News

Happy Download Day! (Yes, there’s a day for that.) Today is an excellent day to share downloading best practices to keep all your devices safe from malicious content. It’s tempting to download “free” shows, movies, and video games, but the consequences of doing so can be quite expensive. All it takes is for one malicious download to compromise your identity or leak your banking information to cybercriminals. 

Luckily, there are a few ways to keep your devices and personally identifiable information (PII) safe. Here’s how! 

Dangers of Downloading Dubious Content 

How many streaming services do you subscribe to? Two? Ten? No matter how many premium entertainment subscriptions you have, the hottest new show always seems to be on the channel you can’t access. This is a common scenario that often drives people to download episodes from websites that claim crystal-clear, safe downloads. In actuality, these sites could harbor malware, spyware, or other types of malware that lurk in the shadows until an unsuspecting person downloads them to their desktop, tablet, or cellphone.  

Malware, which stands for malicious software, often hides behind legitimate-looking links or downloadable content. It’s only until it’s on your device that you realize there’s a criminal hiding behind it. For example, earlier in 2022, a ransomware program (a type of malware) disguised itself as a Microsoft system update. The criminal behind the scheme then threatened leaking or permanently deleting sensitive files if the person didn’t pay the ransom. 

Once malware infects one device, some malware programs can infect an entire home network and spread to other connected devices.1 From there, the cybercriminal can steal the online shopping, banking, or personal details of a whole household and either sell their findings on the dark web or keep it for themselves. 

Your Safe Downloading Checklist 

Before you download anything to any of your devices, go through this checklist to help you determine the safety of most content: 

• Is the website secure? Does the URL of the website contain an “https” and a lock next to it? While the presence of both doesn’t automatically confirm or deny the legitimacy of a site, it’s a good first marker to check. A secure browsing extension, like McAfee web protection, can also alert you when you’re on a risky website. Don’t ignore the alarm!   
• Is the website poorly designed? Are there typos and grammar mistakes everywhere? Is the logo blurry? It’s best to do some background research on any site or mobile app before you download content from it. The first few search results will likely be able to tell you whether it’s reputable or not. Cybercriminals often spend more time perfecting their malicious software than fussing over what the website actually looks like. 
• Where does the download link redirect you to? If you’re on a desktop, right-click the download URL or button to see where it’ll redirect you. The file extension and file size should match what you expect it to be. Additionally, if early in the downloading process error messages pop up about corrupted files, stop the download immediately. 

Overall, while downloading entertainment for free is appealing to people on a budget, it’s better to avoid doing so altogether. The risk isn’t worth it. Consider scheduling a watch party with a friend or family member who has the subscription service you’re seeking.  

Protect Your Devices From Malicious Downloads  

In case you slip up and accidentally download malware, spyware, or ransomware, McAfee+ Ultimate can defend your devices, remove the software, and monitor the dark web to make sure your PII wasn’t compromised. McAfee antivirus is compatible with macOS, iOS, and Android devices and Chromebooks, so you can regularly scan all your devices for programs that shouldn’t be there. If the worst does happen and a cybercriminal gets a grip on your personal information, McAfee can back you up with $1 million in identity theft coverage and restoration and continuous identity monitoring. 

Browse confidently and enjoy your devices to the fullest! Just remember these safe downloading tips and partner with McAfee for peace of mind. 

1Federal Trade Commission, “Malware from illegal video streaming apps: What to know” 

The post Celebrate National Download Day With This Safe Downloading Checklist appeared first on McAfee Blog.

It’s serious, it’s critical, and you could call it severe… but in HHGttG terminology, it’s probably “mostly harmless”.

This is one way of ensuring that IT keeps up with patches:

Albanian prosecutors on Wednesday asked for the house arrest of five public employees they blame for not protecting the country from a cyberattack by alleged Iranian hackers.

Prosecutors said the five IT officials of the public administration department had failed to check the security of the system and update it with the most recent antivirus software.

The next step would be to arrest managers at software companies for not releasing patches fast enough. And maybe programmers for writing buggy code. I don’t know where this line of thinking ends.

There are no ifs, ands, or buts about it: A stolen identity creates a mess. Once they have a few key pieces of personally identifiable information (PII), an identity thief can open new credit lines, create convincing new identities, and ruin an innocent person’s good credit. 

If you suspect you’ve been affected by identity theft, acting quickly is key to stopping the thief and repairing the damage. Here are the definitive five steps of identity remediation, or the process of restoring and protecting the privacy of your identity. 

1. Freeze Your Credit

With a stolen identity in hand, thieves can open new lines of credit or apply for large loans using someone else’s excellent credit score for leverage. If undetected, fraudsters can run up huge bills, never pay them, and in turn, ruin the credit score that you spent years perfecting. When you suspect or confirm that your identity has been compromised and you’re in the United States, alert the three major credit bureaus: Equifax, TransUnion, and Experian.  

Freezing your credit means that no one (not even you) can open a new credit card or bank account. This prevents criminals from misusing your identity. Initiating a credit freeze is free and it doesn’t affect your credit score.  

2. File a Report

Once you suspect a criminal has stolen your identity, file a report with the Federal Trade Commission. Its official identity theft website includes a form for you to detail the circumstances. From there, the FTC will investigate. 

It’s important to file a report because law enforcement can get involved and hopefully stop the criminal from striking again. Also, an official document from law enforcement or the FTC may help your bank and the credit bureaus resolve the damage. 

3. Change Your Passwords and Credit Cards

Whenever a company with which you have an account is breached, the first step you should take is to quickly change your password. The same goes for when your identity is compromised with the added step of getting in touch with your banks and asking their fraud department to issue you new credit and debit cards and put them on alert for possible suspicious charges. 

Having unique passwords for all your accounts is crucial to keeping them secure. For instance, if one of your accounts is breached and a cybercriminal lifts that username and password combination, they may then attempt to use it on other sites. To ensure you have strong passwords and passphrases for every site, consider using password manager software. Password managers are incredibly secure and make it so you only have to remember one password ever again.  

4. Collaborate With Credit Bureaus

In addition to freezing your credit, you may have to sync up with each bureau to remedy any damage the identity thief may have done to your credit. Each bureau’s fraud department is very familiar with these scenarios, so their customer service department is experienced and more than willing to help you work through it. 

5. Sign Up for Credit Monitoring

Once you’ve cleaned up the immediate mess made by an identity thief, it’s important to continuously monitor your identity in case the thief is biding their time or pieces of your PII are still circulating on the dark web. Plus, the headache of one compromised identity incident is enough for someone to never want it to happen again. Identity monitoring is a very thorough process that will give you peace of mind that you’ll be protected and can enjoy your online life safely.  

How McAfee Makes Identity Remediation Less of a Headache 

These five steps, while important, can be tedious. It may require a lot of patience to sit on hold and sift through all the relevant forms. Luckily, McAfee is an excellent partner who can help you with all your identity remediation needs with just one service: McAfee+ Ultimate. For example, security freeze is an easy way to put a halt on your credit. McAfee’s identity monitoring service monitors up to 60 unique types of personal details. If your PII appears on the dark web, Personal Data Cleanup can remove it.  

Recover and move forward confidently after an identity theft with McAfee by your side. 

The post Everything You Need to Know About Identity Remediation appeared first on McAfee Blog.

Last August, LastPass reported a security breach, saying that no customer information—or passwords—were compromised. Turns out the full story is worse:

While no customer data was accessed during the August 2022 incident, some source code and technical information were stolen from our development environment and used to target another employee, obtaining credentials and keys which were used to access and decrypt some storage volumes within the cloud-based storage service.

[…]

To date, we have determined that once the cloud storage access key and dual storage container decryption keys were obtained, the threat actor copied information from backup that contained basic customer account information and related metadata including company names, end-user names, billing addresses, email addresses, telephone numbers, and the IP addresses from which customers were accessing the LastPass service.

The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs, as well as fully-encrypted sensitive fields such as website usernames and passwords, secure notes, and form-filled data.

That’s bad. It’s not an epic disaster, though.

These encrypted fields remain secured with 256-bit AES encryption and can only be decrypted with a unique encryption key derived from each user’s master password using our Zero Knowledge architecture. As a reminder, the master password is never known to LastPass and is not stored or maintained by LastPass.

So, according to the company, if you chose a strong master password—here’s my advice on how to do it—your passwords are safe. That is, you are secure as long as your password is resilient to a brute-force attack. (That they lost customer data is another story….)

Fair enough, as far as it goes. My guess is that many LastPass users do not have strong master passwords, even though the compromise of your encrypted password file should be part of your threat model. But, even so, note this unverified tweet:

I think the situation at @LastPass may be worse than they are letting on. On Sunday the 18th, four of my wallets were compromised. The losses are not significant. Their seeds were kept, encrypted, in my lastpass vault, behind a 16 character password using all character types.

If that’s true, it means that LastPass has some backdoor—possibly unintentional—into the password databases that the hackers are accessing. (Or that @Cryptopathic’s “16 character password using all character types” is something like “P@ssw0rdP@ssw0rd.”)

My guess is that we’ll learn more during the coming days. But this should serve as a cautionary tale for anyone who is using the cloud: the cloud is another name for “someone else’s computer,” and you need to understand how much or how little you trust that computer.

If you’re changing password managers, look at my own Password Safe. Its main downside is that you can’t synch between devices, but that’s because I don’t use the cloud for anything.

News articles. Slashdot thread.

EDITED TO ADD: People choose lousy master passwords.

In a series of emails seen by several media, ByteDance admitted that some of its former employees used TikTok’s data to track two journalists

The law sets out requirements for federal agencies to migrate to quantum-secure cryptography

UK’s privacy regulator says new rules for hacks still being worked out

Most data was encrypted in cloud storage

Latest iteration exploits Apache vulnerabilities