Tag Archive for: coronavirus

Coronavirus Scammers User Fake Sites to Steal Your Stimulus

https://www.youtube.com/watch?v=WJcT81kawc4′ format=’16-9′ width=’16’ height=’9′ custom_class=” av_uid=’av-mo9up3

Coronavirus Scammers Are After Your Stimulus Check

Scammers and cybercriminals love to exploit the headlines. COVID-19 isn’t the only pandemic affecting Americans – so are the scams that go along with it.

Case in point: stimulus checks that will help Americans weather the COVID-19 pandemic are already being targeted by scammers, who take advantage of the confusion and disinformation surrounding the rollout of the relief funds. They know how easy it is to profit from crisis.

The IRS set up an Economic Impact Payment website to enable Americans to claim and track their stimulus checks, and will mail or directly deposit the payments. Unfortunately, scammers have quickly designed more than 4,000 similar websites to try to skim payments from unsuspecting citizens.

IRS Stimulus Check Scams (Economic Impact Payments)

  • Some coronavirus scammers may be after the payments themselves, while others are using the opportunity to get valuable personal information, like bank account numbers
  • There has been a 6,000% increase in spam emails related to COVID-19 since early March, with many of these emails aimed at stealing the IRS checks.
  • 4,000 new websites related to the stimulus checks created since January. The websites are set up to either look like the IRS or banks, with hackers trying to trick individuals into disclosing their financial information.

How to Protect Your Economic Impact Payment Stimulus Check

  • Be extra wary of all stimulus-related emails, calls, and texts. The IRS will never contact you by phone, email, text message, or social media. Only use irs.gov/coronavirus to submit information to the IRS – and never in response to a call, text, or email.
  • Check the language. Stimulus payments aren’t actually called “stimulus checks,”— official term is “economic impact payment.” So if you get an email, call or text using the unofficial language of “stimulus check,” it’s a tip-off that the message isn’t legit
  • Watch for your receipt. Whether you receive your payment via direct deposit or as a paper check through snail mail, the IRS will also send you a letter in the mail 15 days later letting you know that the payment was sent. The agency won’t be hounding you or anyone else over the phone, email or text about it. That letter is useful because it serves as official verification that your stimulus payment was sent out. If you get one after receiving your payment, then you’ve got nothing to worry about. But if you get one before your payment arrives, it’s a sign that you might be the victim of fraud.

Cybersecurity for Your Home or Virtual Office

Cybersecurity Virtual Office Key Links from the Webinar:

ZOOM Sileo Security Video
Password Managers Review
Data Backup Physical/Cloud Backup 
ZOOM Security & Privacy Page

There is something great to be learned about cybersecurity from this pandemic. Preparing for a crisis before it happens is far less expensive than recovering after it happens. The U.S. saved several billions of dollars cutting corners on pandemic preparation, and it’s now estimated that coronavirus will cost the world more than $300 Trillion when the economy is factored in – not to mention the death toll.

Smart preparation beats recovery every time. The same is true for cybersecurity where optimism grows out of preparation. Proper cyber hygiene, just like washing your hands for a full 20 seconds, is both mildly inconvenient and wildly effective. And we need it more than ever, because cybercriminals are taking advantage of the chaos. Going remote increases the exposure of company data exponentially, especially because we had so little time to prepare.

This outline focuses primarily on solopreneurs and small businesses as I have held out some of the more technically detailed information on how larger enterprises can further protect their remote workforce. In this time when so much is outside of our control there’s actually a great deal within our control when it comes to cyber security.

7 Cybersecurity Threats in Your Remote Workplace

I’ve put together the 7 threats that I feel, from having observed thousands of organizations with remote workers, are the FIRST you should address. This is not an exhaustive list, but a great place to start.

Threat #1 – Zoom Videoconferencing – Rapid adoption has meant little security

  1. I received a call from a client who told me two things had happened 1) They discovered that a competitor was lurking on a video BOD meeting and 2) When they discovered it, the user screen-shared porn, called “Zoom bombing”. Had this been a call between business and client, it would have been devastating.
  2. It is imperative that you consider the privacy and security implications of Zoom before you use it for sensitive or critical meetings: https://zoom.us/docs/doc/Zoom-Security-White-Paper.pdf
  3. This article from the NY Attorney General about Zoom privacy practices has good information https://www.nytimes.com/2020/03/30/technology/new-york-attorney-general-zoom-privacy.html
  4. To learn to use Zoom, please visit Mike Domitrz’s recorded webinar on the topic: https://www.youtube.com/watch?v=aVKbnQJrrjg&feature=youtu.be

Threat #2 – You and Your Kids – People, not technology, introduce the greatest risk into your systems

  1. Coronavirus scams started the day the epidemic was announced, let’s focus on…
  2. Phishing emails are a hackers best friend. Consent to download crimeware or upload logins
  3. These scams follow the headlines, especially a crisis (can be by text, phone or SM adv)
  4. Solutions:
    • Recognize the coronavirus scams
    • Click Hygiene – pause for 20 seconds before you click – Too good to be true, too bad to be real, too dramatic to be worth your time, then ignore it
    • The Hover Technique – expectations vs. reality
    • 3rd-Party Spam Filters (corporate tip – block it at the Gateway)
    • Train your kids, as anyone on your network can download malware and spread it elsewhere

Threat #3 – Cyber Blackmail – Cheapest tool hacker has is to lockup data & demand a ransom

  1. Ransomware – byproduct of phishing
  2. Worms its way to other devices – Home offices, kids click habits are biggest culprit
  3. 3-2-1 Backup Plan – iDrive https://www.pcmag.com/reviews/idrive

Threat #4 – Game of Knowns – 95% of vulnerabilities are known

  1. Outdated & Unpatched Operating Systems and software (Windows 7 Question – Bruce)
  2. No centralized firewall to protect whole network (not just yours) DSL Router
  3. Unprotected WiFi – Change Default PW, WPA2+, SSID Masking, MAC-specific addresng
  4. Unencrypted computers, laptops and mobile devices (BitLocker & File Vault) LIABILITY
  5. Wide open Remote Access Protocol
  6. Unprotected, wide-open WiFi
  7. SOLUTION: have an IT professional configure all of the above for you – working @ home, spend the money to prevent it up front. You can learn all of this, but devil in details.

Threat #5 – Cloud Hacking – We’ve pivoted to cloud computing and ignored the storm of cybercrime

  1. Setup 2-Step Logins (2 Factor Authentication)
  2. Enable a VPN
  3. Use a Password Manager Like Keeper, Dashlane or LastPass (https://www.pcmag.com/picks/the-best-password-managers)
  4. Dropbox is NOT a secure enough platform for PII or sensitive data
  5. Bad Communication – We email, transfer & store sensitive docs in plain sight
  6. Don’t email documents with sensitive info unless they are encrypted. PDF/Winzip/TrueCrypt (Use the portal with your financial provider)
  7. Messaging: Signal; Apple Messages (Not What’sApp, Facebook Messenger or Droid)

Threat #6 – Stupid Smartphones – The supercomputers in our pockets are a security afterthought

  1. Walk through EVERY Privacy and Security Setting on your smartphone. Period. If you don’t understand the setting, Google it.

Threat #7 – The “Squirrel” After this Class – Action distraction is the primary cause of breach

  1. Even when people have a checklist of what to do, the often don’t take action until after the breach, after the pandemic.

This is a broad outline of a starter course in protecting your virtual office. To customize a virtual webinar like this one to your organization, contact John directly on the number below.

About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank and an award-winning author, keynote speaker, and expert on technology, cybersecurity and tech/life balance. John specializes in making security engaging so that it sticks. Contact him directly on 303.777.3221. 

 

 

Coronavirus Cyberscam Alert: Protect Your Digital Health and Safety During a Pandemic.

Hey, this is a bit of a solemn and serious post today. First of all, my heart goes out to all of those communities, families, people that are battling with Coronavirus. Just like our physical health, we have to also pay attention to our digital, or cyber health, and how we watch out for all of the disinformation that is out there. Listen, cybercriminals will always exploit the headlines. They will always take advantage of our fears and our ignorance, whether it’s for product sales, whether it’s just to make us panic or whatever the motivation. My daughter, the reason that prompted this, was a feeling of, as a dad, my daughter texted me and said, “Hey, there’s a student, I have just seen that a student is being pulled out of class, out of their dorm by people in hazmat suits.”

Well, of course, that was a social media post. It made its way all the way around the campus and was absolutely false. So I want to just let you know some of the schemes and scams that we have seen, make you aware of them so that you’re listening and that you act differently. First of all, there is just massive disinformation out there right now. There are hoaxes, there are rumors, and you need to be extra skeptical at the moment. One example, there are government advisories out there that aren’t actually being issued by governments. They are false, they are fake, they have nothing to do, for whatever reason, people are putting those out there. There are bogus home remedies of how you can solve the Coronavirus, which there’s no vaccine yet and probably won’t be for 12 to 18 months. Of course, there are home remedies like washing your hands that are legitimate.

There are products meant to defraud you, pills that you can buy, masks that don’t actually work. You have to be really careful that what you’re buying is actually legitimate. And on top of that, there’s price gouging. So masks that are going for hundreds of dollars on Amazon that you don’t probably actually need, hand sanitizer that has run out at your local store. Think before you spend all of the money on this because there are many other answers. There are a ton of fraudulent emails that scam you into clicking on Covid-19 type alerts, an alert in your hometown from your school system, a remote work policy from your work. It may not actually be your work. False test results we have seen. Covid test results. Of course, you probably haven’t been tested, but you’re tempted to click on those links. We’ve seen a bunch of videos, social media, blog posts, fake articles that spread disinformation, a lot of it about voting and the voting that we’re going through right now and polling places, politics, and so forth.

So watch all of that. This is essentially the weaponization of information. It happens all the time. It happens in the corporate world, it happens in the government, and now it’s happening around the health system because it’s in the news. So just like good hygiene, physical hygiene, washing your hands, there are cyber hygiene tips that will help you protect yourself. Number one, if you don’t recognize an email or a text, if you weren’t expecting it, don’t click on it. Don’t respond to it. It’s probably not legitimate. If you can’t verify that it’s from your work, from your kid’s school, from the government, do not believe it until you verify it. Same advice for social media. Articles, videos. Don’t believe it until you verify with a source that you trust, that you go to over and over again. Do that before you take the action that they’re talking about because most of these right now is not legitimate.

So sources like the CDC, the World Health Organization, your local news if you trust it, or the paper that you trust. Finally, if you have questions, ask an expert. Don’t count on what you see in the media necessarily, what you see on the internet, especially on the internet, as being totally legitimate until you verify. The point is, just like with cybercrime, those who think before they react with this Covid and vice versa, those who think about their digital settings and what they’re doing online and email and text and on those devices, those are the ones who prepare in advance for that, that avoid the worst outcomes. Listen, thanks so much. Sorry, it’s such a serious topic, but it’s really important that you protect both your physical health and your digital health. Thanks so much and stay safe.

Telemedicine: Are Virtual Doctor Visits a Cyber & Privacy Risk?

The Trump administration has relaxed privacy requirements for telemedicine, or virtual doctor visits: medical staff treating patients over the phone and using video apps such as FaceTime, Zoom, Skype and Google Hangouts. The move raises the chances that hackers will be able to access patient’s highly sensitive medical data, using it, for example, to blackmail the patient into paying a ransom to keep the personal health information (PHI) private.

This relaxation in privacy regulations about telemedicine is necessary, as treating coronavirus patients in quick, safe, virtual ways is a more critical short-term priority than protecting the data. That may sound contradictory coming out of the keyboard of a cybersecurity expert, and that exposes a misconception about how security works.

Security is not about eliminating all risk, because there is no such thing. Security is about prioritizing risk and controlling the most important operations first. Diagnosing and treating patients affected by Covid-19 is a higher priority than keeping every last transmission private.

Put simply, the life of a patient is more important than the patient’s data. With that in mind, protecting the data during transmission and when recordings are stored on the medical practice’s servers is still important.

  • Doctors should utilize audio/video services that provide full encryption between the patient and the medical office during all telemedicine visits
  • If the doctor’s office keeps a copy of the recording, it should be stored and backed up only on encrypted servers
  • Not all employees of the doctor’s office should have the same level of access to telemedicine recordings; all patient data should be protected with user-level access
  • Employees of the doctor’s office should be trained to repel social engineering attacks (mostly by phone and phishing email) to gain access to telemedicine recordings

Telemedicine and virtual doctor visits is just one way that the government is willing to accept increased risks during the pandemic. Many federal employees are also now working remotely, accessing sensitive data, often on personal computers that haven’t been properly protected by cybersecurity experts. This poses an even greater problem than putting patient data at risk, because nearly every government (and corporate) employee is working remotely for the foreseeable future. I will address those concerns in an upcoming post.

In the meantime, stay safe in all ways possible.

About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a privacy and cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker, and expert on technology, surveillance economy, cybersecurity and tech/life balance.