Social engineering is involved in the vast majority of cyberattacks, but a new report from Proofpoint has revealed five common social engineering assumptions that are not only wrong but are repeatedly subverted by malicious actors in their attacks.

Commenting on the report’s findings, Sherrod DeGrippo, Proofpoint’s vice president threat research and detection, stated that the vendor has attempted to debunk faulty assumptions made by organizations and security teams so they can better protect employees against cybercrime. “Despite defenders’ best efforts, cybercriminals continue to defraud, extort and ransom companies for billions of dollars annually. Security-focused decision makers have prioritized bolstering defenses around physical and cloud-based infrastructure, which has led to human beings becoming the most relied upon entry point for compromise. As a result, a wide array of content and techniques continue to be developed to exploit human behaviors and interests.”

To read this article in full, please click here

Read More

Earlier this month, I and others wrote a letter to Congress, basically saying that cryptocurrencies are an complete and total disaster, and urging them to regulate the space. Nothing in that letter is out of the ordinary, and is in line with what I wrote about blockchain in 2019. In response, Matthew Green has written—not really a rebuttal—but a “a general response to some of the more common spurious objections…people make to public blockchain systems.” In it, he makes several broad points:

Yes, current proof-of-work blockchains like bitcoin are terrible for the environment. But there are other modes like proof-of-stake that are not.
Yes, a blockchain is an immutable ledger making it impossible to undo specific transactions. But that doesn’t mean there can’t be some governance system on top of the blockchain that enables reversals.
Yes, bitcoin doesn’t scale and the fees are too high. But that’s nothing inherent in blockchain technology—that’s just a bunch of bad design choices bitcoin made.
Blockchain systems can have a little or a lot of privacy, depending on how they are designed and implemented.

There’s nothing on that list that I disagree with. (We can argue about whether proof-of-stake is actually an improvement. I am skeptical of systems that enshrine a “they who have the gold make the rules” system of governance. And to the extent any of those scaling solutions work, they undo the decentralization blockchain claims to have.) But I also think that these defenses largely miss the point. To me, the problem isn’t that blockchain systems can be made slightly less awful than they are today. The problem is that they don’t do anything their proponents claim they do. In some very important ways, they’re not secure. They doesn’t replace trust with code; in fact, in many ways they are far less trustworthy than non-blockchain systems. They’re not decentralized, and their inevitable centralization is harmful because it’s largely emergent and ill-defined. They still have trusted intermediaries, often with more power and less oversight than non-blockchain systems. They still require governance. They still require regulation. (These things are what I wrote about here.) The problem with blockchain is that it’s not an improvement to any system—and often makes things worse.

In our letter, we write: “By its very design, blockchain technology is poorly suited for just about every purpose currently touted as a present or potential source of public benefit. From its inception, this technology has been a solution in search of a problem and has now latched onto concepts such as financial inclusion and data transparency to justify its existence, despite far better solutions to these issues already in use. Despite more than thirteen years of development, it has severe limitations and design flaws that preclude almost all applications that deal with public customer data and regulated financial transactions and are not an improvement on existing non-blockchain solutions.”

Green responds: “‘Public blockchain’ technology enables many stupid things: today’s cryptocurrency schemes can be venal, corrupt, overpromised. But the core technology is absolutely not useless. In fact, I think there are some pretty exciting things happening in the field, even if most of them are further away from reality than their boosters would admit.” I have yet to see one. More ore specifically, I can’t find a blockchain application whose value has anything to do with the blockchain part, that wouldn’t be made safer, more secure, more reliable, and just plain better by removing the blockchain part. I postulate that no one has ever said “Here is a problem that I have. Oh look, blockchain is a good solution.” In every case, the order has been: “I have a blockchain. Oh look, there is a problem I can apply it to.” And in no cases does it actually help.

Someone, please show me an application where blockchain is essential. That is, a problem that could not have been solved without blockchain that can now be solved with it. (And “ransomware couldn’t exist because criminals are blocked from using the conventional financial networks, and cash payments aren’t feasible” does not count.)

For example, Green complains that “credit card merchant fees are similar, or have actually risen in the United States since the 1990s.” This is true, but has little to do with technological inefficiencies or existing trust relationships in the industry. It’s because pretty much everyone who can and is paying attention gets 1% back on their purchases: in cash, frequent flier miles, or other affinity points. Green is right about how unfair this is. It’s a regressive subsidy, “since these fees are baked into the cost of most retail goods and thus fall heavily on the working poor (who pay them even if they use cash).” But that has nothing to do with the lack of blockchain, and solving it isn’t helped by adding a blockchain. It’s a regulatory problem; with a few exceptions, credit card companies have successfully pressured merchants into charging the same prices, whether someone pays in cash or with a credit card. Peer-to-peer payment systems like PayPal, Venmo, MPesa, and AliPay all get around those high transaction fees, and none of them use blockchain.

This is my basic argument: blockchain does nothing to solve any existing problem with financial (or other) systems. Those problems are inherently economic and political, and have nothing to do with technology. And, more importantly, technology can’t solve economic and political problems. Which is good, because adding blockchain causes a whole slew of new problems and makes all of these systems much, much worse.

Green writes: “I have no problem with the idea of legislators (intelligently) passing laws to regulate cryptocurrency. Indeed, given the level of insanity and the number of outright scams that are happening in this area, it’s pretty obvious that our current regulatory framework is not up to the task.” But when you remove the insanity and the scams, what’s left?

EDITED TO ADD: Nicholas Weaver is also adamant about this. David Rosenthal is good, too.

Read More

If you’re one of the countless Apple iPhone owners out there, there’s a good chance that one of the reasons you love your smartphone is because you’ve heard that Apple devices tend to have fewer vulnerabilities to viruses.  

Because of their shared operating system, iOS devices enjoy Apple’s security measures, which keeps them protected from malware and viruses differently from most Android devices.  

This is great, right? Certainly! But it’s also important to remember that nothing digital or internet-related is ever foolproof, and while it’s rare, even iOS operating systems can be affected by malicious software.  

The great news is that protecting yourself from iPhone viruses and hackers isn’t hard. Read on to learn more. 

Can iPhones get viruses?

Although Apple has designed its iOS system to be pretty untouchable, it’s still possible to get a virus on your iPhone.  

The biggest way this can happen is through something called “jailbreaking,” which is when you bypass the restrictions on the Apple operating system. You might do this to gain more control over your device, downloading any apps or programs from anywhere on the internet. It basically lets you do whatever you want with your iPhone. 

A major reason that mobile security is so seamless with Apple’s iOS is that — unlike Android and Microsoft Windows products — Apple devices are designed to work only inside set parameters that “talk” exclusively to other approved Apple apps or devices.  

This is all controlled by Apple encryption, making your iPhone security rather impervious to malicious apps. You might also notice that there are no antivirus apps in the App Store, which isn’t a coincidence! 

But when you jailbreak an iPhone, this means you’ve opened the iOS to a wider range of apps, features, and themes — none of which are approved by Apple!  

So, you won’t benefit from the virus protection that comes from having a closed system, meaning you can expose your iPhone to adware, scams, and other internet security issues that Apple permissions blocked. 

Potential threats to your iPhone

So, you’ve jailbroken your iPhone and are out of Apple’s famously closed sandbox. While it’s not an ideal situation, it’s not the end of the world. You may need antivirus protection now. This is especially true if you frequently use public Wi-Fi.  

Here are a few potential threats that a jailbroken iPhone might face: 

Phishing: Unfortunately, malicious websites don’t come with a fraudulent website warning. Phishing happens when a cybercriminal sends a fraudulent message aimed at getting you to reveal important data like your personal or financial information. If your iPhone is successfully phished, private data on the iCloud and your device can be compromised. 
Ransomware: Unsecured Wi-Fi networks can expose connected devices to ransomware. This type of malware threatens users with permanently blocked access to their devices unless they pay a certain amount of money. Some ransomware programs will even try to coerce money from users by warning that private information will be published if they don’t pay a ransom. 
Malware: The reason so many different security apps and antivirus programs exist is that malware is everywhere. It also comes in many forms! Malware is a general term used to describe any software program intended to gain unauthorized access to a computer system or device. Malware can disrupt or disable a device, network, or specific user. It can also actively leak private information and create privacy concerns. 

5 signs your iPhone has a virus

If you’re worried about the Wi-Fi you used at a coffee shop last week and are searching for the “best antivirus protection for Apple,” don’t curse that java-inspired Safari surf just yet.  

There are a few telltale signs that your iPhone or another Apple device has been infected with a virus. They include: 

Overheating: Being out in the extreme sun or having an old battery can be culprits for overheating. But if you’re repetitively seeing that feverish red thermometer on your screen, your iPhone could be letting you know it’s infected with malicious software. 
Unexplained data usage: If you don’t have an unlimited phone plan, you probably keep a pretty close eye on data usage. So, if you see big increases in usage that don’t match your activity, this could be a sign that your iPhone may have a virus. 
Pop-ups: Sometimes, there’s no escaping those pesky “look at me” boxes that pop up when you’re online. But seeing many pop-ups can indicate that your Apple device is harboring unwanted guests. You can minimize pop-ups by using a virtual private network like McAfee Secure VPN. 
Suspicious apps: Make a habit of scrolling through your list of apps from time to time. This could be a red flag if you see anything that you don’t remember downloading yourself or that didn’t come with your iPhone. 
Quick battery drainage: If your iPhone is older or has many big apps, your battery will typically drain faster. But it could also mean an unwanted and unseen program is running in the background. 

How you can protect your iPhone

The first and best way to protect your Apple device from cybersecurity concerns is to avoid jailbreaking it. While an iPhone might be limited in what apps and themes you can enjoy, its built-in security features really can’t be beaten.  

Here are some other ways you can keep your iPhone safe from malware and viruses: 

Keep software updated. Each new version of Apple iOS has patches for security holes discovered by Apple’s internal hackers. Be sure to keep your iPhone software up to date to make sure you’re enjoying the latest security features. You can even set up automatic software updates to make things easier. 
Set up USB restricted mode. Protect your data from “juice jacking,” which is when someone steals your data through your phone’s USB port as it’s plugged into a public charger. Head to “Settings” and then to “Face ID and Passcode.” Enter your passcode and toggle “USB Accessories.” 
Use a password manager. A password manager like McAfee True Key can lend several additional layers of security to Apple’s already highly encrypted operating system. Consider a password management system that can help you create strong passwords and uses biometric security features like fingerprint recognition. 
Enable Touch ID. This may seem like an old-school feature compared to facial recognition. But having touch ID enabled can reduce the chances of someone gaining unauthorized access to your iPhone since it requires your physical presence to open it.  
Use a VPN. If you use public Wi-Fi a lot, you risk exposing your personal information. McAfee Secure VPN uses bank-grade encryption to keep your data protected while you live your life online — no matter where you are. 
Consider antivirus software. Antivirus software can handle many potential vulnerabilities by looking out for online threats like hackers. McAfee antivirus software offers real-time threat protection across multiple devices and can help keep your iPhone free of data breaches. 

Keep your everyday devices secure 

In this day and age, we all live on our devices. And while it’s great to have the built-in security of Apple’s iOS, why settle for just one line of defense?  

For complete protection against malicious software like viruses, malware, and more, look to McAfee Total Protection. Our all-in-one approach means you’re shielded from data breaches, have access to a secure VPN, and can receive up to $1 million in identity theft coverage. The best part is that it works for multiple devices, including Mac OS and iOS.  

Enjoy the peace of mind that comes with having McAfee in your corner.  

The post Does an iPhone Need Antivirus Software? appeared first on McAfee Blog.

Read More

Defunct ransomware operation was one of the most aggressive

Read More

New research uncovers major enterprise security gaps

Read More

Fifteen new investigations opened after reports of human trafficking

Read More