Computer security firm Norton buys Avast for over $8 billion

LONDON - US cybersecurity giant NortonLifeLock is to buy Czech rival Avast for over $8 billion to create a leading consumer business, the pair announced Wednesday after the pandemic fuelled online activity.

The deal, equivalent to more than 6.7 billion euros, "is a huge step forward for consumer cyber safety and will ultimately enable us to achieve our vision to protect and empower people to live their digital lives safely", Norton chief executive Vincent Pilette said in a joint statement.

Ondrej Vlcek, chief executive of London-listed Avast, said that amid increasing global cyber threats, the tie-up would allow for "enhanced solutions and services, with improved capabilities".

More than 500 million users will benefit from the new group's safety offerings, the statement added.

Pilette was set to become chief executive of the expanded group, while Vlcek is to join NortonLifeLock as president and become a member of the NortonLifeLock board.

The combined company, to be listed on the Nasdaq, will be dual headquartered in Prague and Tempe, Arizona.

Businesses worldwide are at threat from an increasingly lucrative form of digital hostage-taking, or ransomware attacks, that typically see hackers encrypting victims' data and then demanding money for restored access. 

A massive ransomware attack on US tech firm Kaseya in July affected businesses from pharmacies to gas stations in at least 17 countries. 

While Kaseya was little known to the public, analysts say it was a ripe target as its software is used by around 40,000 businesses, allowing the hackers to paralyse many companies with a single blow.

"At a time when global cyber threats are growing, yet cyber safety penetration remains very low, together with NortonLifeLock, we will be able to accelerate our shared vision of providing holistic cyber protection for consumers around the globe," Vlcek added Wednesday.

US cybersecurity officials last week announced that Amazon, Google and Microsoft had enlisted to help them fight ransomware and defend cloud computing systems from hackers.

The tech giants are among firms signed on to be part of a Joint Cyber Defense Collaborative intended to combine government and private skills and resources to fight hackers, according to the Cybersecurity and Infrastructure Security Agency (CISA).

Agence France-Presse  

US-based hacker fighter FireEye says breached by elite attackers

SAN FRANCISCO - Hacker fighting firm FireEye on Tuesday said its own defenses were breached by sophisticated attackers who stole "Red Team" tools used to test customers' computer systems.

While the hackers had yet to be identified, their tactics and targets led FireEye to believe it was a state-sponsored attack "by a nation with top-tier offensive capabilities."

"The hack of a premier cybersecurity firm demonstrates that even the most sophisticated companies are vulnerable to cyber-attacks," said US Senator Mark Warner, a Democrat who is vice chairman of the

 senate Select Committee on Intelligence.

"We have come to expect and demand that companies take real steps to secure their systems, but this case also shows the difficulty of stopping determined nation-state hackers."

It did not appear any customer data was stolen from FireEye, or that the taken tools have been used in other attacks, according to the Silicon Valley-based firm.

"The attackers tailored their world-class capabilities specifically to target and attack FireEye," FireEye chief executive Kevin Mandia said in a blog post revealing the breach.

"They used a novel combination of techniques not witnessed by us or our partners in the past."

FireEye shares were down more than 7 percent in after-market trades that followed released of news about the hack.

RELENTLESS ATTACKS

FireEye said it is investigating the attack with help from the FBI and industry partners, including technology colossus Microsoft.

"Their initial analysis supports our conclusion that this was the work of a highly sophisticated state-sponsored attacker utilizing novel techniques," Mandia said.

The hackers primarily sought information related to government customers which is consistent with nation-state cyberespionage, according to FireEye.

Also targeted in the attack were "Red Team" tools that help diagnose the security of customers' networks by mimicking the behavior of hackers, Mandia said.

FireEye was making available countermeasures to defend against someone using the tools.

The US Department of Homeland Security said it was aware of the attack but that it had no information indicating the stolen cyber tools were being "maliciously used" so far.

US spy agencies have been asked to brief the House Permanent Select Committee on Intelligence about the cyber attack in the coming days, according to chairman Adam Schiff, a Democrat from California.

"Foreign actors have not stopped attacking our country and its critical and cybersecurity infrastructure since 2016," Schiff said.

Schiff found it troubling that the hackers stole from FireEye tools that could be used in future attacks.

OIL-BANKS-POLITICS

The FireEye hack came less than two months after the US Treasury announced sanctions against a Russian research institute which it said was tied to the powerful malware Triton, used to damage a Saudi petrochemical plant in 2017.

FireEye tied Triton to the Moscow-based research institute and a specific, unnamed person with close ties to the institute.

It was not determined whether Russia was linked to the FireEye hack.

"The Russian government continues to engage in dangerous cyber activities aimed at the United States and our allies," Treasury Secretary Steven Mnuchin said in a statement at the time.

FireEye's track record includes identifying an Iran-based social media campaign to sway public opinion by impersonating reporters, politicians and others, as well as identifying North Korean hackers implicated in of a wave of cyberattacks on global banks that netted "hundreds of millions" of dollars.

Agence France-Presse

Microsoft issues critical Windows security fix after tipoff from US NSA

WASHINGTON - Microsoft Corp on Tuesday rolled out an important security fix after the US National Security Agency tipped off the company to a serious flaw in its widely used Windows operating system, officials said.

Microsoft said the flaw could allow a hacker to forge digital certificates used by some versions of Windows to authenticate and secure data. Exploiting the flaw could have potentially serious consequences for Windows systems and users.

The NSA and Microsoft said they had not seen any evidence that the flaw had previously been abused, but both urged Windows users to deploy the update as soon as possible. NSA official Anne Neuberger noted that operators of classified networks had already been prodded to install the update and everyone else should now "expedite the implementation of the patch."

The Microsoft patch marks the first time the NSA has publicly claimed credit for prompting a software security update, although the agency said it has alerted companies in the past to flaws in their products. Neuberger said the agency was striving for more transparency with the information security research community.

"Part of building trust is showing the data," she told reporters in a call just minutes before the patch went live.

Experts said the move was unprecedented.

"I have never seen this before," said Tenable Chief Executive Amit Yoran, who previously served as founding director of the U.S. Computer Emergency Readiness Team.

"I cannot think of a single instance where government shared a zero-day with a vendor and took credit for it," he said in an email.

The NSA faces a balancing act when it comes across such vulnerabilities. The agency had been criticized after its cyberspies took advantage of vulnerabilities in Microsoft products to deploy hacking tools against adversaries and kept the Redmond, Washington-based company in the dark about it for years.

When one such tool was dramatically leaked to the internet in 2016, it was deployed against targets around the globe by hackers of all stripes.

In the most dramatic case, a group used the tool to unleash a massive malware outbreak dubbed WannaCry in 2017. The data-wiping worm wrought global havoc, affecting what Europol estimated was some 200,000 computers in more than 150 countries.

Neuberger did not directly address that controversy in her call but said that the NSA hoped to be "a good cybersecurity partner."

"We're working to evolve our mission," she said.

source: news.abs-cbn.com

Stop! Don’t charge your smartphone this way

A dead or dying phone or laptop is enough to send anybody on a mad dash to find a way to charge the device, but you might want to think twice before using that random cable found at an airport charging station or docking into that hotel USB port — hackers could be waiting.

As the busy holiday season approaches, the Los Angeles County District Attorney’s Office is warning travelers about a USB charger scam, or “juice jacking.”

“A free charge could end up draining your bank account,” Luke Sisak, a deputy district attorney, said in a video posted online this month.

Juice jacking happens when unsuspecting users plug their electronic devices into USB ports or use USB cables that have been loaded with malware.

The malware then infects the devices, giving hackers a way in. They can then read and export your data, including your passwords, and even lock up the gadgets, making them unusable.

Juice jacking exploits the fact that somebody doesn’t have a full battery, said Liviu Arsene, a cybersecurity expert at BitDefender, a Romanian cybersecurity and anti-virus software company.

Arsene cautioned against using USB cables found already plugged into charging stations or even given away as promotional gifts.

“You can easily brand these things so you can make it look like any other cable,” he said, adding, “When people see it, they don’t really think or expect it to be malicious in any way.”

Other ways to protect yourself include carrying your own charging wires, only charging directly from an electrical outlet and using portable batteries that were bought from known vendors, Arsene said.

“Don’t believe everything you see, and don’t believe everything you get your hands on,” he said, noting that starting with Black Friday, if it looks too good to be true, it probably is.

But it isn’t just cables that pose a risk for tech consumers; it’s the ports, too.

Like scammers who steal debit card numbers by putting illegal card-reading devices, or skimmers, on ATMs, hackers can easily rip out USB ports and replace them with their own malicious hardware, said Vyas Sekar, a professor at CyLab, a security and privacy research institute at Carnegie Mellon University.

“It’s easy to modify the outlet if the attacker has physical access,” Sekar said.

Though Arsene and Sekar said they were unsure of how often hacking attacks like these happened, the growing ubiquity of USB charging ports in places like hotels, airports and public transportation has translated into an increased risk of falling victim to such scams.

“People want the convenience of charging their phones and tablets wherever they go,” Sekar said, adding, “Obviously I would like it too, but there is a risk.”

Sekar said consumers could also use attachable protective devices on USB cables known as “USB condoms.”

“What they do is a very simple trick,” he said. “They essentially disable the data pin on the USB charger.”

This means that the device will charge, but the cable will be unable to send or receive data.

“For less than 5 bucks you can buy it,” he said, “and that can actually save you.”

The Los Angeles County district attorney’s office echoed cybersecurity experts in its tips for consumers, including using a power outlet and not a USB charging station, carrying your own AC and car chargers and keeping a portable charger for emergencies.

2019 The New York Times Company

source: news.abs-cbn.com

Mystery hacker steals data on 1,000 North Korean defectors in South

SEOUL - The personal information of nearly 1,000 North Koreans who defected to South Korea has been leaked after unknown hackers got access to a resettlement agency’s database, the South Korean Unification Ministry said on Friday.

The ministry said it discovered last week that the names, birth dates and addresses of 997 defectors had been stolen through a computer infected with malicious software at an agency called the Hana center, in the southern city of Gumi.

“The malware was planted through emails sent by an internal address,” a ministry official told reporters on condition of anonymity, due to the sensitivity of the issue, referring to a Hana center email account.

The Hana center is among 25 institutes the ministry runs around the country to help some 32,000 defectors adjust to life in the richer, democratic South by providing jobs, medical and legal support.

Defectors, most of whom risked their lives to flee poverty and political oppression, are a source of shame for North Korea. Its state media often denounces them as “human scum” and accuses South Korean spies of kidnapping some of them.

The ministry official declined to say if North Korea was believed to have been behind the hack, or what the motive might have been, saying a police investigation was under way to determine who did it.

North Korean hackers have in the past been accused of cyberattacks on South Korean state agencies and businesses.

North Korea stole classified documents from the South’s defense ministry and a shipbuilder last year, while a cryptocurrency exchange filed for bankruptcy following a cyberattack linked to the North.

North Korean state media has denied those cyberattacks.

The latest data breach comes at a delicate time for the two Koreas which have been rapidly improving their relations after years of confrontation.

The Unification Ministry said it was notifying the affected defectors and there were no reports of any negative impact of the data breach.

“We’re sorry this has happened and will make efforts to prevent it from recurring,” the ministry official said.

Several defectors, including one who became a South Korean television celebrity, have disappeared in recent years only to turn up later in North Korean state media, criticizing South Korea and the fate of defectors.

source: news.abs-cbn.com

India's Cosmos Bank loses $13.5-M in cyber attack

MUMBAI - Cyber criminals hacked the systems of India's Cosmos Bank and siphoned off nearly 944 million rupees ($13.5 million) through simultaneous withdrawals across 28 countries over the weekend, the bank has told police.

The co-operative bank said unidentified hackers stole customer information through a malware attack on its automated teller machine (ATM) server, withdrawing 805 million rupees in 14,849 transactions in just over two hours on Aug. 11, mainly overseas.

Apart from the ATM withdrawals, the hackers transferred 139 million rupees to a Hong Kong-based company's account by issuing three unauthorised transactions over the SWIFT global payments network, the bank said in a police complaint, a copy of which was seen by Reuters.

SWIFT, whose messaging system is used to transfer trillions of dollars a day, said it did not comment on individual cases.

Cosmos Bank, based in the western city of Pune, said in a press statement that its main banking software receives debit card payment requests via a "switching system" but it was bypassed in the attack.

"During the malware attack, a proxy switch was created and all the fraudulent payment approvals were passed by the proxy switching system," the bank said.

The bank declined to reveal the countries, citing security risks.

Police said they were investigating the theft.

A police official, who declined to be named, said they had enlisted the help of experts to find out how authorised transactions were conducted simultaneously in various countries.

India's City Union Bank Ltd reported in February that it had suffered three "fraudulent remittances" of nearly $2 million that had been pushed through the SWIFT financial platform.

In 2016, unknown hackers stole more than $81 million from the Bangladesh central bank's account with the Federal Reserve Bank Of New York. Investigators have made little progress in the case.

"While there is growing awareness to regularly update an organisation's cyber preparedness and defence mechanisms, a large number of institutions wake up to this reality only post an incident which often leads to a loss of reputation and/or financial misappropriation," said Nikhil Bedi, a partner with Deloitte India.

($1 = 69.8950 Indian rupees) (Reporting by Rajendra Jadhav; Editing by Adrian Croft)

source: news.abs-cbn.com

Microsoft, Facebook vow not to aid gov't cyber attacks

SAN FRANCISCO - Microsoft, Facebook and more than 30 other global technology companies on Tuesday announced a joint pledge not to assist any government in offensive cyber attacks.

The Cybersecurity Tech Accord, which vows to protect all customers from attacks regardless of geopolitical or criminal motive, follows a year that witnessed an unprecedented level of destructive cyber attacks, including the global WannaCry worm and the devastating NotPetya attack.

"We recognize that we live in a new world," Microsoft President Brad Smith said during a speech on Tuesday at the RSA cyber security conference in San Francisco. "We're living amidst a generation of new weapons, and where cyberspace has become the new battlefield."

Smith, who led efforts to organize the alliance, said the devastating cyber attacks in 2017 demonstrated the need for the technology sector to "take a principled path toward more effective steps to work together and defend customers around the world."

It was not clear whether any companies would change their existing policies as a result of joining the accord.

Microsoft did not immediately respond to a series of questions about the accord, including whether the company had previously participated in government-sponsored offensive cyber operations or how the pledge would impact compliance with lawfully obtained surveillance orders in the United States or elsewhere.

The accord also promised to establish new formal and informal partnerships within the industry and with security researchers to share threats and coordinate vulnerability disclosures.

It builds on an idea for a so-called Digital Geneva Convention that Smith rolled out at least year's RSA conference, a proposal to create an international body to protect civilians from state-sponsored hacking.

Countries, Smith said then, should develop global rules for cyber attacks similar to those established for armed conflict at the 1949 Geneva Convention that followed World War Two.

In addition to Microsoft and Facebook, 32 other companies signed the pledge, including Cisco, Juniper Networks, Oracle, Nokia, SAP, Dell and cyber security firms Symantec, FireEye and Trend Micro.

The list of companies does not include any from Russia, China, Iran or North Korea, widely viewed as the most active in launching destructive cyber attacks against their foes.

Major US technology companies Amazon, Apple, Alphabet and Twitter also did not sign the pledge.

source: news.abs-cbn.com

Hacked Japan crypto exchange refunds customers

TOKYO - Japan-based virtual currency exchange Coincheck said Tuesday it had refunded more than $440 million to customers following the hack of its systems, which was one of the largest thefts of its kind.

The company said it used its own funds to reimburse about 46.6 billion yen ($440 million) to all 260,000 customers who lost their holdings of NEM, a leading cryptocurrency.

"Procedures have been completed with the accounts of all 260,000 customers," company spokesman Yosuke Imai told AFP.

Thieves siphoned away 523 million units of the cryptocurrency from Coincheck -- then valued at $547 million -- during the January 26 hack, which exceeded the $480 million in bitcoin stolen in 2014 from another Japanese exchange, MtGox.

The 2014 hack prompted Japan to issue new regulations, requiring exchanges to obtain a government license, but Coincheck was allowed to continue operating while the Financial Services Agency was reviewing its application.

Authorities raided Coincheck's office last month and have slapped the company with sanctions.

Coincheck chief operating officer Yusuke Otsuka said last week that the company's system was breached after several staff members opened emails containing malware.

The firm had failed to upgrade its systems to keep up with the rapid expansion of the cryptocurrency market, he said.

In February, 7 plaintiffs -- 2 companies and 5 individuals -- filed a lawsuit against Coincheck seeking the reimbursement of 19.53 million yen in lost virtual currency and further compensation for interest lost due to the hack.

As many as 10,000 businesses in Japan are thought to accept bitcoin, and bitFlyer -- the country's main bitcoin exchange -- saw its user base grow beyond one million in November.

source: news.abs-cbn.com

Kaspersky blames NSA hack on infected Microsoft software

Embattled computer security firm Kaspersky Lab said Thursday that malware-infected Microsoft Office software and not its own was to blame for the hacking theft of top-secret US intelligence materials.

Adding tantalizing new details to the cyber-espionage mystery that has rocked the US intelligence community, Kaspersky also said there was a China link to the hack.

The Moscow-based anti-virus software maker, which is now banned on US government computers because of alleged links to Russian intelligence, confirmed that someone did apparently steal valuable National Security Agency programs from an NSA worker's home computer, as first reported by the Wall Street Journal on October 5.

According to the Journal, the person had top secret files and programs from the NSA hacking unit called the Equation Group on his computer, which was also using Kaspersky software protection.

They believe that Russian spies used the Kaspersky program as a back door to discover and siphon off the files, reportedly causing deep damage to the NSA's own cyber-espionage operations.

US allegations that Kaspersky, which sold more than $600 million of anti-virus software globally in 2015, knowingly or unknowingly helped Russian intelligence in the theft have effectively killed its US business and hurt its worldwide reputation.

Kaspersky software 'disabled'

Using its own forensic analysis, Kaspersky said the breach of the NSA worker's computer took place between September and November 2014, rather than 2015 as the Journal reported.

Kaspersky said what was stolen included essential source code for some Equation Group malware, as well as classified documents. Based on the materials, it said the computer appeared to belong to someone involved in creating malware for the Equation Group.

The company claimed, however, that the computer was infected by other malware, including a Russian-made "backdoor tool" hidden in Microsoft Office.

Kaspersky said that the malware was controlled from a computer server base in Hunan, China, and would have opened a path into the computer for anyone targeting an NSA worker.

"Given that system owner's potential clearance level, the user could have been a prime target of nation-states," it said.

Kaspersky's own software would have detected that malware, the company said, except that its software had been turned off.

"To install and run this malware, the user must have disabled Kaspersky Lab products on his machine," it claimed.

pmh/jh

source: news.abs-cbn.com

More disruptions feared from cyber attack; Microsoft slams US govt secrecy

WASHINGTON/FRANKFURT - Officials across the globe scrambled over the weekend to catch the culprits behind a massive ransomware worm that disrupted operations at car factories, hospitals, shops and schools, while Microsoft on Sunday pinned blame on the US government for not disclosing more software vulnerabilities.

Cyber security experts said the spread of the worm dubbed WannaCry - "ransomware" that locked up more than 200,000 computers in more than 150 countries - had slowed but that the respite might only be brief amid fears new versions of the worm will strike.

In a blog post on Sunday, Microsoft President Brad Smith appeared to tacitly acknowledge what researchers had already widely concluded: The ransomware attack leveraged a hacking tool, built by the US National Security Agency, that leaked online in April.

"This is an emerging pattern in 2017," Smith wrote. "We have seen vulnerabilities stored by the CIA show up on WikiLeaks, and now this vulnerability stolen from the NSA has affected customers around the world."

He also poured fuel on a long-running debate over how government intelligence services should balance their desire to keep software flaws secret - in order to conduct espionage and cyber warfare - against sharing those flaws with technology companies to better secure the internet.

"This attack provides yet another example of why the stockpiling of vulnerabilities by governments is such a problem," Smith wrote. He added that governments around the world should "treat this attack as a wake-up call" and "consider the damage to civilians that comes from hoarding these vulnerabilities and the use of these exploits."

The NSA and White House did not immediately respond to requests for comment about the Microsoft statement.

Economic experts offered differing views on how much the attack, and associated computer outages, would cost businesses and governments.

The non-profit US Cyber Consequences Unit research institute estimated that total losses would range in the hundreds of millions of dollars, but not exceed $1 billion.

Most victims were quickly able to recover infected systems with backups, said the group's chief economist, Scott Borg.

California-based cyber risk modeling firm Cyence put the total economic damage at $4 billion, citing costs associated with businesses interruption.

US President Donald Trump on Friday night ordered his homeland security adviser, Tom Bossert, to convene an "emergency meeting" to assess the threat posed by the global attack, a senior administration official told Reuters.

Senior US security officials held another meeting in the White House Situation Room on Saturday, and the FBI and the NSA were working to help mitigate damage and identify the perpetrators of the massive cyber attack, said the official, who spoke on condition of anonymity to discuss internal deliberations.

The investigations into the attack were in the early stages, however, and attribution for cyber attacks is notoriously difficult.

The original attack lost momentum late on Friday after a security researcher took control of a server connected to the outbreak, which crippled a feature that caused the malware to rapidly spread across infected networks.

Infected computers appear to largely be out-of-date devices that organizations deemed not worth the price of upgrading or, in some cases, machines involved in manufacturing or hospital functions that proved too difficult to patch without possibly disrupting crucial operations, security experts said.

Microsoft released patches last month and on Friday to fix a vulnerability that allowed the worm to spread across networks, a rare and powerful feature that caused infections to surge on Friday.

Code for exploiting that bug, which is known as "Eternal Blue," was released on the internet last month by a hacking group known as the Shadow Brokers.

The head of the European Union police agency said on Sunday the cyber assault hit 200,000 victims in at least 150 countries and that number would grow when people return to work on Monday.

MONDAY MORNING RUSH?

Monday was expected to be a busy day, especially in Asia, which may not have seen the worst of the impact yet, as companies and organizations turned on their computers.

"Expect to hear a lot more about this tomorrow morning when users are back in their offices and might fall for phishing emails" or other as yet unconfirmed ways the worm may propagate, said Christian Karam, a Singapore-based security researcher.

The attack hit organizations of all sizes.

Renault said it halted manufacturing at plants in France and Romania to prevent the spread of ransomware.

Other victims include is a Nissan manufacturing plant in Sunderland, northeast England, hundreds of hospitals and clinics in the British National Health Service, German rail operator Deutsche Bahn and international shipper FedEx Corp

A Jakarta hospital said on Sunday that the cyber attack had infected 400 computers, disrupting the registration of patients and finding records.

Account addresses hard-coded into the malicious WannaCry virus appear to show the attackers had received just under $32,500 in anonymous bitcoin currency as of (1100 GMT) 7 a.m. EDT on Sunday, but that amount could rise as more victims rush to pay ransoms of $300 or more.

The threat receded over the weekend after a British-based researcher, who declined to give his name but tweets under the profile @MalwareTechBlog, said he stumbled on a way to at least temporarily limit the worm's spread by registering a web address to which he noticed the malware was trying to connect.

Security experts said his move bought precious time for organizations seeking to block the attacks.

(Additional reporting by Jim Finkle, Neil Jerome Morales, Masayuki Kitano, Kiyoshi Takenaka, Jose Rodriguez, Elizabeth Piper, Emmanuel Jarry, Orathai Sriring, Jemima Kelly, Alistair Smout, Andrea Shalal, Jack Stubbs, Antonella Cinelli, Kate Holton, Andy Bruce, Michael Holden, David Milliken, Tim Hepher, Luiza Ilie, Patricia Rua, Axel Bugge, Sabine Siebold, Eric Walsh, Engen Tham, Fransiska Nangoy, Soyoung Kim, Mai Nguyen and Nick Zieminski; Editing by Mark Heinrich and Peter Cooney)

source: news.abs-cbn.com

Android malware steals million Google accounts: researchers

WASHINGTON - Malicious software designed to attack Android smartphones has breached the accounts of more than a million Google users, security researchers said Wednesday.

The report by Check Point Software Technologies said the malware dubbed Gooligan targets devices running Android 4.0 and 5.0, which represent nearly 74 percent of mobile devices using the Google-powered operating system.

The attacks can steal email addresses and authentication data stored on the devices to access sensitive data from Gmail, Google Photos, Google Docs and other services, Check Point said.

"This theft of over a million Google account details is very alarming and represents the next stage of cyber-attacks," said Michael Shaulov, Check Point's head of mobile products.

"We are seeing a shift in the strategy of hackers, who are now targeting mobile devices in order to obtain the sensitive information that is stored on them."

Check Point said researchers discovered Gooligan's code in an application last year and that a new variant appeared in August 2016, affecting some 13,000 devices per day. About 57 percent of those devices are located in Asia and about nine percent are in Europe.

"The infection begins when a user downloads and installs a Gooligan-infected app on a vulnerable Android device, or by clicking on malicious links in phishing attack messages," the company said in a statement.

Attackers can gain control over the device and generate revenue by fraudulently installing apps from Google Play and rating them on behalf of the victim.

Check Point said it reported the details of the malware to Google, and that the tech giant indicated it would take steps to protect users.

Google did not immediately respond to an AFP query.

source: news.abs-cbn.com

Bangladesh Bank hackers compromised SWIFT software

The attackers who stole $81 million from the Bangladesh central bank probably hacked into software from the SWIFT financial platform that is at the heart of the global financial system, said security researchers at British defense contractor BAE Systems.

SWIFT, a cooperative owned by 3,000 financial institutions, confirmed to Reuters that it was aware of malware targeting its client software. Its spokeswoman Natasha Deteran said SWIFT would release on Monday a software update to thwart the malware, along with a special warning for financial institutions to scrutinize their security procedures.

The new developments now coming to light in the unprecedented cyber-heist suggest that an essential lynchpin of the global financial system could be more vulnerable than previously understood to hacking attacks, due to the vulnerabilities that enabled attackers to modify SWIFT's client software.

Deteran told Reuters on Sunday that it was issuing the software update "to assist customers in enhancing their security and to spot inconsistencies in their local database records."

The software update and warning from Brussels-based SWIFT, or the Society for Worldwide Interbank Financial Telecommunication, come after researchers at BAE, which has a large cyber-security business, told Reuters they believe they discovered malware that the Bangladesh Bank attackers used to manipulate SWIFT client software known as Alliance Access.

BAE said it planned to go public on Monday with a blog post about its findings concerning the malware, which the thieves used to cover their tracks and delay discovery of the heist.

The cyber criminals tried to make fraudulent transfers totaling $951 million from the Bangladesh central bank's account at the Federal Reserve Bank of New York in February.

Most of the payments were blocked, but $81 million was routed to accounts in the Philippines and diverted to casinos there. Most of those funds remain missing.



Investigators probing the heist had previously said the still-unidentified hackers had broken into Bangladesh Bank computers and taken control of credentials that were used to log into the SWIFT system. But the BAE research shows that the SWIFT software on the bank computers was probably compromised in order to erase records of illicit transfers.

Deteran reiterated on Sunday that "the malware has no impact on SWIFT's network or core messaging services."

The SWIFT messaging platform is used by 11,000 banks and other institutions around the world, though only some use the Alliance Access software, Deteran said.

SWIFT may release additional updates as it learns more about the attack in Bangladesh and other potential threats, Deteran said.

SWIFT is also reiterating a warning to banks that they should review internal security.

"While we keep all our interface products under continual review and recommend that other vendors do the same, the key defense against such attack scenarios is that users implement appropriate security measures in their local environments to safeguard their systems," Deteran said.

Adrian Nish, BAE's head of threat intelligence, said he had never seen such an elaborate scheme from criminal hackers.

"I can't think of a case where we have seen a criminal go to the level of effort to customize it for the environment they were operating in," he said. "I guess it was the realization that the potential payoff made that effort worthwhile."

A Bangladesh Bank spokesman declined comment on BAE's findings.

A senior official with the Bangladesh Police's Criminal Investigation Department said that investigators had not found the specific malware described by BAE, but that forensics experts had not finished their probe.

Bangladesh police investigators said last week that the bank's computer security measures were seriously deficient, lacking even basic precautions like firewalls and relying on used, $10 switches in its local networks.

Still, police investigators told Reuters in an interview that both the bank and SWIFT should take the blame for the problems.

"It was their responsibility to point it out but we haven't found any evidence that they advised before the heist," said Mohammad Shah Alam, head of the Forensic Training Institute of the Bangladesh police's criminal investigation department, referring to SWIFT.

THWARTING FUTURE ATTACKS

The BAE alert to be published on Monday includes some technical indicators that the firm said it hopes banks could use to thwart similar attacks. Those indicators include the IP address of a server in Egypt the attackers used to monitor use of the SWIFT system by Bangladesh Bank staff.

The malware, named evtdiag.exe, was designed to hide the hacker's tracks by changing information on a SWIFT database at Bangladesh Bank that tracks information about transfer requests, according to BAE.

BAE said that evtdiag.exe was likely part of a broader attack toolkit that was installed after the attackers obtained administrator credentials.

It is still not clear exactly how the hackers ordered the money transfers.

Nish said that BAE found evtdiag.exe on a malware repository and had not directly analyzed the infected servers. Such repositories collect millions of new samples a day from researchers, businesses, government agencies and members of the public who upload files to see if they are recognized as malicious and help thwart future attacks.

Nish said he was highly confident the malware was used in the attack because it was compiled close to the date of the heist, contained detailed information about the bank's operations and was uploaded from Bangladesh.

While that malware was specifically written to attack Bangladesh Bank, "the general tools, techniques and procedures used in the attack may allow the gang to strike again," according to a draft of the warning that BAE shared with Reuters.

The malware was designed to make a slight change to code of the Access Alliance software installed at Bangladesh Bank, giving attackers the ability to modify a database that logged the bank's activity over the SWIFT network, Nish said.

Once it had established a foothold, the malware could delete records of outgoing transfer requests altogether from the database and also intercept incoming messages confirming transfers ordered by the hackers, Nish said.

It was able to then manipulate account balances on logs to prevent the heist from being discovered until after the funds had been laundered.

It also manipulated a printer that produced hard copies of transfer requests so that the bank would not identify the attack through those printouts, he said.

source: www.abs-cbnnews.com

Hyatt Hotels computers infected with malicious software

SAN FRANCISCO, United States - Hyatt Hotels on Wednesday revealed that it recently discovered malicious computer code on computers used for processing payments at locations it manages.

In a short statement, Hyatt did not disclose what, if anything, the cyber attack accomplished but said that the company immediately "launched an investigation and engaged leading third-party cyber security experts."

Hyatt also said it strengthened the security of its systems and that "customers can feel confident using payment cards at Hyatt hotels worldwide."

The hotel group advised customers, as a precaution, to watch payment card account statements for unauthorized charges.

Cyber threats blogger Brian Krebs at KrebsonSecurity.com said in an online post that "Hyatt joins a crowded list of other hotel chains similarly breached in the past year."

Hyatt competitors Hilton, and Starwood Hotels which operates the Sheraton and Westin chains, last month separately announced that payment systems had been targeted by hackers.

US hotel chain Hilton said that hackers infected some of its point-of-sale computer systems with malware crafted to steal credit card information.

Malicious code that infected registers at hotels had the potential to take cardholders' names along with card numbers, security codes and expiration dates, Hilton said in an online post.

Starwood Hotels said that hackers had infected payment systems in some of its establishments, potentially leaking customer credit card data.

The hack occurred at a "limited number" of its hotels in North America, according to Starwood, whose other well-known chains include St Regis and W Hotels.

The cyber attacks on Hilton and Starwood sounded similar to one disclosed earlier in the year by Trump Hotel Collection.

"We believe that there may have been unauthorized malware access to some of the computers that host our front desk terminals and payment card terminals in our restaurants, gift shops and other point-of-sale purchase locations at some hotels," Trump Hotel Collection said at a website devoted to details of the incident.

Locations affected were listed as Trump SoHo New York, Trump National Doral, Trump International New York, Trump International Chicago, Trump International Waikiki, Trump International Hotel & Tower Las Vegas, and Trump International Toronto.

source: www.abs-cbnnews.com

Apple App Store suffers 'worst' malware attack

WASHINGTON, United States - Hackers infiltrated the vaunted Apple ecosystem by injecting malicious software into popular Chinese mobile apps, potentially affecting hundreds of millions of users and raising security concerns as the US tech giant prepares its newest iPhone launch.

The company said Monday it had removed tainted applications from its App Store, days after security researchers revealed the breach of Apple's normally secure system which aims to weed out infected applications.

In China, more than 300 apps including the hugely popular instant messaging service WeChat and ride-hailing app Didi Kuaidi were infected with the "XcodeGhost" malware, potentially allowing access to private user data including passwords, Chinese state-run media said.

The reports were a blow to the US firm, which has Greater China as its second-largest market.

Apple told AFP that it had removed the affected apps from its online store.

"To protect our customers we've removed the apps from the App Store that we know have been created with this counterfeit software and we are working with the developers to make sure they're using the proper version of (Apple software) Xcode to rebuild their apps."

"To protect our customers we've removed the apps from the App Store that we know have been created with this counterfeit software and we are working with the developers to make sure they're using the proper version of (Apple software) Xcode to rebuild their apps."

Apple's reaction came days after US-based cybersecurity firm Palo Alto Networks uncovered the flaw, saying the malware came from computer code uploaded to Baidu's cloud file-sharing service used by Chinese app developers.

Anti-censorship group Greatfire.org, which tracks Chinese Internet restrictions, called the news "the most widespread and significant spread of malware in the history of the Apple app store, anywhere in the world."

Apple, which reviews and approves each application, has generally kept its apps malware-free, analysts say.

But Alan Cockerill at the US security firm Lookout said "there are no perfect systems."

In a blog post, Cockerill said that "while Apple has traditionally done an excellent job of keeping malware out of its App Store, malicious actors are always looking for new ways to break through."

"The malicious code may have hundreds of millions of victims," Cockerill said.

Apple checks failed

Johannes Ullrich at the SANS Technology Institute said that "the real problem here is this malicious code made it past the Apple App Store check-in process."

"Apparently there is some trust between Apple and some of these developers of large applications like WeChat so these applications aren't necessarily tested as carefully if they are coming from a name-brand company," Ullrich said.

Palo Alto Networks said the malware was hidden in the Xcode software required for apps and made its way into applications without the knowledge of developers.

But once installed, the malware could allow a third party to gain access to private and personal information on an Apple device.

The malware can issue a fake dialog alert to gain access to passwords, or hijack a browser to direct users to a fake website. It can also read and write data in the user's clipboard, which could be used to get passwords, according to Palo Alto.

Only Chinese apps were known so far to have been infected -- although some of those, including WeChat, are also used outside China.

Chinese apps are thought to be vulnerable because developers often bypass the official, more secure, Apple channels, which can be slowed by Chinese Internet monitoring.

Tencent, which makes the WeChat software -- used by 500 million in China -- said it had repaired the flaw and that there had been "no theft (or) leakage of users' information or money."

The makers of app Didi Kuaidi, which claims 200 million regular users, also reported a fix and said no user privacy was compromised.

Bad timing

Independent security consultant and researcher Graham Cluley said the incident is not all bad for Apple.

"It suggests that Apple's security is pretty good," Cluley said in a blog post.

"After all, this was quite a complicated way to get malware into the App Store."

Cluley said Apple "has a much much better track record than Google's Android one for security."

But Thomas Reed at the software firm Malwarebytes said it may hurt Apple at a delicate time.

Apple is set to release its new iPhone 6S and 6S Plus handsets on Friday in the US, China and several other key markets.

"There is little doubt that there will be some revision of the app review process at Apple as a result, but it's also certain that this incident will erode consumer confidence in the App Store as a (mostly) unassailable malware-free fortress," he wrote in a blog.

source: www.abs-cbnnews.com

These cyber thugs may hold your data hostage

SAN FRANCISCO - Marriage therapist Valerie Goss turned on her computer one day and found that all of her data was being held hostage.

Malicious code referred to as "ransomware" had encrypted her files and locked them away. Cyber criminals demanded $500 in hard-to-trace virtual currency Bitcoin to give her the key. The ransom would jump to $1,000 in Bitcoin if Goss took more than a day to pay.

"I felt shocked; like I had been robbed," the Northern California therapist said. "And, I felt pressed for time to make a rational decision. It felt so surreal."

After online research by her son revealed that in a quarter of more of ransomware cases victims never see their files again even if they pay, Goss refused to pay.

Instead, she bought a new computer and fortified it with security software. She also started backing up data off the machine.

As painful as it was, Goss did the right thing, according to cyber security specialists interviewed by AFP.

"Unfortunately, it is the right thing to do," said Malwarebytes chief executive Marcin Kleczynski.

"If you do pay the ransom, that money is gone and there is no guarantee you will get your data back."

Kidnapping smartphone files

Ransomware has been around a while, but has been making a big comeback, according to Kleczynski and mobile security researchers at Lookout. Gross fell prey to the hacker tactic last year on the computer she used in her home office.

Data kidnappers are also taking aim at smartphones and tablets, particularly models powered by Google-backed Android software, said Lookout consumer safety advocate Meghan Kelly.

Lookout saw mobile malware "encounters" in the United States jump 75 percent in 2014 as compared with the prior year. Ransomware accounted for a big part of the jump, according to Kelly.

The United States seems to be a preferred target zone, perhaps because people here keep a lot of cherished, personal data on mobile devices and computers, or because they are seen as having the money to pay to get it back.

A US study released last year by Lookout revealed that one-in-three people considered pictures, contacts, and other digital files on mobile devices so precious they would pay to get them back.

Goss said that she was willing to pay the ransom, but had no assurance she would actually see her files again even if she did pony up the Bitcoin.

Like other forms of malicious code, ransomware can get into computers, smartphones or tablets when people click on dubious links or open infected email attachments.

Drive-by attacks
People can also be hit with ransomware at legitimate websites that have been unknowingly booby-trapped by hackers to infect visitors in what are referred to as "drive-by" attacks.

"Sometimes you don't have to do anything wrong, just visit a website that has been infiltrated and then all of a sudden you have a piece of malware on your computer," Kleczynski said.

Ransomware locks and encrypts all files on infected devices. Kleczynski said that ransom demanded typically ranges from $100 to $1,000.

Ransomware targeting mobile devices can lock phones, email and more, essentially stripping control from owners, according to Kelly.

"Ransomware is a pretty loud piece of malware," Kelly said. "It is going to be in your face saying you can't navigate away and we want money from you."

People can protect themselves by being wary of what links they click on or files they open, and by keeping operating software up to date so the latest security patches are in place.

It is also recommended to have security software running to intervene before malware takes root, and to keep back-up copies of files in the cloud or elsewhere in case defenses are breached.

"One day ransomware can hit you and you have to prepare for the worst," Kleczynski said.

"The threat is very serious, users are infected all of the time, and the encryption keys are so strong you can't get those files back."

Malwarebytes and Lookout offer free versions of their security applications.

source: www.abs-cbnnews.com

Why you should be careful about the sites you visit

MANILA - Filipinos are becoming careless about the sites they visit or the links they click, according to data from a US-based global security software company released Tuesday.

Trend Micro, citing its researchers based in the Philippines, revealed that there has been a more than 30 percent spike in the number of malicious URLs clicked in the country during the year's third quarter (July to September).


This, according to the company, leaves Filipinos more vulnerable to malware --a type of software used to disrupt computer operation, gather sensitive information, or gain access to private computer systems.

It also helped Philippines rank 7th in the list of countries that fell prey to ransomware --a type of malware that prevents or limits users from accessing their computers.

Victims of this particular malicious software are forced to pay a ransom via certain online payment methods to make their devices usable again.

Myla Pilao, Marketing Director at Trend Labs --the local arm of Trend Micro-- explained that the reason companies and enterprises in the country are vulnerable to malwares is simply because of outdated security software.

"Updating software in a timely manner remains a challenging process. However, enterprises have to stay protected against these threats. Given how easily malware can affect critical business operations, it is best for these organizations to invest in technologies that will help them secure their endpoints and systems," she said in a statement.

Trend Micro also warned that malware in the country, mostly, is still passed on through traditional methods such as infected USBs.

As a preventive measure, the company encourages businesses to invest more in computer security, and that users should be extra mindful of their browsing habits.

source: www.abs-cbnnews.com

5 security tips for gamers

MANILA – Security software firm Kaspersky Lab shared some tips for gamers as it released data about the number of gaming-related attacks globally.

In a statement, Kaspersky Lab said it recorded a total of 11.7 million attacks on gamers in 2013, with users hit by 34,000 gaming malware every day on average.

Russian gamers were most at risk with more than 8 million attempts on them by hackers, followed by Vietnam (503,947), China (376,058), India (207,245), Spain (139,078), Poland (127,583), Turkey (121,164), Taiwan (97,843), Thailand (92,914) and Italy (75,155).

The Philippines was not included in the list.

As many people are expected to receive games as presents this Christmas, Kaspersky Lab urged users to take the right precautions.

The security software firm noted several types of attacks, such as a fake Minecraft tool that promises to let users ban other players; a fake Grand Theft Auto V download that claims to let users access the game for free; and the traditional phishing, which lures users into handing over data or money with the promise of discounts or cheap gaming goods.

“Gaming has an ever increasing fanbase, which means that the number of potential victims for cyber criminals is rising as well,” said Christian Funk, a senior virus analyst from Kaspersky Lab’s Global Research and Analysis Team.

“Cybercriminals are putting a lot of effort into their attacks and we can see a surge in their sophistication. During Christmas when a lot of new games are being released, gamers need to be even more attentive to stay secure,” Funk added.

Here are Kaspersky Lab’s five tips for gamers:

1. Don’t click through on any offers that look too good to be true, whether from your inbox or on social networks like Facebook or Twitter. If an offer comes through and looks legitimate, ensure the sender is trusted before hitting a link or handing over any details. If in doubt, contact the company the sender claims to be from.

2. Use strong and varied passwords across your gaming accounts. As we’ve seen this year, gaming companies get hacked and logins are leaked. If you don’t have different credentials, stealing one set could be a cybercriminal’s key to open all your different accounts using that same password. Consider investing in a password manager as it will give you simple, smart protection.

3. Get a good quality antivirus. With rafts of gaming malware out there and the increasing sophistication of malicious software, you’ll need some level of protection. You’ll need an antivirus that goes beyond signature-based detection to look at file reputation if you want to stop the smartest malware from getting on your system.

4. Be careful whom you befriend. It’s easy to make friends in virtual worlds today, but not all are doing so innocently. Beware of anyone who asks for your personal details as they may want to do more than just contact you.

5. Only download titles from legitimate sellers. If you’re downloading an illegal copy of a game, you aren’t just breaking the law. You also risk getting malware on your machine as crooks often disguise malicious software as game files.

source: www.abs-cbnnews.com

Thousands still infected with DNSChanger malware in PH as July 9 deadline looms

MANILA, Philippines — Despite stern warnings by various Internet and telecom companies as well as the US’s Federal Bureau of Investigation (FBI), thousands of computers in the Philippines remain infected by the DNSChanger malware and would stand to lose Internet access on Monday, July 9.

According to latest data from the DNS Changer Working Group (DCWG), a multi-sectoral ad hoc group of subject matter experts in security and DNS monitoring, some 1,286 unique IP addresses discovered to be infected with the malware were coming from the Philippines.

Globally, more than 240,000 were still recorded to have the malware in their systems, which mean they would lose access to the Internet if the infection remains unresolved by Monday.

On Sunday, a day before the FBI takes down the DNS server to which the malware has changed infected users’ DNS settings to, security firms and Internet companies have reiterated the call for users to check if their systems still contain the virus.

Some of the popular Internet destinations such as Google and Facebook have put in place systems that notify users of possible infection and the step they can take to ensure their systems remain up after the July 9 deadline.

Kaspersky Lab, a Russian security software provider, meanwhile stressed that even though users have removed the malware from their computers, they should remain vigilant for mutations and strains of the virus, which could still wreak havoc in their systems.

“In other words, it doesn’t mean you have pneumonia, but you still have a cough. And it makes you extraordinarily more likely to get sick again,” said Kurt Baumgartner, a Kaspersky Lab Expert, adding that some antivirus software providers have been prompting users to check and point their settings to “clean” DNS servers to avoid future similar incidents.

The FBI, on the other hand, has put up a website where users can quickly check to see if their PCs had been infected: http://www.dns-ok.us/

The DNSChanger malware was discovered last year to be re-routing Internet traffic of infected PCs to servers of a group of Internet hackers, which allows them to display advertisements or spread malware to more users.

Once infected, the Domain Name Settings (DNS) of an infested computer will be changed to that of the hackers’ servers. Reports said systems have started to become infected when they visited similarly infected websites, “or downloaded particular software to view videos online,” according to technology news site CNet.

In addition to changing the DNS servers of the computer, the malware has also been known to prevent antivirus updates from occurring, which means traditional security software couldn’t possibly detect the infection.

The group behind the malware has since been arrested by authorities in 2011, but the temporary redirection servers set up by law enforcement bodies to give users the time to clean up their systems will soon be shut down.

To check if your system is infected, telcos PLDT and Smart urged to go through your computer’s settings:

Windows
1. Click Start
2. Open the Command Window
3. (For Windows 7) Type cmd at the search bar
4. (For Windows XP) Click Run, then type cmd at the bar
5. Type ipconfig /all
6. Search for the DNS Servers section

Mac OS X
1. Click the Apple icon an the top left of the screen
2. Select System Preferences
3. Locate the “Network” icon
4. Read the “DNS Server” line

If the DNS servers are pointed at any of the following addresses, then it means the system is infected:

• 85.255.112.0 through 85.255.127.255
• 67.210.0.0 through 67.210.15.255
• 93.188.160.0 through 93.188.167.255
• 77.67.83.0 through 77.67.83.255
• 213.109.64.0 through 213.109.79.255
• 64.28.176.0 through 64.28.191.255

THE EASIEST WAY TO CHECK IF YOUR PC IS INFECTED, SIMPLY CLICK THE LINK/S:

DNS CHECKER WEBSITE

DNSCHANGER CHECKUP

source: interaksyon.com

Check for DNSChanger malware or lose Internet access by July 9, telco says

MANILA, Philippines — Leading telecommunications firm Philippine Long Distance Telephone Co. (PLDT) and its wireless arm Smart Communications urged Pinoy Internet users to check if they have been infected with a malware which will restrict their Internet access if not removed by July 9.

The malware, called DNSChanger, was discovered to be re-routing Internet traffic of infected PCs to servers of a group of Internet hackers, which allows them to display advertisements or spread malware to more users.

Once infected, the Domain Name Settings (DNS) of an infested computer will be changed to that of the hackers’ servers. Reports said systems have started to become infected when they visited similarly infected websites, “or downloaded particular software to view videos online,” according to technology news site CNet.

In addition to changing the DNS servers of the computer, the malware has also been known to prevent antivirus updates from occurring, which means traditional security software couldn’t possibly detect the infection.

The group behind the malware has since been arrested by authorities in 2011, but the temporary redirection servers set up by law enforcement bodies to give users the time to clean up their systems will soon be shut down.

“If you fail to take action, you may not be able to access Internet websites and use web services like email and search,” said PLDT and Smart Spokesperson Ramon Isberto in a statement.

To check if your system is infected, PLDT and Smart urged to go through your computer’s settings:

Windows
1. Click Start
2. Open the Command Window
3. (For Windows 7) Type cmd at the search bar
4. (For Windows XP) Click Run, then type cmd at the bar
5. Type ipconfig /all
6. Search for the DNS Servers section

Mac OS X
1. Click the Apple icon an the top left of the screen
2. Select System Preferences
3. Locate the “Network” icon
4. Read the “DNS Server” line

If the DNS servers are pointed at any of the following addresses, then it means the system is infected:

• 85.255.112.0 through 85.255.127.255
• 67.210.0.0 through 67.210.15.255
• 93.188.160.0 through 93.188.167.255
• 77.67.83.0 through 77.67.83.255
• 213.109.64.0 through 213.109.79.255
• 64.28.176.0 through 64.28.191.255

Alternatively, users can visit the following websites to automatically check if their units have the DNSChanger malware: http://www.dns-ok.us/ and http://dnschanger.detect.my.

To permanently rid your system of the malware, you can use various services put up by security software firms such as Kaspersky , ESET, McAfee , Microsoft , Norton, and Trend Micro.

source: interaksyon.com

Valentine-themed spam to rise four-fold this year – McAfee

MANILA, Phiippines — Internet users smitten by the love bug this Valentine’s Day need to be wary about being carried away by their emotions as security software firm McAfee warns that cyber criminals could be on the prowl on hearts–and eventually, pockets–this season of love.

According to a recent threat bulletin from McAfee, the amount of Valentine-themed spam messages is expected to “quadruple globally, as we approach the holiday, based on previous years of spam volumes.”

“This means that the bad guys are trying to take advantage of our open hearts with romance-related scams designed to trick you out of your information and money, or get you to click on dangerous links,” McAfee said.

These suspicious messages could come in the form of unsolicited mail advertising Valentine gifts; Valentine e-cards; online dating scams; romance-related malware; and phishing sites found on search engines, the antivirus provider said.

“One of the reasons we’re seeing an influx in this kind of spam is because scammers are using a technique called ‘snowshoe spamming’ in which they spread spam across multiple Internet addresses to evade spam filters,” it cautioned.

Should users receive any of the messages stated above, McAfee said they should be judicious enough to verify the source of the message, as in the case of e-cards.

“If you click on a link in a phony e-card, you could wind up accidentally downloading malware onto your device,” it pointed out.

The company also warned users who are looking for potential gifts to give to their loved ones through search engines to be extra vigilant, since scammers are always on the prowl and could trick users into giving up their credit card information.

“You may, for instance, come across a dangerous website while doing a search for ‘Valentine’s Day jewelry’,” it said. “Attracted by the site’s low prices, you may enter your credit card number and personal information and then get sweet nothings in return.”

But cyber criminals could also come in the form of an unsuspecting potential flame found on one of the myriad of online dating sites, McAfee said, pretending to be a sweet talker seemingly interested in forging romantic involvements online.

For these types of crooks, McAfee reiterates an age-old advice to “be suspicious of anyone who claims to fall in love too fast,” because they may actually be after your wallet, if not out to break your heart.

“Do an online search on any potential suitor to see if what they’ve said about themselves is true. Cross-reference the information you have against sites like LinkedIn or Spoke,” it added.

source: interaksyon.com