by John Mamon | Mar 11, 2019 | IT Service Blog
Have you seen a new application — Chromium — suddenly appear on your computer? It’s likely that if you did not intentionally download it, the app is malware that should be removed immediately.
While Chromium is a legitimate product, hackers have been using it to deliver adware and potentially unwanted programs, redirect browsers to different websites and track Internet activity. The results of such unwanted software can range from minor irritation to serious privacy concerns, including identity theft.
What Is Chromium?
Chromium is an open-source browser application that was initially created by Google. Chromium is the source code for what became the Chrome browser. When Google released Chrome in 2008, it also released the Chromium code. The Chromium project is now managed by The Chromium Projects and is designed for developers to create a faster, more stable and safer form for web browsing.
Chrome itself still includes some of the Chromium source code along with proprietary features, such as automatic updates. Google owns and manages the product, which is by far the most popular browser worldwide, with 62.5 percent of the market share as of February 2019.
Why Is Chromium Popular with Hackers?
Because it’s an open-source product, Chromium is vulnerable to misuse. Browser hijackers are a type of malware that makes changes to a user’s browser settings without their knowledge or consent. Most users unintentionally download hijacking malware when clicking through online ads or when downloading or purchasing other software.
How Does Malware Chromium Work?
The malware Chromium app uses a virtual layer to push ads or redirect browsers to e-commerce websites. Other types can direct users to dangerous, malicious websites that can themselves contain infectious viruses and programs.
What’s worse is that the bad Chromium browsers track your browser activity and can grab browsing data, including personally identifying information, passwords and financial data such as credit card numbers and bank account numbers. The hackers then sell this information to third parties, who often use it illegally. This activity can mean privacy breaches, unwanted use of cards and accounts, and identity theft.
There are many different Chromium-based browser applications that are dubious, despite appearing to be legitimate. Usually, these apps claim to improve browsing speed and security and boast of having new features that other browsers lack. These claims lure users into a false sense of security and invite downloads that cause trouble. These questionable app names include BeagleBrowser, BrowserAir, Chedot, eFast, Fusion, MyBrowser, Olcinium, Qword, Torch and Tortuga, among others.
How Is Chromium Malware Installed?
Often, these rogue programs are part of the Custom or Advanced settings of an app. The most common victims of these unwanted applications are users who hastily download software and install it quickly without reviewing each step. To avoid these inadvertent downloads, it’s important to pay attention during download and installation steps. Be wary of any software that is bundled with other programs and never accept offers to install third-party programs.
How Do I Uninstall Rogue Chromium Browsers?
There are several step-by-step guides online to show how to remove the malware, do thorough scans of your computer for rogue files and registry keys, and clean and reset browsers. The steps are very specific to your operating system and browsers. Two good online guides are here and here.
Being aware of types of malware, how they infect your computer and what they do can help prevent you or your employees from the frustration, time and irritation of fake Chromium browsers.
by Renee Kennison | Feb 25, 2019 | IT Service Blog
Every business grapples with the challenges of moving to the cloud. It isn’t a matter of IF, but WHEN and HOW.
For tens of thousands of organizations, the WHEN is Today and the HOW is with Ensure VC2.
We partnered with Veeam to provide our customers a solid way to back up files, including Microsoft 365. When we began rolling this product out a little over a year ago, even we didn’t imagine the size of the response in such a short amount of time.
While you are reading this, you may be thinking “Doesn’t Microsoft take care of Office 365 backup?”
It’s important to remember that SaaS platform providers, like Microsoft Office 365, take on the responsibility of application uptime and the underlying infrastructure. But it is the customer’s responsibility to manage and protect their vital business data.
At mPowered IT, we’ve identified 6 reasons why backing up Office 365 is critical:
- Accidental deletion: If you delete a user, whether you meant to or not, that deletion is replicated across the network. A backup can restore that user, either to on-premises Exchange or Office 365.
- Retention policy gaps and confusion: Office 365 retention policies are hard to keep up with, let alone manage. A backup provides longer, more accessible retention all protected and stored in one place for easy recovery.
- Internal security threats: Many businesses are experiencing threats from the inside, and they are happening more often than you think. Having a high-grade recovery solution mitigates the risk of critical data being lost or destroyed.
- External security threats: Malware and viruses have done serious damage to organizations globally in just the past year alone. A backup can easily restore mailboxes to an instance before the attack.
- Legal and compliance requirements: Ensure you can retrieve mailbox data during legal action and to meet any regulatory compliance needs.
- Managing hybrid email deployments and migrations to Office 365: Whether you are migrating to Office 365 or have a blend of on-premises Exchange and Office 365 users, the exchange data should be managed and protected the same way, making the source location irrelevant.
The promise we have made is we will help our customers protect any app, any data, across any cloud, and this latest news moves us closer to fulfilling that promise. I’d like to share what Thierry Schaal, Cloud Solution Manager at Adista had to say. Adista is a Veeam Cloud & Service Provider (VCSP) partner:
“As more workloads move to the cloud, customers need to understand that SaaS applications typically don’t have built-in data protection. SaaS usage has uncovered unique internal and external security threats, as well as all-to-common data deletion scenarios and retention policy gaps. We see a rapidly growing opportunity to provide much-needed data protection services for a wide range of infrastructures and applications – which is why we are excited about Veeam Backup for Microsoft Office 365.”
For more information on Microsoft 365 backups or any other network security question call mPowered IT at 678-389-6200, email us, or contact us online.
by John Mamon | Feb 15, 2019 | IT Service Blog
Social engineering is when “persuasion” takes a darker turn. In a broad sense, it includes any action that attempts to influence a person to act against their best interests. This is the last of a 4-part series on social engineering and how it affects your business. We have covered Impersonation, Email Phishing, Vishing, and finally SMiSHing.
SMiSHing
SMiSHing applies phishing tactics through text messages.
Although this channel is less effective at convincing victims of the sender’s authority, attackers find other uses.
Fake shipping service in Japan
In an on-going SMS phishing attack in Japan, victims receive text messages claiming to be from a parcel delivery service. The message guides victims to a website with more information.
Rather than collecting information online, the site prompts users to send personal information via SMS.
A variation of the attack encourages victims to install a smartphone app. The mobile malware intended to collect login credentials and credit card info and send SMS messages to more potential victims.
SMS phishing via Atlanta
Two Romanian hackers were extradited to the U.S. in April for an elaborate phishing scam that leveraged SMiShing and vishing.
From Romania, the pair used compromised computers around Atlanta to send thousands of automated phone calls and text messages throughout the U.S.
The messages claimed to be from a financial institution and directed victims to call a phone number to resolve a problem. After calling, victims were prompted to enter their bank account numbers, PINs, and/or social security numbers.
The hackers collected more than 36,000 bank account numbers, according to court records.
What You Can Do About It
First, always be aware that these scams exist and keep your guard up. More importantly, partner with a trusted IT service company, who takes on the job of protecting your business from cybercriminals.
For more information, a security assessment, or help training your employees on cyber safety, call mPowered IT 678-389-6200.
by John Mamon | Feb 14, 2019 | IT Service Blog
Social engineering is when “persuasion” takes a darker turn. In a broad sense, it includes any action that attempts to influence a person to act against their best interests. This is the third of a 4-part series on social engineering and how it affects your business. Earlier, we covered Impersonation and Email Phishing. Today – Vishing.
Vishing
Vishing – or ‘voice phishing’ – is used by brazen attackers who call their targets directly. They often impersonate authority figures and threaten victims to send payment, or else…
Malware Routes Calls to Attackers
In one recent example of vishing, rather than calling victims, attackers used malware on victims’ smartphones to redirect their calls.
Once installed, the malware detected when calls were placed to banks and redirected them to scammers who impersonated a banking employee. The phone’s caller ID even listed the bank’s legitimate phone number.
In one example, more than 130 utility customers – many of them restaurants – received calls from a person threatening to shut off their electrical service unless payment was made.
Many of the calls came at busy times – such as the dinner rush – and at least one victim paid $4,000 to avoid having the power cut. Payments were made online or via prepaid card.
Caller ID Spoofing
The attacker may use caller ID spoofing to make their efforts more convincing.
For example, several New Jersey residents experienced vishing attacks in which the caller impersonated a local sheriff’s office.
The attacker attempted to extort money from victims using the threat of arrest and successfully used caller ID spoofing to mimic the sheriff’s office phone number.
In another example of impersonating police, the caller posed as a officer and pressured the victims into share personal information that could be used for fraud.
What You Can Do About It
First, always be aware that these scams exist and keep your guard up. More importantly, partner with a trusted IT service company, who takes on the job of protecting your business from cybercriminals.
For more information, a security assessment, or help training your employees on cyber safety, call mPowered IT 678-389-6200.
by John Mamon | Feb 12, 2019 | IT Service Blog
Social engineering is when “persuasion” takes a darker turn. In a broad sense, it includes any action that attempts to influence a person to act against their best interests. This is the second off a 4-part series on social engineering and how it affects your business. Earlier, we covering Impersonation. Today – Phishing.
Email Phishing
Phishing occurs most often through email and it’s one of the most common ways cyber attacks are launched.
Two main types of email phishing exist:
- Emails that trick victims into sharing access credentials.
- Emails that trick victims into installing malware.
In email phishing, attackers are generally not working to scam you out of money directly. They simply want to steal access credentials or install malware.
In the first variety, attackers typically encourage victims to visit a phony website and enter access credentials. Occasionally, they encourage victims to send credentials directly via email.
Even here, overlap exists – where the phishing websites often attempt to force malware onto the users’ system via drive-by-download or a disguised software update.
Many phishing emails attempt to trick users into installing malware directly via a disguised email attachment. While any type of malware can be used, trojans are a common variety designed to persist on the infected system and collect sensitive information, such as banking credentials.
What You Can Do About It
First, always be aware that these scams exist and keep your guard up. More importantly, partner with a trusted IT service company, who takes on the job of protecting your business from cybercriminals.
For more information, a security assessment, or help training your employees on cyber safety, call mPowered IT at 678-389-6200.
by John Mamon | Feb 11, 2019 | IT Service Blog
Persuasion is part of life. We all try to persuade friends and loved ones to act in a certain way, usually with the best of intentions.
Social engineering is when “persuasion” takes a darker turn. In a broad sense, it includes any action that attempts to influence a person to act against their best interests.
Technically, acts that influence people to behave within their own interests is also social engineering. However, the term is used almost exclusively within the context of fraud, scams, and cyber crime.
Con artists are master social engineers. So are modern hackers who rely on spam and phishing — and they have a few new tricks up their sleeves.
Social Engineering Tactics
In a series of four blogs, I’ll describe some of the most common social engineering tactics used today in cyber crime.
In the real world, cyber attacks do not fit into neat categories. Instead, each is unique, often combining multiple channels and tactics.
While categorization is helpful to understand the nature of the beast, remember that many of these tactics will overlap in the wild.
Impersonation
Impersonation is one of the most common types of social engineering. Obviously, it’s when an attacker presents himself or his communication as originating from another party.
Attackers routinely impersonate authority figures – such as police officers or CEOs – knowing many people are quick to follow orders from authority, as has been proven in psychological experiments.
Many other roles are impersonated: lottery officials, wireless service reps, government officials, coworkers, family members – the list is nearly infinite.
Remote tech support scams
Phone scams are nearly as old as telephones. In a typical scam, the attacker calls the victim, poses as someone else, and uses a false pretense to con the victim into sending payment.
In recent years, the tactics have been used for cyber crime.
Tech support scams are a common example. The attacker calls posing as an employee from Apple, Dell, or Microsoft and claims the victim has a malware infection or other tech problem.
Rather than conning the victim into sending payment, the attacker walks them through the steps to allow a connection to their computer through a remote desktop app.
Once attackers are in, they do as they please, typically installing ransomware.
Some attackers take a multi-pronged approach. Posing as the IRS, one group called victims and demanded either payment or computer access immediately.
Legitimate companies do not call to inform you of an attack and offer to walk you through the process of fixing it. That doesn’t happen in real life. If there were such an issue, you’d receive notice via email, and you would contact your IT support team to resolve it.
Emergency email from the boss
Business email compromise (BEC) scams – which have accelerated in recent years – are an example of impersonation used to devastating effect.
In a typical BEC scam, the attacker has intimate knowledge of the target business, including who is authorized to send wire transfers and how the transfers are initiated.
The attacker targets this person, sending them an email purporting to be from their boss (either by compromising or spoofing the boss’ email). The email requests a large wire transfer to the attacker’s account.
The email is crafted to mimic prior wire requests. It may also inject a sense of urgency, which is a common marketing technique, by adding “I need this handled ASAP.”
It goes without saying, that anytime you are asked to wire money – even if it’s an urgent request from your boss – verify it directly with your boss, or a trusted person who would know if the request was legit.
What You Can Do About It
First, always be aware that these scams exist and keep your guard up. More importantly, partner with a trusted IT service company, who takes on the job of protecting your business from cybercriminals.
For more information, a security assessment, or help training your employees on cyber safety, call mPowered IT 678-389-6200.
Page 1 of 1112345...10...»Last »
