Researchers observed what looks like the Emotet botnet – the “world’s most dangerous malware” – reborn and distributed by the trojan it used to deliver.

The FBI has issued a bulletin describing a bitcoin variant of a wire fraud scam:

As the agency describes it, the scammer will contact their victim and somehow convince them that they need to send money, either with promises of love, further riches, or by impersonating an actual institution like a bank or utility company. After the mark is convinced, the scammer will have them get cash (sometimes out of investment or retirement accounts), and head to an ATM that sells cryptocurrencies and supports reading QR codes. Once the victim’s there, they’ll scan a QR code that the scammer sent them, which will tell the machine to send any crypto purchased to the scammer’s address. Just like that, the victim loses their money, and the scammer has successfully exploited them.

[…]

The “upgrade” (as it were) for scammers with the crypto ATM method is two-fold: it can be less friction than sending a wire transfer, and at the end the scammer has cryptocurrency instead of fiat. With wire transfers, you have to fill out a form, and you may give that form to an actual person (who could potentially vibe check you). Using the ATM method, there’s less time to reflect on the fact that you’re about to send money to a stranger. And, if you’re a criminal trying to get your hands on Bitcoin, you won’t have to teach your targets how to buy coins on the internet and transfer them to another wallet — they probably already know how to use an ATM and scan a QR code.

The other day I was creating a new account on the web. It was financial in nature, which means it gets one of my most secure passwords. I used PasswordSafe to generate this 16-character alphanumeric password:

:s^Twd.J;3hzg=Q~

Which was rejected by the site, because it didn’t meet their password security rules.

It took me a minute to figure out what was wrong with it. They wanted at least two numbers.

Sheesh.

Okay, that’s not really why I don’t like password rules. I don’t like them because they’re all different. If someone has a strong password generation system, it is likely that whatever they come up with won’t pass somebody’s ruleset.

The malware landscape is growing more complex by the minute, which means that no device under your family’s roof—be it Android, iPhone, PC, or Mac—is immune to an outside attack. This reality makes it possible that one or more of your devices may have already been infected. But would you know it? 

Ho Ho Ho, Merry Hackmas 

According to 2021 statistics from the Identity Theft Resource Center (ITRC), the number of data breaches reported has soared by 17 percent over last year. In addition, as reported by McAfee, cybercriminals have been quick to take advantage of the increase in pandemic connectivity throughout 2020. McAfee Labs saw an average of 375 new threats per minute and a surge of hackers exploiting the pandemic through COVID-19 themed phishing campaigns, malicious apps, malware, and more. With Black Friday and Cyber Monday now at hand, we can count on even more new threats.  

Have you been hacked? 

Often, if your device has been compromised, you know it. Things get wonky. However, with the types of malware and viruses now circulating, there’s a chance you may not even realize it. The malware or virus may be working in the background sending usage details or sensitive information to a third party without disrupting other functions. So, be on the lookout for these tell-tale signs.  

5 signs of malware or a virus 

1. Your device is hot to the touch. When you accidentally download malware, your device’s internal components immediately begin working harder to support the malware or virus that’s been embedded. This may cause your device to be hot to the touch or even overheat.  
2. Everything ‘feels off.’ Much like a human virus can impact our whole body, a digital virus can impact every area of a device’s performance. For instance, it may cause websites to load slower, it may cause apps to crash, or your battery may not hold a charge. Overall performance remains sluggish no matter how many times you reboot or how many large files you delete.  
3. An increase in random pop-ups and new apps. If your device is housing a malicious app or a virus, you may notice an increase in random pop-ups (more than usual). And, if you take a closer look at your app library, you may even see app icons from apps you never downloaded.   
4. Fraudulent links from your accounts. It’s common for malware to gain access to your contacts list and then use your phone to send out messages to your friends—a powerful tactic designed to spread the malware to your contacts and their contacts and so on. This can happen via email, and more commonly, via your social media accounts. If you notice this cycle, change your passwords immediately and scan your devices for malware that may be working in the background on all devices.  
5. You have unauthorized charges. If you notice unauthorized charges on your credit card or banking statements, dig deeper. It may be a malicious app making purchases on your behalf or malware that’s grabbed your personal information to make fraudulent purchases.  

Ways to safeguard family devices

• Stay on top of updates. In addition to installing comprehensive security software to block malware and viruses, be sure to update your device’s security features. Regular updates give you the latest security features, some of which have been developed to thwart specific attacks. 
• Use strong, unique passwords. Every family device should have a strong password along with a unique username. This means changing your factory settings immediately and getting your family on a schedule to change passwords.  
• Know your apps. Only download apps from trusted sources. Avoid third-party apps. Also, consider researching the app safeguards and reading reviews before installing. A best practice is to stick to apps from the app store or verified associated app stores. 
• Don’t click that link. Slow down and notice your digital surroundings. Does that link look suspicious? Phishing scams that load malware and viruses onto your devices often come in emails, text messages, or via your trusted social media circles.  
• Lockdown settings and limit app permissions. A great way to block malware is to make all accounts as private as possible and limit app permissions. Instead of opting for “always-on” in an app’s permissions, change the setting, so it requires you to give the app permission every time. In addition, if an app requests access to your contacts or connect to other apps in your digital ecosystem, decline. Each time you allow an app to connect to different branches of your digital footprint, you hand over personal data and open yourself up to various new risks.  
• Clear browsing history. Take the time to go through your history and data. If you notice a suspicious link, delete it. Clear your browsing history by choosing your browser and clicking “clear history and website data.” 

Next steps 

If you discover a family device has been compromised, there are several things you can do. 1) Install security software that will help you identify the malware so you can clean your device and protect yourself in the future. 2) Delete any apps you didn’t download, delete risky texts, delete browsing history and empty your cache. 3) In some situations, malware warrants that you wipe and restore your device (Apple or Android) to its original settings. Before doing so, however, do your research and be sure you’ve backed up any photos and critical documents to the cloud. 4) Once you’ve cleaned up your devices, be sure to change your passwords.  

The surge in malware attacks brings with it a clear family mandate that if we want to continue to live and enjoy the fantastic benefits of a connected life, we must also work together at home to make online safety and privacy a daily priority.  

The post 5 Signs Your Device May be Infected with Malware or a Virus appeared first on McAfee Blogs.

With the widespread adoption of hybrid work models across enterprises for promoting flexible work culture in a post pandemic world, ensuring critical services are highly available in the cloud is no longer an option, but a necessity. McAfee Enterprise’s MVISION Unified Cloud Edge (UCE) is designed to maximize performance, minimize latency, and deliver 99.999% SLA guaranteed resiliency, offering blazing fast connectivity to cloud applications from any location and causing no service degradation, even when the usage of cloud services spiked 600% during the COVID-19 pandemic, as reported in our Cloud Adoption and Risk Report (Work From Home Edition). This blog shares details on how MVISION UCE is architected to enable uninterrupted access to corporate resources to meet the demands of the hybrid workforce.

MVISION UCE, our data-centric, cloud-native Security Service Edge (SSE) security platform, derives its capabilities from McAfee Enterprise’s industry leading Secure Web Gateway and Enterprise Data Protection solutions. However, this is not a lift and shift of capabilities to the cloud, which would have made it prone to service outages and impossible to have the flexibility that is needed to meet the demands of SSE. Instead, the best of breed functionality was purposefully reconstructed for SSE, using a microservices architecture that can scale elastically, and built on a platform-neutral stack that can run on bare metal and public cloud, equally effectively. A hallmark of the architecture is that the cloud is a single global fabric where service instances are spread throughout the globe. Users automatically access the best instance of any service through policy configuration.

What other alternatives are out there? We have seen some cloud services replicated in each region of their presence. While this makes controlling resources and data simple, and keeps everything within a boundary, such an approach loses out on the flexibility needed to scale on demand and reduced latency on access. With UCE, each point of presence (POP) is part of the global fabric, yet at the same time, fully featured with all services housed within the POP. This avoids the need to send traffic back and forth between various services located at different locations, a phenomenon known as traffic hairpin.

By default, user traffic gets processed at the POP closest to their physical location, regardless of where the user may be. A user may work at their office in New York 90% of the time and travel to UK occasionally. When the user connects to MVISON UCE, they are connected to New York POP when they are at office, and the POP in London if they are in a UK hotel while traveling. This is a big advantage if you think about it. User’s traffic does not need to trombone from the hotel in UK, to the POP in New York and back to a server in London. MVISION UCE’s out-of-the-box traffic routing scheme favors low latency. This does not mean that the customer cannot override this policy and force the traffic to be processed at the New York POP. They might do so if there is a compliance need to process all traffic at a certain location. Many customers have a need to store logs in a certain geography even though traffic processing may occur anywhere on the globe. MVISION UCE architecture decouples log storage from traffic processing and lets the customer choose their log storage geography based on criteria that customers define.

One of the key considerations while choosing a SSE vendor would be how much latency the service adds to user’s requests. Significant latency can negatively affect user experience and could be a deterrent to product adoption. With 85 POPs strategically placed around the globe providing low latency access to customers, UCE POPs have direct peering with the biggest SaaS vendors like Microsoft, Google, Akamai, and Salesforce to further reduce latency. In addition, MVISION UCE POPs peer with many ISPs around the globe, enabling high bandwidth and low latency connectivity end to end, from the customer’s network to UCE and from UCE to the destination server.

With thousands of peering partners growing every day, over 70% of traffic served by MVISION UCE uses peering links in some geographies. The whitepaper, How Peering POPs Make Negative Latency Possible, shares details about a study conducted by McAfee Enterprise to measure the efficacy of these peering relationships. This paper is proof that UCE customers experience faster response times going through our POPs than they would usually get by going directly through their Internet Service Providers. UCE follows a living partnership model when it comes to peering, with thousands of peering relationships in production. We are committed to keeping the latency to a minimum.

You may be wondering what the secret sauce is for achieving a reliability of five 9s or higher in MVISION UCE. Several items play a crucial role in preventing unplanned service degradation.

1. Redundantly provisioned components that allow for one or more instances to pick up the work when one of them goes down. Unexpected system failures and interruptions do occur in the real world and having a good architecture that detects failures early and reroutes the traffic to another suitable instance is paramount to maintaining availability. A combination of client redirection, server-side redirection, along with deep application state tracking, is used to seamlessly bypass a failed spot. The global nature of the fabric allows for multiple simultaneous failures without causing a local outage.
2. State of the art automation and deployment infrastructure is key to localize issues, maintain redundancy, and react automatically when issues are found. Containerized workloads over Kubernetes are the foundation of the cloud infrastructure in MVISION UCE, which facilitates fast recovery, canary rollouts of software, and elastic scaling of the infrastructure in case of peak demand. This is combined with an extensive automation and monitoring framework that monitors the customer’s experience and alerts the operations team of any localized or global service degradation.
3. Ability to scale up on demand at a global scale. We are not talking about scale out within a POP here. Many times, physical data centers have a hard limit on resources and sometimes it takes several months to add new servers and resources at a physical site. We are talking about bursting out to newly provisioned POPs when the traffic demands, in a matter of hours. Through extensive automation and intelligent traffic routing, a new MVISION UCE POP can be deployed in public cloud quickly and start absorbing load, providing the needed cushion to avoid traffic peaks that could otherwise cause service degradation when usage patterns change. This capability allowed MVISION UCE to successfully handle increasing demand when customer VPNs could not handle the load created by dramatically increased remote work due to the pandemic last year.

At McAfee Enterprise, security is not an afterthought. From the start, the architecture was designed with zero trust in mind. Services are segmented from one another and follow the least privileged principle when resources need to be shared between services. Industry standard protocols and methodologies are used to enforce user and identity access management (UAM/IAM). Strong role-based access controls (RBAC) across the platform keep customer’s data separate and provide self-defense when a service is compromised. None of these features matter if the software is vulnerable. McAfee Enterprise follows one of the strictest Software Development Life Cycle (SDLC) processes in the industry to eliminate known vulnerabilities and threats in our software as it is written.

Another aspect of security that is gaining momentum these days is data privacy. This is at the forefront of all feature designs in MVISION UCE. Usually, data privacy means tokenization or anonymization of customer private data stored in MVISION UCE, be it logs or other metadata. At McAfee Enterprise, we strive to take this a step further. We do not want to retrieve private data from the customer environment if it can be avoided. For example, to evaluate a policy that involves customer premise data, UCE can offload the evaluation to a component on the customer premise. Case in point, McAfee Client Proxy (MCP) that is installed on user’s machine can perform a policy evaluation and avoid sending private data to the cloud. The McAfee Enterprise cloud leverages the results of the evaluation to complete the policy execution. Where this is not possible, private data is anonymized at the earliest entry point in the cloud to minimize data leaks.

Last but not the least, a chain is only as strong as its weakest link, and physical data center security must also be considered. Global partners are selected only after careful evaluation of their facilities and infrastructure that will host our data centers, while other vendors in this space are working with a larger set of less rigorously qualified regional partners to increase their presence. The McAfee Enterprise approach provides the necessary guard rails against supply chain attacks that our customers demand.

There are other architectural gems hidden within UCE and thus failing to mention them would make this article incomplete. First, the policy engine is exposed in the form of code with which the customer can construct complex policies without being constrained by what UI provides. If you are a user of MVISON UCE, you can see this in action by enabling “Code View” in the Web Policy tree. If you do not like the way policy nodes are ordered in the tree or the evaluations made by default, you can take complete control and process the traffic in any manner you wish. By the way, the policy is so flexible that one can write a policy to process traffic in one region and store logs in another region.

Second, policy evaluation can be distributed across various components which allows its evaluation at the earliest point in the network. This avoids hauling all traffic to the cloud to apply policy. For example, if a sensitive document needs to be blocked due to data protection rules, the DLP agent running on the user’s machine can block it instead of hauling the traffic to cloud for classification and blocking. This strategy reduces load on the cloud and consequently increases the scale at which we can process requests.

Lastly, all services are automated and require no manual intervention to provision a customer unlike other vendors that require a support ticket to provision some features. Independent of where your account has been provisioned and where your preferred UI console resides, polices that you author are stored in a global policy system that is synchronized to all POPs around the world, giving you the flexibility to process traffic anywhere in the world.

To conclude, all clouds are not built equally. Architecture of a cloud is a matter of choice and tradeoffs. MVISON UCE implements a global cloud and puts customers in the driver’s seat through programmatic policies, that are secure, scalable, and highly available.

To learn more about how MVISION UCE can help ensure your critical services are highly available in the cloud, watch this short video or visit our MVISION UCE page to get started.

The post Qualities of a Highly Available Cloud appeared first on McAfee Blogs.

In this career-journey series, Marketing Director Trevor shares why patient listening is the most helpful skill he’s acquired, the top career advice he’s received, and how his career at McAfee has taken him across four countries and five roles in 11 years. 

Learn more about the steps they took to find success and their advice to help you do the same. 

Q: Tell us about your McAfee career journey. 

“Three continents, four countries, five roles, eleven years. At McAfee, I’ve lived and worked in the United Kingdom, Afghanistan (mobilized as an army reservist), Luxembourg, and the United States. I’ve worked in acquisition marketing, sales, marketing operations and technology, retention marketing, and strategic projects.” ​​​​​​​​​​​​​​

Q: What do you like most about working at McAfee? 

“Great people, interesting problems, and we’re always driving new ways to innovate and grow the business.”

Q: Can you share more about your role and typical day? 

“In terms of a workday, no two are alike, but there are three constants to what I’m working on:

I’m delivering projects that drive or protect McAfee’s future revenue streams and profitability or I’m Uncovering, stitching, and interpreting facts and information into a narrative to advise and inform senior leadership decision making 

I’m learning & developing myself. Since I joined McAfee the company has supported me in gaining an advanced degree in E-Commerce Technology from Manchester University and more recently supported me in attending Stanford University’s Graduate School of Business.   

After March 2020 our local office went remote.  This has meant I was able to restructure and balance out my home life. My day always starts the same (early) followed by coffee, gym, or training at ice hockey, and then family breakfast and dropping my son off at school. Workflows throughout the day.  McAfee is an environment where you can balance your life and work.   

Whilst I miss the daily interaction with my colleagues, the local ones all live within 5-30 minutes of me, allowing for many impromptu or planned meet-ups .”

 

Q: What is one of the most helpful skills you have developed in your career at McAfee?

“Listening persistently and patiently .

Being heard and delivering growth starts with listening.  In a complex organization, there can be a lot of people impacted by what might, at first, be considered a simple change.   

Persistence and tenacity are what helps you maintain your drive towards a goal or a project.    

Patience is what pulls it all together. It takes time to get everyone on board, and then it takes more time for them to align, start, forget, get distracted, restart, fall down, pick themselves up and start running. “

Q: What makes your role exciting?

“I love working and interacting with people across all functions, groups, and locations. I love learning about new cultures, perspectives, and the different behaviors of consumers worldwide that we have to plan and adapt for. I also love the diversity of work and activity of what I get to do! ”

Q: Tell us about a time when you had to get outside of your comfort zone to further your career development.

“One day my leader asked me if I would be willing to move into a sales role to better align with the strategic direction of the company while building out my own skillset. Instead of panicking about the unknown, I made a decision to embrace this as a growth opportunity.  

From scratch, I built up a sales pipeline, learned how to negotiate, run contracts, and negotiate. I shadowed our best sales leaders, read and re-read ‘How to Win Friends and Influence People’, learned Sandler methodology, and had to cold call (it’s not as scary as it sounds and there’s a true art in doing it well!).  

The result of these efforts? I closed multiple deals and built up a digital reseller network. I still remember the first deal I closed. As soon as the prospect agreed to the number proposed, I kicked myself under the table… I realized I should have negotiated and asked for more! But experience is how we learn and the skills I acquired during this period ultimately made me a better marketer and put me on the path I’m on today.”

Q: What advice would you give to prospective McAfee employees who are looking to drive their career forwards?

“I also wondered the same thing, so I asked a senior McAfee executive about how she’d managed to get to the top of the organization.   

I’ll never forget her response – “I asked.” 

I interpreted that as… be a positive force for the people around you, deliver results, ask for more… and your career will continue moving forwards.”   

—

Thinking about how to propel your career forward? Interested in hearing more about how McAfee fosters career growth and development? Stay tuned for more in our ‘How I Got Here’ series as we spotlight the journeys of team members who cultivated rich and impressive career paths here at McAfee. 

Want to join a team that invests in YOU? Check out our roles today. 

The post How I Got Here: Trevor’s Career Journey Across Four Countries and Five Roles appeared first on McAfee Blogs.

Scam Spotter Campaign Flags Gift Card Fraud

US Journalist Imprisoned for Spreading False Information is Freed

Immersive Labs Acquires Snap Labs

42% of UK Gamers Have Experienced a Cyber-Attack on Their Account or Device