Author: admin

The latest Magecart iteration is finding success with a new PHP web shell skimmer.

Hey, that’s not my kitchen! Those aren’t my kids! And that dreadful wallpaper’s certainly not mine!

Keynoters from Cisco, Netflix and RSA highlighted lessons from the last year, and cybersecurity’s new mandate in the post-pandemic world: Bounce back stronger.

The criminal forum washed its hands of ransomware after DarkSide’s pipeline attack & alleged shutdown: A “loss of servers” that didn’t stop another attack.

Pandemic and evolving IT demands are having a major, negative impact on CISOs’ mental health, a survey found.

The advanced Brazilian malware has gone global, harvesting bank logins from Android mobile users.

Most US critical infrastructure is run by private corporations. This has major security implications, because it’s putting a random power company in — say — Ohio — up against the Russian cybercommand, which isn’t a fair fight.

When this problem is discussed, people regularly quote the statistic that 85% of US critical infrastructure is in private hands. It’s a handy number, and matches our intuition. Still, I have never been able to find a factual basis, or anyone who knows where the number comes from. Paul Rosenzweig investigates, and reaches the same conclusion.

So we don’t know the percentage, but I think we can safely say that it’s a lot.

Summary points:

• Scammers are increasingly using Windows Push Notifications to impersonate legitimate alerts
• Recent campaigns pose as a Windows Defender Update
• Victims end up allowing the installation of a malicious Windows Application that targets user and system information

Browser push notifications can highly resemble Windows system notifications.  As recently discussed, scammers are abusing push notifications to trick users into taking action.  This recent example demonstrates the social engineering tactics used to trick users into installing a fake Windows Defender update.  A toaster popup in the tray informs the user of a Windows Defender Update.

Clicking the message takes the user to a fake update website.

The site serves a signed ms-appinstaller (MSIX) package.  When downloaded and run, the user is prompted to install a supposed Defender Update from “Publisher: Microsoft”

After installation, the “Defender Update” App appears in the start menu like other Windows Apps.

The shortcut points to the installed malware: C:Program FilesWindowsApps245d1cf3-25fc-4ce1-9a58-7cd13f94923a_1.0.0.0_neutral__7afzw0tp1da5ebloomEversible.exe, which is a data stealing trojan, targeting various applications and information:

• System information (Process list, Drive details, Serial number, RAM, Graphics card details)
• Application profile data (Chrome, Exodus wallet, Ethereum wallet, Opera, Telegram Desktop)
• User data (Credit card, FileZilla)

Am I protected?

• McAfee customers utilizing Real Protect Cloud were proactively protected from this threat due to machine learning.
• McAfee customers utilizing web protection (including McAfee Web Advisor and McAfee Web Control) are protected from known malicious sites.
• McAfee Global Threat Intelligence (GTI) provides protection at Very Low sensitivity

General safety tips

• See: How to Stop the Popups
• Scams can be quite convincing. It’s better to be quick to block something and slow to allow than the opposite.
• When in doubt, initiate the communication yourself.
  • For Windows Updates, click the Start Menu and type “Check For Updates”, click the System Settings link.
  • Manually enter in a web address rather than clicking a link sent to you.
  • Confirm numbers and addresses before reaching out, such as phone and email.

Reference IOCs

• MSIX installer: 02262a420bf52a0a428a26d86aca177796f18d1913b834b0cbed19367985e190
• exe: 0dd432078b93dfcea94bec8b7e6991bcc050e6307cd1cb593583e7b5a9a0f9dc
• Installer source site: updatedefender [dot] online

 

The post Scammers Impersonating Windows Defender to Push Malicious Windows Apps appeared first on McAfee Blogs.

Data protection acts are regularly coming into force around the world and on July 1^st 2021 it is the turn of South Africa, as the POPIA (Protection of Personal Information Act) will be enforced from that date.  I caught up with David Luyt, Privacy Counsel at Michalsons in Cape Town to discuss what this means for South African consumers, businesses and IT teams.

Nigel: Must my organisation comply with POPIA?

David: Essentially, if you are domiciled in South Africa or you process personal information in South Africa, then you need to comply with POPIA. POPIA, unlike the GDPR, does not apply extraterritorially. Meaning that it only applies to organisations in South Africa.

Nigel: How can I find out more about the POPI Act?

David: Knowledge is Power. Having a high-level awareness of POPIA is crucial in helping you decide what your next steps are going to be. To learn more about the impact of POPIA on your organisation, take the Michalsons’ complimentary impact assessment for your specific organisation, read our insights on it, or watch our video.

Nigel: Who is the right person to be responsible for this?

David: Every organisation has an Information Officer by default and they are responsible for ensuring that the organisation complies with POPIA. However, the whole organisation needs to understand its responsibilities. Any employee that handles personal information, all systems that store and process that information and all 3^rd party and cloud providers that are part of that data processing need to be reviewed and understand their responsibilities.

Nigel: What is the impact on my organisation?

David: You need to know the impact of POPIA on your specific organisation so that you can decide what the next best steps are.

Complying with POPIA is not a case of one size fits all. Different organisations need to take different actions to comply. For example, what a small enterprise (or SME) has to do is very different from what a medium or large-sized organisation has to do.

An organisation’s actions are also dependant on the foundations already built to protect personal information. Some organisations may have many safeguards in place while others are new to the issue.

Nigel: What are my organisation’s next steps?

David: At Michalsons we believe that data protection is like personal fitness – it takes time to get fit! To learn more, have a look at our top tips for data protection projects. And if you’re wondering ‘how much does data protection compliance cost?’ then we have the answer for that too!

Nigel: Which departments seem to need the most help understanding POPIA?

David: It would be unfair to single out a single group or department, but the adage “you cannot manage what you cannot see” is very true in this situation.  Every organisation needs to know where its personal data is kept, how it is handled and make sure that all employees recognise the importance of the Act.

A lot of initial work falls to the IT department to find all the current data on employees, business partners and clients and to ensure that this data is kept secure – whether inside or outside the organisation.

As we discussed in our joint webinar, this includes reviewing all outsourcing and cloud services – when you share or pass data to other organisations you are STILL responsible for everything that happens to that data, so you need to review these providers and put in appropriate measures to make sure that the data handling policies are designed to conform to the Act.

Your document on mapping POPIA to Cloud Computing has some good ideas for IT people to review – and not just for cloud, but all data handling should be reviewed in a similar way.

Nigel: Thank you for your time.

David: My pleasure.

 

The post POPIA – July 1st Deadline Approaches For New South African Data Protection Act appeared first on McAfee Blogs.

Every year CRN recognizes the women who are leading the channel and their unique strengths, vision, and achievements. This year, CRN recognized five McAfee individuals on their prestigious list of those leading the channel. Those selected demonstrate commitment to mentoring future generations and driving channel innovation and growth.

The 2021 Women of the Channel (WOTC) awards highlight over 1,000 women in all areas of the IT ecosystem, including technology vendors, distributors, solution providers and other IT organizations. We’re thrilled to see our colleagues recognized for their strategic vision and dedication to channel success. See below to learn more about each McAfee honoree.

Please join us in celebrating this recognition and congratulating these exceptional women who are at the heart of our channel business.

Kristin Carnes, Senior Director, Global Distribution Sales, Strategy

A channel veteran of 20+ years and 2020 WOTC recipient, Kristin Carnes joined McAfee through the acquisition of Skyhigh Networks and has lead channel growth for industry bellwethers like EMC (NYSE: EMC), Nimble Storage, (HPE Subsidiary) and Veritas Software. She was chosen to lead McAfee’s global channel programs and operations and now leads global teams supporting an extensive network of distributors. Kristin was instrumental in organizing the early 2021 expansion of McAfee and Ingram Micro’s partnership to sell in more than 20 countries leveraging the Ingram Cloud Marketplace. She has also launched new partner experience initiatives that have been adopted worldwide and driven changes in the McAfee rebate policy to improve partner profitability.

Madeline Fugate, Distribution Account Manager

Madeline Fugate is an experienced sales and marketing leader with 23 years of experience in the channel. Madeline has a passion for mentoring and nurturing younger talent. Through coaching, she has developed a strong McAfee team for Tech Data that has delivered Tech Data’s Cyber Range with McAfee on premise and cloud solutions as well as an easy to use customer demo environment. Her work with Tech Data led to further growth in 2021 with IBM. This year, she also launched McAfee’s first social media campaign through Tech Data and played a fundamental role in improving operational efficiency to reduce quoting lead times.

Sheri Leach, Senior Distribution Account Manager

With 25+ years of experience in distribution, Sheri Leach has dedicated the last 15 years to supporting and growing Ingram Micro with their McAfee business. This year, she was instrumental in launching McAfee on the Ingram Micro Cloud Marketplace soon to bring in millions of dollars in no touch business to McAfee and our partners. She’s worked closely with the team at Ingram Micro to also facilitate a creative finance program and to deliver a Business Intelligence program that helped the McAfee sales teams to create, plan and execute on business plans to drive more sales. Sheri was recognized on the 2020 WOTC list and believes that in 2021, the keys to partner success are partner enablement, frequent engagement and special finance to ensure partners are thriving amid the pandemic.

Sarah Thompson, Worldwide Service Provider Program Manager

Sarah Thompson joined McAfee’s channel organization 13 years ago and has spent the last six years focused on building the Service Provider Specialization for partners delivering managed services globally. This year, Sarah managed the launch coordination, tracking progress and initiatives across product, channel, marketing and executive teams for McAfee’s partner lead managed endpoint detection and response (EDR) offerings. She’s driven innovation for McAfee’s channel by helping define a select set of partners as Global Service Provider Partners through the creation of formal requirements and curriculum.

Natalie Tomlin, Director, North America Channel Sales

Natalie Tomlin has been at McAfee for over 20 years, and currently drives much of McAfee’s “Channel First” global strategy through resources, tools, enablement and marketing efforts ensuring partners and customers have a good experience with McAfee. Her team is focused on helping McAfee’s strategic partners lead customer cloud adoption and deliver security from Device to Cloud. Returning to the WOTC list from 2020, Natalie’s current goal is to continue with McAfee’s “Channel First” strategy and to continue empowering, enabling, and listen to our partners.

The post CRN’s Women of the Channel 2021 Recognizes McAfee Leaders appeared first on McAfee Blogs.