Tuesday, May 3, 2022

PCMag SecurityWatch

Why you should use a password manager.

Views expressed in this cybersecurity-cyber crime update are those of the reporters and correspondents.

 Accessed on 03 May 2022, 2106 UTC.

Content provided by email subscription to "PCMag SecurityWatch."

Source: https://mail.google.com/mail/u/0/?tab=rm&ogbl#inbox/FMfcgzGpFgxgqfdbDVRXPKwQddxlxSNs

Please click link or scroll down to read your selections.

Thanks for joining us today.

Russ Roberts

https://hawaiicybersecurityjournal.blogspot.com

https://paper.li/RussellRoberts (machine learning, artificial intelligence, IoT, and information security)


PCMag SecurityWatch
A Plea for Password Management Best Practices
In just about every SecurityWatch newsletter, I manage to shoehorn in encouragement for readers to use a password manager. I mean, why not? There are free password managers, and many of the paid versions are inexpensive. Adding an extra step to your online routine can be a pain, but the benefits of keeping complex and unique passwords in an encrypted vault rather than using the same password for multiple logins around the web are worth the hassle. Since World Password Day is May 5 this year, now is a good time to talk about password management best practices again.

Password Management Statistics

Bitwarden, one of PCMag's Editors' Choice award-winning password managers, recently conducted a global password management survey and the results are pretty grim. In the US, 31% of respondents experienced a data breach in the last 18 months, as compared to about 1 in 4 globally. More than 8 in 10 (85%) Americans reuse passwords across multiple sites, and almost half of US respondents (49%) rely on their memory alone to manage passwords. That said, Americans are still more likely (44%) to use a password manager than the rest of the globe (34%). 

There were some bright spots in the report. Multi-factor authentication is mainstream these days, with 79% of US respondents saying they use MFA for workplace accounts and 77% for personal accounts. Globally, that number sits at 73% (work) and 78% (personal).

What You Need From a Password Manager

A password manager can make life online a lot easier. The best password managers not only store credentials for websites and apps, but many also help you identify and replace weak and duplicated passwords. 

Most password managers autofill your stored credentials for web forms, which can save you time when you're checking out on shopping sites. Many password managers also include built-in mechanisms for securely sharing passwords with other users, which is useful for families sharing one streaming login or coworkers who all need to access one online account. 

World Password Day at PCMag

My colleagues are working hard to keep all of our password management articles up to date and address reader concerns regarding the topic. Here's a list of our top password-related articles. 

Best Password Managers. PCMag puts a litany of premium password managers to the test and determines which ones are the best value for your money.

Best Free Password Managers. We test the free versions of popular password managers.

Simple Tricks to Remember Seriously Secure Passwords. You need to lock your password manager with one strong master password, and you must remember it yourself. Here's how to do it.

How to Switch to a New Password Manager. Modern password managers make it very easy to switch between services. Just follow these simple steps.

How to Share Passwords Safely. It's perfectly safe and easy to share your passwords, as long as you use the right tools for the job.

Got a Password Manager? Good, But You’re Using It Wrong. Studies show that you probably aren’t using your password manager correctly. Here’s how to fix all your password problems.

How to Use a Random Password Generator. Most password managers include tools for generating random, strong passwords, but not all are created equal. Understanding the differences can help you make an informed choice.

How to Create a Random Password Generator. Do you trust the passwords created by third-party software to be truly random and safe? No? Here's how to build your own random generator for uncrackable passwords.

Get this from a friend? Get it delivered to your inbox weekly. Sign up for the SecurityWatch newsletter.


What Else Is Happening in the Security World This Week?

US Gets 60 Countries to Sign 'Declaration for the Future of the Internet.' The most obvious name absent from the declaration is India, which also happens to be the world’s leading internet-shutdown offender.

Microsoft: Nearly 40 'Destructive' Malware Attacks Have Hit Ukraine. Most of the attacks have been on government organizations or critical infrastructure providers in the country, according to a Microsoft investigation.

US Offers $10 Million for Information on 6 Russian Military Hackers. They carried out cyber attacks on US infrastructure using the NotPetya ransomware.

Hackers Reportedly Target Wind-Energy Companies. Nordex SE and Deutsche Windtechnik AG were both hacked over the past few months, while Enercon GmbH reportedly experienced collateral damage from the Viasat hack.

PCMag Tests the Best Ad Blockers. There are big differences among popular ad blockers. We put them to the test to see which one is best for cleaning up your browsing experience.

Save $50 on IPVanish VPN
TECH DEAL OF THE DAY
If you buy something from our links, we may get a commission from the sale. Learn more here.
Never forget your passwords again! Get 30% off Keeper Unlimited and Keeper Family Plans
 
GET DEAL
TODAY'S TOP NEWS
How Phishing Scams Work
One of the common comments we receive on our articles about phishing scams runs along the lines of “I don’t see how people keep falling for this stuff.” That’s why I decided this week to publish an excerpt from Neil J. Rubenking’s article on how to avoid phishing scams. It’s easier to get tricked by a scammer than you may think.

“The key to running a credential-stealing phishing scam is creating a replica of a secure website that's good enough to fool most people or even just some people. With the classiest fakes, every link goes to the real site. Well, every link except the one that submits your username and password to the perpetrators. As icing on the cake, the fraudsters may try to create a URL that looks at least a little bit legitimate. Instead of paypal.com, perhaps pyapal.com, or paypal.security.reset.com.

"However, not every phishing page is well done. Some use the wrong colors or otherwise fail to match the page they imitate. Others have totally unconvincing URLs, things like seblakenakkalikalaudimakan.crabdance.com, or X8el87.journal.com. Even these lame fakes can pick up a few suckers, apparently, or the fraudsters would give up.

"When you enter your username and password on a phishing site, the site owners gain full access to your account. To keep you from realizing you've been scammed, they may pass the credentials along to the real site, so it looks like you logged in normally. Your only clue may come when you find that your bank account is empty, or that you can't log into your email, and your friends say they're getting spam from you.”

Protect Yourself From Phishing Scams

To combat the good fakes, take the time to pay close attention to links you receive via chat, email, or SMS. Here are some common phishing signs to look for:

1. Misspellings in the web address
2. A link routes you to a site marked “Not Secure”
3. A link routes you to a page that urges you to take instant action (usually to secure your account or to check a bank balance)

If you have doubts about the link you received, do not click on it, especially if it comes from someone you do not know. It helps to have an antivirus or a security suite installed for extra protection against phishing.

Grindr Reportedly Sold Precise Location Data for Years

Spain Claims Government Officials Were Targeted by Pegasus Spyware

5 Tips for Blocking Mobile Tax Scammers

What Is a Zero-Click Attack?

Do You Really Need to Buy an Antivirus App or a VPN Anymore?

TOP TECH DEALS
Want more deals like these delivered to your inbox?
GET OUR BEST DEALS TODAY
DJI Mavic Air 2 Fly More Combo Drone Quadcopter w/ 4K 60fps Video
$988.00 $789.00  
GET DEAL

Clip $80 off Coupon Roborock S4 Max 2000Pa Suction Robot Vacuum Cleaner w/ Lidar Navigation
$429.99 $299.99  
GET DEAL

Bonus $100 eGift Card 32" Dell S3222DGM Curved 2560x1440 QHD 165Hz 2ms Gaming Monitor
$529.99 $329.99  
GET DEAL

Over $50 Cheaper than Amazon JBL Live Free NC+ Active Noise Cancelling Bluetooth Earbuds w/ Wireless Charging
$149.95 $49.99  
GET DEAL

Lenovo Flex 5 AMD Ryzen 5 5500U 14" 1080p Convertible 2-in-1 Touch Laptop w/ 16GB RAM, 256GB SSD
$849.99 $577.14  
GET DEAL

All product and deal information such as discount, price and availability are believed to be accurate as of the time of publication. Please verify these details with the merchant site and check the merchant's terms and conditions before you buy. Publisher is not responsible for errors or omissions.
SHARE & FOLLOW US

Monday, May 2, 2022

The Hacker News Daily Updates

Chinese "Override Panda" hackers return with new espionage attacks.

Views expessed in this cybersecurity-cyber espionage-cyber crime update are those of the reporters and correspondents.

Accessed on 03 May 2022, 0250 UTC.

Content supplied by email subscription to "The Hacker News Daily Updates."

Source:  https://mail.google.com/mail/u/0/?tab=rm&ogbl#inbox/FMfcgzGpFgwWpBrsxsrbXtnsScsJXNNz

Please click link or scroll down to read your selections.

Thanks for joining us today.

Russ Roberts

https://hawaiicybersecurityjournal.blogspot.com.

The Hacker News Daily Updates
Newsletter
cover

Linux for Networking Professionals ($44.99 Value) FREE for a Limited Time

As Linux continues to gain prominence, there has been a rise in network services being deployed on Linux for cost and flexibility reasons.

Download NowSponsored
LATEST NEWSMay 2, 2022

Chinese "Override Panda" Hackers Resurface With New Espionage Attacks

A Chinese state-sponsored espionage group known as Override Panda has resurfaced in recent weeks with a new phishing attack with the goal of stealing sensitive information. "The Chinese APT used a spear-phishing email to deliver a beacon of a Red Team framework known as 'Viper,'" Cluster25 said in ...

Read More
TwitterFacebookLinkedIn

Which Hole to Plug First? Solving Chronic Vulnerability Patching Overload

According to folklore, witches were able to sail in a sieve, a strainer with holes in the bottom. Unfortunately, witches don’t work in cybersecurity – where networks generally have so many vulnerabilities that they resemble sieves.  For most of us, keeping the sieve of our networks afloat requires ...

Read More
TwitterFacebookLinkedIn

Russian Hackers Targeting Diplomatic Entities in Europe, Americas, and Asia

A Russian state-sponsored threat actor has been observed targeting diplomatic and government entities as part of a series of phishing campaigns commencing on January 17, 2022. Threat intelligence and incident response firm Mandiant attributed the attacks to a hacking group tracked as APT29 (aka ...

Read More
TwitterFacebookLinkedIn

Google Releases First Developer Preview of Privacy Sandbox on Android 13

Google has officially released the first developer preview for the Privacy Sandbox on Android 13, offering an "early look" at the SDK Runtime and Topics API to boost users' privacy online. "The Privacy Sandbox on Android Developer Preview program will run over the course of 2022, with a beta ...

Read More
TwitterFacebookLinkedIn

Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation (OpenSSF) has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source ...

Read More
TwitterFacebookLinkedIn
cover

Linux for Networking Professionals ($44.99 Value) FREE for a Limited Time

As Linux continues to gain prominence, there has been a rise in network services being deployed on Linux for cost and flexibility reasons.

Download NowSponsored

Sunday, May 1, 2022

CSOonline.com

Today's top cybersecurity news and analysis from "CSOonline.com."

Views expressed in this cybersecurity-cybercrime update are those of the reporters and correspondents.

Accessed on 01 May 2022, 2228 UTC.

Content supplied by "CSOonline.com."

Source: https://www.csoonline.com/news-analysis/

Please click link or scroll down to read your selections.

Thanks for joining us today.

Russ Roberts

https://hawaiicybersecurityjournal.blogspot.com

https://paper.li/RussellRoberts (machine learning, artificial intelligence, IoT, and information security)

News Analyses

CSO  >  Searching for vulnerabilities  >  Magnifying lens in a virtual interface idnetifies weakness
malware attack

A user reviews data and statistical models. [analytics / analysis / tracking / monitoring / logging]

Proficio launches detection and response service to tackle identity-based threats

MDR firm claims solution is the industry’s only vendor-agnostic open XDR solution that supports identity threat detection and response.

Binary Russian flag

New Five Eyes alert warns of Russian threats targeting critical infrastructure

The alert provides detailed information on Russian government and state-sponsored cybercriminal groups as well as guidance for reducing risk.

money currency international denominations global currency by metamorworks getty images 1129515470

Ransomware plagues finance sector as cyberattacks get more complex

Cybercriminals have evolved from hacking wire transfers to targeting market data, as ransomware continues to hit financial firms, says a new VMware report. Here's what to do about it.

spyware alert notification

Spyware was used against Catalan targets and UK prime minister and Foreign Office

Researchers at the Citizen Lab says dozens of officials' phones were compromised by spyware sold by NSO Group or Candiru.

radar grid / computer circuits / intrusion detection / scanning

Bitdefender enters native XDR market with new offering

GravityZone XDR promises to reduce attacker dwell time with robust detection, quick triage, and automated threat containment.

hand at keyboard with Windows logo

Why you should patch the latest critical Windows RPC vulnerability right now

CVE-2022-26809 can allow attackers to compromise networks without user intervention, making it the most dangerous vulnerability fixed by Microsoft's April 12 Patch Tuesday update.

industrial power plant hacked skull and crossbone pixels security breach power plant by jason black

Rare and dangerous Incontroller malware targets ICS operations

A coalition of U.S. government agencies, security researchers, and companies warn about this new malware that can gain complete access to ICS and SCADA systems.

Artificial intelligence and digital identity

Ballooning growth of digital identities exposing organizations to greater cybersecurity risk

New enterprise initiatives are driving up the number of human and digital identities, increasing security risks.

Toy soldiers + binary code / wargames / cyberwarfare

Ukraine energy facility hit by two waves of cyberattacks from Russia’s Sandworm group

Sandworm succeeded in planting a new version of the Industroyer malware to disrupt ICS infrastructure at multiple levels, but was thwarted from doing serious damage.

CSO  >  Botnet  >  Robots amid a blue binary matrix

Serious flaws allow the hijacking of autonomous logistics robots used in hospitals

The now patched JekyllBot:5 vulnerabilities in Aethon TUG robots expose three communications interfaces, two APIs, and a websocket interface.

A virtual brain is wired with technology connections.

With AI RMF, NIST addresses artificial intelligence risks

The new framework could have wide-ranging implications for the private and public sectors. NIST is seeking comments on the current draft by April 29, 2022.

binary code, magnifying lens, skull and crossbones

FBI active defense measure removes malware from privately owned firewalls

The action targeted devices infected by the Cyclops Blink malware, believed to have been developed by Russia's Sandworm group.

innovation co innovation startup venn overlapping partnering iot by pettycon via pixabay

CrowdStrike and Mandiant form strategic partnership to protect organizations against cyber threats

Vendors say the partnership combines CrowdStrike’s Falcon platform with Mandiant’s breach investigation and response services offering tighter platform integrations, industry-leading intelligence, and shared expertise.

malware attack

New cryptomining malware targets AWS Lambda

The malware, dubbed Denonia, is written in Go for easier deployment and uses AWS's own open-source Go libraries.

A network of security components overlays a credit card payment made by laptop user.

New PCI DSS v4.0 receives kudos for flexibility

Customization, multi-factor authentication are key features in PCI DSS v4.0 global payment benchmark.

Digital bugs amid binary code. [security threats / malware / breach / hack / attack]

Zoom’s bug bounty ROI clear as program pays $1.8 million to fix over 400 bugs

The firm’s CISO reflects on bug bounty ROI and selling the concept to senior leadership.

Binary Russian flag

New threat group underscores mounting concerns over Russian cyber threats

Crowdstrike says Ember Bear is likely responsible for the wiper attack against Ukrainian networks and that future Russian cyberattacks might target the West.

Abstract Java code

Spring4Shell patching is going slow but risk not comparable to Log4Shell

More tools to identify vulnerable applications and options to mitigate the risk from Spring4Shell are also now available.

LOAD MORE

 

Cyber War News Today.

"From trade wars to cyber wars in modern era." Views expressed in this cybersecurity, cyber espionage, and cyber crime update are ...