Did you get an email from Target?

Are you one of the roughly 70 million people who got an email from Target last week about the store's mega security breach? If so, be careful.

Target did indeed do a blast to customers to offer one year of free credit monitoring. The problem is scammers are also on the prowl and are sending out similar emails.

Target even says it has identified and stopped at least 12 scams preying on consumers via email, Facebook and other outlets.

The Target emails went to customers whose personal information was in the Target database. Cyber thieves penetrated the records during the holiday shopping season breach discovered last month and stole info like names, phone numbers and email addresses. The full extent of the hacking is still under investigation.

In the meantime, here's what to do if you see an email from Target pop up in your inbox.

If you've already opened the email: Target has posted a copy of the email it sent out online. So go here to make sure the email you opened, the address it came from, and the link you clicked all matches up.

If it doesn't match, and especially if you clicked a link to an external website and entered personal information, you need to take action quickly.

First, get a copy of your credit report, check your bank and credit card activity on a daily basis and call the credit reporting agencies to tell them what happened. You can ask to have a fraud alert placed on your account, meaning it will be flagged to lenders if someone attempts to open credit in your name.

If you're really worried, you can request a credit freeze, which prohibits any credit from being extended under your name. But that's a big step because you will have to go through the process of undoing this whenever you need credit again.

If you entered a credit card or debit card number, reach out to those institutions to warn them of potential fraud as well.

If you haven't opened the email: To avoid any chance of a virus or of falling prey to a potential scam, it is  recommended to go directly to Target's website to view the letter you believe has landed in your inbox -- since even opening a fraudulent email could lead malware to be installed on your computer. And if you do open the email, don't click on any links.

All other correspondence from Target can be found here. The retailer emphasizes that it will never email a consumer and ask for personal information like a Social Security number or credit card information.

But it's not just emails claiming to be from Target that customers need to worry about.

If your personal information was compromised in the breach, that means scammers could contact you pretending to be anyone -- like another retailer.

Beware - Trojans on Google Play Infected Up to 25,000 Devices

Malicious Apps were designed to send text messages to premium numbers

Researchers at Russian anti-virus company Doctor Web recently uncovered three malicious Android apps on Google Play that install the Android.SmsSend Trojan, which sends text messages to premium numbers without the user's permission.

All three apps, which are audio players and a video player that displays adult content, were uploaded by a Vietnamese developer called AppStore Jsc.

According to Doctor Web, the apps have been installed between 11,000 and 25,000 times.

Each app asks the user for permission to download additional content, such as adult video clips in the case of the video app -- but that download the installs the Trojan.

"The program covertly sends short messages to the short number 8775 which is specified in the malware's configuration file," Doctor Web notes.

"It is noteworthy that this Trojan really does enable a user to view adult video clips. Apparently, the attackers implemented this feature to avoid unnecessary suspicion."

What's your personal Disaster Recovery Strategy?

After the Storm Comes a Rainbow

If you've ever had a computer device unexpectedly fail on you, you know how it feels - like a flash flood, taking you by surprise and washing away everything you need.

Lets say, you have an external hard drive which stopped. Completely. Unexpectedly.

Did you had backups of that data? Do you make backups of your data regularly?

Here are some recommendations to help you from feeling the pain of a failed hard drive:

• Invest in an external backup drive for storing your backups. You can see some good guidance here.
  
• For data that is especially valuable (income tax data, photos, business data), make another copy on a different external drive and store at a different, secure location, such as a bank safety deposit box.
  
• Back up your email at least once a week; more often if you depend on it for business and would be lost without it.
  
• Most external hard drives can be configured to automatically make backups at specified intervals; look for external hard drives with these capabilities.
  
• If personal information is on your backup drive, encrypt it!
  
• If you want to use a cloud service to store your backups, make sure they will encrypt your data, and that they have terms of service that will allow you ample time to remove your data, completely, if there is ever the need.
  
• Regularly test backups to ensure the backup data is actually good.

Is It Safe & Secure To Use Free Email Service?

If a government wants to peek into your Web-based e-mail account, it is surprisingly easy, most of the time not even requiring a judge’s approval

Ever wonder what Google has planned for all of the information it's collecting on its users? Well, their intentions may be completely irrelevant. As it turns out, Google has been compelled to give over their user data by law enforcement at an increasing and alarming rate.

In the second half of 2012, the tech giant received more than 21,000 requests for information, which represents a 70-percent increase over three years. The majority of the requests came from the federal government, who was hoping for a peek into users' email accounts. In most cases, the Feds didn't need a judge's okay.

Google is fighting back, trying to rally support against government access to personal data. In this professional's opinion, however, that's a bit ironic considering Google's own policies on collecting user information.

Just remember, anytime you are using a webmail site like Gmail for communication, understand your email is absolutely not protected and is not private.

Do not send sensitive information or conduct business using these types of free webmail services.

If you must use these sites, gather the emails through an off-cloud software system, like Microsoft Outlook. Then, configure your Outlook settings to delete the emails from Gmail, Yahoo, Hotmail or whatever cloud email service they are coming from, as soon as Outlook downloads them.

Dishing-Off Your Old Device?

Did you know that in the wrong hands that "old" device can mean "new" problems for you?

Have you, like many adults, given a child in your life a hand-me-down mobile device? Maybe it's a "disabled" cell phone or your old iTouch that you let them play around on.

Savvy criminals are increasingly targeting mobile devices (even outdated ones) because they are very often loaded with personal data, including bank and credit cards numbers cached on mobile browsers, passwords, contact information, email and GPS histories.

If you are dead-set on letting your children play with these devices, be sure they have been wiped completely clean of your personal and business information. For tips on how to do this, give this eHow Tech post a thorough read.

Social Media: Addressing Risk

A Refresher on the Risks, Mitigation Strategies

The biggest social media concern for risk managers is the potential reputational impact to the organization. Reputational risk comes in two areas, one is from the company's own social media activities, which tend to be a little less regulated and controlled at the corporate level than other communications going through traditional public relations and advertising channels. 

The other area of reputational harm comes from public discussion about the organization via social media, whether it's true or not true. It could be a rumor. It could be a fact. But it can spread like wildfire. 

To mitigate the risks, an organization first and foremost needs to develop a social media policy. [The company] has to be able to control what's coming out of the company via social media for the official channels. In the policy, it's important to designate who can talk about the company and what they're talking about. 

Also, guidelines should be established to provide employees with reminders about how their statements can reflect on the company and to be cautious of their own activities using platforms like Facebook, Twitter and LinkedIn.

Organizations also need to monitor social media to be aware of public attitudes towards the company and what's being said. And have a plan in place to respond if there's an incident that results in a negative issue being communicated via social media.

Smart meter hacking tool released

Termineter, an open-source tool designed to assess the security of smart meters, has been released


SecureState, an information security firm, on Thursday announced the public release of Termineter, an open-source framework written in Python that allows users to assess the security of Smart Meter utility meters over the optical interface. The company is calling it the first framework designed to give authorized individuals access to manipulate and test the security of smart meters.


You can check it out, as well as download it for yourself, over on Google Code. For the uninitiated, smart meters measure the amount of power and water being used in a home or business as well as gather other data. They send periodic reports back to the utility company for analysis.


Smart meters have been criticized by privacy advocates for tracking consumer actions while security researchers have warned about their potential for being exploited.


Here's the tool's official description:

Termineter is a framework written in python to provide a platform for the security testing of smart meters. It implements the C12.18 and C12.19 protocols for communication. Currently supported are Meters using C12.19 with 7-bit character sets. Termineter communicates with Smart Meters via a connection using an ANSI type-2 optical probe with a serial interface.

SecureState says it is releasing Termineter publicly to promote security awareness for Smart Meters and to improve security overall by providing a tool that brings basic testing capabilities to the community and meter manufactures. 


While individual users will require general knowledge of the meter's internal workings in order to use Termineter proficiently, power companies can use the framework to identify and validate internal flaws that leave them susceptible to fraud and significant vulnerabilities.


As with any release of a hacking tool, there are two sides of the same coin. On the one hand, Termineter should help companies find vulnerabilities and test their products. On the other hand, Termineter can also be used maliciously to modify consumer data, inflicting financial loss on one or multiple victims.

Video: How Viruses Attack a PLC/HMI without Deep Packet Inspection via an USB memory stick?

Virus Attack & Prevention With/Without Deep Packet Inspection


In the first video, Eric Byres, cto and vp Engineering of Tofino Security, a Belden Co., shows how a worm can attack a PLC/HMI in a simulated Oil and Gas environment. This video sees Deep Packet Inspection in action to prevent a USB thumb drive attack.


The second video sees Deep Packet Inspection in action to prevent a USB thumb drive attack

US-CERT: Security Recommendations to Prevent Cyber Intrusion

Good practice guidelines to prevent cyber intrusion attacks

US-CERT is providing this Technical Security Alert in response to recent, well-publicized intrusions into several government and private sector computer networks. Network administrators and technical managers should not only follow the recommended security controls information systems outlined in NIST 800-53 but also consider the following measures. These measures include both tactical and strategic mitigations and are intended to enhance existing security programs.

Recommendations

• Deploy a Host Intrusion Detection System (HIDS) to help block and identify common attacks.
• Use an application proxy in front of web servers to filter out malicious requests.
• Ensure that the "allow URL_fopen" is disabled on the web server to help limit PHP vulnerabilities from remote file inclusion attacks.
• Limit the use of dynamic SQL code by using prepared statements, queries with parameters, or stored procedures whenever possible. Information on SQL injections is available at http://www.us-cert.gov/reading_room/sql200901.pdf.
• Follow the best practices for secure coding and input validation; use the secure coding guidelines available at: https://www.owasp.org/index.php/Top_10_2010 and https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/coding/305-BSI.html.
• Review US-CERT documentation regarding distributed denial-of-service attacks: http://www.us-cert.gov/cas/tips/ST04-015.html and http://www.us-cert.gov/reading_room/DNS-recursion033006.pdf.
• Disable active scripting support in email attachments unless required to perform daily duties.
• Consider adding the following measures to your password and account protection plan.

Use a two factor authentication method for accessing privileged root level accounts.

Use minimum password length of 15 characters for administrator accounts.

Require the use of alphanumeric passwords and symbols.

Enable password history limits to prevent the reuse of previous passwords.

Prevent the use of personal information as password such as phone numbers and dates of birth.

Deploy NTLMv2 as the minimum authentication method and disable the use of LAN Managed passwords.

Use minimum password length of 8 characters for standard users.

Disable local machine credential caching if not required through the use of Group Policy Object (GPO).

Deploy a secure password storage policy that provides password encryption.

• If an administrator account is compromised, change the password immediately to prevent continued exploitation. Changes to administrator account passwords should only be made from systems that are verified to be clean and free from malware.
• Implement guidance and policy to restrict the use of personal equipment for processing or accessing official data or systems (e.g., working from home or using a personal device while at the office).
• Develop policies to carefully limit the use of all removable media devices, except where there is a documented valid business case for its use. These business cases should be approved by the organization with guidelines for their use.
• Implement guidance and policies to limit the use of social networking services at work, such as personal email, instant messaging, Facebook, Twitter, etc., except where there is a valid approved business case for its use.
• Adhere to network security best practices. See http://www.cert.org/governance/ for more information.
• Implement recurrent training to educate users about the dangers involved in opening unsolicited emails and clicking on links or attachments from unknown sources. Refer to NIST SP 800-50 for additional guidance.
• Require users to complete the agency's "acceptable use policy" training course (to include social engineering sites and non-work related uses) on a recurring basis.
• Ensure that all systems have up-to-date patches from reliable sources. Remember to scan or hash validate for viruses or modifications as part of the update process.