In recent times, the humble password’s efficacy as a security measure has come under scrutiny. With tendencies to be easily guessed, stolen, or bypassed, passwords have been deemed inadequate for securing sensitive information. Thankfully, more secure alternatives have emerged, with terms such as “two-factor” and “multi-factor” authentication gaining traction.

However, these terms may seem abstract to those unfamiliar with them, potentially leading to confusion about their functions and differences. This article aims to break down these forms of authentication, explaining how they work and how they can enhance online information security.

Single-Factor Authentication

Before diving into the intricacies of multi-factor and two-factor authentication, it is pertinent to understand their predecessor: single-factor authentication. The simplest form of authentication, single-factor authentication, requires only one factor to verify a user’s identity. Typically, this involves matching a password with a corresponding username, a method used universally for online account logins.

While convenient in its simplicity, single-factor authentication carries glaring security flaws. Easy-to-guess passwords or stolen credentials can lead to unauthorized access, compromising the security of user accounts and confidential information. Hence, it became necessary to introduce additional layers of security to the authentication process, giving rise to two-factor and multi-factor authentication.

→ Dig Deeper: The Optus Data Breach – Steps You Can Take to Protect Yourself

Two-Factor Authentication

Two-factor authentication augments the simplicity of single-factor authentication with an extra layer of security. Besides providing a password, users are also required to verify their identity with an additional factor that only they possess. This additional factor often takes the form of a unique code sent to the user’s mobile phone.

The rationale behind this method is straightforward: even if a hacker manages to secure a user’s password, they would still require the unique code to gain access. However, it is important to note that this method is not completely foolproof. Crafty hackers able to intercept the unique code or create duplicate websites to steal credentials can still bypass this security measure. Despite these vulnerabilities, the complexities involved in these hacking methods make two-factor authentication considerably safer than its single-factor counterpart.

Also worth mentioning is “true” two-factor authentication, which involves giving users a unique device, such as a security token, that generates a unique code for the user. This code, which changes at set intervals, is matched with a profile in a database, making guessing impossible.

Multi-Factor Authentication

Building upon the concepts of two-factor authentication, multi-factor authentication introduces even more factors for user verification. These factors usually include something that the user possesses and something unique to their physical being, such as a retina or fingerprint scan. Location and time of day can also serve as additional authentication factors.

While the notion of multi-factor authentication may seem like a concept from a science fiction movie, it is already being used extensively, especially by financial institutions. Advancements in camera technology have enabled the implementation of facial recognition as a secure method of recognition, adding another factor to the multi-factor authentication process.

→ Dig Deeper: Banks are Using Biometric Measures to Protect Against Fraud

Implementing Two-factor and Multi-factor Authentication

With the potential vulnerabilities associated with single-factor authentication, implementing two-factor or multi-factor authentication for sensitive online accounts becomes a necessity. These added layers of security help to safeguard your digital information from unscrupulous elements. Two-factor authentication utilizes a password and an extra verification layer, such as a unique code sent to your mobile device, to ensure that you’re indeed the account holder. With multi-factor authentication, additional verification elements are added, such as biometric data or your physical location.

So how do you implement these forms of authentication? Most online service providers now offer two-factor authentication as an option in their security settings. Once you’ve opted for this extra level of security, you’ll be required to input a unique code sent to your mobile device each time you attempt to log in. For multi-factor authentication, the process might require additional steps, such as providing biometric data like facial recognition or fingerprints. However, these extra steps are a small inconvenience compared to the potential risk of your sensitive information being compromised.

→ Dig Deeper: Make a Hacker’s Job Harder with Two-step Verification

Understanding Biometric Authentication

Biometric authentication is a subset of multi-factor authentication that relies on unique physical or behavioral traits for verification. Biometric authentication methods include facial recognition, fingerprints, iris scans, voice recognition, and even your typing pattern. These methods are gradually becoming mainstream, with smartphone manufacturers leading the way in implementing fingerprint scanners and facial recognition technology into their devices. Biometric authentication’s edge over traditional passwords lies in its uniqueness; while passwords can be guessed or stolen, biometric traits are unique to each individual.

As with all forms of technology, biometric authentication also has its drawbacks. For instance, it may not always be accurate, as facial features or fingerprints may change over time due to aging or injury. Also, there are valid concerns about privacy and the potential misuse of biometric data if it falls into the wrong hands. However, with proper safeguards and data encryption in place, biometric authentication can be a secure and efficient way to protect online accounts from unauthorized access.

McAfee Pro Tip: Biometric authentication definitely has its strengths and weaknesses, so it’s important to choose the best combination of authentication and security software for your devices and accounts. Learn more about the opportunities and vulnerabilities of biometric authentication. 

Final Thoughts

As our digital footprint grows, so does the need for secure authentication methods. Single-factor authentication, although simple and convenient, is no longer sufficient to protect sensitive online information. Two-factor and multi-factor authentication provide an additional layer of security, significantly reducing the risk of unauthorized access.

Additionally, advancements in biometric technology have introduced a new realm of secure verification methods unique to each individual. Remember, the goal is not to eliminate all risks but to reduce them to a level that’s acceptable and manageable. When setting up your online accounts, always opt for the highest level of security available, whether it’s two-factor, multi-factor, or biometric authentication. Take full advantage of these methods, and ensure you’re doing everything you can to safeguard your digital information.

The post Two-Factor vs. Multi-Factor Authentication: What’s the Difference? appeared first on McAfee Blog.

Read More

With the surge in the usage of mobile phones, there has been a concurrent increase in malicious activities targeting these devices. One common technique used by hackers is to corrupt legitimate applications. Android devices, in particular, see increases in malware targeting mobile phones year by year. According to McAfee 2023 Consumer Mobile Threat Report, Clicker Malware, a type of malware that runs in the background, spread through deceptive applications masquerading as system utilities such as flashlights and task managers in 2022. Other types of malware also became rampant, such as Dropper, Hidden Ads, and FakeApp. Almost all new mobile malware targets Android’s operating system.

Steps to Secure Your Device

While the instances of smartphone malware are relatively few compared to what is seen with desktop or laptop PCs, being aware of the threat is the first step towards safeguarding yourself and your data. Thorough research of applications and their publishers is crucial. It is always safer to install applications that have high user ratings, are widely used, or have been recommended by your friends or acquaintances.

Getting apps from a reputable and well-established market is also advisable. Android users can prevent the installation of non-market apps by deselecting the “Unknown Sources” option in their device’s application settings menu. However, if this option isn’t available, it means that your mobile provider has automatically blocked applications from unknown sources.

→ Dig Deeper: Are third-party apps for you?

Watching the Permissions

As you install different applications, you will notice a list of permissions for services that can access the hardware and software components on your device. You need to stay vigilant and check these permissions. If you suspect any foul play, for instance, a game or alarm clock app asking for your contact details or any other sensitive data, refrain from installing the app. In case you have any doubts regarding the data the app is accessing, the best course of action is not to install it.

Another important step that you can take is installing antivirus software on your phone. Doing this before adding any other apps to your new mobile device can help to increase its security.

McAfee Pro Tip: Enhance your mobile security with McAfee Mobile Security! Not only does it alert you to app permissions during downloads, but it also offers insights into any unexpected capabilities an app may have. Discover our software’s range of additional features for comprehensive protection.

Avoiding Bad Mobile Apps

When it comes to the complex world of mobile threats, having security software that offers multiple layers of protection can act as your best defense. For instance, McAfee Mobile Security™ for Android smartphones and tablets, BlackBerry, and Symbian smartphones is one such software.

McAfee Mobile Security provides complete antivirus, antispyware, and antiphishing facilities helping you to scan and clean malicious code from inbound or outbound emails, text messages, attachments, and files.

Other features of this security software include safe searching and shopping – protection against web threats like risky links within text messages, emails, and social networking sites, browser exploits, and malicious QR codes; app protection and app alert system – letting you review a report on your app’s access to your personal data to make informed decisions about each app; as well as a device lock feature – helping to protect against misuse of your phone and personal data by remotely locking all data, including the data on your memory (SIM) card.

→ Dig Deeper: Are Fake Apps Taking Over Your Phone?

Additional Mobile Security Measures

Aside from the aforementioned steps, there are several other security measures that you can employ to protect your mobile device. A very elementary yet highly efficient method is setting up a strong password for your device. Make sure to choose one that cannot be easily guessed. Regularly updating your phone’s operating system and apps is also crucial since updates usually come with security fixes for vulnerabilities that hackers might exploit.

Next, be cautious when clicking on links in text messages, emails, or social media. Verify the sender’s legitimacy and avoid downloading attachments or clicking suspicious links. These may lead to phishing websites, which aim to deceive you into revealing sensitive information, or malware downloads that can compromise your device’s security.

One more thing to be wary of is the Wi-Fi networks that your device connects to. Public Wi-Fi networks are often unsecured and can provide an avenue for hackers to steal information. When connecting to such networks, it’s best to use a VPN (Virtual Private Network) to encrypt your data and keep it safe from prying eyes. Furthermore, always be cautious about the information you share online; avoid posting sensitive data such as your address, phone number, or personal identification number.

Recognizing Malicious Mobile Apps

Recognizing malicious apps requires vigilance and a keen eye. Malicious apps often masquerade as popular apps, baiting users into downloading them. They often have strange names, with spelling or grammatical errors. Another tell-tale sign is when the app asks for unnecessary permissions that are not needed for it to function. If you find an app asking for permission to access your location or contacts when it has no need to, then it might be malicious.

Finally, note the publisher of the app. Malicious apps often come from unknown or suspicious sources. Genuine apps come from reputable companies that you can trust. Check the reviews and ratings of the app, as they often indicate the app’s legitimacy. Remember, it’s always better to err on the side of caution regarding your mobile device’s security.

→ Dig Deeper: Device & App Safety Guide for Families

Final Thoughts

In conclusion, safeguarding your mobile device from malicious apps is a task that requires constant vigilance and proactive measures. From thoroughly researching the apps you install, and carefully reviewing their permissions, to installing robust antivirus software, every step is crucial in securing your device. Moreover, recognizing the tell-tale signs of malicious apps and employing additional security measures such as strong passwords and secure Wi-Fi connections can add an extra layer of protection.

While the rise of mobile threats is alarming, being informed and taking appropriate protective measures can greatly minimize the risk. Stay safe by staying informed and always prioritize your device’s security in this increasingly digital age.

The post Beware of Malicious Mobile Apps appeared first on McAfee Blog.

Read More

Zhdanova reportedly utilized cash, international money laundering associates and businesses fronts

Read More

The findings are part of Kaspersky’s latest investigation, spanning from July 2022 to July 2023

Read More

The consultative body aims to tackle cyber-attacks used to fund Pyongyang’s weapons development, including its nuclear program

Read More

The Flipper Zero is an incredibly versatile hacking device. Now it can be used to crash iPhones in its vicinity by sending them a never-ending stream of pop-ups.

These types of hacks have been possible for decades, but they require special equipment and a fair amount of expertise. The capabilities generally required expensive SDRs­—short for software-defined radios­—that, unlike traditional hardware-defined radios, use firmware and processors to digitally re-create radio signal transmissions and receptions. The $200 Flipper Zero isn’t an SDR in its own right, but as a software-controlled radio, it can do many of the same things at an affordable price and with a form factor that’s much more convenient than the previous generations of SDRs.

Read More

Last week, KrebsOnSecurity broke the news that one of the largest cybercrime services for laundering stolen merchandise was hacked recently, exposing its internal operations, finances and organizational structure. In today’s Part II, we’ll examine clues about the real-life identity of “Fearless,” the nickname chosen by the proprietor of the SWAT USA Drops service.

Based in Russia, SWAT USA recruits people in the United States to reship packages containing pricey electronics that are purchased with stolen credit cards. As detailed in this Nov. 2 story, SWAT currently employs more than 1,200 U.S. residents, all of whom will be cut loose without a promised payday at the end of their first month reshipping stolen goods.

The current co-owner of SWAT, a cybercriminal who uses the nickname “Fearlless,” operates primarily on the cybercrime forum Verified. This Russian-language forum has tens of thousands of members, and it has suffered several hacks that exposed more than a decade’s worth of user data and direct messages.

January 2021 posts on Verified show that Fearlless and his partner Universalo purchased the SWAT reshipping business from a Verified member named SWAT, who’d been operating the service for years. SWAT agreed to transfer the business in exchange for 30 percent of the net profit over the ensuing six months.

Cyber intelligence firm Intel 471 says Fearlless first registered on Verified in February 2013. The email address Fearlless used on Verified leads nowhere, but a review of Fearlless’ direct messages on Verified indicates this user originally registered on Verified a year earlier as a reshipping vendor, under the alias “Apathyp.”

There are two clues supporting the conclusion that Apathyp and Fearlless are the same person. First, the Verified administrators warned Apathyp he had violated the forum’s rules barring the use of multiple accounts by the same person, and that Verified’s automated systems had detected that Apathyp and Fearlless were logging in from the same device.  Second, in his earliest private messages on Verified, Fearlless told others to contact him on an instant messenger address that Apathyp had claimed as his.

Intel 471 says Apathyp registered on Verified using the email address triploo@mail.ru. A search on that email address at the breach intelligence service Constella Intelligence found that a password commonly associated with it was “niceone.” But the triploo@mail.ru account isn’t connected to much else that’s interesting except a now-deleted account at Vkontakte, the Russian answer to Facebook.

However, in Sept. 2020, Apathyp sent a private message on Verified to the owner of a stolen credit card shop, saying his credentials no longer worked. Apathyp told the proprietor that his chosen password on the service was “12Apathy.”

A search on that password at Constella reveals it was used by just four different email addresses, two of which are particularly interesting: gezze@yandex.ru and gezze@mail.ru. Constella discovered that both of these addresses were previously associated with the same password as triploo@mail.ru — “niceone,” or some variation thereof.

Constella found that years ago gezze@mail.ru was used to create a Vkontakte account under the name Ivan Sherban (former password: “12niceone“) from Magnitogorsk, an industrial city in the southern region of Russia. That same email address is now tied to a Vkontakte account for an Ivan Sherban who lists his home as Saint Petersburg, Russia. Sherban’s profile photo shows a heavily tattooed, muscular and recently married individual with his beautiful new bride getting ready to drive off in a convertible sports car.

A pivotal clue for validating the research into Apathyp/Fearlless came from the identity intelligence firm myNetWatchman, which found that gezze@mail.ru at one time used the passwords “геззи1991” (gezze1991) and “gezze18081991.”

Care to place a wager on when Vkontakte says is Mr. Sherban’s birthday? Ten points if you answered August 18 (18081991).

Mr. Sherban did not respond to multiple requests for comment.

Read More