Author: admin

Zscaler has found more than 200 malicious apps on Google Play with over eight million installs

The Washington Post has a long and detailed story about the operation that’s well worth reading (alternate version here).

The sales pitch came from a marketing official trusted by Hezbollah with links to Apollo. The marketing official, a woman whose identity and nationality officials declined to reveal, was a former Middle East sales representative for the Taiwanese firm who had established her own company and acquired a license to sell a line of pagers that bore the Apollo brand. Sometime in 2023, she offered Hezbollah a deal on one of the products her firm sold: the rugged and reliable AR924.

“She was the one in touch with Hezbollah, and explained to them why the bigger pager with the larger battery was better than the original model,” said an Israeli official briefed on details of the operation. One of the main selling points about the AR924 was that it was “possible to charge with a cable. And the batteries were longer lasting,” the official said.

As it turned out, the actual production of the devices was outsourced and the marketing official had no knowledge of the operation and was unaware that the pagers were physically assembled in Israel under Mossad oversight, officials said. Mossad’s pagers, each weighing less than three ounces, included a unique feature: a battery pack that concealed a tiny amount of a powerful explosive, according to the officials familiar with the plot.

In a feat of engineering, the bomb component was so carefully hidden as to be virtually undetectable, even if the device was taken apart, the officials said. Israeli officials believe that Hezbollah did disassemble some of the pagers and may have even X-rayed them.

Also invisible was Mossad’s remote access to the devices. An electronic signal from the intelligence service could trigger the explosion of thousands of the devices at once. But, to ensure maximum damage, the blast could also be triggered by a special two-step procedure required for viewing secure messages that had been encrypted.

“You had to push two buttons to read the message,” an official said. In practice, that meant using both hands.

Also read Bunnie Huang’s essay on what it means to live in a world where people can turn IoT devices into bombs. His conclusion:

Not all things that could exist should exist, and some ideas are better left unimplemented. Technology alone has no ethics: the difference between a patch and an exploit is the method in which a technology is disclosed. Exploding batteries have probably been conceived of and tested by spy agencies around the world, but never deployed en masse because while it may achieve a tactical win, it is too easy for weaker adversaries to copy the idea and justify its re-deployment in an asymmetric and devastating retaliation.

However, now that I’ve seen it executed, I am left with the terrifying realization that not only is it feasible, it’s relatively easy for any modestly-funded entity to implement. Not just our allies can do this—a wide cast of adversaries have this capability in their reach, from nation-states to cartels and gangs, to shady copycat battery factories just looking for a big payday (if chemical suppliers can moonlight in illicit drugs, what stops battery factories from dealing in bespoke munitions?). Bottom line is: we should approach the public policy debate around this assuming that someday, we could be victims of exploding batteries, too. Turning everyday objects into fragmentation grenades should be a crime, as it blurs the line between civilian and military technologies.

I fear that if we do not universally and swiftly condemn the practice of turning everyday gadgets into bombs, we risk legitimizing a military technology that can literally bring the front line of every conflict into your pocket, purse or home.

If you think your Gmail account’s been hacked, you’ll want to act. And act quickly.

The fact is that your email has all manner of personal info in there. Receipts, tax correspondence, medical info, and so on. With a hacked account, that info might get deleted, shared, or used against you for identity theft.

Luckily, Google has mechanisms in place to restore a hacked Gmail account. We’ll walk through the steps here — and a few others that can keep you secure in the long term after you have your account back.

What are signs that your Gmail account got hacked?

Several things can tip you off, including:

• Discovering sent messages that you didn’t send.
• Changes to the labels or filters that help organize your mail.
• Updates to your security settings.
• You can’t log into your account with your password.
• Your account has been deleted entirely.

With varying degrees of certainty, those are some signs that your account has been hacked.

Also, many people have a Google Account linked with their Gmail password and login. Beyond email, that might include files in Google Drive, photos, a YouTube account, and other features that contain personal info. In those cases, that only increases the potential harm of a hacked account.

Additionally, services like Google Pay and Google Play complicate matters more in the event of a hacked account because they contain financial info.

If you see any unusual changes in those apps or services, that might be a sign of a hacked account as well.

What to do if you can’t access your Gmail account

If you think someone else has changed your password or deleted your account, head to Google’s account recovery page. It’ll take you through a multi-step process to restore your account.

With that, you’ll want to do some quick prep. First, do your best to begin the recovery process with a device that you typically use to access your account. Also, if possible, do it in a location where you typically access your account. This provides Google with identifiers that you are who you say you are.

After that, gather up your Gmail account passwords, old and current. The recovery page will ask for them, along with other questions. Do your best to answer each question the very best you can. There’s no penalty for a wrong answer and the more info you can provide, the better.

If you can access your Gmail account, but you think someone else is using it

If you can log into your account, yet worry it’s been hacked, take these steps:

• Go to your Google Account login page at: https://myaccount.google.com/
• In the menu, select Security -> Recent security events.
• Look for any suspicious activity and mark the events “Yes” or “No” if you did or didn’t do them yourself.
• Next, select Security -> Manage devices.
• If you find a device that you don’t recognize: Select “Don’t recognize a device?” Then, follow the steps on the screen to help secure your account.
• Lastly, select Security -> Your devices -> Manage all devices.
• Select any unfamiliar device and then sign it out.

Next, run a virus scan on your device. Your password might have gotten compromised in one of several ways, including malware. This can remove any malware that might be spying on your device (and your passwords).

At this point, create a new password that’s strong and unique. Use at least 14 characters using a mix of upper- and lowercase letters, symbols, and numbers. Or have a password manager do that work for you.

And finally, set two-factor verification on your account if you aren’t already using it. This makes your account far tougher to hack, as two-factor verification requires a unique code to log in. One that only you receive. And just like with your password, never share your unique code. Anyone asking for it is a scammer.

Looking ahead: Ways you can prevent your Gmail account from getting hacked

By taking the steps we just covered, you’ve done two important things that can protect you moving forward. One is setting up a strong, unique password. The second is using two-factor verification.

The next thing is to get comprehensive online protection in place. Protection like you’ll find in our McAfee+ plans offers several features that can keep you and your accounts safe.

Once again, your password got compromised one way or another. It could have been spyware on your device. It could have been a phishing attack. It could have been a data breach. The list goes on. However, we refer to it as comprehensive online protection because it’s exactly that. In addition to antivirus, our McAfee+ plans have dozens of features that can protect your devices, identity, and privacy.

For example:

• It has the password manager we mentioned above, which can protect all your accounts online with strong, unique passwords.
• Our multi-award-winning antivirus detects and removes malware that tries to steal your personal info.
• It also has protections against phishing attacks and against websites that try to steal passwords and personal info — like our Text Scam Detector and Web Protection.
• Our McAfee+ plans also have identity monitoring, so if your accounts or personal info crop up on the dark web, you’ll get notified.
• And our plans also include Online Account Cleanup. It scans for accounts you no longer use and helps you delete them, along with your personal info, so you’re less exposed to data breaches.

Recovering from a hacked Gmail account

The important thing is this: if you think your Gmail account got hacked, act quickly. You might have much more than just your email linked to that account. Files, photos, and finances might be tied to it as well.

Even if something looks just slightly off, act as if your account got hacked. Log in, change your password, establish two-step verification if you haven’t, and take the other steps mentioned above. Above and beyond your email and all the personal info packed in there, your account can give a hacker access to plenty more.

The post How to Reset Your Gmail Password After Being Hacked appeared first on McAfee Blog.

Online scammers are targeting Booking.com and Airbnb users with Telekopye, a Telegram-based toolkit

CISA urged organizations to tackle security risks from unencrypted cookies in F5 BIG-IP LTM systems

The US DoD has finalized the Cybersecurity Maturity Model Certification (CMMC) Program, which defense contractors must pass to bid for government contracts

Personal data of over 2600 employees has been exposed and insider information about the Switch 2 and future Pokémon games leaked

Japanese electronics firm Casio has reported a ransomware attack and data breach

Sophos claims that a lack of cybersecurity talent is considered a major risk by SMBs

Deploy the new 2nd Gen XGS Series desktops with zero touch.