Most phishing attack vectors observed involved clicking a direct link to a phishing page

Read More

“My phone’s been hacked!” Words you probably don’t want to hear or say. Ever. 

Your phone gets to be like an old friend after a while. You have things laid out the way you like, your favorite apps are at the ready, and you have the perfect home screen and wallpaper all loaded up. So, if you unlock your phone one day and notice that something is a little … off, you’ll know pretty quickly. And it could be a sign that your phone may be hacked.  

How to know if your phone is hacked? 

It’s often pretty easy to tell when a piece of your tech isn’t working quite right. The performance is off, things crash, and so on. While there are several cases where there’s a legitimate technical issue behind that, it could also be the sign of a hacked device.  

Many hacks and attacks involve the installation of malware on the device, which eats up system resources, creates conflicts with other apps, and uses your data or internet connection to pass along your personal information—all of which can make your smartphone feel a little off. 

A few examples follow. Note that these may be signs of a hacked phone, yet not always. 

Performance hits and battery drain 

A suddenly sluggish phone or one that simply can’t hold a charge anymore are often attributed to phones that are getting a little old (these things happen). Yet, those same behaviors can also be signs of a compromised phone. For example, malicious bitcoin miners can run in the background and cause all types of performance issues because they eat up battery life and take up resources that your phone could otherwise normally use. In a way, it’s like having a second person using your phone at the same time you are. 

Your phone feels like it’s running hot 

Similar to the performance issues mentioned above, malware or mining apps running in the background can burn extra computing power, battery life, and data. Aside from a performance hit, they can cause your phone to physically run hot or even overheat. So if your phone feels like it’s been sitting in the sun, this could be a sign that malware is present. 

Popups suddenly appear on your phone 

If you’re seeing more popup ads than usual or seeing them for the first time, it could be a sign that your phone has been hit with adware—a type of malicious app that hackers use to generate revenue by distributing ads without the consent of the user. Furthermore, those ads may be malicious in nature as well (which is a good reminder to never click on them). Such ads may lead to bogus products and services or pages designed to steal personal information. All in all, malicious adware is what hackers prop up to make money off unsuspecting people. 

Mysterious apps, calls, or texts appear 

A potential telltale sign that your phone has been hacked is the appearance of new apps that you didn’t download, along with spikes in data usage that you can’t account for. Likewise, if you see calls in your phone bill that you didn’t make, that’s a warning as well. 

You run out of data or see unknown charges pop up 

Big red flag here. Like seeing an unknown charge or payment in your bank statement, this is a possible sign that a hacker has hijacked your phone and is using it to transfer data, make purchases, send messages, or make calls via your phone.  

What to do if your phone is hacked? 

Install and run security software on your smartphone if you haven’t already. From there, delete any apps you didn’t download, delete risky texts, and then run your mobile security software again. 
If you still have issues, wiping and restoring your phone is an option. Provided you have your photos, contacts, and other vital info backed up in the cloud, it’s a relatively straightforward process. A quick search online can show how to wipe and restore your model of phone. 

Lastly, check your accounts and your credit card statements to see if any unauthorized purchases have been made. If so, you can go through the process of freezing those accounts and getting new cards and credentials issued. Further, update your passwords for your accounts with a password that is strong and unique to prevent further theft.  

Five tips to keep your phone from getting hacked  

To help keep your phone from getting hacked in the first place, there are a few relatively easy steps you can take. Inside of a few minutes, you can find yourself much safer than you were before.  

1. Use comprehensive security software on your phone. Over the years, we’ve gotten into the good habit of using this on our computers and laptops. Our phones? Not so much. Installing security software on your smartphone gives you the first line of defense against attacks, plus several of the additional security features mentioned below. 

2. Stay safer on the go with a VPN. One way that crooks can hack their way into your phone is via public Wi-Fi, such as at airports, hotels, and even libraries. These networks are public, meaning that your activities are exposed to others on the network—your banking, your password usage, all of it. One way to make a public network private is with a VPN, which can keep you and all you do protected from others on that Wi-Fi hotspot.  

3. Use a password manager. Strong, unique passwords offer another primary line of defense. Yet with all the accounts we have floating around, juggling dozens of strong and unique passwords can feel like a task—thus the temptation to use (and re-use) simpler passwords. Hackers love this because one password can be the key to several accounts. Instead, try a password manager that can create those passwords for you and safely store them as well. Comprehensive security software will include one. 

4. Avoid public charging stations. Charging up at a public station seems so simple and safe. However, some hackers have been known to “juice jack” by installing malware into the charging station. While you “juice up,” they “jack” your passwords and personal info. So what to do about power on the road? You can look into a portable power pack that you can charge up ahead of time or run on AA batteries. They’re pretty inexpensive and can prevent malware from a public charging station.  

5. Keep your eyes on your phone. Preventing the actual theft of your phone is important too, as some hacks happen simply because a phone falls into the wrong hands. This is a good case for password or PIN protecting your phone, as well as turning on device tracking so that you can locate your phone or even wipe it remotely if you need to. Apple provides iOS users with a step-by-step guide for remotely wiping devices and Google offers up a guide for Android users as well.  

Phone acting funny? Follow up. 

A phone that’s acting a little funny may indicate a run-of-the-mill tech issue, yet it could also be a tell-tale sign of a hack. At a minimum, following up on your gut instinct that something isn’t quite right can take care of a nagging tech issue. But in the event of a possible hack, it can save you the far greater headache of unauthorized charges and purchases, and even identity theft. If you spot a problem, it absolutely pays to take a closer look. Follow up with tech support for help, whether that’s through your device manufacturer, retailer, or your antivirus providers. They’ll help pinpoint the issue and get you on your way. 

The post Help! I Think My Phone’s Been Hacked appeared first on McAfee Blog.

Read More

There’s little rest for your hard-working smartphone. If you’re like many professionals today, you use it for work, play, and a mix of personal business in between. Now, what if something went wrong with that phone, like loss or theft? Worse yet, what if your smartphone got hacked? Let’s try and keep that from happening to you. 

Globally, plenty of people pull double duty with their smartphones. In Spain, one survey found that 55% of people use the same phone for a mix of personal and and work activity. The same survey showed that up to half of people interviewed in Japan, Australia, and the U.S. do so as well, while nations like the UK and Germany trailed at 31% and 23% respectively. 

Whether these figures trend on the low or high end, the security implications remain constant. A smartphone loaded with business and personal data makes for a desirable target. Hackers target smartphones because they’re often unprotected, which gives hackers an easy “in” to your personal information and to any corporate networks you may use.  It’s like two hacks with one stone.  

Put simply, as a working professional with a smartphone, you’re a high-value target.  

Protect your smartphone from being hacked 

As both a parent and a professional, I put together a few things you can do to protect your smartphone from hacks so that you can keep your personal and work life safe: 

1. Add extra protection with your face, finger, pattern, or PIN. 

First up, the basics. Locking your phone with facial ID, a fingerprint, pattern or a pin is your most basic form of protection, particularly in the event of loss or theft. (Your options will vary depending on the device, operating system, and manufacturer.) Take it a step further for even more protection. Secure the accounts on your phone with strong passwords and use two-factor authentication on the apps that offer it, which doubles your line of defense.    

2. Use a VPN. 

Or, put another way, don’t hop onto public Wi-Fi networks without protection. A VPN masks your connection from hackers allowing you to connect privately when you are on unsecure public networks at airports, cafes, hotels, and the like. With a VPN connection, you’ll know that your sensitive data, documents, and activities you do are protected from snooping, which is definitely a great feeling given the amount of personal and professional business we manage with our smartphones. 

3. Stick to the official app stores for your apps.

Both Google Play and Apple’s App Store have measures in place to help prevent potentially dangerous apps from making it into their stores. Malicious apps are often found outside of the app stores, which can run in the background and compromise your personal data like passwords, credit card numbers, and more—practically everything that you keep on your phone. Further, when you are in the app stores, look closely at the descriptions and reviews for apps before you download them. Malicious apps and counterfeits can still find their way into stores, and here are a few ways you can keep those bad apps from getting onto your phone.    

4. Back up the data on your phone. 

Backing up your phone is always a good idea for two reasons: 

First, it makes the process of transitioning to a new phone easy by transferring that backed up data from your old phone to your new phone. 
Second, it ensures that your data stays with you if your phone is lost or stolen—allowing you to remotely wipe the data on your lost or stolen phone while still having a secure copy of that data stored in the cloud.  

Both iPhones and Android phones have straightforward ways of backing up your phone regularly. 

5. Learn how to lock or wipe your phone remotely in case of emergency. 

Worst case scenario—your phone is gone. Really gone. Either it’s hopelessly lost or got stolen. What now? Lock it remotely or even wipe its data entirely. While that last bit about wiping the phone seems like a drastic move, if you maintain regular backups as mentioned above, your data is secure in the cloud—ready for you to restore. In all, this means that hackers won’t be able to access you, or your company’s, sensitive information—which can keep you out of trouble and your professional business safe. Apple provides iOS users with a step-by-step guide for remotely wiping devices, and Google offers up a guide for Android users as well. 

6. Get rid of old apps—and update the ones you keep. 

We all download apps, use them once, and then forget they are on our phone. Take a few moments to swipe through your screen and see which ones you’re truly done with and delete them along with their data. Some apps have an account associated with them that may store data off your phone as well. Take the extra step and delete those accounts so any off-phone data is deleted.  

The reason for this is that every extra app is another app that needs updating or that may have a security issue associated with it. In a time of data breaches and vulnerabilities, deleting old apps is a smart move. As for the ones you keep, update them regularly and turn on auto-updates if that’s an option. Updates not only introduce new features to apps, but they also often address security issues too. 

7. Protect your phone. 

With so much of your life on your phone, getting security software installed on it can protect you and the things you keep on your phone. Whether you’re an Android owner or iOS owner, mobile security software can keep your data, your shopping, and payments secure. 

The post 7 Tips to Protect Your Smartphone from Getting Hacked appeared first on McAfee Blog.

Read More

New ESG and ISSA study shows nearly half of organizations are shifting towards integrated cybersecurity platforms. Here’s why many CISOs are making the shift.

Less complexity, more security.

The shift to integrated cybersecurity platforms has become a growing trend among CISOs. With security teams managing tens of disparate security tools — some even more than 100 — to protect their infrastructure, CISOs are looking for a simpler solution that protects their expanding attack surface and provides comprehensive visibility.

For years, security professionals have relied on buying best-of-breed (BOB) security products to meet the demands of the ever changing cybersecurity landscape. However, as cybersecurity threats continue to evolve and become more sophisticated in nature, the result has been an influx of specialized, point security products. For every new or greater threat comes a new product or security tool to combat it. This creates more complexities, such as tool sprawl, which limits control and overall visibility as each new tool is only best at solving a particular problem. Additionally, increased training is often required for teams to sufficiently manage a plethora of different security tools and products. Thus, it’s critical that organizations adopt new security tools with a cohesive strategy in mind.

The shift to integrated cybersecurity platforms

The new research report Technology Perspectives from Cybersecurity Professionals from Enterprise Strategy Group (ESG) and Information Systems Security Association (ISSA) polled 280 cybersecurity leaders globally and found a growing preference among respondents towards integrated security platforms, as well as a desire to see vendors embrace open standards and APIs for better product interoperability.

Specifically, 38% of respondents said they tend to purchase integrated security platforms rather than BOB products today, and 15% said that they plan to transition from BOB products to platforms in the next few years.

When asked to explain what they consider a cybersecurity platform, respondents offered two definitions:

A suite of products from a single vendor (29%)
A standards-based architecture which contains products from multiple vendors as an open suite integrated via APIs (67%)

Specifically, the study found that respondents want to see security vendors support more open standards (77%) and believe a product’s integration capabilities are important (84%.)

Currently, 32% of respondents from organizations with 1,000-plus employees use 25 or more different cybersecurity products.

“This data can be seen as yet another cry for help. Security professionals are asking for more industry cooperation and standards to ease their technology integration burden,” the report, authored by ESG Senior Principal Analyst Jon Oltsik, reads.

With thousands of vendors competing against each other in the market across numerous security product categories, organizations are seeking to optimize all their security technologies in their stack at once. According to the report, vendors who support open standards for technology integration are best positioned to meet the demand for integrated cybersecurity platforms.

As the need for security technology consolidation continues to rise, the demand for integrated cybersecurity platforms continues to increase. The report found that 21% of organizations are consolidating security vendors while 25% are considering it.

Additionally, the report identified the most common reasons for vendor consolidation which include:

Operational efficiencies realized by security and IT teams (65%)
Tighter integration between previously disparate security controls (60%)
Improved threat detection efficiency (51%)

Furthermore, for cybersecurity professionals who are evaluating large, enterprise-class cybersecurity vendors that can serve as a “center of gravity” for security consolidation and integration, the most important attributes are:

A proven track record in product roadmap and strategy execution (34%)
Products designed for enterprise-scale, integration and business process requirements (33%)
A commitment to reduce operational complexity and to lower cost of ownership (31%)

Meanwhile, ISSA and ESG recommend that security professionals take the following steps, as they go through this vendor consolidation and product integration process:

Push vendors to adopt industry standards.
Appoint a cybersecurity architect who can outline the organization’s needs, assess its current security stack and design an end-to-end architecture.
Establish a comprehensive process for vendor qualification and security procurement.
Create a three-year plan for executing the integration process and deploy an integrated security architecture.

Want more details? Check out this slide presentation from ESG and ISSA.

Learn more

“Thanks to the economy, cybersecurity consolidation is coming. CISOs are more than ready.” (Protocol)
“Cybersecurity: Best-of-Breed Approach or Single-Vendor Platform?” (BizTech Magazine)
“Bye-bye best-of-breed?” (CSO)
“Note to Security Vendors: Companies Are Picking Favorites” (DarkReading)
“Security tool investments: Complexity vs. practicality” (Infosec Institute)

Read More

The Atlantic Council has published a report on securing the Internet of Things: “Security in the Billions: Toward a Multinational Strategy to Better Secure the IoT Ecosystem.” The report examines the regulatory approaches taken by four countries—the US, the UK, Australia, and Singapore—to secure home, medical, and networking/telecommunications devices. The report recommends that regulators should 1) enforce minimum security standards for manufacturers of IoT devices, 2) incentivize higher levels of security through public contracting, and 3) try to align IoT standards internationally (for example, international guidance on handling connected devices that stop receiving security updates).

This report looks to existing security initiatives as much as possible—both to leverage existing work and to avoid counterproductively suggesting an entirely new approach to IoT security—while recommending changes and introducing more cohesion and coordination to regulatory approaches to IoT cybersecurity. It walks through the current state of risk in the ecosystem, analyzes challenges with the current policy model, and describes a synthesized IoT security framework. The report then lays out nine recommendations for government and industry actors to enhance IoT security, broken into three recommendation sets: setting a baseline of minimally acceptable security (or “Tier 1”), incentivizing above the baseline (or “Tier 2” and above), and pursuing international alignment on standards and implementation across the entire IoT product lifecycle (from design to sunsetting). It also includes implementation guidance for the United States, Australia, UK, and Singapore, providing a clearer roadmap for countries to operationalize the recommendations in their specific jurisdictions—and push towards a stronger, more cohesive multinational approach to securing the IoT worldwide.

Note: One of the authors of this report was a student of mine at Harvard Kennedy School, and did this work with the Atlantic Council under my supervision.

Read More