Mobile App Security Threats To Plan For

Posted by Andreas Christodoulou

Description :

Mobile apps continue to grow with technology. There are countless ways that apps make our lives easier—whether it be tracking our fitness progress, or improving our online shopping experience. The rapid growth in app usage around the world means that, a lot of people don’t have experience on how to protect themselves against a possible security attack. 

In 2018, 71% of fraud transactions came from mobile apps and mobile browsers. In comparison, 29% came from people using the web, which is a 16% increase year over year. Additionally, one out of every 36 mobile devices has high-risk apps installed. 

Savvy hackers don’t rely on one method to gain access to you and your users’ private data. That’s why, you must anticipate their attacks ahead of time, and design your app so that your users won’t have to worry about whether their data will be compromised. In return, this will signal to others that the business or service you provide through your app, is not only high-quality but also safe. 

Mobile App Security Threats

If a hacker can’t gain access to your precious passwords one way, don’t celebrate too early. They have an arsenal of other weapons they have at their disposal. And after they do exploit your personal information, a lot of the times you won’t even notice it until after the damage has been done. 

Here are a handful of ways that hackers will try to catch you off guard:

No Multifactor Authentication 

You’re especially vulnerable to this attack if you’re the kind of person that uses the same password across all your online accounts and apps. If a hacker is able to uncover it from one of your accounts, they will no doubt gain access to related apps you use. 

Adding an extra step to “authenticate” your account doesn’t always mean you must remember two passwords. It can also mean that you must answer a personal question, or access your account using an SMS confirmation code. 

No Proper Encryption 

Like changing the combination of a security lock, encryption puts data into an indecipherable code that can only be viewed after implementing a secure password. But everyone makes mistakes, and sometimes a developer can design an encryption code that is too easy to crack. After a hacker gains access, they can clear the encryption so that your private data is available in plain sight. 

Reverse Engineering

If your code is too easy to figure out, a hacker can take their hacking a step further and learn exactly how your app functions. They’ll know your code inside and out. And if they have a plethora of experience to draw from, they might even know more about your app than you do. 

This means a hacker can not only expose encryption, but they can modify the source code—using their knowledge to build a fake app designed to look like yours. A hacker can use this fake app to inject malware or worse to your misled users. 

Learn From Others

Mobile app hacks result in time-consuming (and expensive) data breaches. Plus, you lose the trust of your potential users as they don’t want to lose their personal data to hackers. 

Unfortunately, every day there are new cases of hackers taking advantage of a growing app or business. Learn from the mistakes of others so you can understand how to shield yourself against a potential attack. 

TimeHop

TimeHop was the victim of an unauthorized attack that led to a privacy breach of over 21 million users. The hack occurred in December of 2017, but it wasn’t uncovered until July 4, 2018. The attack not only led to the exploitation of TimeHop’s users, but it also led to an app crash.

And what was the main reasoning for the attack? TimeHop failed to use multifactor authentication. As a result, the hacker used the security information found from a TimeHop employee, to access the cloud of the company. 

Fortnite 

Fornite originally released its beta version of the game using an invitation-only environment. Hackers saw this as an opportunity to produce fraudulent links to fake clone versions of the game. 

These versions of the game misled fans, because the hackers cleverly used reverse engineering to include the same loading screens, music, and images the real version used. 

It doesn’t matter if the app you use provides a business, service, or is a video game. If the code is simple to break, hackers will take advantage. 

What Can You Do?

Prevent Reverse Engineering With Obfuscation

Reverse Engineering occurs (like the Fortnite example) because of faulty code. But obfuscation and minification make the code less readable—meaning hackers won’t be able to study how your app functions to build their own. 

Validate Inputs

Remember, it’s dangerous to rely on the same password for all the apps and online services you use. A stranger can access your accounts just by knowing a single password, but when you add more validation inputs to follow, you add an additional layer of app security. 

More Tips

Who’s most vulnerable to attack? In 2018, apps in the tools and lifestyle categories made up a combined 54% of malicious mobile apps. But regardless of which category your app resides in, you can’t take your app security lightly.

Remember, some of the top ways hackers gain access to your app is because of a lack of multifactor authentication or lack of encryption practices. But staying on top of these two aspects leads to a safe and trustworthy app for your users. 

Implementing the right security protocols for your app requires intensive collaboration between your design and development team. And it doesn’t stop there, you must envision yourself as if you were in your hacker’s shoes. What other ways would you try to hack your app? If you plan several steps ahead, you can safeguard your app and focus on the success of your business. 

Learn more about the cases you can learn from, as well as how to make sure you’re doing multi-factor authentication or encryption the right way, by reading this infographic from CleverTap.

Source: CleverTap

READ ALSO: How to Protect Your Company’s Email Against Cyberattack

Keep reading my friends! 💗

*by andreascy*

How to Protect Your Company’s Email Against Cyberattack

Posted by Andreas Christodoulou

Description :

Hello folks and hope you had a restful holiday. At the dawn of the New Year, we'd like to wish you all a prosperous 2019, with personal and family fulfillment! We look forward to being your companion all year round. 😎👍

While Hollywood may portray hacking as a complicated endeavor which requires sophisticated technical expertise and endless nights spent staring at a computer, the truth is that hackers rely on a variety of methods, some of which are as simple as sending company employees an email pretending to be a reputable source. In fact, taking advantage of security loopholes among your company’s employees is one of the most reliable and fastest ways for malicious parties to access your company’s sensitive data. 

Often times, hackers or other criminals can simply send fake emails – also called “spoofed” emails – purporting to be from a reputable source, which can gain the attention of company employees who then surrender data or even money. Other times, hackers can gain access to your corporate email lists and send out emails to your clients and vendors requesting money. 

Hackers can even pretend to be the CEO and contact employees of your organization with demands such as emergency payments. Read on to learn more about the many different forms of Business Email Compromise, its harmful effects, and how to prevent it from happening within your company.

What is Business Email Compromise?

Business email compromise, refers to a type of cybersecurity infiltration that can occur in a company or business. In a business email compromise, which is also called BEC, malicious parties such as hackers or criminal organizations typically target high-level employees of an organization, such as corporate executives. Hackers may send emails to the executives, in a practice known as phishing. 

Phishing is a fraudulent form of email activity, in which hackers send emails pretending to be reputable companies to obtain information such as passwords, credit card numbers, and even financial payments. In BEC, high-level corporate executives are strategically targeted so that hackers can obtain confidential information and payments from the executives. This can pose significant risks to a company’s operations, both in terms of data loss and financially.

How does a typical email cyberattack work? There are four types of BEC scams which we will discuss in the next section.

Four Types of Email-Based Cyberattacks

There are several types of BEC scams. Hackers can pretend to be an employee in your organization to obtain information from your real employees, or they may be able to access sensitive information, such as a list of email contacts, to request payments from people with whom your company may work. 

Two types of BEC which involve the hackers pretending to be a reputable source are CEO fraud and attorney impersonation. In CEO fraud, the malicious parties pretend to be an executive and contact finance or the human resources department of a company, demanding an emergency payment. Hackers can also pretend to be a lawyer or an employee from a law firm to obtain access to sensitive data – this is known as “attorney impersonation.” 

Other types of BEC scams take advantage of employees’ poor data security practices rather than purporting to be high-profile members of your company. In account compromise, a high-level exec’s email is hacked, and the email address is used by hackers to request payments from clients listed in the executive’s email contacts. Hackers can also steal other types of data, and even steal data from company employees. Data theft can occur in which hackers obtain personally identifiable information (also called PII) from the human resources department, which can be used to plot further cyberattacks.

While these attacks may seem different, the common thread that unites all of them is that they result from poor cybersecurity and safety practices among all levels of employees within an organization. High-level corporate executives are prime targets for hackers because of their stature in the organization and access to confidential data. However, entry-level employees who are poorly trained in email security best practices can also risk clicking on links in emails sent by hackers and unknowingly sending malicious parties your company’s sensitive data, or even their own personal information.

Companies who do not train their employees on cybersecurity best practices, therefore, risk exposing sensitive corporate data, which can not only hurt the business’ bottom line and potentially leak data to competitors, but can cost companies thousands, and even millions, of dollars as they seek to institute damage control. The best way to avoid dealing with the fallout of a BEC, is to be prepared and train employees across your organization – from entry-level employees, to human resources, to high-level executives -- in best practices for maximum email security.

How Can I Prevent Business Email Compromise in My Organization?

The best way to prevent BEC in your company is to utilize state-of-the-art security practices and train employees on email best practices. Make employees aware of the dangers of email phishing and impersonation scams. Remind your employees – whether they are entry-level or at the top of the corporate food chain – that they should never open emails from people that they do not recognize, and should certainly never click on links in emails from unknown senders, due to the fact that such emails can be phishing attempts.

Your information technology staff, can also institute several security practices which make it more difficult for hackers to gain access to your information in general, even in the event of a data breach. Emails should be sent over an encrypted server, so that anyone who can access your internet network cannot read the information being sent over the network. Another important cybersecurity practice, that is now utilized in most secure servers is two-factor authentication, which requires users to input a passcode sent to their email or mobile device to gain access to a website or online service. Two-factor authentication on company email accounts, can make it more difficult for hackers to gain access to company emails. 

Finally, minimize your electronic “paper trail” to make it more difficult for hackers to gain employees’ personal information. Financial information such as W-2 forms and tax forms should also be delivered to your human resources department in person to avoid having sensitive personal information being leaked to hackers. Finally, limit the number of employees who are authorized to disperse company funds, and make sure to set alerts and limit the number of withdrawals from this fund.

Source: Panda Security

Interested in learning more about how to protect your company against email compromise? Panda Security is a Spanish company that specializes in the development of high-tech products to help internet users navigate the web more safely and securely. Head over to WatchGuard’s blog for more information on business email compromise, including a helpful infographic and warning signs to look for in an email to determine whether or not it is compromised. By educating your company’s employees about the dangers of BEC, you can help stop these cyberattacks and improve corporate security.

If you found this article of interest, we'd love to hear what you think!

*by andreascy*

How to Spot a Phishing Email

Posted by Andreas Christodoulou

Description :

Contrary to popular belief, it’s not just Gen X’ers and Millennials who are plugged in to today’s Internet-driven technologies. Baby Boomers – born between the late 1940s and mid-1960s – represent more than a third of all Internet users, according to a Nielsen study. 

And although boomers have become pretty savvy when it comes to their Internet use, they risk falling victim to various identity theft scams. Below are a few fresh and informative tips that, as a savvy boomer, you can follow to keep your yourself and your identity safe. 

Spotting Red Flags 

According to the Bureau of Justice Statistics, more than 16.6 million people in the U.S. found themselves the victim of at least one identity theft incident. Many of these incidents come as the result of phishing, the act of sending fake emails or instant messages aimed at convincing users to submit private information, such as bank account and credit card numbers. With phishing on the rise, it’s more important than ever to protect yourself properly from emerging threats. Here are a few red flags that boomers should look out for as they check their emails: 

The email and its links feature a misleading domain name – Most boomers might not notice a slightly tweaked URL in the sender’s email address or in any of the links within the email. For instance, a phisher may try to make part of their domain name appear as close to the official version as possible (e.g. Microsoft.baddomain.com vs. microsoft.com). Some phishing attempts use a redirecting URL on top of a seemingly legit link as a cover. In most cases, simply hovering over the link can reveal the URL’s true destination. 

The message contains threats to your account status – Many phishing attempts feature urgent messages that not only tell you that your account is in jeopardy, but threaten suspension or deletion unless it’s confirmed or verified with your personal or account information. Another phishing tactic involves a fake email warning of a recent unauthorized access attempt, with a request to validate the account using your personal information. 

Legitimate banks, government agencies and other institutions won’t threaten account closure over ID verification, nor will they require you enter your name, account number, password and Social Security number via email. If an email requests two forms of ID or any other information that could possibly compromise your identity, chances are it’s a phishing attempt. 

The message comes from someone you haven’t done business with before – If you receive an official sounding e-mail about an account, but you’ve never done business with that company, chances are it's a phishing attempt. 

Trust Your Gut 

If something tells you that an e-mail is potentially suspicious, go with your gut feeling. It’s better to be on the safe side than fall victim to identity theft. When in doubt, simply delete the message. 

As On Guard Online’s phishing guide notes, there are several other steps you can take to protect yourself from identity theft. In addition to reviewing credit card statements for unauthorized charges, you can also forward phishing emails to several organizations dedicated fighting phishing. These organizations include the Anti-Phishing Working Group and the Federal Trade Commission.

STAY INFORMED: Hackers Can Wirelessly Read Your Credit Cards Through Clothes And Wallets

Hope you find this post helpful! Till next time my friends. 😉💪

*by andreascy*

Taking The Help Of A Web Based Billing System

Posted by Andreas Christodoulou

Description : 

Imagine all your business processes done as far as your billing and accounting department is concerned; at a fraction of the cost.

If you could outsource your accounting and billing operations to a reliable and reputable firm and enjoy seamless and smooth services then it would be an extremely wise business decision and here is exactly where opting for a web base billing system comes in. Most firms that deal with such web-based billing systems offer plenty of features and benefits.

What Are the Benefits of a Web Based Billing System? 

There is quite a wide range of benefits the business organization can enjoy when it scouts for an online or a web based billing system. Some of them are: 

• Flexibility of the service which can scale up as the customer base grows.

• Immediacy and up-to-date information which means that a customer can get billing information even somewhere in the middle of his billing cycle, if he so chooses.

• Control of the billing process is possible from almost any location. All an individual needs is to have access to a laptop and Internet access.

• Capability of delivering a high degree of data visualization and data customization as well. 

The Features of a Web Based Billing System

One of the easiest things that you can do when you are searching for a reliable and comprehensive billing system for your business organization, is to go through the websites of different firms that deal with this particular product. This will also give you a pretty good idea of the kind of features that they offer and the costs of the same. 

Getting the highest possible value for your money is a good idea indeed when it comes to the choice of an online billing system. Most companies do have flexible packages or editions of such billing systems and depending on the kind of features that you want, you could either opt for a normal or standard version or go in for a full featured, premium version.

Enhanced User Interface

With the help of a web-based billing system, you as a business organization owner can program the system in such a way that the user facing interface allows your customers to login and enjoy granular visibility and details as far as their bills are concerned. Such user interface also means that a customer can also use your web based billing system to make his payments online and in time.

Cross Platform Capabilities

A web-based billing system should also be capable of being accessed and operated and even controlled through different types of platforms such as Windows, Linux and so on. This would mean that you can enjoy all the features of such billing system regardless of the platform that your organization’s computers and network uses.

Security

A web based billing system will be successful only if it promises completely failsafe security. This means that unauthorized personnel and even hackers should not be able to get into your network and access personal information of your customers and, even worse, credit card details that they may use while making the payments.

 DON'T MISS OUT: Top 3 Tech Tools for Managers That Mean Business

Follow us for future updates! 😎

*by andreascy*

The Grinch’s Data Theft Shenanigans of 2012

Posted by Andreas Christodoulou

Description : 

Looking at your children playing around the Christmas tree, your partner standing right beside you and with a glass of wine in your hand; life could not be any more perfect. Suddenly you hear commotion and turned around to see the Grinch has sneaked into your house from the chimney.  

So how are you going to protect your family’s happiness from the scheming, mean Grinch? This Christmas don’t forget to protect your data from the evils of hacking and theft. You never know where Grinch would be waiting in a hide to take you off guard and steal your confidential documents saved in your data.

Source: MobiStealth.com

*by andreascy*

7 Effective Ways To Deter Online Fraud

Posted by Andreas Christodoulou

Description : 

Many businesses are more worried than ever about credit card fraud. The same is true for chargebacks. Both of these issues can result in lost revenue. When it comes to chargebacks, some of the most common causes include credit card expiration, double-charging, bank error or a dispute with a customer. 

If you're concerned that one or both of these issues may negatively impact your business, the good news is there are several preventative steps you can take.

1. Always Verify CVV2 and CVC2 Numbers

According to Visa, this strategy will not only effectively reduce chargebacks by at least 26%, but it can also help minimize pass-through charges. Depending on the specific card, this number should either be 3 or 4 digits long. 

2. Make Use of the AVS Address Verification System

This will ensure that the entered address in an order form matches the address of the credit card’s billing address. This will prevent unauthorized users from making orders since they don’t know the exact billing address of the real cardholder. 

3. Be Cautious About Orders from Developing Countries

A large percentage of online fraud comes from countries like Russia and Indonesia. While an order you receive from one of these countries may be completely legitimate, it's worth your time to verify that's actually the case. 

4. Make All Customers Aware of the Name that Will Appear on Statements

Many businesses encounter problems as a result of a different name showing up on customers' credit card statements. Since this can lead to customers filing chargebacks because they think they've been ripped off, be sure to educate them about what they're going to see on their statement. 

5. Consider Requiring a Signature on Delivery

While it may not be the right fit for every single business, if you're concerned about delivery issues, your best option may be to require customers to sign upon receipt. 

6. Don't Be Afraid to Ask for a Credit Card and ID Copy 

If a transaction comes along and you're on the fence about it, you need to remember that in the long run, it's much better to be safe than sorry. Although you may be worried about inconveniencing a customer, if an order seems off, there's nothing wrong with you asking for the buyer to send you a copy of their credit card and ID via fax. 

7. Display a Warning Message 

Although you don't need to throw up a large banner that makes your entire site look intimidating, you can include a warning message within the payment processing part of your site. By telling visitors that you have measures in place to detect and stop fraud, you can make fraudsters think twice and assure legitimate customers that they'll be safe on your site.

RELATED POST: How to Spot a Phishing Email

If you have any questions or comments you are free to leave them below. Thanks and enjoy your stay!

*by andreascy*

Hackers Can Wirelessly Read Your Credit Cards Through Clothes And Wallets

Posted by Andreas Christodoulou

Description :

Pickpockets no longer need to touch their victims - they can use cheap technology to read credit cards through peoples’ pants. Hacker Kristin Paget proved as much with a demonstration at the Shmoocon hacker conference in Washington last week. 

With a $50 Vivotech RFID (radio frequency identification) credit card reader, she wirelessly read a volunteer’s credit card standing near her on a stage before using a $300 magnetizing tool to put the data onto a blank card, reports Forbes’ Andy Greenberg. 

Paget then used a credit card-swiping iPhone attachment and voila! She stole $15 bucks from her “victim” before paying him back immediately, Greenberg wrote. 

Fears that hackers will steal personal or banking information have also sparked an industry of wallets, passport covers and individual credit card holders made of stainless steel or even aluminum foil to block unwanted radio signals from lifting information. 

While Paget’s demonstration has been possible for years, questions about contactless payments are rising to the surface as RFID-enabled credit cards become ubiquitous (just look for a triangle made of arches to see if your credit card is RFID equipped). 

In Canada, Visa’s payWave and MasterCard’s PayPass make it easy for consumers to tap their RFID-enabled cards on a terminal and pay quickly at thousands of merchants across the country, including Impark and McDonald’s. 

The terminals may not accept transactions of more than $50. 

MasterCard uses encryption technology and Visa embeds chips to prevent theft over the contactless systems, according to their websites. Both say the cards must be waved very near to the machines to work, and Visa adds that “only secure readers at authorized merchants” can process its cards. 

But with the right machine, stealing credit card numbers, expiry dates and transaction codes is as simple as waiting for people to walk by on a crowded street, said project scientist and hacker 3ric (pronounced Eric) Johanson. 

Consumers shouldn’t be too worried - at least not yet, Johanson said. Criminals will choose the easiest method to steal credit card information, which at the moment is hacking insecure websites “from the comfort of their own home,” he said. 

If data was stolen, it would be difficult to use online as most websites require an address for confirmation, he said. Each contactless transaction involves a unique CCV code, but an “ample” number of those can be collected in just a few seconds, he explained. Scams would only be detected if the consumer used their card before the attacker had time to make fraudulent purchases. 

Despite the logistical challenges, it’s just a matter of time before RFID hacks become commonplace, Johanson said. There are additional steps credit card companies can take to protect consumers, such as demanding a pin number, yet that’s unlikely to happen because it would slow down the payment process, he said. 

“My general advice to people is to demand that their credit card companies offer them a non RFID-enabled card,” he added. 

By the end of 2012, all Canadian passports will come equipped with RFID technology, according to Passport Canada. The RFID information will only become accessible if bar code on the second page has already been scanned, meaning the passport needs to be open for people to get data. New American passports already have this technology. 

*by andreascy*