AI is on your side. In fact, it’s kept you safer online for some time now. 

Now that scammers and hackers have gotten their hands on AI tools, they understandably get their share of headlines. Rightfully so. AI tools have helped them scale up their attacks while also making them look and feel increasingly sophisticated.  

Meanwhile, at McAfee, we’ve used AI as a core component of our protection for years now. As such, it’s done plenty for you over the years. AI has sniffed out viruses, malicious websites, and sketchy content online. It’s helped steer you clear of malicious websites too.  

Now we’ve made improvements to our AI-driven protection—and unveiled an all-new feature that takes full advantage of AI, McAfee Scam Protection. 

AI is indeed on your side. A quick tour will show you how. 

How AI keeps you safe: The plain language version. 

AI-driven protection quashes threats in three ways: 

It detects threats by referencing models of existing threats. This combats pre-existing threats and entirely new (zero-day) threats alike. AI can spot varieties of different threats by comparing them to features it’s seen before. For example, it’s like AI learning to identify different varieties of fruit. An apple is still an apple whether it’s a Fuji or Granny Smith. In that way, a virus is still a virus if it’s “Virus A” or the newly discovered “Virus Z.” 

It further detects suspicious events and behaviors. AI provides a particularly powerful tool against zero-day threats. It analyzes the activities of applications for patterns that are consistent with malicious behavior. With that it can spot and prevent a previously unknown file or process from doing harm. In its way, AI says, “I’ve seen this sketchy behavior before. I’m going to flag it.” 

It automatically classifies threats and adds them to its body of knowledge. AI-driven threat protection gets stronger over time. Because it learns. Something we call “threat intelligence.” The more threats it encounters, the more rapidly and readily it can determine if files want to do you no good. The body of threat intelligence improves immensely as a result. 

So, what does AI-driven protection look like in the real world?  

AI can identify malicious websites and links before you can connect to them. It can prevent new forms of ransomware from encrypting your photos and files. And it can let you know when the link you got in that text is a total fake.  

In combination with our security engineers and teams, AI really on your side.  

AI leads to powerful new protections. 

As part of our product launch a few weeks ago, we created advances in one or our AI-driven protections and released an entirely new AI-driven protection as well. 

McAfee Next-gen Threat Protection: McAfee’s AI-powered security just got faster and stronger. Our Next-gen Threat Protection takes up less disk space, reduces its background processes by 75%, and scans 3x faster than before. This makes your time online safer without slowing down your browsing, shopping, streaming, and gaming.  

As for strength, it offers 100% protection against zero-day threats and 100% against threats released in the past month (AV-TEST results, June 2023). You’ll find it across all our products that have antivirus included. 

McAfee Scam Protection: McAfee’s patented and powerful AI technology helps you stay safer amidst the rise in phishing scams. Including phishing scams generated by AI. It detects suspicious URLs in texts before they’re opened or clicked on. No more guessing if that text you just got is real or fake. 

And if you accidentally click on a suspicious link in a text, email, social media, or browser search, it blocks the scam site from loading. You’ll find McAfee Scam Protection across our McAfee+ plans. 

Above and beyond AI, more protections for your privacy and identity. 

In addition to AI-driven improvements, we also released several new features. Together they help you protect your privacy, lock down your identity, and set up your McAfee software for the best security. 

Online Account Cleanup helps reduce the likelihood of being impacted by a data breach—because you have fewer accounts that can get hacked. Many internet users can have over 350 online accounts, many of which they might not know are still active. This feature runs monthly scans to find your online accounts and shows you their risk level to help you decide which to delete, and how to do so.​ 

Social Privacy Manager helps safeguard your privacy on social media with personalized privacy recommendations based on your own preferences. It does the heavy lifting by adjusting more than 100 privacy settings across your social media accounts in just a few clicks. This ensures your personal info is only visible to the people you want to share it with. 

Transaction Monitoring helps spot unusual transactions which could be a sign of identity theft. Track deposits, withdrawals, and payments across your accounts, all in one place. (Included with McAfee+ Advanced and Ultimate.) 

Bank Account Takeover Monitoring provides alerts when your personal contact info changes on your banking account. If it wasn’t you, McAfee will guide you so you can take quick action. (Included with McAfee+ Ultimate.) 

Increased ID Theft Coverage now provides $2 million identity theft coverage, including 401K plans, stolen funds, and incurred expenses for you and your household members. Also includes $25K ransomware coverage. (Included with McAfee+ Ultimate.) 

McAfee Assist – Protection Setup connects you with one of our experts for a live session. You can call whenever it’s convenient for you to set up your account. No scheduling needed. (Included with McAfee+ Ultimate.) 

The great feeling you get when you have AI in your corner. 

Hackers might be making headlines as they cook up new attacks with AI, yet maybe it’s time to flip the script this once. AI works for you and can keep you safer online. 

Whether hackers try to hit you with ransomware or scammers pepper you with phony messages, AI can help keep you from harm. In conjunction with other advanced features that protect your privacy and identity, AI makes for powerful protection. 

The post Advances in Our Use of AI Keep You Even Safer Online appeared first on McAfee Blog.

Read More

The top-level domain for the United States — .US — is home to thousands of newly-registered domains tied to a malicious link shortening service that facilitates malware and phishing scams, new research suggests. The findings come close on the heels of a report that identified .US domains as among the most prevalent in phishing attacks over the past year.

Researchers at Infoblox say they’ve been tracking what appears to be a three-year-old link shortening service that is catering to phishers and malware purveyors. Infoblox found the domains involved are typically three to seven characters long, and hosted on bulletproof hosting providers that charge a premium to ignore any abuse or legal complaints. The short domains don’t host any content themselves, but are used to obfuscate the real address of landing pages that try to phish users or install malware.

Infoblox says it’s unclear how the phishing and malware landing pages tied to this service are being initially promoted, although they suspect it is mainly through scams targeting people on their phones via SMS. A new report says the company mapped the contours of this link shortening service thanks in part to pseudo-random patterns in the short domains, which all appear on the surface to be a meaningless jumble of letters and numbers.

“This came to our attention because we have systems that detect registrations that use domain name generation algorithms,” said Renee Burton, head of threat intelligence at Infoblox. “We have not found any legitimate content served through their shorteners.”

Infoblox determined that until May 2023, domains ending in .info accounted for the bulk of new registrations tied to the malicious link shortening service. Since then, they found that whoever is responsible for running the service has used .US for approximately 55 percent of the total domains created, with several dozen new malicious .US domains registered daily.

.US is overseen by the National Telecommunications and Information Administration (NTIA), an executive branch agency of the U.S. Department of Commerce. But Uncle Sam has long outsourced the management of .US to various private companies, which have gradually allowed the United States’s top-level domain to devolve into a cesspool of phishing activity.

Or so concludes The Interisle Consulting Group, which gathers phishing data from multiple industry sources and publishes an annual report on the latest trends. As far back as 2018, Interisle found .US domains were the worst in the world for spam, botnet (attack infrastructure for DDOS etc.) and illicit or harmful content.

Interisle’s newest study examined six million phishing reports between May 1, 2022 and April 30, 2023, and identified approximately 30,000 .US phishing domains. Interisle found significant numbers of .US domains were registered to attack some of the United States’ most prominent companies, including Bank of America, Amazon, Apple, AT&T, Citi, Comcast, Microsoft, Meta, and Target. Others were used to impersonate or attack U.S. government agencies.

Under NTIA regulations, domain registrars processing .US domain registrations must take certain steps (PDF) to verify that those customers actually reside in the United States, or else own organizations based in the U.S. However, if one registers a .US domain through GoDaddy — the largest domain registrar and the current administrator of the .US contract — the way one “proves” their U.S. nexus is simply by choosing from one of three pre-selected affirmative responses.

In an age when most domain registrars are automatically redacting customer information from publicly accessible registration records to avoid running afoul of European privacy laws, .US has remained something of an outlier because its charter specifies that all registration records be made public. However, Infoblox said it found more than 2,000 malicious link shortener domains ending in .US registered since October 2023 through NameSilo that have somehow subverted the transparency requirements for the usTLD and converted to private registrations.

“Through our own experience with NameSilo, it is not possible to select private registration for domains in the usTLD through their interface,” Infoblox wrote. “And yet, it was done. Of the total domains with private records, over 99% were registered with NameSilo. At this time, we are not able to explain this behavior.”

NameSilo has not yet responded to requests for comment.

Experts who track domains associated with malware and phishing say even phony information supplied at registration is useful in identifying potentially malicious or phishous domains before they can be used for abuse.

For example, when it was registered through NameSilo in July 2023, the domain 1ox[.]us — like thousands of others — listed its registrant as “Leila Puma” at a street address in Poland, and the email address blackpumaoct33@ukr.net. But according to DomainTools.com, on Oct. 1, 2023 those records were redacted and hidden by NameSilo.

This is why Infoblox refers to the people behind this malicious link shortening service as “Prolific Puma.” Infoblox notes that the username portion of the email address appears to be a reference to the song October 33 by the Black Pumas, an Austin, Texas based psychedelic soul band.

The Black Pumas aren’t exactly a household name, but they did recently have a popular Youtube video that featured a cover of the Kinks song “Strangers,” which included an emotional visual narrative about Ukrainians seeking refuge from the Russian invasion, titled “Ukraine Strangers.” Also, Leila Puma’s email address is at a Ukrainian email provider.

DomainTools shows that hundreds of other malicious domains tied to Prolific Puma previously were registered through NameCheap to a “Josef Bakhovsky” at a different street address in Poland. According to ancestry.com, the anglicized version of this surname — Bakovski — is the traditional name for someone from Bakowce, which is now known as Bakivtsi and is in Ukraine.

This possible Polish and/or Ukrainian connection may or may not tell us something about the “who” behind this link shortening service, but those details are useful for identifying and grouping these malicious short domains. However, even this meager visibility into .US registration data is now under threat.

The NTIA recently published a proposal that would allow registrars to redact all registrant data from WHOIS registration records for .US domains. A broad array of industry groups have filed comments opposing the proposed changes, saying they threaten to remove the last vestiges of accountability for a top-level domain that is already overrun with cybercrime activity.

Infoblox’s Burton says Prolific Puma is remarkable because they’ve been able to facilitate malicious activities for years while going largely unnoticed by the security industry.

“This exposes how persistent the criminal economy can be at a supply chain level,” Burton said. “We’re always looking at the end malware or phishing page, but what we’re finding here is that there’s this middle layer of DNS threat actors persisting for years without notice.”

Infoblox’s full report on Prolific Puma is here.

Read More

Ukraine is using $400 drones to destroy tanks:

Facing an enemy with superior numbers of troops and armor, the Ukrainian defenders are holding on with the help of tiny drones flown by operators like Firsov that, for a few hundred dollars, can deliver an explosive charge capable of destroying a Russian tank worth more than $2 million.

[…]

A typical FPV weighs up to one kilogram, has four small engines, a battery, a frame and a camera connected wirelessly to goggles worn by a pilot operating it remotely. It can carry up to 2.5 kilograms of explosives and strike a target at a speed of up to 150 kilometers per hour, explains Pavlo Tsybenko, acting director of the Dronarium military academy outside Kyiv.

“This drone costs up to $400 and can be made anywhere. We made ours using microchips imported from China and details we bought on AliExpress. We made the carbon frame ourselves. And, yeah, the batteries are from Tesla. One car has like 1,100 batteries that can be used to power these little guys,” Tsybenko told POLITICO on a recent visit, showing the custom-made FPV drones used by the academy to train future drone pilots.

“It is almost impossible to shoot it down,” he said. “Only a net can help. And I predict that soon we will have to put up such nets above our cities, or at least government buildings, all over Europe.”

Science fiction authors have been writing about drone swarms for decades. Now they are reality. Tanks today. Soon it will be ships (probably with more expensive drones). Feels like this will be a major change in warfare.

Read More