News

As the summer sun beckons us to explore new destinations, many of us rely on public Wi-Fi to stay connected while on the go. Whether checking emails, browsing social media, or planning our next adventure, access to Wi-Fi has become an essential part of our travel experiences. However, amidst the convenience lies a lurking threat to our cybersecurity. Public Wi-Fi networks are typically unencrypted, meaning data transmitted over these networks can be intercepted by hackers.  

A study found that 40% of respondents have had their information compromised while using public Wi-Fi. In one notorious incident, a hacker accessed a journalist’s confidential work emails through in-flight Wi-Fi and then confronted him at baggage claim to reveal the breach. Often, individuals remain unaware of such compromises until well after the fact.  

Since public Wi-Fi networks are often unsecure and used by many people, they are prime targets for cybercriminals looking to steal personal information such as passwords, credit card numbers, and other sensitive data. But fear not! With the right precautions, you can enjoy your summer travels while keeping your data safe and secure.  

1. Understanding the Risks: Before delving into the world of public Wi-Fi, it’s crucial to understand the risks involved. Public networks, such as those found in cafes, airports, and hotels, are often unencrypted, meaning that cybercriminals can intercept data transmitted over these networks. This puts your sensitive information, including passwords, credit card details, and private messages, at risk of being compromised. 

2. Utilize a Virtual Private Network: One of the most effective ways to safeguard your data while using public Wi-Fi is by using a Virtual Private Network (VPN). A VPN encrypts your internet connection, creating a secure tunnel between your device and the internet. This encryption prevents hackers from intercepting your data, ensuring your online activities remain private and secure. Invest in a reputable VPN service and install it on your devices before embarking on your summer adventures for added protection. Check out our step-by-step tutorial if it’s your first time setting up a VPN.  

3. Keep Software Updated: Another essential aspect of cybersecurity is keeping your devices and software up-to-date. Updates often include security patches that address vulnerabilities and protect against emerging threats. Before setting off on your summer travels, install any available updates for your operating system, web browser, and security software. This simple step can significantly reduce the risk of falling victim to cyberattacks while connected to public Wi-Fi networks. 

4. Enable Multi-Factor Authentication: Adding an extra layer of security to your online accounts can help prevent unauthorized access, even if your passwords are compromised. Multi-factor authentication (MFA) requires you to provide two or more forms of verification before accessing your accounts, such as a password, a fingerprint scan, or a one-time code sent to your mobile device. Enable MFA on your email, social media, and banking accounts before your travels to enhance your cybersecurity defenses. 

5. Exercise Caution: Avoid accessing sensitive information while connected to public Wi-Fi. Refrain from logging into banking or shopping accounts and accessing confidential work documents while connected to unsecured networks. Instead, save these tasks for when you’re connected to a trusted network or using your mobile data. 

6. Practice Good Password Hygiene: While connected to public Wi-Fi, it’s crucial to use strong, unique passwords for all your accounts. Avoid using easily guessable passwords or reusing the same password across multiple accounts, as this increases the risk of unauthorized access to your sensitive information. Consider using a reputable password manager to generate and store complex passwords securely.  

7. Consider a Personal Hotspot: Using a personal hotspot instead of public Wi-Fi networks can often be a safer choice. Many mobile devices allow you to create a secure Wi-Fi network using your cellular data connection. Check your phone provider’s data plan beforehand to ensure this option doesn’t incur additional data charges. 

Connecting to public Wi-Fi safely during your summer travels requires awareness and preparation. By taking steps like utilizing a VPN, keeping your software updated, and enabling MFA, you can enjoy the convenience of staying connected while protecting your personal information from cyber threats.  

To further safeguard your digital devices, explore McAfee’s array of software solutions to discover the perfect fit for your security requirements. With the right cybersecurity tools, it’s easy to surf the web securely while exploring new destinations during your summer adventures.

The post How to Safely Connecting to Public Wi-Fi While Traveling appeared first on McAfee Blog.

CISA has informed chemical facilities that its Chemical Security Assessment Tool (CSAT) was infiltrated by a malicious actor, and potentially exfiltrated sensitive data

Kaspersky “poses an undue or unacceptable risk to national security,” according to the US Commerce Department’s Bureau of Industry and Security

Ransomware group Qilin has reportedly published nearly 400GB of data stolen following the attack on NHS provider Synnovis in early June

Beautiful astronomical photo.

The memorial service for Ross Anderson will be held on Saturday, at 2:00 PM BST. People can attend remotely on Zoom. (The passcode is “L3954FrrEF”.)

This has to be a first. Something from our blogs got made into a movie.

We’re talking about voice scams, the soundalike calls that rip people off. One such call sets the action in motion for a film released this weekend, “Thelma.”

The synopsis of the comedy reads like this …

“When 93-year-old Thelma Post gets duped by a phone scammer pretending to be her grandson, she sets out on a treacherous quest across the city to reclaim what was taken from her.”

What times we live in, where voice scams form the premise of a film. In fact, writer/director Josh Margolin based the film on a phone scam that targeted his grandmother (yet one that they were lucky to shut down.) With that, it gives us a reminder that voice scams like these occur, and occur often.

What are voice scams?

Voice scams have been around for some time. They play out like an email phishing attack, where scammers try to trick people into forking over sensitive info or money — just in voice form over the phone. The scammer poses as someone the victim knows, like a close family member.

Yet the arrival of AI has made voice scams far more convincing. Cheap and freely available AI voice cloning tools have flooded the online marketplace in the past couple of years. They’re all completely legal as well.

Some cloning tools come in the form of an app. Others offer cloning as a service, where people can create a clone on demand by uploading audio to a website. The point is, practically anyone can create a voice clone. They sound uncanny too. Practically like the real thing, and certainly real enough over the phone. And it only takes a small sample of the target’s voice to create one.

Our own labs found that just a few seconds of audio was enough to produce a clone with an 85% voice match to the original. That number bounced up to 95% when they trained the clone further on a small batch of audio pulled from videos.

How do voice scammers create voice clones?

As to how scammers get a hold of the files they need, they have a ready source. Social media. With videos harvested from public accounts on YouTube, Instagram, TikTok, and other platforms, scammers have little trouble creating clones — clones that say whatever a scammer wants. All it takes is a script.

That’s where the attack comes in. It typically starts with a distress call, just like in the movie.

For example, a grandparent gets an urgent message on the phone from their grandchild. They’re stuck in the middle of nowhere with a broken-down car. They’re in a hospital across the country with a major injury. Or they’re in jail overseas and need to get bailed out. In every case, the solution to the problem is simple. They need money. Fast.

Sure, it’s a scam. Yet in the heat of the moment, it all sounds terribly real. Real enough to act right away.

Fearing the worst and unable to confirm the situation with another family member, the grandparent shoots the money off as instructed. Right into the hands of a scammer. More often than not, that money is gone for good because the payment was made with a wire transfer or through gift cards. Sometimes, victims pay out in cash.

Enter the premise for the movie. Thelma gets voice-scammed for thousands, then zips across Los Angeles on her friend’s mobility scooter to get her money back from the voice scammers.

The reality is of course more chilling. According to the U.S. Federal Trade Commission (FTC), nearly a million people reported a case of imposter fraud in 2023. Total reported losses reached close to $2.7 billion. Although not tracked and reported themselves, voice clone attacks certainly figure into this overall mix.

Voice scams target everyone. Not just Thelma

Even as we focus on the character of Thelma, voice clone attacks target people of all ages. Parents have reported cases involving their children. And married couples have told of scams that impersonate their older in-laws.

Common to each of these attacks is one thing: fear. Something horrible has happened. Or is happening. Here, scammers look to pull an immediate emotional trigger. Put plainly, they want to scare their victim. And in that fear, they hope that the victim immediately pays up.

It’s an odds game. Plenty of attacks fail. A parent might be sitting at the dinner table with their child when a voice clone call strikes. Or a grandchild might indeed be out of town, yet traveling with their grandmother when the scammer gives her a ring.

Yet if even a handful of these attacks succeed, a scammer can quickly cash in. Consider one attack for hundreds, if not thousands, or dollars. Multiply that by five, ten, or a dozen or so times over, a few successful voice clone scams can rack up big returns.

How to protect your family from voice scams

Yet you can protect yourself from these attacks. A few steps can make it more difficult for scammers to target you. A few others can prevent you from getting scammed if a voice clone pops up on the other end of the phone.

Make it tougher for scammers to target you by:

Clear your name from data broker sites. How’d that scammer get your phone number anyway? Chances are, they pulled that info off a data broker site. Data brokers buy, collect, and sell detailed personal info, which they compile from several public and private sources, such as local, state, and federal records, in addition to third parties. Our Personal Data Cleanup scans some of the riskiest data broker sites, shows you which ones are selling your personal info, and helps you remove your data.

Set your social media accounts to private. Scammers sift through public social media profiles in search of info on their targets. In some cases, an account can provide them with everything they need to launch an attack. Family names, family interests, where the family goes for vacation, where family members work — and videos that they can use for cloning. By making your accounts private, you deny scammers the resources they require. Our Social Privacy Manager can do this for you across all your accounts in only a few clicks.

Prevent getting scammed by:

Recognize that voice clone attacks are a possibility. As we’re still in the relatively early days of AI tools, not everyone is aware that this kind of attack is possible. Keeping up to date on what AI can do and sharing that info with your family and friends can help them spot an attack. As we’ve reported here before, voice clones are only the start. Other imposter scams run on video calls where a scammer takes on someone else’s voice and looks. All in real-time.

Always question the source. In addition to voice cloning tools, scammers have other tools that can spoof phone numbers so that they look legitimate. Even if it’s a voicemail or text from a number you recognize, stop, pause, and think. Does that really sound like the person you think it is? Hang up and call the person directly or try to verify the info before responding.

Set a verbal codeword with kids, family members, or trusted close friends. Even in the most high-tech of attacks, a low-tech precaution can keep everyone safe. Have a codeword. Save it for emergencies. Make sure everyone uses it in messages and calls when they ask for help. Further, ensure that only you and those closest to you know what the codeword is. This is much like the codewords that banks and alarm companies use to help ensure that they’re speaking to the proper account holder. It’s a simple, powerful step. And a free one at that.

The post Thelma – The Real-Life Voice Scam That Made It into the Movies appeared first on McAfee Blog.

Sarah didn’t see it coming.

A single mom in her late 40s, “Sarah” was especially lonely after her divorce (name changed to protect her identity). Her teenager had convinced her to join a dating site, so she created a profile on a popular app. After a handful of dates fell flat, she found Scott (name also changed). He was charismatic, kind. “We had an instant connection,” according to Sarah.

They spent hours on the phone sharing their deepest secrets and even started imagining a future together. But after about three months, Scott fell on hard times. At first, he needed to borrow $400 to pay for airfare to visit a dying relative, which he paid back immediately. Over the next few months, the numbers grew to $1,000 for rent and $3,000 for a business venture.

Repayments for those loans never came, and before long, Sarah had loaned her new love over $8,500. When she pressed him for the money, Scott ghosted Sarah online, moved out of town, and she never saw him again. She didn’t share her story with many people. She didn’t report it. She was too embarrassed and humiliated and even became depressed following what she calls “the Scott scam.” Painfully, she lost her trust in others.

Sarah isn’t alone. In the U.S. alone, about 70,000 people reported a romance scam in 2022, according to the Federal Trade Commission (FTC). Reported losses hit $1.3 billion, with a median loss of $4,400. And with such statistics, those figures reflect only what was reported. How many other “Sarahs” in the U.S. got scammed and never reported it? How many worldwide?

That’s the pain of online dating and romance scams. Feelings of embarrassment and humiliation compound financial and emotional pain. After all, the victims were looking for love and companionship.

And that’s what scammers count on. Yet that shouldn’t stop you from a romance that springs online. With a strong heart and sharp eye, you can spot a scam and put an end to it before any damage gets done.

How do online dating and romance scams get started?  

Dating and romance scams can start in several ways. They might begin on dating apps and sites, just like in Sarah’s case. Yet they can happen elsewhere and even pop out of the blue too. Scammers prowl around on social media, texts, and online games by pinging potential victims with an unexpected introductory message — a sort of digital opening line. In fact, the FTC reports that 40% of online dating and romance scams began with a message on social media, versus only 19% on dating apps.

With the initial connection made, a chat begins, and a friendship (or more) blossoms from there. Along the way, the scammer will often rely on a mix of somewhat exotic yet believable storytelling to lure the victim in. Often, that will involve their job and where they’re working. Reports say that scammers will talk of being workers on an offshore oil rig, members of the military stationed overseas, doctors working alongside an international organization or working in the sort of jobs that prevent them from otherwise easily meeting up in person.

With the phony relationship established, the scammer starts asking for money. The FTC reports that they’ll ask for money for several bogus reasons, usually revolving around some sort of hardship where they need a “little help” so that they can pay:

• For a plane ticket or other travel expenses.
• For medical expenses.
• Customs fees to retrieve something.
• Gambling debts.
• A visa or other official travel documents.

The list goes on, yet that’s the general gist. Scammers often employ a story with an intriguing complication that seems just reasonable enough, one where the romance scammer makes it sound like they could really use the victim’s financial help.

How scammers ask you to pay

People who have filed fraud reports say they’ve paid their scammer in a few typical ways.

One is by wiring money, often through a wire transfer company. The benefit of this route, for the scammer anyway, is that this is as good as forking over cash. When it’s gone, it’s gone. The victim lacks the protections they have with other payment forms, such as a credit card that allows the holder to cancel or contest a charge.

Another way is through gift cards. Scammers of all stripes like these because they effectively work like cash, whether it’s a gift card for a major online retailer or a chain of brick-and-mortar stores. Like a wire transfer, when that gift card is handed over, the money on it is highly difficult to recover, if at all.

One more common payment method is reloadable debit cards. A scammer might make an initial request for such a card and then make several follow-on requests to load it up again.

In all, a romance scammer typically looks for the easiest payment method that’s the most difficult to contest or reimburse, leaving the victim in a financial lurch when the scam ends.

How to avoid getting stung by an online dating or romance scam

When it comes to meeting new people online, the FTC suggests the following:

• Never send money or gifts to someone you haven’t met in person — even if they send you money first.
• Talk to someone you trust about this new love interest. It can be easy to miss things that don’t add up. So pay attention if your friends or family are concerned.
• Take the relationship slowly. Ask questions and look for inconsistent answers.
• Try a reverse-image search of any profile pictures the person uses. If they’re linked with another name or with details that don’t match up, it’s a scam.

Scammers, although heartless, are still human. They make mistakes. The stories they concoct are just that. Stories. They might jumble their details, get their times and dates all wrong, or simply get caught in an apparent lie. Also, remember that some scammers might be grifting several victims at once, which is yet another opportunity for them to get confused and slip up. Keep an eye out for that. Inconsistencies are the watermarks of a scam.

Lastly, take note that romance scammers have an entirely new set of tricks at their disposal. AI deepfakes. With inexpensive and readily available AI tools, scammers can make themselves look and sound like an entirely different person. All in real-time. As striking as that sounds, keep it in mind. Romance deepfakes now exist in the realm of possibility.

It once was that if a person didn’t want to hop on a voice chat, it might count as a sign of a scam. That’s no longer the case with deepfake technology in play. Even so, many of the same tried-and-true means of avoiding a romance scam still apply.

Protect yourself further from scams

1. Lock down your privacy on social media.

Social media platforms like Facebook, Instagram, and others give you the option of making your profile and posts visible to friends only. Choosing this setting keeps the broader internet from seeing what you’re doing, saying, and posting, which can help protect your privacy and give a romance scammer less info to exploit. Using our Social Privacy Manager can make that even easier. With only a few clicks, it can adjust more than 100 privacy settings across their social media accounts — making them more private as a result.

2. Google yourself, and then remove what you find.

Have you ever googled yourself online? You’ll find personal info like your date of birth, previous addresses, names of your children and their ages, your estimated income, and more. This info is collected by data brokers and available for sell to advertisers or worse — like scammers. Sophisticated scammers use this info to profile and exploit their victims further. A Personal Data Cleanup service can help you remove this kind of personal data from the web. ​

3. Say “no” to strangers bearing friend requests.

Be critical of the invitations you receive. Out-and-out strangers might be more than a romance scammer. They might front fake accounts designed to gather info on users for cybercrime, or they can be an account designed to spread false info. There are plenty of them too. In fact, in Q4 of 2023 alone, Facebook took action on 691 million fake accounts. Reject such requests.

4. Go light on the details in your dating profile.

To the extent that you can, provide the minimum amount of details in your dating profile. Granted, this requires a bit of a balancing act. You want to put some info out there to help find a match, yet too much can give you and your location away. Same for your profile pics. Be sure yours have a generic-looking background, rather than anything that might identify where you live, work, or go to school.

5. Protect yourself and your devices.

Online protection software can steer you clear from clicking on malicious links that a scammer might send you online, while also steering you clear of other threats like viruses, ransomware, and phishing attacks in general. It can look out for your personal info as well, by protecting your privacy and monitoring your email, SSN, bank accounts, credit cards, and other info that a scammer or identity thief might put to use. With identity theft a rather commonplace occurrence today, security software is really a must.

Put an end to it

If you suspect that you’re being scammed, put an end to the relationship and report it, as difficult as that might feel.

Notify the FTC at ReportFraud.ftc.gov for support and next steps to help you recover financially as much as possible. Likewise, notify the social media site, app, or service where the scam occurred as well. In some cases, you might want to file a police report, which we cover in our broader article on identity theft and fraud.

If you sent funds via a gift card, the FTC suggests filing a claim with the company as soon as possible. They offer further advice on filing a claim here, along with a list of contact numbers for gift card brands that scammers commonly use.

Lastly, go easy on yourself. If you find yourself a victim of online dating or romance fraud, know that you won’t be the first or last person to be taken advantage of this way. By reporting your case, you might help others from falling victim too.

The post How Online Dating Scams work and How to Spot Them appeared first on McAfee Blog.

The LockBit ransomware group returned the fold to launch 176 attacks in May 2024 following a law enforcement takedown, NCC Group found

The French cybersecurity agency has warned that Russian-aligned threat actor has been targeting public organizations for years