure 6 shows header information taken from the OneNote specification document.
The Data Stream in OneNote, Say Hello To FileDataStoreObject
To find the embedded data in a OneNote document, we need to learn more about the FileDataStoreObject which has a GUID value of {BDE316E7-2665-4511-A4C4-8D4D0B7A9EAC}. The structure that holds the data is shown below:
The FileData member of the FileDataStoreObject is the key member that holds the embedded data in the OneNote document. The size can be retrieved from the cbLength member.
Figure 7 shows the “on disk” representation of the FileDataStoreObject This is taken from a malicious OneNote document used to spread the Qakbot payload. The guidHeader for the data object is highlighted in yellow and the data is shown in red. As it is evident from the image the data represents a text file which is a script to launch PowerShell.
For more information on the OneNote specification, go to reference section
Now we have an idea of what the data object is, with this knowledge we can automate the process of extracting embedded artifacts for further analysis from the OneNote document by following the below algorithm.
Looking at the runtime characteristics of OneNote Desktop application we have observed that when an embedded file gets executed by the user, it is stored temporarily in the OneNote directory in the User’s Temp location. Each directory with GUID values represents a different document opened in the OneNote application.
By analyzing numerous malicious documents, we have been able to create a “test” OneNote document that executes a batch file that contains the “whoami” command. The image in Figure 9 show the batch file being created in the user’s temp location.
This section contains specific details on a Qakbot campaign. In campaign 1, the malware author used phishing emails to deliver malicious OneNote document either as attachment or a URL link to zip file containing the OneNote document. The OneNote contained aHTA file that once executed would make use of the curl utility to download Qakbot and then execute it.
The OneNote file with the embedded HTA file is shown in the Figure 11. Once this OneNote file is opened, it prompts the user with a fake message to double-click on open to view the attachment.
Upon clicking the Open button, it drops the HTA file with the name Open.hta to the %temp% Folder and executes it using mshta.exe.
The HTA file contains obfuscated script as shown below:
The HTA file is loaded by MSHTA and creates a registry key in HKEY_CURRENT_USER\SOFTWARE\ with obfuscated content as shown below:
De-obfuscated content from the HTA file is shown below:
Figure 18 shows the process tree of Qakbot:
| Type | Value | Product | Detected |
| Campain 1 – OneNote File | 88c24db6c7513f47496d2e4b81331af60a70cf8fb491540424d2a0be0b62f5ea | Total Protection and LiveSafe | VBS/Qakbot.a |
| Campain 1 – HTA File | e85f2b92c0c2de054af2147505320e0ce955f08a2ff411a34dce69c28b11b4e4 | Total Protection and LiveSafe | VBS/Qakbot.b |
| Campain 1 – DLL File | 15789B9b6f09ab7a498eebbe7c63b21a6a64356c20b7921e11e01cd7b1b495e3 | Total Protection and LiveSafe | Qakbot-FMZ |
The OneNote document for campaign 2 is shown in Figure 19. At first glance it it appears that there is a ‘Open’ button embedded within the document. The message above the ‘Open’ button instructs the user to “double click” in order to receive the attachment.
A closer look at the document reveals the graphical elements are all images placed in a layered style by the malicious actor. By moving the icons aside, we can see the malicious batch file which when executed downloads the payload from the Internet and executes on the target system.
Execution Of Payload Dropper
Upon execution of the batch file, Powershell will be invoked and it fetch the Qakbot payload from Internet and execute it on the target system. This section will cover details of dropper script used to deploy QakBot. The Figure 21 Show the process tree after the execution of the script and you can see that powershell.exe was launched by cmd.exe and the parent of cmd.exe is onenote.exe.
The contents of process cmd.exe (7176) are shown below.
The base64 decoded batch file is shown in Figure 23. This will use powershell to download the payload and then execute it with rundll32.exe
| Type | Value | Product | Detected |
| Campain 2 – Zip File |
000fb3799a741d80156c512c792ce09b9c4fbd8db108d63f3fdb0194c122e2a1
|
Total Protection and LiveSafe | VBS/Qakbot.a |
| Campain 2 – OneNote File | 2bbfc13c80c7c6e77478ec38d499447288adc78a2e4b3f8da6223db9e3ac2d75 | Total Protection and LiveSafe | One/Downloader.a |
| Campain 2 – Powershell File | b4dd3e93356329c076c0d2cd5ac30a806daf46006bdb81199355952e9d949424 | Total Protection and LiveSafe | PS/Agent.gs |
| Campain 2 – OneNoteFile | a870d31caea7f6925f41b581b98c35b162738034d5d86c0c27c5a8d78404e860 | Total Protection and LiveSafe | VBS/Qakbot.a |
starcomputadoras.com
Malware authors are getting more sophisticated when it comes to hiding their payloads. This Blog highlights the recent Qakbot campaign that delivers its payload which uses the OneNote application as a delivery mechanism. McAfee Customers should keep their systems up-to-date and refrain from clicking links and opening attachments in suspicious emails to stay protected.
The post The Rising Trend of OneNote Documents for Malware delivery appeared first on McAfee Blog.
Social media platforms often get a hard time by us parents. But a recent announcement by TikTok of industry first screen time limits might just be enough to win you over. On March 1, the social media platform announced that it will automatically impose a 60-minute daily screen time limit to every account belonging to a user that is under the age of 18. How good??
I hear what you’re thinking – maybe we can cross TikTok off our list of social media platforms that we need to get our head around? But no, my friends – not so fast! Tik Tok’s new screen time limits are all about parental involvement – which is why I am a fan! So, buckle-up because if you have an under 18 on TikTok (and you’re committed to their digital well-being) then my prediction is that you’ll soon know more about this social media platform than you even thought was possible!
Over the coming weeks, every account that belongs to an under 18-year-old will automatically be set to a 60-minute daily screen time limit. Once they’ve clocked up an hour of scrolling, teens will be asked to enter a passcode, which TikTok will supply, to keep using the platform. TikTok refers to this as an ‘active decision’.
So, clearly this isn’t quite the silver bullet to all your screen time worries as teens can choose to opt out of the 60-minute limits. But if they do choose to opt out and then spend more than 100 minutes a day on the platform, they will be prompted to set a daily screen time limit. ‘Will that actually do anything?’ – I hear you say. Well, in the first month of testing this approach, TikTok found that this strategy resulted in a 234% increase in the use of its screen time management tools – a move in the right direction!
But here’s the part I love the most: TikTok offers Family Pairing which allows you to link your child’s account to yours. And as soon as you enable Family Pairing, your teen is no longer in control of their own screen time.
Now, don’t get me wrong – I am not a fan of the authoritarian approach when it comes to all things tech. I do prefer a consultative ‘let’s work together’ vibe. However, TikTok’s move to involve parents in making decisions about their child’s screen time means that families will need to talk digital wellbeing more than ever before and here’s why…
Within the Family Pairings settings, parents are able to set screen time limits based on the day of the week which means homework and holidays can be worked around. There is also a dashboard that shows your child’s screen time usage, the number of times the app was opened plus a breakdown of time spent during the day and night. Now, with all this control and information, you’ll be in quite the powerful position so be prepared to be sold hard by your teen on many the benefits of TikTok!
For years I have been a fan of creating a Family Digital Contract which means you get to outline your family’s expectations around technology use. Now the agreement can include time spent online, the sites that can be visited and even the behaviour you expect of your child when they are online. So, if your kids are avid TikTok users then I highly recommend you do this ASAP. Check out the Family Safety Agreement from the Family Online Safety Institute as a starting point but I always recommend tailoring it to suit the needs of your own tribe.
But let’s keep it real – your kids are not always going to comply, remember how you pushed the boundaries when you were young?? And that’s OK if they understand why their actions weren’t ideal and you have a suitable level of confidence that they will get back on track. However, if you have concerns that they need an additional level of structure to ensure their digital wellbeing remains intact then that’s when TikTok’s Family Pairing can work a treat!
It’s no secret that social media can be incredibly captivating, possibly even addicting, for so many. And it’s not just TikTok – Instagram, Facebook even Twitter has all been designed to give us regular hits of dopamine with each scroll, like and post. And while I know that parental controls are only one part of the solution, they can be very handy if you need to bring your tween’s usage under control.
But when all is said and done, please remember that the strength of your relationship with your child is the best way of keeping them safe online and their wellbeing intact. If your kids know that they can come to you about any issue at all – and that you will always have their back – then you’re winning!!
So, be interested in their life – both online and offline – ask questions – who do they hang with? How do they spend their time? And remember to share your online experience with them too – get yourself a little ‘tech’ cred – because I promise they will be more likely to come to you when there is a problem.
‘Till next time – keep talking!!
Alex
The post What Parents Need To Know About TikTok’s New Screen Time Limits appeared first on McAfee Blog.
When I started my job as Cybermum – over 10 years ago – it was quite common to strategise ways to prevent your private information appearing online. But those days have long gone. Unless you have been living off the grid and opted out of life completely, having an online presence is now essential. Whether you’re paying bills, booking appointments or renewing your insurance premiums, many companies have made it almost impossible to conduct your business in person, forcing even the most reluctant of us online.
Now, many of us consider ourselves to be proactive in managing just what we share online by using VPNs, not always setting up accounts with online stores and ensuring our social media privacy settings are nice and tight. But unfortunately, managing your privacy online is more complicated than that. In fact, most of us maybe sharing our private information online every day without even knowing. So, in the spirit of keeping you safe – here are three different areas that I suggest you focus on to ensure you know exactly where you are sharing your private information
Every time you visit an online site, send an email, search for information or basically do anything online, multiple parties collect this information. Your Internet Service Provider (ISP), Wi-Fi network administrator, operating system e.g. Windows or iOS, search engine plus the websites and apps you use will all keep a record of what’s you’re up to – even if you are in Incognito Mode!
This information is often gathered using cookies – small files that are placed on your device by the website that you visit. These are created whenever you visit a website, and they contain data about your visit. Some websites are required by law to advise you if and when they use cookies but if you choose to reject cookies, your browsing experience can become really clunky.
What each of these parties does with your private information varies. Your ISP, for example, can easily put together a pretty accurate profile based on your searching, location and downloads and link this to your IP (unique) address. This data can be held for years – subject to your country’s laws and could potentially be used for surveillance, policing and even advertising.
Now I appreciate that my ISP is required to collect information for the greater good but I am far less comfortable when search engines, websites and apps collect my private data. Since the Cambridge Analytica Scandal of 2018, the industry has definitely had a shake-up however this can still be a risky business.
You know those annoying pop-up adds that just randomly appear on your devices? Well – that’s adware, software that is designed to generate revenue through advertisements. Many of us download it without knowing – you may have downloaded a free program or app without realising it contained bonus adware software. Alternatively, hackers can insert it into your system by exploiting a vulnerability in your software – that’s why you need to keep all your software updated!
And while those pop-ups can be super irritating what you really need to worry about is that adware can compromise your online privacy. Adware is designed to track your search and browsing history so it can display ads that are most relevant to you. And once the adware developer has your location and browser history, they are likely to sell this info to a third party, making themselves a nice, tidy profit – all without you even knowing!!
When I first discovered autofill, I was hooked! No need to tediously enter your name, address, telephone number- even credit card – every time you need it! How good?? But I have since learnt that having autofill enabled on your computer means your personal information is at risk of being hacked. Cybercrims have mastered the art of capturing our credentials by tricking browsers to share our personal details and here’s how: unsuspecting people are lured to a compromised website that has an invisible form. Autofill identifies that there is a form on the site and then gives up your private information allowing the hacker to collect your credentials.
Not sure whether it’s worth the effort? Well, let me make it simple – if you want to lock down your online identity to ensure your financial health and reputation aren’t compromised then you need to do something very soon! Imagine losing your hard-earned savings or having your Instagram account hacked and your reputation compromised? Not fun at all – so it’s time to take action, my friends.
Stay Safe
Alex
The post How You May be Sharing Private Information Online Without Even Knowing appeared first on McAfee Blog.
As people get into their 70s, they stand to lose more to fraud than any other age group—which makes a strong case for protecting the older people in our lives.
If you’re looking to protect them online, you have several ways to go about it. Our new McAfee+ Family plans are one way, where two adults and four children get personalized online protection that they can set up and manage on their own. With your McAfee+ Family plan a simple invitation, you can rest easy that they’re protected against online scams and other threats.
And threats certainly face us all, and hit older adults hardest.
In the following table courtesy of the U.S. Federal Trade Commission (FTC), you can see the risks that adults faced in 2022. While younger victims reported fraud loss at a higher rate, their median losses were typically smaller than the losses of older adults. By the time victims reach their 70s and 80s, the reporting rate dropped, yet the median losses made a significant leap.
Note that these are reported cases of fraud, and those reported to the FTC. In other words, this represents just a slice of the fraud that occurred in 2022.
Moreover, as we’ve shared before in articles about elder scams, older adults may be less willing or able to report a scam. The reasons vary. They may not know how they were scammed or they may feel shamed by being scammed—all of which can lead to underreporting. Moreover, not every scam report includes an age range, which leads to further underreporting.
Yet the case is clear. Scams pose a significant threat to older adults.
Looking further into the FTC data, older adults in the U.S. lost more than $1.6 billion to scams in 2022 across four primary categories:
So many scams fail to pass the sniff test. The moment you scrutinize the incredible offer plastered on that ad or question why a so-called tax collector would hound you on social media, something immediately smells fishy. Yet people don’t always catch that whiff. People of all ages. Not just the elders in our lives.
One way we can help everyone stay safer online is through conversation. The knowledge that comes from a good, ongoing conversation about life online provides them with one pillar of protection. Talking about how they spend their time online and the types of scams that are out there arms them with the savvy they need to spot a scam. That will help them take that crucial moment when faced with a possible scam, a crucial moment to consider if that ad, email, or direct message is indeed bogus.
The second pillar comes from comprehensive online protection. Today’s protection goes far beyond antivirus. It protects devices the privacy and the identity of the people using them. In the case of our McAfee+ Family plans, they protect up to six people from viruses, credit card fraud, and identity theft with tailored guidance as they do what they do online. With an elder on your family plan, you can see which devices they’ve installed protection on, so you’ll know they’re protected.
More specific to some of the scams we talked about, it can help block older adults from accessing messages. Further, it can help prevent scam calls and texts in the first place. Personal Data Cleanup spots and removes their personal info from risky data broker sites that spammers use to find victims. And if their personal information has been compromised, our identity monitoring alerts them if their data is found on the dark web, an average of 10 months ahead of similar services—and get expert guidance about what to do next. Our identity theft protection and recovery service identity and credit if the unexpected happens to them.
Adding a parent to your family plan.
Adding someone to your McAfee+ Family plan is practically as simple as typing in an email address.
Think of it as sending an invitation, one where everyone gets their own personalized protection with their own unique login. This way, each member of the family can set up and manage their own protection for their identity, privacy, computers, and phones.
With this invitation, they’ll see that it comes from you and that all they need to do to start their protection is to click the link—no extra charges or fees. They’re simply part of your plan now.
From there, they can download their protection, set up their devices, and consult their McAfee Protection Score to see how secure they are. Then simple instructions make it easy to set up and fix gaps to improve their online security so that they’re safer still.
In all, it’s a highly straightforward process, for you and members of your family.
Spending any time online calls for online protection, no matter what age you are. While threats may look different across different age groups, every family member faces them. Another thing everyone has in common is that every family member can protect themselves from threats, far more thoroughly now than before. Comprehensive online protection has evolved far beyond antivirus. It protects the person, which is important because that’s who scammers target. They target people, so they can invade their privacy, steal their personal information, or simply rip them off.
Put plainly, knowing what today’s scams look like and using comprehensive online protection offer a one-two punch in the defense against online scams. You have several options to get it for the older adults in your life, our new McAfee+ Family plans being one of them. Whichever route you take, putting your family’s protection plan in place will absolutely reduce the chances of someone you love getting stung by a scam.
The post Protecting Your Parents from Scams with Our New Family Plans appeared first on McAfee Blog.
Who else loves tax season besides accountants? Scammers.
It’s high time of year for online risks here in the U.S. with the onset of tax season, where scammers unleash all manner of scams aimed at taxpayers. The complexity, and even uncertainty, of filing a proper tax return can stir up anxieties like, Have I filed correctly, Did I claim the right deductions, Will I get audited, and Will I get stung with a tax penalty are just a few—and these are the very same anxieties that criminals use as the cornerstone of their attacks.
Yet like so many scams, tax scams give off telltale signs that they’re indeed not on the up-and-up. You have ways you can spot one before you get caught up in one.
In all, we’ve learned to watch our step with the Internal Revenue Service (IRS), so much so that receiving a notification from the IRS can feel like an unwanted surprise. Uh oh, did I do something wrong? However, in reality, less than 2% of returns get audited and most discrepancies or adjustments can get handled easily if addressed promptly.
Still, that wariness of the IRS makes for ripe pickings when it comes to hackers, who prey on people’s fear of audits and penalties. Common scams include email phishing attacks, phone calls from crooks posing as IRS agents, texts claiming there’s a problem with our tax software, and even robocalls that threaten jail time for unpaid back taxes. What’s more, fraudsters can take things a step further by committing identity theft and then filing tax claims in other people’s names.
With that, let’s dig into a list of the top scams wind up on our screens and phones during tax time.
Straight from the authority itself, the IRS publishes its Dirty Dozen, an annual list of the top tax season scams. Year-over-year, many of the same scams make the list, yet new ones continue to crop up as scammers try to take advantage of current events. A couple recent examples include email phishing scams centered around Employee Retention Credits, pandemic relief checks, and federal stimulus checks. Additionally, the IRS has warned filers about disinformation that circulates on social media, such as bogus advice that urges filers to alter their W-2 figures for a better refund. With new scams entering the mix every tax season, the Dirty Dozen offers plenty of good advice that can help you steer clear of scams.
We all know the annoyance of spammy phone calls, whether they’re for phony car warranties, tech support services, or debt collection agencies. During this time of year, you can add phony IRS agents and financial service providers to the list.
The stories that scammers will tell will vary, but they often share common themes:
Another thing they have in common: they each outright ask for money, personal information, and sometimes a combination of both. All of which is an indication of a scam.
For the record, per the IRS, it does not:
Also per the IRS, they cannot revoke your driver’s license, business licenses, or immigration status. As noted above, scammers will often weave these threats into their stories. Those threats are entirely empty.
What will the IRS do? Generally, the IRS will first mail a notice to any taxpayer who owes taxes. In some instances, IRS collection employees may make an unannounced visit to your home and properly identify themselves with IRS-issued credentials and an federal ID card. In all cases, the revenue officer will only request required payments by cash, check, certified funds, or money order payable to “United States Treasury.”
As for scam calls that pose as financial services companies or tax preparers, ignore them. If you’re planning to work with a tax pro, do your research and work with a legitimate, accredited individual or organization. The IRS has a great resource that can get you started on your search with its “Directory of Federal Tax Return Preparers.” There you can get a list of qualified tax preparers that are verified by the IRS, which you can narrow down based on their accreditations and distance from your zip code.
One way you can be sure that someone other than the IRS has reached you is if they contact you by text, messaging app, or social media. The IRS will not contact you in any of these ways. Ignore any such messages, and if your app or platform allows you to report messages or accounts as spam, do so. You can often do it with a simple click or tap.
Another increasingly popular scam on phones is the bogus account alert. The scammer may send a message that says Your account is on hold, or something like We’ve detected unusual activity. During most of the year, scammers will use these messages to pose as online payment platforms, banks, credit card companies, online stores, and streaming services.
Now during tax season, they’ll masquerade as IRS agents or popular tax software companies. Even though the names change, the game remains the same. The text or message will serve up a link so you can “correct the situation,” one that leads to a site that could steal your personal information or otherwise trick you into installing malware on your phone.
As always, don’t click these links. Report them if you can.
Phishing emails pull many of the same tricks that calls, texts, and direct messages do—you’ll simply find them in your inbox instead. The same rules for avoiding other IRS scams apply here. First, note that the IRS will never initiate contact with you via email. Nor will they send you emails about your tax refund or any other sensitive information.
In the past, the IRS has reported that phishing emails often send their victims to lookalike IRS sites that can appear quite convincing. There, victims either receive a prompt to enter their personal and financial information or to download a file that’s laden with malware. Other emails may include attachments, which may be loaded with malware as well.
Delete any such emails you receive. And if you have any concerns, contact your tax professional or the IRS directly. Also, the IRS asks people who receive scam emails to notify them at phishing@irs.gov. This helps the IRS track and prosecute scammers.
Imagine filing your return only to find out it’s already been filed.
A far more serious form of tax-related crime is identity theft, where a scammer uses the victim’s personal information and Social Security number to file a return in the victim’s name—and claim the refund. One particularly painful aspect of identity theft and taxes is that victims often find out only after it occurs or when it’s well underway. For example:
Other signs are related to employment, such as getting assigned an Employer Identification Number even though you didn’t request one, discovering that the IRS shows you received income from an employer you didn’t work for, or finding out that someone has claimed unemployment benefits in your name. Once again, both are signs of full-on identity theft where someone has assumed your identity.
The IRS states that you should always respond to any IRS notice, particularly if you believe it is in error. If you’ve already contacted the IRS about an identity theft issue, you can reach them at 800-908-4490 for further assistance.
Understand that if this form of identity theft occurs to you, it’s highly likely that the scammer has your Social Security number. Report that right away at https://www.ssa.gov/number-card/report-stolen-number if you think your number is being used by someone else.
Your Social Security number ranks at the very top of your most valuable personal information. It unlocks everything from driver’s licenses, photo identification, employment, insurance claims, and of course taxes. Act immediately if you think it’s been compromised.
One way to protect yourself from an identity thief from claiming a return in your name is to file yours before they do. As mentioned, many victims of identity theft find out they’ve been scammed when they receive an IRS notification that their tax claim has already been filed. Simply put, file early.
Another way you can help prevent someone from filing a return in your name is to request a six-digit Identity Protection PIN (IP PIN). Once you receive am IP PIN, the IRS will use it to verify your identity when you file by paper or electronically. It’s good for one calendar year, and you can generate a new one each year for your account. You can request an IP PIN at: https://www.irs.gov/identity-theft-fraud-scams/get-an-identity-protection-pin.
Also be aware that scammers want your IP PIN as well. Phone calls, emails, or texts asking for it are scams. Outside of including it when filing your return, the IRS will never ask for it. If you are working with a tax professional, only provide it when it comes time to file.
Keeping tabs on your credit report and knowing if your personal information has been compromised in some way can help prevent tax fraud. Together, they can let you know if someone has stolen your identity or if you have personal info on the dark web that could lead to identity theft.
Our credit monitoring service can keep an eye on changes to your credit score, report, and accounts with timely notifications and guidance so you can take action to tackle identity theft.
Our identity monitoring service checks the dark web for your personal info, including email, government IDs, credit card and bank account info, and more—then provides alerts if your data is found on the dark web, an average of 10 months ahead of similar services.
If you fall victim to identity theft, having identity theft protection in place can provide significant relief, both financially and in terms of recovery. Our identity theft coverage & restoration support includes $1 million in funds if it’s determined that you’re a victim, which covers lawyer’s fees, travel expenses, and stolen funds reimbursement—while licensed recovery experts can help you repair your credit and identity. Considering the potential costs in both time and money, identity theft protection can speed and ease recovery.
How’d that scammer get your phone number or email address anyway? Chances are, they pulled that information off a data broker site. Data brokers buy, collect, and sell detailed personal information, which they compile from several public and private sources, such as local, state, and federal records, plus third parties like supermarket shopper’s cards and mobile apps that share and sell user data. Moreover, they’ll sell it to anyone who pays for it, including people who’ll use that information for scams.
You can help reduce those scam texts and calls by removing your information from those sites. Our Personal Data Cleanup scans some of the riskiest data broker sites and shows you which ones are selling your personal info. We also provide guidance on how you can remove your data from those sites and, with select plans, even manage the removal for you—while continuing to scan those sites in case your information reappears.
Comprehensive online protection software can help you on a number of counts. It warns you of suspicious links in emails and texts that could send you to malicious sites. It can further protect you from ransomware attacks, which IRS has also listed among its Dirty Dozen. And you can use it to monitor all your transactions across all your financial accounts in one place, which can spot any questionable activity. In all, tax time or otherwise, online protection software is always a strong security move.
A little stress and uncertainty can enter the picture during tax season, and scammers know it. In fact, they prey upon it. They concoct their scams around those feelings, hoping that you’ll take the bait and act quickly without taking the time to scrutinize what they’re saying and what they’re really asking you to do.
Keeping up to date on what the latest scams are, having a good sense of which ones get recycled every year, and putting protections in place can help you avoid getting stung by a scam at tax season.
For yet more information, visit the IRS Tax Scam and Consumer Alert site at: https://www.irs.gov/newsroom/tax-scams-consumer-alerts
The post How to Stay Safe When Paying Your Taxes to the IRS appeared first on McAfee Blog.
So, can Android phones get viruses and malware? The answer is yes, and likewise you can do several things to spot and remove them from your phone.
A couple things make Android phones attractive to cyber criminals and scammers. First, they make up about half of all smartphones in the U.S. and roughly 71% worldwide. Second, while its operating system gives users the flexibility to install apps from multiple apps markets, it also makes the operating system more vulnerable to tampering by bad actors. Also, Android has a more fragmented ecosystem with multiple device manufacturers and different versions of the operating system. As a result, each may have different security updates, and consistency will vary depending on the carrier or manufacturer, which can make Android phones more vulnerable to threats.
So, just like computers and laptops, Android phones are susceptible to attack. And when you consider how much of our lives we keep on our phones, the importance of protecting them can’t be overstated. Steps truly are called for. With a look at how viruses and malware end up on Androids, you’ll see that you have several ways of keeping you and your phone safe.
When it comes to viruses and malware on Android phones, malicious apps are often to blame. They’ll disguise themselves in many ways, such as utility apps, wallpaper apps, games, photo editors, and so on. Once installed, they’ll unleash their payload, which can take several forms:
Google Play does its part to keep its virtual shelves free of malware-laden apps with a thorough submission process as reported by Google and through its App Defense Alliance that shares intelligence across a network of partners, of which we’re a proud member. Further, users also have the option of running Play Protect to check apps for safety before they’re downloaded.
Yet, bad actors find ways to sneak malware into the store. Sometimes they upload an app that’s initially clean and then push the malware to users as part of an update. Other times, they’ll embed the malicious code so that it only triggers once it’s run in certain countries. They will also encrypt malicious code in the app that they submit, which can make it difficult for reviewers to sniff out.
Beyond Google Play, Android allows users to download apps from third-party app stores, which may or may not have a thorough app submission process in place. Moreover, some third-party app stores are actually fronts for organized cybercrime gangs, built specifically to distribute malware.
You might spot the signs rather quickly. Sometimes, you might not. Some malware can make your phone run poorly, which may indicate a technical issue, yet it can also be a symptom of a hacked phone. Others work quietly in the background without you knowing it. Either way, both cases provide good reasons to run regular scans on your phone.
Let’s look at some possible signs:
Malware has a way of taking up resources and eating up battery life as it furiously does its work in the background. For example, adware or clicker malware can hijack your phone and tap the central processing unit to run the complex calculations needed to mine cryptocurrencies like bitcoin, thus putting high stress on your device. In a way, it’s like having a second person using your phone at the same time as you are. This can make your phone hot to the touch, like it’s been sitting in the sun, because the stress malware puts on your phone could cause it to overheat.
Adware is annoying as it sounds, and potentially even more malicious in nature. If popup ads suddenly pepper your phone, it may be malware that distributes ads without your consent, which can generate revenue for rogue developers (they can get paid per view and per click). Worse yet, adware can also collect personal information and browsing history from your phone, which bad actors can then sell—a major invasion of your privacy.
A potential telltale sign that your phone has been compromised is the appearance of new apps that you didn’t download, along with spikes in data usage that you can’t account for. Likewise, if you see calls in your phone’s history that you didn’t make, that’s a warning as well.
Like an overdraft statement or seeing a suspicious charge your bank statement, this is a possible sign of malware installed on your device and is using it to perform subscriptions scam or premium SMS messages to unsolicited services.
Broadly, you can take two big steps toward keeping you and your phone safer from attack. The first is to keep a critical eye open as you use your phone. Malware authors rely on us to trust what we see a little too quickly, such as when it comes time to download that new app or tap on a link in a phishing email that looks legitimate, yet most certainly isn’t upon closer inspection. Slow down and scrutinize what you see. If something seems fishy, don’t tap or interact with it.
The second big step is to use online protection software on your Android phone. In addition to providing strong antivirus protection and removal, it has further features that protect you against identity theft, online scams, and other mobile threats—including credit card and bank fraud, malicious texts, sketchy links, and bogus QR codes.
With that, here are a few more steps you can take:
Scammers have put Android phones in their crosshairs. And for some time now. While phishing emails and smishing texts with sketchy links persists as avenues of attack, a popular form of attack comes by way of malicious app downloads. One reason why is that malicious apps disguise themselves so well, as a utility or game you really want on your phone. You’re more apt to tap “Install” when you’re actively shopping for an app than to tap on a link in an unsolicited email or text.
Yet as with so many of today’s online attacks, a combination of good sense and strong online protection software can prevent viruses and malware from ending up on your phone. Slowing down and putting preventative measures in place goes a long way toward keeping what’s arguably your most important device far more secure.
The post How to Remove Viruses from Your Android Phone appeared first on McAfee Blog.
“I bought a Mac, because it’s safer than a PC.”
“I always surf the web with my iPhone, because I know it can’t get infected.”
“I got a virus on my first PC, so now I only use Apple products.”
Sound familiar?
Too often, the rhetoric around the Mac vs. PC debate focuses on Apple’s presumed invincibility to cybercrime. Many people believe (a belief that is bolstered by Apple’s marketing of “security by design”) that unlike Windows devices, Apple products are immune to cyber threats.
This logic is deeply flawed. Apple products can and do get hacked. People who believe their devices are unhackable are most at risk of falling to a cybercriminal. A false sense of security could blind people to the threats out there.
In this article, we’ll explore the myth of Apple’s immunity to viruses and outline a few recent threats Mac users should be on the lookout for.
The relative global unpopularity of Apple devices is likely a large contributor to the myth that they’re virus-proof. Worldwide, Android is far and away the most popular operating system. Seventy-two percent of global mobile devices run off Android. Apple iOS is in a far-away second place at 27%.1
Cybercriminals are busy people just like the rest of us and want to get the most reach for their nefarious efforts. That’s why they design most viruses to attack Android systems: Because there are more possible targets to infect and propagate their illegal bugs.
While Apple’s security systems are certainly robust, security is also a priority for every other mobile device and computing system out there. On your cellphone, tablet, or laptop, does it seem like you’re always getting alerts to update the software? In many cases, software updates are made in response to stop newly discovered threats that have or could possibly sneak through gaps in their current security protocols. No technology company wants to leave its users vulnerable to cybercriminals nor do leaders want their company in headlines for the wrong reasons. As long as you keep your devices up to date and follow a few digital safety best practices, you should be protected against many threats regardless of whether you have an Apple or Android operating system.
To further illustrate that Mac users should be just as careful online as everyone else, here are a few viruses that’ve broken through Apple’s excellent security lately.
Every villain necessitates a hero, and these recent Apple viruses underscore the importance of threat research and responsible vulnerability disclosure. Vulnerability disclosure refers to a company’s obligation to tell the public about their security flaws.
Cybercriminals are getting faster and smarter every day. The collective power of a global community of researchers collaborating to identify and disclose critical vulnerabilities is an important step in eliminating these types of malicious campaigns. Equally as important is dissecting attacks in their aftermath to expose unique and interesting characteristics and empowering defenders and developers to mitigate these threats in the future.
The common theme among these Apple viruses is that people let their guard down and visited risky sites that were best left alone. Make sure to stick to safe downloading practices and avoid “free” versions of TV shows, movies, video games, and expensive software. While you don’t have to pull out your wallet, you may have to pay for these “free” downloads by replacing infected devices or restoring your compromised online security.
To protect all your devices (including your Apple products) from viruses, consider investing in McAfee+ Ultimate. McAfee+ Ultimate includes antivirus for all your devices, unlimited VPN, and web protection to alert you to risky sites. Plus, if you’re ever unsure of the safety of your identity or your online privacy, McAfee lets you scan and remove your information from the dark web. Finally, the top-notch monitoring services allow you to go about your digital life confidently.
1Statcounter, “Mobile Operating System Market Share Worldwide”
2Bleeping Computer, “Pirated Final Cut Pro infects your Mac with cryptomining malware”
3MacPaw, “How to protect your Mac against oRAT malware”
The post Can Your Apple Devices Get Hacked? appeared first on McAfee Blog.
By 2030, experts predict that there will be 5 billion devices connected to 5G.1 For the general population, this connectedness means better access to information, communication with far-flung loved ones, greater convenience in everyday tasks … and more hours devoted to everyone’s favorite pastime: scrolling through funny online videos.
For cybercriminals, this vast mobile population fills their pool of targets with billions. And criminals are getting better at hiding their schemes, making threats to mobile devices seem nearly invisible.
When undetected, cybercriminals can help themselves to your personal information or take over your expensive mobile device for their own gains. The best way to combat criminals and protect your mobile device is to know their tricks and adopt excellent online habits to foil their nefarious plots.
Here are the tips you need to uncover these four hard-to-spot mobile threats.
Spyware’s main ability is right in the name: it spies on you. Spyware is a type of malware that lurks in the shadows of your trusted device, collecting information about your browsing habits, personally identifiable information (PII), and more. Some types, called key loggers, can keep track of what you type. The software then sends the details and movements it collects about you to the spying criminal. They can then use this information to steal your passwords and waltz into your online accounts or steal your identity.
Malicious downloads are often the origin of spyware getting onto your mobile device. The spyware hides within “free” TV show, movie, or video game online downloads; however, instead of getting the latest episode you’ve been dying to watch, your device gets spyware instead.
Have you visited risky sites recently? Is your device running slowly, overheating, or suddenly experiencing a shorter-than-usual battery life? One or all of these signs could indicate that your device is working overtime running the spyware and trying to keep up with your everyday use.
Safe downloading habits will go a long way in protecting you from spyware. While streaming from free sites is less expensive than paying a monthly membership to a legitimate streaming service, you may have to pay more in the long run to reverse the damage caused by unknowingly downloading spyware. If you’re unsure if the sites you visit are safe, a safe browsing tool like McAfee WebAdvisor will alert you to untrustworthy sites.
Malicious apps are applications that masquerade as legitimate mobile apps but are actually a vessel to download malware onto your mobile device. For example, when Squid Game was all the rage in 2021, 200 apps related to the show popped up on the Google Play store. One of these themed apps claiming to be a wallpaper contained malware.
Similar to spyware, a device infected with malware will overheat, load pages slowly despite a solid Wi-Fi connection, and have a short battery life. Also, you may notice that texts are missing or that your contacts are receiving messages from you that you never sent. Finally, your online accounts may have suspicious activity, such as purchases or money transfers you didn’t authorize.
Avoiding malicious apps requires that you do a bit of research before downloading. Even if you’re using an authorized app store, like Google Play or the Apple Store, apps with hidden malware can pass the vetting process. One way to determine if an app is risky is to look at the quality of its reviews and its number of star ratings. Approach an app with less than 100 ratings with caution. Also, read a few of the reviews. Are they vague? Are they written poorly? Cybercriminals may pad their apps with fake reviews, but they’re unlikely to spend too much time writing well-composed comments. Finally, do a background check on the app’s developer listed in the app description. If they have a criminal reputation, a quick search will likely alert you to it.
Perusing the reviews isn’t a guaranteed way to sniff out a malicious app. In 2020, McAfee discovered that one bad app had more than 7,000 reviews. To help prevent malware from taking hold of your device, consider investing in antivirus software. Antivirus software isn’t just for your desktop. Mobile devices benefit from it, too! McAfee antivirus is compatible with any operating system and offers 24/7 real-time threat protection.
A botnet is a vast collection of malware-infected devices controlled by a cybercriminal. The criminal uses their network of bots to proliferate spam or crash servers.
Malware is a broad term that encompasses dozens of specific strains of malicious software, several of which are capable of recruiting your mobile device to a cybercriminal’s army of bots. Without your knowledge, the criminal can force your phone to message your contact list or divert your device’s computing power to overload a server in a cyberattack.
All the telltale signs of malware are applicable here if your phone is part of a botnet. A botnet commander grants themselves the highest admin access to any device they take over. That means you may also see new apps on your home screen that you never downloaded or messages sent by text, email, or social media direct message that you never wrote.
Criminals recruiting devices to their botnet can embed the necessary malware anywhere malware typically lurks: in fake apps, dubious streaming and file-sharing sites, phishing emails, risky links, etc. The best way to avoid becoming a member of a botnet is to watch what you click on, stay away from risky sites, and treat any message from a stranger with suspicion.
Cybercriminals can conceal their malware within fake software updates that look official. Fake updates often pose as Microsoft updates because of the company’s huge user base. Java and Android operating system updates have also been impersonated in the past.
The common signs of malware apply to fake software updates too. Also, if a fake update was widespread, you’ll likely receive an official correspondence from the software provider issuing a patch.
The best way to avoid being tricked by a fake update is to enable automatic updates on all your devices. When your devices auto-update, you can ignore any pop-up, email, or text that urges you to click on a link to update. Auto-update is a good practice to adopt anyway, as it ensures that you have the latest software, which often means that it’s the most secure.
Another excellent habit that’ll prevent you from compromising your device with a fake software update is to always preview where links will take you. You can do this by tapping and holding the link. Check the hyperlink for typos or for pages that direct away from the organization’s official website.
Cybercriminals are getting craftier by the day, employing new tools (like ChatGPT) and new strains to trick people and infect mobile devices for their own gains. To safeguard all your devices, consider investing in a solution that’ll protect you from every angle. McAfee+ Ultimate is the all-in-one device, privacy, and security service that helps you confidently live your best online life. The proactive monitoring features stop threats in their tracks, saving you a massive headache and guarding your finances and PII. If any online scheme does compromise your identity, the Family Plan offers up to $2 million in identity theft restoration.
Mobile malware doesn’t always scream “suspicious!” As long as you arm yourself with the right tools, practice good habits, and keep your eyes peeled, you should be able to spot malicious software.
1GSMA, “The Mobile Economy”
The post 4 Mobile Malware Threats You Can’t Even See appeared first on McAfee Blog.
Artificial intelligence (AI) is making its way from high-tech labs and Hollywood plots into the hands of the general population. ChatGPT, the text generation tool, hardly needs an introduction and AI art generators (like Midjourney and DALL-E) are hot on its heels in popularity. Inputting nonsensical prompts and receiving ridiculous art clips in return is a fun way to spend an afternoon.
However, while you’re using AI art generators for a laugh, cybercriminals are using the technology to trick people into believing sensationalist fake news, catfish dating profiles, and damaging impersonations. Sophisticated AI-generated art can be difficult to spot, but here are a few signs that you may be viewing a dubious image or engaging with a criminal behind an AI-generated profile.
To better understand the cyberthreats posed by each, here are some quick definitions:
AI art and deepfake aren’t technologies found on the dark web. Anyone can download an AI art or deepfake app, such as FaceStealer and Fleeceware. Because the technology isn’t illegal and it has many innocent uses, it’s difficult to regulate.
How Do People Use AI Art Maliciously?
It’s perfectly innocent to use AI art to create a cover photo for your social media profile or to pair it with a blog post. However, it’s best to be transparent with your audience and include a disclaimer or caption saying that it’s not original artwork. AI art turns malicious when people use images to intentionally trick others and gain financially from the trickery.
Catfish may use deepfake profile pictures and videos to convince their targets that they’re genuinely looking for love. Revealing their real face and identity could put a criminal catfish at risk of discovery, so they either use someone else’s pictures or deepfake an entire library of pictures.
Fake news propagators may also enlist the help of AI art or a deepfake to add “credibility” to their conspiracy theories. When they pair their sensationalist headlines with a photo that, at quick glance, proves its legitimacy, people may be more likely to share and spread the story. Fake news is damaging to society because of the extreme negative emotions they can generate in huge crowds. The resulting hysteria or outrage can lead to violence in some cases.
Finally, some criminals may use deepfake to trick face ID and gain entry to sensitive online accounts. To prevent someone from deepfaking their way into your accounts, protect your accounts with multifactor authentication. That means that more than one method of identification is necessary to open the account. These methods can be one-time codes sent to your cellphone, passwords, answers to security questions, or fingerprint ID in addition to face ID.
Before you start an online relationship or share an apparent news story on social media, scrutinize images using these three tips to pick out malicious AI-generated art and deepfake.
Fake images usually don’t appear by themselves. There’s often text or a larger article around them. Inspect the text for typos, poor grammar, and overall poor composition. Phishers are notorious for their poor writing skills. AI-generated text is more difficult to detect because its grammar and spelling are often correct; however, the sentences may seem choppy.
Does the image seem too bizarre to be real? Too good to be true? Extend this generation’s rule of thumb of “Don’t believe everything you read on the internet” to include “Don’t believe everything you see on the internet.” If a fake news story is claiming to be real, search for the headline elsewhere. If it’s truly noteworthy, at least one other site will report on the event.
AI technology often generates a finger or two too many on hands, and a deepfake creates eyes that may have a soulless or dead look to them. Also, there may be shadows in places where they wouldn’t be natural, and the skin tone may look uneven. In deepfaked videos, the voice and facial expressions may not exactly line up, making the subject look robotic and stiff.
Fake images are tough to spot, and they’ll likely get more realistic the more the technology improves. Awareness of emerging AI threats better prepares you to take control of your online life. There are quizzes online that compare deepfake and AI art with genuine people and artworks created by humans. When you have a spare ten minutes, consider taking a quiz and recognizing your mistakes to identify malicious fake art in the future.
To give you more confidence in the security of your online life, partner with McAfee. McAfee+ Ultimate is the all-in-one privacy, identity, and device security service. Protect up to six members of your family with the family plan, and receive up to $2 million in identity theft coverage. Partner with McAfee to stop any threats that sneak under your watchful eye.
The post How to Spot Fake Art and Deepfakes appeared first on McAfee Blog.
Four years ago, we achieved something that few companies had — pay parity, by compensating all our employees equally for their contributions, regardless of gender. While it might seem like a given, McAfee was the first cybersecurity company to reach this goal, and that work continues, particularly in a time where pay gaps persist.
And they certainly persist. Stubbornly so. Recent data from Pew Research indicates that women in the U.S. make 82 cents for every $1 men earn, a figure that has only increased by two cents in the last two decades. At the current rate, women overall will not reach pay parity until 2059.
We believe no one should have to wait.
At McAfee, we’re proud to demonstrate our commitment to an equitable and inclusive workplace with our ongoing attainment of pay parity. In 2019, we achieved gender pay parity before adding ethnicity to our analysis a year later. Today we’re proud to say that all McAfee team members are compensated fairly and equally for their contributions, regardless of gender or ethnicity.
Creating an equitable environment is part of our DNA and who we are. In fact, half of the McAfee leadership team are female and, together with their male counterparts (including myself), are committed to driving diversity at every level. Whether it’s through our Diversity Impact Analysis, where awards, promotions, or employee programs are analyzed through the lens of equality and equity; or our candidate interviews where a woman is on every panel; or our comprehensive employee benefits and offerings centered around the needs of a diverse workforce — we’re proud of the progress we’re making, while knowing there is still much to do.
Countless studies point to the ways diversity across gender and ethnicity correlates with business performance. At McAfee, we do it first and foremost because we simply believe it’s the right thing to do. Achieving and maintaining pay parity is not without its challenges. It takes effort. Ongoing effort. If left unchecked, we know that the pay divide can resurface overtime, whether through our own unconscious biases or other factors, such as fewer women negotiating starting salaries than men. We must be proactive and intentional to maintain parity. This means quarterly analyses, third-party audits to help identify and address potential bias and subjectivity, and immediate action when we identify discrepancies to ensure the divide remains closed.
At McAfee, we will continue to shape our hiring practices, talent management practices, internal mobility, promotion and award programs, and other practices in a way that creates an employee experience rooted in equity and inclusion, so that all McAfee team members can do the best work of their lives.
We’re honored to play our part in the broader movement toward equality. You can learn more about how McAfee drives meaningful change in our Impact Report and who we are at Careers.McAfee.com.
The post Closing the Pay Gap: How Pay Parity Continues to Transform Our Workplace appeared first on McAfee Blog.
Dozens of content creators center their channels on highlighting the differences between today’s most prominent generations: the Silent Generation, baby boomers, Generation X, millennials, and Generations Z and Alpha. At quick glance, no generation seems to have much in common with the others.
Despite our vastly different life experiences and philosophies, there’s something that people of any age should get behind: identity and online privacy protection. Young or old, cybercriminals don’t discriminate against who they target. In fact, some generations are more prone to certain scams than others.
Education on current cyber threats is the first step to defending against them. Here’s how to protect every member of the family against online threats.
Cybercriminals can steal identities even from young children who don’t yet have an online presence. Criminals can buy Social Security Numbers (SSNs) of minors on the dark web or gather them through medical record or school system breaches. Those SSNs are valuable to a cybercriminal, because the theft can go undetected for years. Since children aren’t opening credit cards or applying for mortgages, there’s seemingly no reason to keep tabs on their credit and ensure everything is normal.
To check up on the online safety of your youngest family members, it’s never too early to start identity monitoring. Also, consider putting a credit freeze on your child’s credit. A credit freeze does not negatively affect their credit score. Since they won’t be needing it for several years anyway, might as well make your child’s credit inaccessible to everyone, including criminals.
Teenagers crave independence. Often at this age, parents allow their teens to open and manage their first email addresses and social media profiles independently. It’s an important life lesson in organization, responsibility, and digital literacy; however, these platforms are not without risks like cyberbullying, fake news, and social engineering.
The best way to avoid falling for each is through education. Globally, 13% of children experienced the most severe forms of cyberbullying, including harassment, physical threats, and stalking. Ensure that your tweens and teens who spend time unsupervised on their connected devices know what to do if they encounter cyberbullying. The best course of action is to report the incident to an adult, and in the meantime, to suspend their accounts.
To steer clear of fake news perpetuated by social media bots and social engineering scams, a safe browsing extension may protect your teen’s device from risky sites. McAfee WebAdvisor not only alerts users to possible hidden malware, but also to phishing attempts, which may be difficult for teenagers to suss out. For teens who are eager to download a “free” TV or video game, they may miss the telltale signs of malicious sites, such as typos, blurry logos, or offers that are too good to be true.
While adults typically have more street smarts than teens, their schedules are brimming with important tasks. Juggling work, social obligations, and running a household often leaves adults feeling like they don’t have time to spare. The feeling that they have to rush through emails, social media direct messages, and even dating app correspondences could increase their susceptibility to phishing, malware, and computer viruses.
The best advice to adults to avoid phishing or malicious bugs is this: slow down! Take your time when you receive any message from someone you don’t know or have never met in person. If you feel even an iota of suspicion, don’t engage any further with the sender. Delete the message. If it’s important, the person or organization will follow up.
To fully protect expensive connected devices and the personally identifiable information they store, consider investing in safe browsing, antivirus software, and identity monitoring and restoration services to catch any threats that may have passed under your watchful eye.
Cybercriminals often seek out seniors as easy targets for online scams. Because they aren’t digital natives like millennials and Gen Zers, seniors are typically less confident in their online skills. For example, they may not realize that every email in their inbox isn’t necessarily sent by someone with good intentions. What can start out as a friendly online pen pal can quickly spiral into divulging sensitive personal information or sending huge sums of money to a criminal.
The best way to prepare the seniors in your life for online safety is to impart a few, easy-to-follow absolutes. Start with these three rules:
For peace of mind, enroll the seniors in your family in identity monitoring and restoration services. This will help them get back on their feet if their identity was compromised in a senior scam.
Get the whole family committed to safer and more private online lives with the help of McAfee+ Ultimate Family Plan. The Family Plan covers up to six individuals and protects their online lives with an entire suite of comprehensive privacy, identity, and device security features. For example, families can receive up to $2 million in identity theft recovery and $50,000 in ransomware coverage. The plan also includes preventive measures to fight online crime, such as safe browsing tools, an advanced firewall, unlimited VPN, and antivirus software for unlimited devices.
Empower your whole family with online confidence and protection for their digital life!
The post Protect the Whole Family with McAfee+ Ultimate Family Plan appeared first on McAfee Blog.
International Women’s Day is a time for us to celebrate the achievements and contributions of women at McAfee and around the world. We reflect on progress, the work ahead, and how all of us can create a more equitable and inclusive world.
Collectively we can #EmbraceEquity and raise awareness of how equity leads to equality today and beyond.
See how Team McAfee embraces equity.
|
“As a father of two daughters, I want them to be able to embrace any opportunities they encounter and be successful at whatever they put they mind to. So, I embrace equity as it creates the best environment for everyone to succeed and simply, it’s just the right thing to do.” Andrew – Software Sales Senior Manager |
|
“In 2023, I’m hopeful that equity will be embraced by all sectors of our society. When we collectively embrace equity, we create a more equal world that strives to be diverse, inclusive and fair.” Fiona, Accounting Senior Manager |
|
“I embrace equity because I believe that everyone deserves to be treated fairly and have equal opportunities, regardless of their background, identity, or personal characteristics.” – Jeremy, Senior UC Engineer |
|
“Embracing equity will help us advance into a future where we appreciate and value uniqueness of each other!” – Ambareen, Senior Manage, Content Operations & QA, DevOps |
|
“I love the #EmbraceEquity theme as it demonstrates how the conversation has progressed to a point where we are having meaningful conversations about why equality is not enough. Equity-based solutions consider the experiences people have and with that more women can get what they need to succeed. This is a long-term solution and I’m excited for continuing this conversation going forward.” – Keegan, Senior Retail Channel Marketing Manager |
|
“I embrace equity because it’s the right thing. But more than this, because without it there is no way we would be able to achieve our full potential.” – Aaron, VP Finance |
|
“To me, #EmbracingEquity means to accept everyone’s differences, uniqueness, and backgrounds; the very essence that makes us each who we are.” – Deb, Executive Assistant |
|
“Change won’t happen unless we make it happen. I embrace equity because well it’s so clearly and fundamentally the right thing to do.” – Jared, VP Legal |
|
“Embracing Equity means recognizing and supporting women across the globe, regardless of their background. We come together to empower one another, celebrate our achievements, and continue to build workplaces where ALL women can thrive.” – Taylor, People Experience Program Manager |
|
“I reaffirm my commitment to raise my voice to help others who need support to be heard, to enable them to succeed in their career and to lead. When we make room for diverse voices – we enrich the social fabric and through this, deepen our own perspectives.” – Natalia, Software Sales |
|
“Gender equality is not just an issue for women to solve, it takes men and allies to lean in and truly remove those barriers. The more we can speak out, the more we can stand up and the more stories we can share the greater chance we have to truly inspire action. We can help create a more equitable world for everyone.” – Mike, Director of Global Transformation |
|
“Humanity is diverse: we’re all unique individuals with our own passions, strengths and weaknesses. Equity is taking that uniqueness into account, so everyone has the resources and opportunities they need to succeed.” – Elodie, Security Researcher |
Join McAfee and millions of others around the world in celebrating International Women’s Day by sharing how you’ll #EmbraceEquity.
Interested in finding out more about what we’re doing to drive meaningful change at McAfee? Check out our Impact Report
The post McAfee Teammates Share How They #EmbraceEquity This International Women’s Day appeared first on McAfee Blog.
Malware—the term seems to be at the center of the news every day, with each headline telling of a new way the cyber threat has inserted itself into our lives. From an entire attack campaign on banks worldwide, to a strain residing within medical devices, to a variant that has learned to self-heal, the list of malware-based attacks goes on. And as they do, it’s becoming more and more clear that today’s malware has not only become adaptive, but has learned how to spread its wings further than before, to devices beyond laptops and phones, and in a way that creates a longevity behind each cyberattack it spearheads.
However, though it is important to understand the many forms that malware, or malicious software, takes, it’s crucial to first and foremost grasp what it is.
The abbreviated term for malicious software, “malware,” is a generic term used to describe any type of software or code specifically designed to exploit a computer/mobile device or the data it contains, without consent. Most malware is designed to have some financial gain for the cybercriminal, as crooks typically use it to extract data that they can leverage over victims. That information can range anywhere from financial data, to healthcare records, to personal emails and passwords—the possibilities of what sort of information can be compromised have become endless.
So how exactly can these cybercriminals get their hands on so much data? Since its birth over 30 years ago, malware has found a variety of vessels to help it enact attacks. This includes email attachments, malicious advertisements on popular sites (malvertising), fake software installations, USB drives, infected apps, phishing emails, and even text messages.
Now, these are just a few of the ways malicious software can be delivered–but there are also different kinds of malware itself. To name a few:
Now that you know what malware is, how it can be delivered, and the many forms it takes, it’s time to learn how you can protect yourself against it:
The post Malware: 5 Tips for Fighting the Malicious Software appeared first on McAfee Blog.
Each year the independent labs at AV-TEST announce their best products in IT security, and McAfee has come out on top with AV-TEST’s award for “Best Protection.”
McAfee received the award across a field of 20 different products assessed by AV-TEST, which included evaluation across three key categories:
Maik Morgenstern, CEO of AV-TEST, said: “The test category of protection is an elite discipline in the lab of AV-TEST. That is why we are particularly pleased that we were able to confer such an important and coveted award on McAfee. The consumer user product Total Protection demonstrated with perfect detection in all lab tests that it earned the AV-TEST Best Protection 2022 Award for Consumer Users.”
Their labs utilize thousands of rigorous real-world tests that determine how well online protection performs against known, new, and emerging threats—such as previously unknown zero-day malware, drive-by attacks, malicious downloads from websites, attacks via infected emails, ransomware, and many more.
“Recognition from AV-TEST is an honor,” says Chief Technology Officer, Steve Grobman. “Their reputation for analysis and quality assurance stands tall and further reinforces our leadership in online protection. Grobman also continued to say, “With the internet now an integral part of our daily lives, cybercriminals have stepped in to take advantage of that reliance. As ever, we’re committed to staying one step ahead of them so that people can confidently enjoy their lives online.”
Get a free 30-day trial of McAfee Total Protection, which includes McAfee’s award-winning anti-malware technology plus identity monitoring, Secure VPN, and safe browsing for all-in-one online protection.
The post McAfee Awarded Best Protection by the Labs at AV-TEST appeared first on McAfee Blog.
We created McAfee+ so people can be safe and feel safe online, particularly in a time where there’s so much concern about identity theft and invasions of online privacy—and reviewers have given it top marks as a result.
With data breaches, spam texts and calls, companies collecting and selling personal info, and suspicious charges cropping up on billing statements becoming so commonplace nowadays, it can seem like there’s little you can do to prevent it. Yet that’s far from the case. McAfee+ offers protection that puts you in control of your identity and privacy, all while protecting your devices from viruses and threats.
Journalists who have reviewed McAfee+ recognize the need for this kind of protection today, and here’s what three leading consumer PC publications had to say about McAfee+ and how strongly its protection stacks up.
Tech Advisor’s review opened with the big picture, stating ‘McAfee+ is Total Protection on steroids’ and McAfee+ is ‘a complete cybersecurity package that goes beyond simply blocking nasties to offer holistic protection for everything you do online.’ Tech Advisor said, “This feels like the beginning of a new era of cybersecurity where the customer is no longer helpless to unwanted intrusion, and McAfee+ makes sure they have the tools to use that new-found power.”
Top features they called out include Lost Wallet support, which will help you cancel your cards and order replacements from a single screen. Moreover, they applauded our Identity Theft and Restoration Coverage which is “the sort of identity protection that you’d normally see from an insurance company.”
Our industry-first Protection Score also racked up points with Tech Advisor, which really latched onto the idea of improving their score. “We actually found chasing points quite compulsive – and most importantly, it means that you don’t need to worry about how any of the features we’re about to look at work, what they do, or even what they’re called – McAfee+ does all that for you, making it great, not just for tech-heads, but seniors, kids, and the less-tech-savvy alike.”
In their summary of McAfee+, Tech Advisor expressed our approach to online protection well by saying, “the future of safety online is holistic, and McAfee has come up with a package that reflects the realities of modern-day living.”
The PC Mag review gave McAfee+ a thorough walkthrough with a particular focus on its privacy and identity features, saying, “McAfee+ is now the most complete product in the McAfee line, and its combination of unlimited device protection with identity theft remediation is quite appealing.”
It highlighted our Personal Data Cleanup feature that scans some of the riskiest data broker sites and shows you which ones are selling your personal info and provides guidance for removing it—and further touched on our Identity Theft and Restoration Coverage that, “offers full identity monitoring and identity theft remediation rivaling that of many competing products, and you can now extend protection to your family.”
The review also put McAfee’s Credit Monitoring, Credit Lock, and Security Freeze features through the paces as well, which help you keep an eye on changes to your credit score, report, and accounts with timely notifications and guidance so you can take action to tackle identity theft.
PC Mag also called out the unlimited device coverage that protects all devices in your household, McAfee’s excellent third-party test scores for antivirus protection, and unlimited VPN—all adding up to a four-star review and an “Excellent” rating.
Like Tech Advisor, Trusted Reviews focused on the broader nature of online protection today and that it calls for much more than antivirus. Identity and privacy protection are equally important, and “McAfee+ Advanced is very much a do-it-all service.”
Notably, along the same lines, the review mentioned that the “new McAfee Plus tiers are among very few mainstream internet security suites to offer data broker removal services in the UK and Europe.” As mentioned above, our Personal Data Cleanup can help you spot and remove personal information from data broker sites, which bad actors of all stripes use to commit scams and identity theft. A couple of examples—scammers use data brokers to create lists of people that they can send spammy texts and calls, and thieves can also use data broker sites to harvest info that can help them commit identity theft.
Trusted Reviews also called out the unlimited number of devices and how it’s helpful for households with a lot of hardware to protect. The core antivirus was highlighted as well, in that “the performance for McAfee Plus Advanced in recent lab tests has been excellent. It detected all malware with no false positives in AV-TEST’s latest Windows consumer antivirus test.”
The journalist concludes their review by stating that “the company’s push into identity protection and recovery in the UK is almost beyond the score of my anti-malware focus on these reviews, but it’s a useful toolkit to have on hand, and its data broker listing removal service is very welcome indeed.”
Drop by our product page for more about McAfee+, including our new Family plans that include personalized protection for each member of the family. With several tiers and degrees of protection available across all our plans, you can get the level of privacy, identity, and device protection that’s right for you and everyone in your household.
The post The Reviews are In—McAfee+ Earns Top Marks from Review Sites appeared first on McAfee Blog.
Smartphones put the proverbial world in the palm of your hand—you pay with it, play with it, keep in touch with it, and even run parts of your home with it. No wonder hackers and scammers have made smartphones a target. A prime one.
Each year, our Consumer Mobile Threat Report uncovers trends in mobile threats, which detail tricks that hackers and scammers have turned to, along with ways you can protect yourself from them. For 2023, the big trend is apps. Malicious apps, more specifically.
Malicious apps often masquerade as games, office utilities, and communication tools. Yet now with the advent of a ChatGPT AI chatbot and the DALL-E 2 AI image generator, yet more AI-related malicious apps have cropped up to cash in on the buzz.
And money is what it’s all about. Hackers and scammers generally want your money, or they want your data and personal info that they can turn into money. Creating fraudulent ads, stealing user credentials, or skimming personal information are some of the most common swindles that these apps try. Much of this can happen in the background, often without victims knowing it.
How do these apps end up on people’s phones? Sometimes they’re downloaded from third-party app stores, which may not have a rigorous review process in place to spot malicious apps—or the third-party store may be a front for distributing malware-laden apps.
They also find their way into legitimate app stores, like Apple’s App Store and Google Play. While these stores indeed have review processes in place to weed out malicious apps, hackers and scammers have found workarounds. Sometimes they upload an app that’s initially clean and then push the malware to users as part of an update. Other times, they embed the malicious code so that it only triggers once it’s run in certain countries. They will also encrypt bad code in the app that they submit, which can make it difficult for stores to sniff out.
In all, our report cites several primary ways how hackers and scammers are turning to apps today:
For starters, stick with legitimate apps stores like Google Play and Apple’s App Store, which have measures in place to review and vet apps to help ensure that they are safe and secure. And for the malicious apps that sneak past these processes, Google and Apple are quick to remove malicious apps once discovered, making their stores that much safer.
As with so many attacks, hackers rely on people clicking links or tapping “download” without a second thought. Before you download, take time to do some quick research. That may uncover some signs that the app is malicious. Check out the developer—have they published several other apps with many downloads and good reviews? A legit app typically has quite a few reviews, whereas malicious apps may have only a handful of (phony) five-star reviews. Lastly, look for typos and poor grammar in both the app description and screenshots. They could be a sign that a hacker slapped the app together and quickly deployed it.
Yet better than combing through user reviews yourself is getting a recommendation from a trusted source, like a well-known publication or from app store editors themselves. In this case, much of the vetting work has been done for you by an established reviewer. A quick online search like “best fitness apps” or “best apps for travelers” should turn up articles from legitimate sites that can suggest good options and describe them in detail before you download.
Another way hackers weasel their way into your device is by getting permissions to access things like your location, contacts, and photos—and they’ll use sketchy apps to do it. So, check and see what permissions the app is requesting. If it’s asking for way more than you bargained for, like a simple game wanting access to your camera or microphone, it may be a scam. Delete the app and find a legitimate one that doesn’t ask for invasive permissions like that. If you’re curious about permissions for apps that are already on your phone, iPhone users can learn how to allow or revoke app permission here, and Android can do the same here.
With all that we do on our phones, it’s important to get security software installed on them, just like we install it on our computers and laptops. Whether you go with comprehensive online protection software that secures all your devices or pick up an app in Google Play or Apple’s App Store, you’ll have malware, web, and device security that’ll help you stay safe on your phone.
Together with installing security software, keeping your phone’s operating system up to date can help to keep you protected from most malware. Updates can fix vulnerabilities that hackers rely on to pull off their malware-based attacks—it’s another tried and true method of keeping yourself safe and your phone running great too.
Who can you trust? As for scammers who use legitimate communications apps to lure in their victims, McAfee’s Mobile Research team recommends the following:
The complete report uncovers yet more mobile trends, such as the top mobile malware groups McAfee identified in 2022, predictions for the year ahead, ways you can keep your children safer on their phones, and ways you can keep yourself safer when you use your phone for yourself and for work.
The full report is free, and you can download it here.
The post McAfee 2023 Consumer Mobile Threat Report appeared first on McAfee Blog.
ChatGPT is, without doubt, the biggest tech story of the year. It’s created debate in schools and universities, made history by being the fastest ever growing app in history and even caused Google to issue a Code Red! But if you haven’t heard anything about it or still can’t get your head around it then I’ve got you! Keep reading because I’ve put together a ‘cheat sheet’ to help get you up to speed plus some pointers on how to manage this intriguing technology and your kids.
ChatGPT is an online software program that uses a new form of artificial intelligence – generative artificial intelligence – to provide human style responses to a broad array of requests. And let me assure you, its responses are much less robotic and far more intelligent sounding that earlier iterations of artificial intelligence. Whether you need a recipe formulated, poetry written, tips for your next party or text translated, ChatGPT can assist. Think of it as Google but on steroids. But instead of overwhelming you with 1000’s of search results, it summarises them in a conversational form.
It was developed by San Francisco startup OpenAI, which was co-founded by Elon Musk and Sam Altman in 2015. Like all new startups, it also has a host of investors in tow but Microsoft is without a doubt, the biggest.
When I asked ChatGPT to describe itself, it replied:
ChatGPT is a conversational AI model developed by OpenAI. It’s based on the GPT-3 (Generative Pre-trained Transformer 3) architecture, which is one of the largest and most advanced language models in existence. The model has been trained on a massive corpus of text data from the internet, allowing it to generate human-like responses to a wide range of topics and questions. It can be used to power various applications such as chatbots, language translation, content generation, and more.
Let me simplify – ChatGPT uses generative artificial intelligence to provide ‘human style’ content, language translation, summarisation ability and search engine results within seconds. It can solve maths questions, write jokes, develop a resume and cover letter, write code and even help you prepare for a job interview.
ChatGPT is powered by a large language model, or LLM, meaning it’s programmed to understand human language and create responses based on large quantities of data. It has the ability to remember or ‘log’ context from a user’s previous message and use it to create responses later in the conversation, giving it a human-like feel.
Just five days after its release, ChapGPT had signed up 1 million users, according to a tweet by OpenAI co-founder Sam Altman. In just two months, it had amassed a whopping 100 million monthly active users making it the fastest growing application in history. And just to give you some context, it took TikTok nine months to reach 100 million users and two and half years for Instagram.
Without doubt, the main reasons for its popularity is the ease of access and its seemingly endless scope of ability. It’s super easy to use – once you’ve set up an account, it’s as simple as typing in your request or question into the text box. And there is no minimum age required for users – unlike many other social media platforms. And because it can assist with any issue from writing a legal brief to answering questions to providing companionship in almost 100 languages, a lot of us could easily find a way to use it in our day-to-day lives.
Some experts believe that the timing of ChatGPT is another reason for its success. It’s widely known that the Renaissance period followed The Black Death in the 14th Century so ChatGPT could have arrived at a time in history when creativity is surging after 2-3 very long and hard years of living with Covid.
ChatGPT is still a free service however recently it has introduced a premium version called ChatGPT Plus. For $US20 per month, users will get access to the chatbot even when demand is high with a faster response speed. Priority access to new features will also be made available to new users. While I have never had an issue gaining access to ChatGPT, even in peak times, friends of mine in the US have had to invest in the paid membership otherwise they have to wait till late in the evening to have their questions answered!
Microsoft recently announced that it will be incorporating some of the ChatGPT functionality into its Bing and Edge search engines but that it will use a next generation OpenAI model that is more powerful than ChatGPT. If you’re a Microsoft customer, keep a watch on your inbox for an invite!
Google has just unveiled its offering. Called Bard, it’s similar to ChatGPT but the biggest difference is that it will use current information from the web whereas ChatGPT’s data sources are only current as of September 2021 – I did confirm that with my ChatGPT source!! Bard is projected to be ready for use by the end of February 2023. Interestingly, Google was in fact the first to embrace conversational AI through the launch of Lamda (Language Model for Dialogue Applications) in 2021 but it didn’t launch a consumer version which left a wide opening for ChatGPT to be the first offering in the consumer race.
There’s no doubt that ChatGPT will help fuel a curious mind and be a captivating way to spend time online for inquisitive kids however there are a few things us parents need to be aware of to ensure our kids stay as safe as possible.
Without a doubt, using ChatGPT to write your essay, solve a maths problem or translate your French homework, has been the biggest concern for schools, universities, and parents. Some schools have already banned the use of ChatGPT while others are rewriting curriculums to avoid tasks that could be undertaken by ChatGPT.
However, it appears that these concerns may be managed with the release of new software that can detect work that has been produced by ChatGPT. Stanford University has just released DetectGPT which will help teachers detect work that was created using the ChatGPT chatbot or other similar large language models (LLMs). ChatGPT has also released its own ChatGPT software detection tool however it does refer to it as ‘imperfect’.
What To Do – Some experts believe we need to work with ChatGPT and that it in fact could be a powerful teaching tool if it’s embraced and used wisely. Regardless of your thoughts on this, I suggest you work closely with your child’s school to understand what their policy is on its use and encourage your kids to follow it accordingly.
Even though ChatGPT states that its intention is to ‘generate appropriate and informative responses’, there’s no guarantee that this will always happen. I have spent a considerable time trying to catch it out and I am pleased to report that I couldn’t. It appears that there are certain topics it steers away from and that it does seem to have a good set of boundaries about what questions not to answer or topics to not content on, however don’t rely on these!
What To Do – If you have concerns, ensure your child has supervision when using ChatGPT.
While ChatGPT’s IQ and scope seems limitless, it isn’t perfect. Not only have there been reports of it being factually incorrect when creating content, its data sources are only current as at September 2021.
What To Do – Double check the content it creates for accuracy but steer your child towards a reliable and safe source for research projects.
And my final piece of advice – if you haven’t yet used ChatGPT, make yourself a cuppa and give it a whirl. Like everything in the online world, you need to understand how it works if you want to be able to help your kids stay safe. And if you aren’t sure what to ask it – why not a recipe for dinner? Simply enter what you can find in your fridge in the text box and within seconds, you’ll have a recipe!
Bon Appetit!
Alex
The post A Parent’s Guide to ChatGPT appeared first on McAfee Blog.
Deciding when to give your child a phone is not an easy task. Should you wait until they start high school or until they catch public transport home alone from school? Or, should 10 be the magic age when they become official phone owners? Or do hold off as long as you can until you can no longer bear their moaning that everyone else has one except for them!!
When my boys were younger (and I knew a little less), we had a family ‘understanding’ that when the boys started Year 5, they would receive a (very cheap and likely second hand) phone. Up until Year 5, my boys would go to after-school care. Somehow, turning 10 and entering Middle School meant after-school care wasn’t really that ‘cool’ anymore, so instead they required a phone so they could safely catch the train home by themselves. The fact that they could also use these devices to play games and talk to their friends was of course, only a secondary consideration for them!
That was how we managed the phone situation but let me assure you, almost every other family we knew had a different approach. Some gifted their offspring the latest iPhones as soon as they were requested, others provided a phone but with no ‘credit’ so the devices could only be used to receive calls. Others chose to wait till Year 7 and beyond and made their kids pay for the phone plan out of their pocket money.
Now, I’m a big fan of parents choosing what works best – no one knows a child quite like a parent does, right? But the problem is, deciding what’s right can be really overwhelming. So, I’ve put together a list of things to consider when making this all important decision. Once you’ve worked through these points, I am sure you’ll feel more confident to make a decision that works for both you and your child.
Having parented 4 very different boys, I am the first to confirm that every child grasps personal responsibility at different stages. Some kids just have a knack for losing things while others have the same lunchbox their entire school career! Some kids just get the consequence of spending money while others spend up big whilst gaming online, blissfully unaware of their bill.
You child’s digital reputation should also be worth considering when making your decision. Some kids understand that their online behaviour forms a key part of their reputation while others will charge forth in a heated online exchange without thinking.
I really believe there is a direct link between social smarts and a positive online experience. When a child can read a situation and instinctively know when to shut it down or withdraw, their online experience will be far more rewarding. If your child is slow to catch on to social cues, they may struggle with posting and communicating online.
When I was deliberating about giving my eldest son a phone, he really went hard with the safety argument – knowing it would appeal to my parental anxiety. So, I relented but he had to promise to answer when I called. And he did – usually!! But it’s worth pointing out that a device itself doesn’t guarantee safety. If your kids are travelling home from school, they still need to know how to cross the road, not to talk to strangers and to always lock the front door once home. A phone doesn’t teach this. But I personally did find it handy (and anxiety reducing) to be able to give them a quick call to give them a few reminders and ensure all was well.
When my younger boys received their phones, tracking apps like Life 360 were available. I know, they are controversial but, personally I found these super helpful. Being able to see where they were after school and to ensure they were heading in the right direction on the train, brought me great comfort to me when I was beating away on my keyboard at work.
If, after reading this, you’re thinking that your child really isn’t ready but still love the idea of being able to contact them, why not consider parental controls or a phone with limited features?
Putting age-appropriate boundaries around what your child does on their device is what parental controls will do. If you decide that you don’t want them to download TikTok, play particular games or view certain categories of websites, then this maybe your answer. You can also choose to set limits on their daily screen time and block out times when their phone can’t be used. Check out McAfee’s SafeFamily parental controls for peace of mind.
Or, instead, why not make a ‘dumb’ phone their only option? A basic dumb phone lacks the advanced functionality of most smartphones – think phones before the internet. This means you’ll be able to call and text them but will probably be more relaxed knowing they’re not researching the latest fads on TikTok!
Some companies have designed dumb phones for kids that even have built in parental controls. Open Mobile has a SmartKids Phone with a built-in GPS tracker and SOS button and comes without a camera. It does have internet connectivity but parents can see which apps have been downloaded, restrict specific apps and nominate what days and times apps can be used. A perfect option for a tween or young teenager!
Now, before making your final decision, I think it’s essential to think about your child’s sense of connectedness. As adults, we all know that being part of a community and ‘belonging’ is critical to mental health and self-worth. And I would not be doing my job if I didn’t remind you of just how fabulous a phone can be for staying in touch with your people. Just take a moment to remember how essential devices were for survival during Covid lockdowns.
So, over to you mums and dads. This is definitely one of the trickiest decisions you’ll make in your parenting journey but don’t forget that you know your child best. You’ve got this!
The post When Does My Child Really Need A Phone? appeared first on McAfee Blog.
It all feels so harmless. Who isn’t even alittle curious which celebrity is their look-a-like or what ’80s song best matches their personality? While some of these fun little quizzes and facial recognition-type games that pop up on social media are advertiser-generated and harmless, others have been carefully designed to steal your data.
According to the Better Business Bureau (BBB) consumers need to beware with the IQ tests, quizzes that require you to trade information. Depending on the goal of the scam, one click could result in a new slew of email or text spam, malicious data mining, or even a monthly charge on your phone bill.
Besides the spammy quizzes, scammers also use click bait, that are headlines designed to get your click and your data. Such headlines often promise juicy info on celebrities and may even legitimate human interest stories that claim, “and you won’t believe what happened next.” While some of those headlines are authored by reputable companies simply trying to sell products and compete for clicks, others are data traps that chip away at your privacy.
The best defense against click bait is knowledge. Similar to the plague of fake news circulating online, click bait is getting more sophisticated and deceptive in appearance, which means that users must be even more sophisticated in understanding how to sidestep these digital traps.
Our digital landscape is peppered with fake news and click bait, which makes it difficult to build trust with individuals and brands who have legitimate messages and products to share. As you become savvy to the kinds of data scams, your discernment and ability to hold onto your clicks will become second nature. Continue to have fun, learn, connect, but guard your heart with every click. Be sure to keep yor devices protected while you do!
The post Are You Getting Caught by Click Bait? appeared first on McAfee Blog.
Scammers now have new tools to lure people who are looking for love online, by reeling in potential victims with artificial intelligence (AI). Thanks to the aid of popular AI tools like ChatGPT, scammers can potentially generate anything from seemingly innocent intro chats to full-blown love letters in seconds, all ready to dupe their victims on demand.
Tactics like these are typical of “catfishing” in dating and romance scams, where the scammer creates a phony online persona and uses it to lure their victim into a relationship for financial gain. Think of it as a bait-and-hook approach, where the promise of love is the bait, and theft is the hook.
And as explained above, baiting that hook just got far easier with AI.
Sound farfetched? After all, who would fall for such a thing? It turns out that a sophisticated AI chatbot can sound an awful lot like a real person seeking romance. In our latest “Modern Love” research report, we presented a little love letter to more than 5,000 people worldwide and asked them if it was written by a person or by AI:
My dearest,
The moment I laid eyes on you, I knew that my heart would forever be yours. Your beauty, both inside and out, is unmatched and your kind and loving spirit only adds to my admiration for you.
You are my heart, my soul, my everything. I cannot imagine a life without you, and I will do everything in my power to make you happy. I love you now and forever.
Forever yours …
One-third of the people (33%) thought that a person wrote this letter, 31% said an AI wrote it, and 36% said they couldn’t tell one way or another.
What did you think? If you said that a person wrote the letter, you got hoodwinked. An AI wrote it.
The implications are concerning. Put plainly, scammers can turn on the charm practically at will with AI, generating high volumes of romance-laden content for potentially high volumes of victims. And as our research indicates, plenty of people are ready to soak it up.
Worldwide, we found:
Chatting with a stranger is one thing. Yet how often did it lead to a request for money or other personal information? More than half the time.
Scammers love a good story, one that’s intriguing enough to be believable, such as holding a somewhat exotic job outside of the country. Common tales include drilling on an offshore oil rig, working as a doctor for an international relief organization, or typically some sort of job that prevents them from meeting up in person.
Luckily, this is where many people start to catch on. In our research, people said they found out they were being catfished when:
Of course, the true telltale sign of an online dating or romance scam is when the scammer asks for money. The scammer includes a little story with that request too, usually revolving around some sort of hardship. They may say they need to pay for travel or medical expenses, a visa or other travel documents, or even customs fees to retrieve an item that they say is stuck in the mail. There’s always some kind of twist or intriguing complication that seems just reasonable enough such that the victim falls for it.
Scammers will often favor payment via wire transfers, gift cards, and reloadable debit cards, because they’re like cash in many regards—once you fork over that money, it’s as good as gone. These forms of payment offer few protections in the event of scam, theft, or loss, unlike a credit card charge that you can contest or cancel with the credit card company. Unsurprisingly, scammers have also added cryptocurrency to that list because it’s notoriously difficult to trace and recover.
In all, a romance scammer will typically look for the easiest payment method that’s the most difficult to contest, reimburse, or trace back to the recipient. Requests for money, particularly in these forms, should raise a major red flag.
What makes online dating and romance scams so malicious, and so difficult to sniff out, is that scammers prey on people’s emotions. This is love we’re talking about, after all. People may not always think or act clearly to the extent that they may wave away their doubts—or even defend the scammer when friends or family confront them on the relationship.
However, an honest look at yourself and the relationship you’re in provides some of the best guidance around when it comes to meeting new people online:
Scammers, although arguably heartless, are still human. They make mistakes. The stories they concoct are just that. Stories. They may jumble their details, get their times and dates all wrong, or simply get caught in an apparent lie. Also, keep in mind that some scammers may be working on several victims at once, which is yet another opportunity for them to get confused and slip up.
In the cases where scammers may use AI tools to pad their conversations, you can look for several other signs. AI still isn’t always the smoothest operator when it comes to language. AI often uses short sentences and reuses the same words, and sometimes it generates a lot of content without saying much at all. What you’re reading may seem to lack a certain … substance.
Scammers are likely to use all kinds of openers. That text you got from an unknown number that says, “Hi, where are you? We’re still meeting for lunch, right?” or that out-of-the-blue friend request on social media are a couple examples. Yet before that, the scammer had to track down your number or profile some way or somehow. Chances are, all they needed to do was a little digging around online.
Be critical of the invitations you receive. Out-and-out strangers could be more than a romance scammer, they could be a fake account designed to gather information on users for purposes of cybercrime, or they can be an account designed to spread false information. There are plenty of them too. In fact, in Q3 of 2022 alone, Facebook took action on 1.5 billion fake accounts. Reject requests from strangers.
How did that scammer get your phone number or contact information in the first place? It could have come from a data broker site. Data brokers are part of a global data economy estimated at $200 billion U.S. dollars a year fueled by thousands of data points on billions of people scraped from public records, social media, third-party sources, and sometimes other data broker sites as well. With info from data broker sites, scammers compile huge lists of potential victims for their spammy texts and calls.
Our Personal Data Cleanup can help remove your info from those sites for you. Personal Data Cleanup scans some of the riskiest data broker sites and shows you which ones are selling your personal info. It also provides guidance on how you can remove your data from those sites and can even manage the removal for you depending on your plan. It also monitors those sites, so if your info gets posted again, you can request its removal again.
Online protection software can protect you from clicking on malicious links that a scammer may send you online, while also steering you clear of other threats like viruses, ransomware, and phishing attacks in general. It can look out for your personal information as well, protecting your privacy by monitoring the dark web for your email, SSN, bank accounts, credit cards, and other info that a scammer or identity thief may put to use. With identity theft a rather commonplace occurrence today, security software is really a must.
Worldwide, we found that 30% of men (and 26% of all adults) said they plan to use artificial intelligence tools to put their feelings into words. Yet, there’s a flipside. We also found that 49% of respondents said they’d be offended if they found out the note they received had been produced by a machine.
So why are people turning to AI? The most popular reason given for using AI as a ghostwriter was that it would make the sender feel more confident (27%), while others cited lack of time (21%) or lack of inspiration (also 21%), while 10% said it would just be quicker and easier and that they didn’t think they’d get found out.
It’s also worth noting that true romance seekers have called upon AI to kick off chats in dating apps, which might take the form of an ice-breaking joke or wistful comment. Likewise, AI-enabled apps have started cropping up in app stores, which can coach you through a conversation based on contextual cues like asking someone out or rescheduling a date. Some can even create AI-generated art on demand to share a feeling through an image.
It may be better than opening a conversation with an otherwise dull “hey,” yet as our research shows, there are risks involved if people lean on it too heavily—and prove to be quite a different person when they start talking on their own.
It’s important to remember that an AI chatbot like ChatGPT is a tool. It’s not inherently good or bad. It’s all in the hands of the user and how they choose to apply it. And in the case of scammers, AI chatbots have the potential to do a lot of harm.
However, you can protect yourself. In fact, you can still spot online dating and romance scams in much the same way as before. They still follow certain rules and share the same signs. If anything, the one thing that has changed is this: reading messages today calls for extra scrutiny. It will take a sharp eye to tell what’s real and what’s fake.
As our research showed, online dating and romance scams begin and end with you. Thinking back to what we learned as children about “stranger danger” goes a long way here. Be suspicious and, better yet, don’t engage. Go about your way. And if you do find yourself chatting with someone who requests money or personal information, end it. Painful as the decision may be, it’s the right decision. No true friend or partner, one you’ve never seen or met, would rightfully ask that of you.
Editor’s Note:
Online dating and romance scams are a crime. If you think that you or someone you know has fallen victim to one, report it to your authorities and appropriate government agencies. In the case of identity theft or loss of personal information, our knowledge base article on identity theft offers suggestions for the specific steps you can take in specific countries, along with helpful links for local authorities that you can turn to for reporting and assistance.
The post Could ChatGPT Cause Heartbreak with Online Dating Scams? appeared first on McAfee Blog.
Swiping right is like a box of Valentine’s Day chocolates: You never know what you’re going to get. You could land with a ghost, a gem, or a fraudster who’s not interested in stealing your heart but your cryptocurrency.
Romance scams have been breaking hearts and emptying bank accounts since the advent of online dating in the 1990s. In 2021 alone, the FTC received 56,000 reports of romance scams and losses totaling $547 million. Compared to just four years earlier, total losses increased by 500%.1
Cryptocurrency romance scams are a relatively new evolution of the scheme. Here’s what you should know and signs that may indicate you’re communicating with a manipulative crypto thief.
A cryptocurrency romance scam is an online scheme where a cybercriminal forges romantic relationships through online platforms to trick people into handing over crypto assets. Conversations may begin on social media platforms or dating apps. After a few days, weeks, or – if the criminal is patient – months of communicating, the scammer uses their manufactured romantic bond to guilt their target into sending cryptocurrency. The criminal will often tug on heartstrings with made-up sad stories to explain what they’ll use the money for. They may ask for a few hundred to thousands of dollars’ worth of crypto. Once they’ve received payment, they may continue the charade of a relationship to attempt to weasel more money, or they may “end the relationship” and disappear to try their luck with someone else.
Artificial intelligence text generators like ChatGPT make juggling multiple love scams at once easier and quicker for scammers. Instead of using their brain to think up “heartfelt” proclamations of love, they can ask an AI program to do the work for them. And AI-written love letters are convincing! In McAfee’s Modern Love Report, 69% of global respondents were unable to tell if a love note was written by a human or a machine.
In crypto romance plots specifically, the criminal will ask for payment in cryptocurrency, such as Bitcoin or Ethereum. In general, you should be skeptical of any person or organization that asks for payment in crypto. Cryptocurrency is famously untraceable, meaning that once it hits someone else’s crypto wallet, there’s no way to get it back or ascertain the real identity of the account holder. Unlike a bank account that a real person with a valid Social Security Number must open, crypto does not have such requirements. The anonymity is what makes crypto the preferred payment type of nefarious characters.
In a 14-month span, cryptocurrency romance scams accounted for $185 million in crypto losses.2 And that figure only accounts for filed reports. It’s possible that some people are still in the swirls of a scam or are too embarrassed to report the crime.
There are three tell-tale signs of an online crypto dating scam. If you encounter any of these scenarios, begin to ask more probing questions. If you’re unsatisfied with the answers or the person you’re communicating with becomes defensive, you may want to consider blocking this person on your device and removing them from your life.
The getting-to-know-you phase of any new relationship is exciting and interesting. Even in this day and age of accelerated courtship and constant communication via texting, social media direct messages, and dating apps, this important phase takes time. If someone you’ve never met in person tells you they love you after just a few conversations, be wary of their compliments. Love-at-first-direct-message isn’t real.
Refusing or constantly postponing in-person meetings is a major red flag. In 39% of catfishing incidents, turning down in-person meetups was the ultimate sign that alerted people to the catfish, according to the Modern Love Report. Catfish – or someone using fake photos and/or backstories to deceive others online – often make all kinds of excuses to avoid showing their face or even talk on the phone. Excuses range from illness, family or work obligations, to the burdensome cost of travel. When two people have a deep connection based on genuine love, they’ll make the necessary compromises to show their real face.
Romance scammers may constantly lament their financial woes and say how they wished money wasn’t a problem. To gain sympathy, they may claim to have a sick family member or pet who needs expensive medical treatment. At this point, the scammer will hope that the target offers to send money, or the scammer may sheepishly request money outright. To keep targets from growing suspicious or resentful, the scammer is often overly thankful and promises to never ask for money again; however, they always do. Never share your crypto wallet private key with anyone, and immediately be on alert if someone you met online and have never met in person asks for payment in crypto.
Everyone who’s ever endured a breakup hates this saying for its maddening simplicity, but its message is true: There are other fish in the sea. Literally billions. Everyone deserves a partner who respects their time and needs. If the person on the other side of the screen is taking more than they’re giving, it’s time to say goodbye.
A partner who will never let you down is McAfee+ Ultimate. This all-in-one device, privacy, and identity protection service lets you live your best online life confidently. In case you ever fall victim to identity theft or you suspect your credit is compromised, you’re protected with credit lock, security freeze, and up to $1 million in identity theft coverage.
So, this Valentine’s Day, slow down and evaluate each new match for the robustness of their messages, not their “photo,” “job,” or “grand future plans.” Be careful in that harsh dating world and never settle for mediocre. The perfect person is out there somewhere!
1Federal Trade Commission, “Reports of romance scams hit record highs in 2021”
2Federal Trade Commission, “Reports show scammers cashing in on crypto craze”
The post 3 Signs You May Be Caught in a Cryptocurrency Romance Scam appeared first on McAfee Blog.
If you’re like most people, you like to stay connected whether you are traveling or just on the go. That’s why it can be tempting to connect to free, public Wi-Fi networks, but you should know that these networks could open you up to some serious risks.
Public Wi-Fi networks often lack a security measure called encryption, which scrambles the information sent from your computer or device to the router so strangers cannot read it. Without this security measure in place, the information you send over these networks can potentially be intercepted by cybercrooks.
This information could include your banking and social media passwords, as well as your identity information. A nosy cybercriminal could also potentially snoop on you by watching which websites you visit, and what you type into web forms.
In fact, it is so easy to steal your information over unsecured networks cybercrooks sometimes set up malicious Wi-Fi hotspots in high-traffic areas, like airports, with the intention of grabbing users’ information.
That’s why if you have to connect when you’re away, you should only use secure and well-advertised Wi-Fi networks. You can usually tell if they use encryption because they require a password to join.
If you have to do something sensitive online, like check your bank account balance or make a purchase, try to stick to webpages that start with “HTTPS” rather than just “HTTP”. The “S” stands for secure and indicates that the site uses encryption to protect your data. You can also look for a green lock icon at the beginning of the browser address, which indicates that the website connection is secure.
If you are on your mobile phone, you can skip the Wi-Fi network altogether and connect using the cellular network. It is somewhat more secure since it’s harder for cybercrooks to sniff out your individual data from others on the network.
If you travel a lot, consider investing in a Virtual Private Network (VPN), which is a piece of software that allows you to create a secure connection to another network over the Internet. Anyone potentially trying to snoop on you will only see that you are connected to the VPN, and not what you are doing.
Of course, the most important thing is to remember that using public Wi-Fi is always risky, and requires some extra steps to protect your data.
The post Why You Need to Watch Out When Using Public Wi-Fi appeared first on McAfee Blog.
“Together for a better internet.” That’s the rallying cry of this year’s Safer Internet Day, and it’s one we’re happy to hear. Particularly from a parent’s perspective.
Safer Internet Day celebrates its 20th year on February 7th and focuses on ways we can all protect, empower, and respect all children when they go online—and gives us an opportunity to reflect on what that really means.
Consider that for some time now, children have found themselves born into an online world. As soon as they can pick up a toy, they can pick up a phone or tablet too. And they often do, given that they’re growing up in homes where one is practically always in reach. With that, their online life begins.
Learning how to live life online is simply another part of growing up nowadays. And that’s where we as parents play a significant role. Just as in every other aspect of life, they look to us for guidance, encouragement, and new things to see and do online. Safely, too.
Children have said as much. In our recent global report entitled “Life Behind the Screens of Parents, Tweens, and Teens,” we asked who is best suited to teach them about being safe online. Children said their parents are the clear winners. Nearly three-quarters of children pointed to parents, almost twice more than teachers at school (39%) and more than twice over for online resources (34%).
However, while parents agreed with this, it appears they didn’t always follow through. For starters, parents reported using basic protection on their own computers at a relatively low rate. Even the simplest of security steps scored relatively low despite how relatively easy they are to take. That included using antivirus software (68%), protecting the computer with a password (58%), or sticking to reputable online stores when shopping (50%). These figures dropped yet lower when asked if they took the same precautions for their children on their computers.
For example, only 57% of parents said they installed antivirus on their child’s computer and only 44% have their child password or passcode protect their computer, as illustrated by the drops in the chart below.
This trend extends to smartphones as well. While 56% of parents said that they protect their smartphone with a password or passcode, only 42% said they do the same for their child’s smartphone—a 14% difference. Again, considering how easy it is to create a password or passcode for a phone, and how much of our online lives course through those devices, that figure would ideally come in at 100%.
In all, many parents protect their children even less than they protect themselves.
Everyone loves their smartphone. Children particularly so. While parents placed their smartphone as their top device at 59%, followed by their computer or laptop at 42%, tweens and teens put their smartphone at the top of the at a decisive 74%. Second was their gaming console at 68%.
Unsurprisingly, that love for the smartphone pushes children’s internet usage quickly to an adult level at an early age, marking a sort of early mobile maturity where they are exposed to the broader internet full of apps, chats, entertainment, and social media—along with their benefits and risks nearly right away.
Taken with the low level of security measures parents place on their children’s phones, we can see how children are going online with a device that’s largely unprotected—in part because their parents leave their smartphones largely unprotected as well.
Beyond devices, parents have other concerns about their children as they increasingly spend more time online, particularly as they get older. Some of the top ones include:
Increasingly, staying safe online involve more than protecting devices—it revolves around protecting the people who use them. Topics like the ones above are prime examples. They’re about people, not devices. Further, we have the broader issues of staying more private online and protecting your identity from hackers, scammers, and thieves—where once again, bad actors target people, not their devices.
It’s a lot to keep on top of.
And that can feel a bit overwhelming to a parent. Luckily, as with other aspects of parenting, you don’t have to think about all these topics all at once. They’ll crop up naturally over time, just as the umpteen other teaching moments do over the course of parenting.
It starts with asking a few questions. What might be on the horizon for our children as they go online over the next few weeks and months? How can you support them? And how can you prepare yourself for that support? Granted, those are some pretty broad questions. Yet we can help:
As for tools you can use to help keep your children safer online, we just released our McAfee+ Family Plans, online protection that’s personalized for the ones closest to you. Whether you want to protect your partner, children, parents, or a loved one practically anywhere, they offer tailored device, identity, and privacy protection for up to six people.
For your children, that means you can protect them from viruses, sketchy websites, and inappropriate content—plus establish ground rules for screen time, all in a way that’s right for them. Each child also gets their own Protection Score, a reflection of just how safe they are online, which you can quickly review and then get guide you through steps that can make them safer still. In all, it’s a powerful tool for parents who care about their children’s safety online.
You have yet another powerful tool at your disposal: conversations. You’ll find that some of the best protection you provide stems from chats with your children.
Sit down with them while they play an online game, ask what apps they like to use, or ask to look when a TikTok reel makes them laugh. These are all natural moments to get a glimpse into their digital life and simply talk about it—without lectures or preaching. The more you can make talking about life online feel like a normal thing, the more opportunities you’ll get to support them when they need it.
As parents, we can look at our children now and wonder what the internet will bring to them in the next five, ten, or even twenty years from now. It’s exciting, perhaps a bit dizzying, yet it’s more reason to offer your guidance and encouragement, to learn about life online together. That will give them a foundation they can build on, so they can enjoy a fulfilling and safer life online.
The post Safer Internet Day: Through a Parent’s Eyes appeared first on McAfee Blog.
Cybercriminals will always try to cash in on a good thing, and football is no exception. Online scammers are ramping up for the big game with all types of schemes designed to rip you off and steal your personal info—but you have several ways you can beat them at their game.
Like shopping holidays, tax season, and even back-to-school time, scammers take advantage of annual events that get people searching for deals and information online. You can include big games and tournaments in that list too.
Specific to this big game, you can count on several types of scams to rear their heads this time of year—ticket scams, merchandise scams, betting scams, and phony sweepstakes as well. They’re all in the mix, and they’re all avoidable. Here, we’ll break them down.
As of two weeks out, tickets for the big game on the official ticketing website were going for $6,000 or so, and that was for the so-called “cheap seats.” Premium seats in the lower bowl 50-yard line, sold by verified resellers, were listed at $20,000 a pop or higher.
While the game tickets are now 100% mobile, that hasn’t prevented scammers from trying to pass off phony tickets as the real deal. They’ll hawk those counterfeits in plenty of places online, sometimes in sites like your friendly neighborhood Craigslist.
So if you’re in the market for tickets, there are certainly a few things to look out for:
If you plan on enjoying the game closer to home, you may be in the market for some merch—a hat, a jersey, a tee, or maybe some new mugs for entertaining when you host the game at your place. With all the hype around the game, out will come scammers who set up bogus online stores. They’ll advertise items for sale but won’t deliver—leaving you a few dollars lighter and the scammers with your payment information, which they can use on their own for identity fraud.
You can shop safely with a few straightforward steps:
This is a great one to start with. Directly typing in the correct address for reputable online stores and retailers is a prime way to avoid scammers online. In the case of retailers that you don’t know much about, the U.S. Better Business Bureau (BBB) asks shoppers to do their research and make sure that retailer has a good reputation. The BBB makes that easier with a listing of retailers you can search simply by typing in their name.
If you feel like doing extra sleuthing, look up the address of the website and see when it was launched. A visit to the Internet Corporation for Assigned Names and Numbers (ICANN) at ICANN.org gives you the option to search a web address and see when it was launched, along with other information about who registered it. While a recently launched site is not an indicator of a scam site alone, sites with limited track records may give you pause if you want to shop there—particularly if there’s a chance it was just propped up by a scammer.
<h3>Look for the lock icon in your browser when you shop.
Secure websites begin their address with “https,” not just “http.” That extra “s” in stands for “secure,” which means that it uses a secure protocol for transmitting sensitive info like passwords, credit card numbers, and the like over the internet. It often appears as a little padlock icon in the address bar of your browser, so double-check for that. If you don’t see that it’s secure, it’s best to avoid making purchases on that website.
Credit cards are a good way to go. One reason why is the Fair Credit Billing Act, which offers protection against fraudulent charges on credit cards by giving you the right to dispute charges over $50 for goods and services that were never delivered or otherwise billed incorrectly. Your credit card companies may have their own policies that improve upon the Fair Credit Billing Act as well. Debit cards don’t get the same protection under the Act.
Comprehensive online protection software will defend against the latest virus, malware, spyware, and ransomware attacks plus further protect your privacy and identity. In addition to this, it can also provide strong password protection by generating and automatically storing complex passwords to keep your credentials safer from hackers and crooks who may try to force their way into your accounts. And, specific to the scams floating around this time of year, online protection can help prevent you from clicking links to known or suspected malicious sites.
It’s hard to watch sports these days without odds and stat lines popping up onto the screen, along with a fair share of ads that promote online betting. If you’re thinking about making things interesting with some betting, keep a few things in mind:
As it is every year, you’ll see kinds of sweepstakes and giveaways leading up to the game, plenty of them legitimate. Yet as they do, scammers will try and blend in by rolling out their own bogus promotions. Their aim: to part you from your cash or even your personal information.
A quick way to sniff out these scams is to take a close look at the promotion. For example, if it asks you to provide your bank information to send you your prize money, count on it being a scam. Likewise, if the promotion asks you to pay to claim a prize in some form or other, it’s also likely someone’s trying to scam you.
In all, steer clear of promotions that ask something for something in return, particularly if it’s your money or personal information.
As it is of late, all kinds of scams will try to glom onto the big game this year. And some of the best advice for avoiding them is not to give in to the hype. Scammers prey on scarcity, a sense of urgency, and keyed-up emotions in general. Their hope is that these things may make you less critical and more likely to overlook things that would otherwise seem sketchy or too good to be true. Staying focused as you shop, place a wager, or otherwise look to round out your enjoyment of the big game is some of your absolute best defense against scammers right now, and any time.
The post Super Scams – Beat the Online Scammers Who Want to Sack Your Big Game appeared first on McAfee Blog.
Knowing the whole family is protected online is a great feeling—that they’re safe from online scams, inappropriate content, and people stealing or collecting their personal data. But online protection looks a little different for everyone, because everyone goes online a little differently.
With that, we’re introducing our McAfee+ Family plans, online protection that protects each family member with their own login, all based on their online risks and activities.
Like so many things in family life, a one-size-fits-all approach doesn’t always do the trick. For example, a movie night with an award-winning film that’s “R” rating may be fine for mom and dad but not for the kids. And music? CoComelon works great for playdates, but not for dinner dates. Yet everyone in the family wants the same thing. To enjoy themselves. It just looks different from person to person.
The same goes for online protection.
We all need protection when we go online. Yet different family members may need different kinds of protection depending on their age, interests, and what they do online. So, staying safer calls for a personalized approach, one that’s tailored to the things they do online.
McAfee+ Family plans offer identity, privacy, and device protection for up to six people so that you know that they’re protected from viruses, fraud, identity theft, and inappropriate content in a way that’s right for them.
The larger idea that inspired our family plans is this—you should have absolute confidence that everyone you care about has the protection they need.
That can get a little tricky when you think it through. With the family spending so much time online, it’s tough to know what everyone’s really doing, or if they’re safe while they’re doing it. Add to that all the ways companies track our activities online and the clever phishing tricks hackers use to steal our identity, there’s plenty to be concerned about. Simply put, it’s tough to know if everyone has the right protection in place and ways to take control of their privacy and identity.
Our family plans make sure they have it, and it can cover any loved one anywhere. That includes family still living at home, but it could also include your aunt two time zones away, the kids away at school, or an elderly mom in the next town. If it’s someone you care about, you can protect them with this plan. Up to six people in total.
That’s the idea. Everyone gets the right protection they need when they go online. Imagine ordering a pizza where each of the slices has someone’s favorite topping. That’s how our new family plan works. Your children get one set of protections made for them, your parents another, and you yet another. The result is the same, though. You’ll know everyone is safer. Because you set it up.
I’m happy to share that our McAfee+ Family plans are available now, ready to protect the people who matter most—your people, the way they go online, wherever they are.
The post McAfee+ Family Plans: The Right Protection for the Right People—Your People appeared first on McAfee Blog.
Written by James Schmidt
Editor’s Note: We often speak of online scams in our blogs, ones that cost victims hundreds if not thousands of dollars. This account puts a face on one of those scams—along with the personal, financial, and emotional pain that they can leave in their wake. This is the story of “Meredith,” whose aunt “Leslie” fell victim to an emerging form on online elder fraud. Our thanks to James for bringing it forward and to “Meredith’s” family for sharing it, all so others can prevent such scams from happening to them.
“Embarrassing. Simply embarrassing.” She shook her head. “It’s too raw. I can’t talk about it right now. I need time.”
Her aunt had been scammed. To the tune of $100,000 dollars. My colleague—we both work in the security industry—felt a peculiar sense of loss.
“I work in this industry. I thought I’d done everything right. I’ve passed on enough warnings to my family and friends to ensure they’d avoid the fate of the scammed. Simply because I’m in this industry does not imply my circle is always aware of all the threats to them, even if I do my best to teach them.”
“My mental state, recently, borders on shame; this feeling, you know? How could someone working in my industry have something like this happen to a family member?”
I told her many people working in other industries cannot control what happens to people in their families even if people in that industry had knowledge that could have helped them or otherwise avoided a problem altogether.
“I know, but this simply should never have happened! My aunt is one of the smartest, most conscientious people I know, and she fell for this. It’s crazy and I can’t wrap my head around it.”
My colleague, let’s call her Meredith (not her real name as she’s a bit ashamed to know this happened to a family member), told me the beginnings.
Let’s call her aunt Leslie.
Her story unfolds, the overall picture a pastiche of millions of people in the United States today. Her aunt is retired, bored, lonely, and isolated. She feels adrift without something to occupy her time; she was looking for companionship, connections, someone (anyone) to talk to. Her feelings intensified during the pandemic. She morphed into perfect prey for scammers of what is now known as the “Pig Butchering Scam.”
The term “Pig Butchering” has a visceral and raw feel to it, which falls right in line with how brutal this scam can be. It’s a long con game, where the scammer befriends the victim and encourages them to make small investments through the scammer, which get bigger and bigger over time. The scammer builds trust early with what appear to be small investment wins. None of it is legit. The money goes right into the scammer’s pocket, even as the scammer shows the victim phony financial statements and dashboards to show off the bogus returns. Confidence grows. The scammer wrings even larger sums out of the victim. And then disappears.
It was a targeted attack that started innocuously enough with a “fake wrong number”. An SMS arrives. A text conversation starts. The scammer then apologizes but tells Leslie someone gave them the number to initiate the text.
The scammer then uses emotional and psychological techniques to keep Leslie hooked. “How are you, are you having a nice day?” Leslie, being bored and interested, engages willingly.
The scammer asks to talk directly, not via text: and a phone conversation ensues. The scammer proceeds to describe—in very soothing detail—what they are doing, helping people, like Leslie, invest their “hard-earned money” into something that will make them more money, to help them out in retirement.
Of course, it is too good to be true.
“The craziest part of all of this is my aunt refuses—to this day—to believe she’s been scammed!”
She still thinks this scammer is a “friend” even though the entire family is up in arms over this, all of whom beg her aunt to “open her eyes.”
“My aunt still thinks she’d going to see that money again, or even make some money, which is crazy. The scammers are so good at emotional intelligence; really leveraging heartstrings and psychological makeup of the forlorn in society. My aunt finally agreed to stop sending more money to the scammers, but only after the entire family threatened to cut her off from the rest of the family. It took a lot to get her to stop trusting the scammers.”
Meredith feels this is doubly sad as the aunt in question is not someone they’d ever imagine would in this predicament. She was always the upright one, always the diligent and hardworking and the best with money. She is smart and savvy and we could never imagine her to be taken by these people and taken so easily. It boggles the mind.”
She did start to change in the last few years. And the pandemic created a weird situation. Retirement, loneliness from loss of a partner, and the added burden of the pandemic created a perfect storm for her to open herself up to someone willingly, simply for the sake of connection.
“No one deserves this. It has rocked my family to the core. It is not only about the money, but we’ve found family bonds stretched. She believes these random people, these scammers, more than she believes her own family. Have we been neglectful of our aunt? Does she no longer put her faith in people she knows, rather gives money to complete strangers?”
Being a security professional does not provide magical protection. We are more aware of scams and scammers, and how they work, and what to look for, and we try to do all we can to keep our family aware of scams out there in the big wide world, but we are human. We fall short.
Diligence is action. Awareness is action. Education is action.
We need to be better, all of us, at socializing risky things. We need to consistently educate our family and friends to protect themselves, not only via security software (which everyone should have as default) but by providing tips and tricks and warnings for things we all need to be on the lookout. This is not a one-time thing. The cliché holds true: “If you see something say something.” Repetition helps.
In today’s world, the need for protecting people’s security, identity, and privacy is critical to keeping them safe. Scammers long stopped focusing on attacking only your computer. Now focus more than ever on YOU: your identity, your privacy, your trust. If they get you there, they soon get your money.
As for contributing factors to scammers success with their victims, such as loneliness, isolation, and boredom, they all have remedies. Make connections with your loved ones, especially those easily tagged as vulnerable, those you feel might be at risk. Reach out. It may be hard sometimes due to distance and other factors but make it a point to connect. There is a reason these scammers are succeeding. They are stepping into roles of companions to people who are desperate for connection.
Most people are greatly saddened at seeing other people being “taken.” Let’s work together to help stop the scammers.
Look out for each other, and get your people protected!
Editor’s Closing Note:
If you or someone you know suspects elder fraud, the following resources can help:
For further reading on scams and scam prevention, check out the guides in our McAfee Safety Series, which provide in-depth advice on protecting your identity and privacy—and your family from scams. They’re ready to download and share.
The post A Scam in the Family—How a Close Relative Lost $100,000 to an Elder Scam appeared first on McAfee Blog.
All your online activity creates a trail of data. And that data tells a story. The story of you.
The websites, apps, and services you use throughout the day all collect data. They may collect data about your behaviors, interests, and purchases—along with what you’re doing, for how long, and where, largely without your knowledge. They may also collect personal information, information you provide, such as health records, your Social Security Number, banking info, your driver’s license number, and more. This can include further health data, such as the kind that gets tracked from a smartwatch or wearable device.
“So what?”
I’ve heard plenty of people say exactly that about data collection. And plenty of others simply resign themselves to the reality of data collection. “What’s out there is already out there.” They feel like there’s not much they can do about it. If anything at all. And does it really matter?
It absolutely matters.
That is, it matters if you hate spam calls and texts. If you’re worried about identity theft. If you’re worried that practically anyone can purchase a detailed picture of your personal information from an online data broker and use it as they like.
Indeed, your data tells the story of you. And plenty of others are interested in your story. Businesses and advertisers for one, so they can market to the most targeted of your needs and interests. Yet also hackers, scammers, spammers, and thieves—and in extreme cases, stalkers as well.
While it’s true that you cannot control how each byte of data about you and your family is shared and processed, you’re not helpless! In many cases, you can control how you share your data by taking a few steps. Your data is precious, and you deserve to be selective about who you share it with.
That’s the reason you’ve seen McAfee roll out so many protections for your privacy and identity, with several more to come. While there are so many tools for data collection today, so are the tools for you to take control.
Looking at our own McAfee+ online protection plans, they offer you identity theft and fraud protections such as Personal Data Cleanup, identity monitoring, along with credit monitoring, a VPN that can help keep your online activity more private, $1M in identity theft coverage and support from an identity restoration specialist … the list goes on. These are tools everyone can benefit from in the face of the current threats out there.
The evolution of McAfee+ reflects the nature of online threats today. Increasingly, the target is you—your privacy, your identity, and all the things that they unlock.
Another simple yet powerful step is to protect your devices with comprehensive online protection software. This will help defend you against the latest virus, malware, spyware, and ransomware attacks plus further shield your privacy, and minimize web tracking (think advertisers) with a VPN. In addition to this, it will also create and store strong, unique passwords, and offer web protection that can help steer you clear of sketchy websites that may try to steal your data.
Start with the devices and apps you use most. Different devices and apps will have their own privacy settings, so give them a look and see what your options are. You may be surprised to find how you can limit which information advertisers can use to serve up ads to you. You may find that some apps have GPS tracking turned on, even though they don’t need it to function. All of this adds up to data that companies may collect, share, or resell—depending on their privacy policy. Again, start with the devices and apps you use most then expand from there. It’s also a good opportunity to delete apps you don’t use anymore—along with the data associated with them.
One major privacy leak comes at the hands of online data brokers, companies that collect and resell volumes of exacting personal information about millions of people. In fact, they make up a multi-billion-dollar industry that spans worldwide. Additionally, there are so-called “White Pages” and “people finder” sites that post information like names, addresses, and other public records that anyone can access. With all this information collected in a central location that’s easily searched and accessed, these sites can be an ideal resource for hackers, spammers, and thieves. McAfee’s Personal Data Cleanup can help you take control. It scans high-risk data broker sites and lets you know which ones are selling your data, and depending on your McAfee+ plan, it can remove it for you too.
Yet you can take even more control of your privacy. As part of our McAfee Safety Series, we have an entire guide dedicated to the topic of online privacy, the McAfee Digital Privacy Guide. It shows you ways that you can take control of your digital privacy, insight into what information you may be creating, and how you may be passing it along—whether you know it or not.
In all, your privacy is your own. We believe that what you share and don’t share, who you share it with and who you don’t, and for what reason … should be your decision.
It’s your story. Take control. And we’re here to help.
The post How to Protect Your Personal Data appeared first on McAfee Blog.
ChatGPT: Everyone’s favorite chatbot/writer’s-block buster/ridiculous short story creator is skyrocketing in fame. 1 In fact, the AI-generated content “masterpieces” (by AI standards) are impressing technologists the world over. While the tech still has a few kinks that need ironing, ChatGPT is almost capable of rivaling human, professional writers.
However, as with most good things, bad actors are using technology for their own gains. Cybercriminals are exploring the various uses of the AI chatbot to trick people into giving up their privacy and money. Here are a few of the latest unsavory uses of AI text generators and how you can protect yourself—and your devices—from harm.
Besides students and time-strapped employees using ChatGPT to finish writing assignments for them, scammers and cybercriminals are using the program for their own dishonest assignments. Here are a few of the nefarious AI text generator uses:
The best way to avoid being fooled by AI-generated text is by being on high alert and scrutinizing any texts, emails, or direct messages you receive from strangers. There are a few tell-tale signs of an AI-written message. For example, AI often uses short sentences and reuses the same words. Additionally, AI may create content that says a lot without saying much at all. Because AI can’t form opinions, their messages may sound substance-less. In the case of romance scams, if the person you’re communicating with refuses to meet in person or chat over video, consider cutting ties.
To improve your peace of mind, McAfee+ Ultimate allows you to live your best and most confident life online. In case you ever do fall victim to an identity theft scam or your device downloads malware, McAfee will help you resolve and recover from the incident. In addition, McAfee’s proactive protection services – such as three-bureau credit monitoring, unlimited antivirus, and web protection – can help you avoid the headache altogether!
1Poc Network, “I asked AI (ChatGPT) to write me a rather off short story and the result was amazing”
2CyberArk, “Chatting Our Way Into Creating a Polymorphic Malware”
The post ChatGPT: A Scammer’s Newest Tool appeared first on McAfee Blog.
FreshRSS 