Not long ago, we received an urgent call from a client whose employee mistakenly downloaded a resume containing a malicious virus. As soon as she clicked on the resume (an innocent looking Word file), it locked up her computer. Word documents (and PDF documents) have the ability to run scripts. The document attached to the employee’s email was a malicious document containing a script which executed another program called a Trojan-Downloader. Once activated, a Trojan Downloader can enable cyber-criminals to spy on you, steal your sensitive data, gain backdoor access to your system, and/or destroy your computer.
Unfortunately, the employee (and consequently, the business), fell victim to a malicious phishing attack. These attacks can cost an organization thousands of dollars in lost productivity, lost data, and data breaches. In fact, earlier this year, a study by Ponemon Institute reported that the average 10,000-employee company spends $3.7 million per year dealing with phishing attacks. The report, which surveyed 377 IT professionals in companies ranging in size from less than 100 to over 75,000 employees, showed that about half of the costs were due to loss of productivity.
In Part I of this three-part series, I talked about preventing lost information, protecting client data and avoiding unnecessary downtime due to malicious Phishing attacks. In Part II (this article), we will discuss the top seven “vehicles” cyber thieves can use to breach your computer and/or your cell phone.
1. Emails with File Attachments and/or Hyperlinks
This is one of the easiest ways for cyber thieves to gain access to your computer. With the holidays right around the corner and online ordering at an all-time high, be extra wary of any emails that contain attachments or hyperlinks. Before you click on that file attachment or hyperlink, take 10 seconds to review it for authenticity. If you do not know the sender, do not click anything!
2. Web Browser Pop-Up Alert Scams
We have recently seen an increase in the number of computer users reporting an issue with pop-up alert windows. The window appears in their web browser and informs them that their computer may have been hijacked, has a "major security issue", or that they downloaded a virus. It usually instructs the client to call a phone number in order to fix the problem (as seen above).
A few users have made the mistake of calling the phone number listed in the pop-up alert and then proceeded to provide them with remote access to their computer. Several minutes into the phone call, they started to get an uneasy feeling. That is when they called us – and we told them to immediately disconnect the computer from the internet. Once we did an audit, we found that their financial information was being copied. Please DO NOT call any phone numbers that pop up on your computer screen.
3. USB Trojans
USB devices run with administrator privileges, regardless of how secure the computer systems are. It only takes one USB device to execute a Trojan Download. Be sure to scan your USB drive for viruses BEFORE you plug them into your computer.
4. Unlocked Computers
Desktop computers and mobile devices should never be left unlocked or unattended in a way that risks access by an unauthorized user. Unattended, logged-in computers create easy opportunities for unauthorized access to information and misuse of accounts, such as sending of bogus email messages appearing to come from the genuine account holder. BE SURE your computer is locked and you are logged out of important/secure accounts.
5. Family & Friends
You may be savvy when it comes to security, but are your friends and family? Computers are often shared between family members and friends. Since it only takes one mistake to compromise your computer, phone or tablet, make a guest account with limited privileges and set passcodes for each user on a device. If you are allowing a friend or family member to use your devices, be sure to set boundaries and educate everyone about the risks of cybercrime.
Do not use the same username/password for all of your logins. Many people use the same password on multiple websites for convenience. This is a huge problem because if one account is compromised, cybercriminals now have the keys to every other account you have made. If necessary, purchase a small paper notebook for recording passwords and usernames and keep it in a secure location. Also, whenever possible, take advantage of dual factor authentication. This means that if you have the option to enter your phone number or create a pin number as another form or authentication when signing in at a new location, do so. DO NOT make it so easy for people to get your information.
The majority of security issues are not software or hardware based – the main problem is usually between the keyboard and the chair (You!). Stay alert, and continue to educate yourself about cybercrime. Pay attention to local news stories regarding scamming or phishing and avoid any abnormal email attachments, websites, or phone numbers. If you are unsure about an attachment or file, need a USB scanned, or protect your computer in any other way, please contact us at Coulson Technologies. Don’t know? Don’t click!
An Ounce of Prevention is Worth a Pound of Cure
We educate our clients about the potential threat of phishing attacks – however, we are human, and sometimes we find ourselves hacked. When that happens, you need urgently to fix the problem. Sometimes the damage is irreversible. However, if your computer and system are properly set up, we can reverse some or all of the damage, such as with the business mentioned at the beginning of this article. Fortunately, this client was running her desktop in a virtual environment allowing us to take full backups of her computer (both data and operating system). She was back up and running in less than an hour, with 100% confidence that there were no files or other malicious programs lingering. If, however, the employee had a standard computer, we would have had to reformat and reinstall all of the applications. This could have taken the rest of the day to fix, costing valuable time she needed to work.
So what are some real-world examples of suspicious looking emails? In Part III of this three-part series, we will show you how to spot suspicious emails.