31.12.19

20 tips for 2020: Mistakes to avoid – cybersecurity habits to avoid - part 1


By Amer Owaida


As we’re entering 2020, we’re also plotting out our New Year’s resolutions. Instead of suggesting what you should do next year, however, let’s have a look at some cybersecurity mistakes you should avoid for a more secure 2020.

Denying you are a target
You’ve probably already brushed off this possibility with contempt, thinking the chances are slim to none. To quote Dwight from The Office, “False”. When it comes to the internet, you cannot anticipate if a breach will directly affect you. New malware may appear or a service that you use may get hacked and your password can be leaked. All of these are probabilities that you should be aware of, and prevention can go a long way in securing your connected presence.

Clicking on suspicious links
Receiving spam has become a part of everyday life. Sometimes it’s just a harmless ad, but every now and then it can be something more sinister. You might get an email coaxing you to click on a suspicious link to claim a prize you’ve won. Or an offer that sounds too good to pass up might appear in an ad. Whatever the case, if you have even a shred of doubt about it: avoid clicking on it at all costs. The link just may contain malware that may wreak all kinds of havoc on your computer.

Failing to patch
Is your computer nagging you for the umpteenth time to install that pesky update? Perhaps the latest patch for your smartphone’s OS has been released. You’ve probably hit the postpone button more times than you’ve snoozed your alarm. We can’t speak to your sleeping habits, but you should always keep your devices updated to the latest version of software available. It will probably save you from a headache in the long run. The infamous WannaCryptor malware spread due to devices not being patched.

Recycling your passwords
To simplify the arduous task of memorizing scores of passwords, some people resort to recycling. This means that they reuse the same password or passphrase, perhaps varying a character or two or by adding upon it. This practice should be avoided. If the bad actors figure out one of your passwords, password reuse allows them to guess the rest of your passwords.

Not using 2FA
Two-factor authentication (2FA), also known as multifactor authentication (MFA), is a simple way to add an extra layer of security to your accounts. The most common 2FA method used by popular online services is a text message with an authentication code sent to your phone. It is one of the most basic methods but use at least this one if you have no other option. If bad actors are missing one piece of the puzzle, they cannot get in until they overcome that hurdle, which might make them look for an easier challenge elsewhere.

Ignoring your router setup
When it comes to home interconnectivity, the router is the heart of your home. All your devices with an internet connection are linked to it, be it your smart TV, smartphone, personal computer or laptop. For convenience’s sake, a lot of people just go through the bare necessities when installing it or keep the default settings pre-configured by your ISP. You should always take steps to secure your router, so you can browse the internet safely.

Using unsecured public Wi-Fi
Most places like cafes, restaurants, and even shops offer complimentary Wi-Fi connections, which is a welcome alternative to using up your precious data plan. As convenient as such free connections might be, you should be careful what you connect to. An unsecured public Wi-Fi can lead to your private data being stolen or your device being hacked.

Disregarding VPN
Besides using a Virtual Private Network (VPN) to connect to your work’s servers, there are other security reasons to use one in private. You can use VPNs to access your home network remotely or to limit your ISP from seeing what you are doing, or to browse safely on public Wi-Fi. Depending on what you want to do, there are various types of VPNs you can choose from to protect your communication.

Skimping on security software
The internet is a useful tool, no doubt, but to paraphrase G.R.R. Martin, it can be dark and full of terrors. Granted, this leans towards hyperbole, but you should always use reputable security software to protect your data. Clicking on the wrong link might lead to malicious code making its way to your computer. Security software provides multiple layers that can stop these threats in their tracks. Prevention is the mother of security; athletes in contact sports use mouthguards as a preventive measure because fixing their teeth is more expensive than protecting them. The same goes for your data.

Underestimating backup and encryption
If, due to some unforeseen circumstances, your computer kicks the can, having a backup comes in handy. Always back up your sensitive data and things you have been working on recently; thus, if something does happen, you can continue unhindered by the unfortunate loss of your device. The same goes for encryption. Never underestimate the value of having your data encrypted: if you get hacked, the bad actor will have a tough time getting to your data; if your device gets stolen, you have an extra layer of security in place before you remotely wipe it.

If you just counted ten tips and not twenty, you would be right. So stay tuned, as tomorrow we’ll continue with tips that will be geared towards smartphones.

30.12.19

How to get rid of your old devices safely


Disposing of old tech isn’t a one-click solution; there are multiple things you have to consider before moving on to greener pastures.

Black Friday, Cyber Monday and even Christmas are behind us. Which means some of us may have been fortunate enough to unwrap a shiny new laptop, smartphone or tablet. But what about our old devices?

Some of us keep our old devices as back-ups in case something goes amiss. On the other hand, the majority likes either to share the holiday cheer and gift their old devices or sell them. Whatever the case may be, there are some things you should do before you can pass the device along safely.

Mind you, if you’re more of a video person, we’ve got you covered, too. Otherwise just scroll down to read the main part of this article.

General advice

The one rule you should always adhere to is back up your data frequently. Usually, if it involves your smartphone, you can back up your data to the cloud or your computer. If it involves your computer, you can use a combination of cloud and external drive. Whichever suits you better, but just make sure you do it so you will not lose any sensitive data you may need in the future.

Computers

Most computer users think that formatting their hard drive means that they have wiped their data from the drive, which simply put, is untrue. The data is still recoverable from your drive even after you format it. Wiping the drive on your computer differs from operating system to operating system.

If you have a Mac, the process is quite simple and straightforward. You can use the built-in Disk Utility feature to wipe your drive; it even allows you to determine how thoroughly you want to wipe it.

If you are running Windows, there is no built-in disk wiper, but there are a variety of options you can use. You can browse the web for the best reviewed tool to fit your needs, but the free versions of some may only work with mechanical hard drives.

For solid-state drives (SSDs), then we suggest referring to the manufacturers’ websites for their drive utilities. If you want to go above and beyond, then there is the nuclear option of physically destroying your drive. If you’re comfortable and are well versed in how drives work, you can destroy the necessary components yourself.

The other option is visiting a specialist service that has machines, such as shredders or crushers to dispose of your disk. Fair warning though, not all computers have easily removable drives. Macs, for example, have SSDs soldered to their motherboards.

Smartphones

Smartphones have their own utilities that are implemented in the system to make the process as streamlined as possible. If you’re getting rid of your old iPhone, first sign out of all your services such as iTunes, iCloud, App Store, etc. Then go through your Settings, enter the Reset menu, and tap on Erase All Content and Settings.

If you’re planning on passing along your Android device, the process may vary a bit from manufacturer to manufacturer, but the procedure should be roughly the same. Start by removing the security measures like the Lock screen, then move on to removing the accounts you are signed in with. To go the extra mile, encrypt the data on your phone and after that’s done run the Factory Data Reset on your phone. If you’re using an SD card, don’t forget to pop it out.

Recycle

Be environmentally responsible. If you plan to dispose of the device, don’t just throw it away. Look for places that recycle used electronic devices. They contain valuable resources that can be used in manufacturing future devices. If you’re not sure how to go about it, you can check with the manufacturer’s website or your government should have reasonable advice.

If you are not planning on handing a still functional device on to a relative or friend, consider donating it. One person’s trash is another’s treasure and after all, it is the season to be jolly, so why not share the cheer with someone less fortunate?
b

19.12.19

ESET geeft tool vrij om na te gaan of uw Windows beveiligd is tegen Blue Keep




Onderzoekers van ESET raden aan om Internet Remote Desktop Protocol-verbindingen te blokkeren en zo mogelijke schade door BlueKeep en andere exploits te voorkomen

ESET heeft zopas een gratis BlueKeep-tool (CVE-2019-0708) vrijgegeven om te controleren of een computer waarop Windows draait veilig is tegen misbruik van de kwetsbaarheid. ‘Brute-force’-aanvallen en de BlueKeep-exploit gebruiken rechtstreekse Remote Desktop Protocol (RDP) –verbindingen en laten aanvallers grootschalige kwaadaardige activiteiten uitvoeren door de servers van het slachtoffer te misbruiken.

“Hoewel de BlueKeep-kwetsbaarheid tot nu toe geen grote schade heeft aangericht, zijn we slechts aan het begin van zijn levenscyclus," verduidelijkt Aryeh Goretsky, vooraanstaande onderzoeker bij ESET. “Veel systemen zijn echter nog niet gepatcht en een grondig wormbare versie van de exploit kan nog steeds gevonden worden”, voegt hij eraan toe.

Met RDP kan een verbinding tussen computers gemaakt worden via een netwerk om dat op afstand te gebruiken. In de afgelopen twee jaar heeft ESET steeds meer incidenten waargenomen waarbij de aanvallers op afstand verbinding maakten met een Windows-internetserver door middel van RDP. De aanvallers loggen in als beheerders en kunnen vervolgens verschillende kwaadaardige acties uitvoeren waaronder het downloaden en installeren van programma's op de server, het uitschakelen van beveiligingssoftware of het exfiltreren van servergegevens. Hoewel de precieze aard van wat aanvallers kunnen doen zeer uiteenlopend kan zijn, zijn twee van de meest voorkomende praktijken het installeren van muntenextractieprogramma's, om cryptocurrencies te genereren en ransomware te installeren en zo geld van de organisatie af te persen.

“De aanvallen uitgevoerd met RDP kennen een langzame maar regelmatige groei en werden het onderwerp van een aantal overheidsmededelingen in de Verenigde Staten, het Verenigd Koninkrijk, Canada en Australië, om er slechts enkele te noemen,” vertelt Goretsky. De komst van BlueKeep hebben de poorten geopend waardoor nieuwe aanvallen mogelijk werden. “Deze kwetsbaarheid zou wormbaar kunnen worden, wat betekent dat een aanval zich automatisch over netwerken kan verspreiden zonder tussenkomst van gebruikers”, waarschuwt Goretsky.

Microsoft heeft in zijn klantenrichtlijnen (published guidance for customers) de BlueKeep- kwetsbaarheid het niveau van Kritiek toegewezen, wat het meest ernstige is. In de database met kwetsbaarheden van de Amerikaanse overheid kreeg de CVE-2019-0708 een score van 9,8 op 10.
"Gebruikers moeten niet langer rechtstreeks op hun servers aansluiten via het internet met behulp van RDP. Dit kan problematisch zijn voor sommige bedrijven. Daar de ondersteuning voor Windows Server 2008 en Windows 7 in januari 2020 eindigt, vormen computers met deze programma’s een risico voor het bedrijf. Men moet nu al maatregelen treffen om deze risico’s te verminderen, " beveelt Goretsky aan.

Voor meer informatie over de  BlueKeep-kwetsbaarheid, de beoordelingstool van ESET en de soorten Remote Desktop Protocol-aanvallen, lees de blog “It’s time to disconnect RDP from the internet” op WeLiveSecurity.com . Volg ook ESET Research on Twitter voor de nieuwste berichten van ESET Research.

Voor het gratis e-book over gegevensbescherming, bezoek  https://www.eset.com/be-nl/zakelijk/data-protection-ebook/

Les mots de passe populaires en 2019 : perdant en termes de sécurités





Année après année, les analyses montrent que des millions de personnes font, c’est le moins qu’on puisse dire, des choix douteux quant aux mots de passe qu’elles utilisent pour protéger leurs comptes. Et de nouvelles statistiques pour l’année qui s’achève confirment que les mauvaises habitudes ont la vie dure et que de nombreuses personnes se mettent volontiers sur la ligne de feu des attaques de prise de contrôle de comptes.

S’appuyant sur l’analyse d’un total de 500 millions de mots de passe qui ont fait l’objet de fuites lors de diverses atteintes à la protection des données en 2019, NordPass a constaté que « 12345 », « 123456 » et « 123456789 » régnaient en maître en termes de fréquence. Ensemble, ces chaînes numériques ont été utilisées pour la « sécurité » d’un total de 6,3 millions de comptes. Il n’y a pas beaucoup plus d’optimisme en bas de la liste, cependant, car ces trois choix ont été suivis par « test1 » et l’ineffable « password ».

Comme on pouvait s’y attendre, le tableau comprend également d’autres habitués de cette infâme liste, dont les célèbres « asdf », « qwerty » et « iloveyou ». D’autres mots de passe extrêmement piratables – y compris de simples chaînes numériques, des noms communs et des rangées de clés – abondent également. Les listes des mots de passe les plus utilisés de SplashData, que ce soit l’année dernièrel’année précédente et ainsi de suite, brossent chaque année le même tableau.

La liste complète des 200 mots de passe les plus populaires est disponible dans l’article du blog lié, mais ci-dessous il y a les 25 premiers.

Tristement familier
Si vous reconnaissez l’un des éléments ci-dessus comme l’un des vôtres, la modification de vos mots de passe est presque certainement l’une des choses qui méritent une place sur votre liste des résolutions du Nouvel An. Pour commencer, réparer ici signifie ne pas avoir exactement la même idée que des millions d’autres personnes lorsque vous vous inscrivez à un service et qu’on vous demande de créer votre mot de passe.

Une façon d’y parvenir est d’opter pour la phrase de passe, qui, si elle est bien faite, est généralement plus difficile à casser et plus facile à retenir. Ce dernier est particulièrement utile si vous n’utilisez pas de logiciel de gestion de mots de passe, qui, comme on pouvait s’y attendre, s’est avéré avantageux Ã  la fois pour la force et l’unicité des mots de passe. Oui, cette phrase de passe devrait, bien sûr, être unique pour chacun de vos comptes en ligne, car le recyclage de vos mots de passe dans divers services équivaut à vous causer des problèmes.

Vous voudrez peut-être aussi faire attention aux fuites de mots de passe. De nos jours, il existe un certain nombre de services qui vous permettent de vérifier si vos informations d’identification ont pu faire l’objet d’une brèche de données connue. Certains d’entre eux vous offrent même la possibilité de vous inscrire pour recevoir des alertes si vos informations de connexion sont compromises par une violation connue.

En fait, comme nous vivons à une époque où les données de connexion sont compromises par des millions de personnes, pourquoi se contenter d’une ligne de défense si vous pouvez en avoir deux ? Au risque de nous répéter, l’authentification à deux facteurs est un moyen très précieux d’ajouter une couche supplémentaire de sécurité aux comptes en ligne en plus de votre mot de passe.

Classement                                                                                                  Mots de passe

1                                                                                                                                                                                          12345
2                                                                                                                                                                                          123456
3                                                                                                                                                                                          123456789
4                                                                                                                                                                                          test1
5                                                                                                                                                                                          password
6                                                                                                                                                                                          12345678
7                                                                                                                                                                                          zinch
8                                                                                                                                                                                          g-czechout
9                                                                                                                                                                                          asdf
10                                                                                                                                                                                      qwerty
11                                                                                                                                                                                      1234567890
12                                                                                                                                                                                      1234567
13                                                                                                                                                                                      Aa1323456.
14                                                                                                                                                                                      iloveyou
15                                                                                                                                                                                      1234
16                                                                                                                                                                                      abc123
17                                                                                                                                                                                      111111
18                                                                                                                                                                                      123123
19                                                                                                                                                                                      Dusmach
20                                                                                                                                                                                      test
21                                                                                                                                                                                      princess
22                                                                                                                                                                                      qwertyuiop
23                                                                                                                                                                                      sunshine
24                                                                                                                                                                                      BvtTest123
25                                                                                                                                                                                      11111