Return-Path: <1921889-456-1022@be6.maropost.com> Delivered-To: edward@transocean.com Received: from vps.transocean.com by vps.transocean.com (Dovecot) with LMTP id au7IGFzMiVm5RgAAInt2oQ for ; Tue, 08 Aug 2017 07:36:12 -0700 Return-path: <1921889-456-1022@be6.maropost.com> Envelope-to: edward@transocean.com Delivery-date: Tue, 08 Aug 2017 07:36:12 -0700 Received: from mpmta4.knowbe4.com ([168.235.226.74]:29635) by vps.transocean.com with esmtp (Exim 4.89) (envelope-from <1921889-456-1022@be6.maropost.com>) id 1df5bx-0004hG-9b for edward@transocean.com; Tue, 08 Aug 2017 07:36:12 -0700 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=default; d=knowbe4.com; t=1502202956; l=1; h=from:subject:date:to; bh=nR4OLZRZ0GUjrRPiikCTwjFrqv567Fsl8w66LhE1mcQ=; b=LRckKtayIe4b7fX1j6J0TSCNde1+yd5CKWMoNYxhS5aSVB792m+hXzve5MYbYcDSRIKOrA vyS6Z6yfAwv9B0wS/XZtJlysnx0zrUByu/9AvVRs3Ymmvnelu953kBEDanHO6dtCthyjtp rma3k4HSNbdRCwmK6SH+0zLRWQBjE3E= Received: from [<1921889-456-1022@be6.maropost.com>] ([<1921889-456-1022@be6.maropost.com>] helo=) by 771414-mailer6.maropost.com (envelope-from 1921889-456-1022@be6.maropost.com) (Jetsend MTA 0.0.1 with ESMTP; Tue Aug 8 10:14:48 EDT 2017 Date: Tue, 08 Aug 2017 10:14:47 -0400 From: CyberheistNews Reply-To: feedback@knowbe4.com To: edward@transocean.com Message-ID: Subject: How Not to Fall for Phishing as an IT Pro Mime-Version: 1.0 Content-Type: multipart/alternative; boundary="--==_mimepart_5989c757e596a_5c5c6b846642054061b4"; charset=UTF-8 Content-Transfer-Encoding: 7bit List-Unsubscribe: X-CampaignID: 456 X-Campaign-ID: 456 X-ContactID: 1921889 X-AccountID: 1022 X-Binding: 168.235.226.74 X-DkimDomain: knowbe4.com X-DkimSelector: default X-Feedback-ID: 456:Maropost X-Spam-Status: No, score=-0.6 X-Spam-Score: -5 X-Spam-Bar: / X-Ham-Report: Spam detection software, running on the system "vps.transocean.com", has NOT identified this incoming email as spam. The original message has been attached to this so you can view it or label similar future email. If you have any questions, see root\@localhost for details. Content preview: This email was sent to &lt;b&gt;edward@transocean.com&lt;/b&gt; by &lt;b&gt;feedback@knowbe4.com&lt;/b&gt; Manage Subscriptions http://newsletter.knowbe4.com/a/1022/unsubscribe/456/1921889/6f5d510ee5a3cfd5aff672db77e6c6c9111f60b6 33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA Report Spam http://newsletter.knowbe4.com/a/1022/report_spam/456/1921889/6f5d510ee5a3cfd5aff672db77e6c6c9111f60b6 [...] Content analysis details: (-0.6 points, 3.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- 0.0 URIBL_BLOCKED ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [URIs: thehill.com] 0.0 T_SPF_TEMPERROR SPF: test of record failed (temperror) 0.0 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level mail domains are different 0.0 T_KAM_HTML_FONT_INVALID BODY: Test for Invalidly Named or Formatted Colors in HTML -0.5 BAYES_05 BODY: Bayes spam probability is 1 to 5% [score: 0.0460] 0.0 HTML_MESSAGE BODY: HTML included in message -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from author's domain -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines X-Spam-Flag: NO ----==_mimepart_5989c757e596a_5c5c6b846642054061b4 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit This email was sent to &lt;b&gt;edward@transocean.com&lt;/b&gt; by &lt;b&gt;feedback@knowbe4.com&lt;/b&gt; Manage Subscriptions http://newsletter.knowbe4.com/a/1022/unsubscribe/456/1921889/6f5d510ee5a3cfd5aff672db77e6c6c9111f60b6 33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA Report Spam http://newsletter.knowbe4.com/a/1022/report_spam/456/1921889/6f5d510ee5a3cfd5aff672db77e6c6c9111f60b6 ----==_mimepart_5989c757e596a_5c5c6b846642054061b4 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable How Not to Fall for Phishing as an IT Pro
3D""
=
Email not displaying?
View = Knowbe4 Blog
CyberheistNews Vol 7 #31 =C2=A0 | =C2=A0 Au= g 8th., 2017


OK, here is a new spear phishing scheme that attacks your development tea= m. Cyber criminals with IPs resolving to Russia hijacked an extension for= Google Chrome and abused their illegal access to push out spam to unsusp= ecting users.

The security incident happened to Copyfish, a type of Optical Character R= ecognition software which allows users to extract text from images, video= , and/or PDF documents. Only the program=E2=80=99s Chrome extension suffe= red as a result of the attack, the Firefox component was not affected.
Copyfish=E2=80=99s developer, a company known known as a9t9 software, rev= ealed it traced the trouble back to a phishing attack that occurred on 28= July:

=E2=80=9CA team member received an email from Google=E2=80=99 saying that= we need to update our Chrome extension (Copyfish) otherwise it would be = removed from the store. =E2=80=9CClick here to read more details=E2=80=9D= the email said. The click opened the =E2=80=98Google=E2=80=99 password d= ialog, and the unlucky team member entered the password for our developer= account. This looked all legit to the team member, so we did not notice = the phishing attack as such at this point. Phishing for Chrome extensi= ons was simply not on our radar screen." [emphasis added]

The upshot?

Enable 2-factor authentication on all your critical accounts. Oh, and get= some security awareness training for *everyone* in the organization, esp= ecially the people that think they do not need it...

PS: by the way, there is a new spearphishing technique, relying entirely = on social engineering: a targeted mail that contains no links or exploits= , but mentions an interesting report title. Googling the title leads to t= he exploit site. Devious, huh?
The Russian 800-pound gorilla Dridex Banki= ng Trojan gang who are also behind the Cerber ransomware have just upped = their game. Cerber is part of the small set of professional ransomware fa= milies that gets updated at a furious pace in an attempt to gain (crimina= l) market share.

Cerber now comes with new capabilities that allow the Dridex gang to stea= l data from three Bitcoin wallet apps =E2=80=94 the Bitcoin Core wallet, = the Electrum wallet app and the Multibit wallet app.

This new Cerber flavor is also able to steal saved passwords from popular= web browsers, including Internet Explorer, Google Chrome, and Mozilla Fi= refox.

Trend Micro security researchers said that while stolen browser passwords= may help the cyber criminals hijack victims' accounts, the stolen data f= rom Bitcoin wallets is only the first step: "Theft of these files does no= t assure that the stored Bitcoins can be stolen. The thief would still ne= ed to get the password that protects the wallet in question," Trend Micro= researchers said in a blog.

Cerber's criminal coders have been working hard to avoid detection. Last = year, just a day after a Cerber decryption tool was issued out by Check P= oint security experts, they updated Cerber which made the decryptor usele= ss.

Trend Micro also said that just in May this year, Cerber underwent six di= fferent upgrades. "Cerber ransomware has acquired the reputation of being= one of the most rapidly evolving ransomware families to date. This new f= eature shows that attackers are trying out new ways to monetize ransomwar= e."

Some details of Cerber haven=E2=80=99t changed, though. It still arrives = via phishing emails with an attached file.

Solutions and Best Practices

Trend Micro noted: "Cerber=E2=80=99s entry vector onto systems didn=E2=80= =99t change, so known best practices against it would still work. Educati= ng users against opening attachments in emails from external or unverifie= d sources would lower the risks; system administrators should also consid= er email policies that strip out such attachments."

We could not agree more.
This article by Tim Crosby in ReadITQuick = is great ammo if you need more IT security budget.

"In a Harvey Nash/KPMG survey, 4,500 CIOs and technology leaders from aro= und the world indicate that the insider threat is the fastest growing sec= urity risk of all. Employees and contractors, who are often provided with= access to a company=E2=80=99s network infrastructure without proper risk= management training, pose a significant risk to businesses.

While some employees act maliciously against their organization, many cyb= ersecurity breaches are due to negligence or inadvertent error. In fact, = 60% of businesses admit their employees have no knowledge of security ris= ks."

He introduces the concept of "stale employee training" which I like a lot= .

"With a rapidly changing cyber criminal landscape, static assessments, st= ale employee training and protocols will not keep up with the dynamics of= cybersecurity today. Training and system evaluation must be ongoing and = respond to the ever-changing environment." Full article:
https://www.readitquik.com/articles/personal-security/employees-pose-bigg= er-threat-to-cybersecurity-than-hackers/


Today, your employees are frequently expos= ed to sophisticated phishing and ransomware attacks. Old-school security = awareness training doesn=E2=80=99t hack it anymore. More than ever, your = users are the weak link in your network security.

Join us on Wednesday, August 9, 2017, at 2:00 p.m. (EDT) for a 30-= minute live product demonstration of KnowBe4=E2=80=99s Security Awareness= Training and Simulated Phishing Platform to see the latest features and = how easy it is to train and phish your users:
  • NEW, Customized Automated Security= Awareness Program creates a fully mature training program in just a = few minutes!
  • Social Engineering Indicators patent-= pending technology, turns every simulated phishing email into a tool IT c= an use to instantly train employees.
  • Access to the world's largest library= of awareness training content through our innovative Module Store.
  • Send Simulated Phishing tests to your= users during specified business hours with "Reply-to Tracking" that show= s you which users fall for spoofed emails and what they answer to the bad= guys.
  • Reporting to watch your Phish-prone p= ercentage drop, with great ROI.
Find out how 12,000+ organizations have m= obilized their end-users as their last line of defense.

Register Now: https://register.gotowebinar.com/register/55459029498066557= 47

Warm Regards,
Stu Sjouwerman

Quotes of the Week
"Truth, like gold, is to be obtained not= by its growth, but by washing away from it all that is not gold." - Leo Tolstoy - Writer and Philosopher (1828 - 1910)

"Three things cannot be long hidden: the sun, the moon, and the truth.= " - Buddha
=C2=A0

Thanks for reading CyberheistNews
But if you want to unsubscribe, you can do that right here

You can read CyberheistNews online at our Blog
https://blog.knowbe4.com/cyberheistnews-vol-7-31-how-not-to-fall-for-phis= hing-as-an-it-pro
Security News
Interview With Perry Carpenter and the Security Guy at Black Hat<= /span>

It's a 9 minute interview with KnowBe4's Chief Evangelist and Strategy Of= ficer Perry Carpenter who provides a great overview of what security awar= eness training offers, and touches on several key benefits and topics inc= luding compliance, behavioral conditioning, creating a transformative cul= ture and security hygiene.

It's a great wrap up at the end (7:50), when he answers what keeps you up= at night: the final thought is focused on technology vs. human side, and= the need for multiple layers:
https://livestream.com/SecurityGuyTV/blackhatusa2017/videos/160309432
Are Regular= Audits Taking up Too Much of Your Time?

Here is a new way to get audits done in half the time and half the cost!<= br>
Our customers have been telling us about their compliance headaches. Here= are their major challenges, any of this ring true for you?
  • Are you dealing with the problem of ma= naging (multiple) compliance requirements, but careless end-users cause a= ll kinds of problems?

  • Need to satisfy auditors that all cont= rols are in place, but you have a lack of time and management support?

  • Have to produce all the evidence regul= arly, but the duplication of effort and keeping track of everything in a = spreadsheet or word processor is a pain?

  • Are regular audits for PCI, HIPAA, SOX= or any other regulation taking up too much of your time?
Here=E2=80=99s a new way to manage this pr= oblem.

Over the last 4 years, KnowBe4 has developed KCM, a cloud-based service w= hich consolidates your audit management and regulatory compliance tasks i= nto simple automated workflows that prevent overlap and eliminate gaps.
See how you can get audits done in half the time at half the cost: Check = out the new KCM page and request a demo:
https://www.knowbe4.com/products/compliance-manager-software

(Don't like to click on redirected links? Copy & Paste this link in y= our browser)
Senators Advance Bill to Train Small Business Counselors in Cyber= security

The Hill wrote: "A Senate committee with oversight of the Small Business = Administration has advanced legislation that would mandate cybersecurity = training for counselors helping businesses prepare for cyber threats.
=
The Senate Small Business and Entrepreneurship Committee approved the leg= islation following a business meeting on Wednesday, committee leaders sai= d in a statement. The legislation, introduced by Sen. Jim Risch (R-Idaho)= , would require that employees at small-business development centers that= receive grants from the Small Business Administration be trained in how = to defend against cybersecurity threats and attacks.

The bill passed the committee easily in a unanimous vote, along with five= additional pieces of legislation. Full article:
http://thehill.com/policy/cybersecurity/345144-senators-advance-bill-to-t= rain-small-business-counselors-in
Try the Weak Password Test Tool to Win a Nintendo Switch!<= br>
Are your user=E2=80=99s passwords...P@ssw0rd? Verizon's recent Data Breac= h Report showed that 81% of hacking-related breaches used either stolen a= nd/or weak passwords. Employees are the weakest link in your network secu= rity.

KnowBe4's Weak Password Test checks your Active Directory for 10 differen= t types of weak password related threats and reports any fails so that yo= u can take action. Plus, you=E2=80=99ll be entered to win a Nintendo Swit= ch!

Also, EVERYONE in the US/Canada will receive a real Kevin Mitnick collect= ible stainless-steel lock-pick business card!

To enter, just go here and fill out the form, it's quick, easy and often = a shocking discovery:
https://info.knowbe4.com/wpt-sweepstakes-082017
How Modern = Email Phishing Attacks Have Organizations on the Hook

Israeli anti-phishing vendor IronScales came out with an interesting new = report about phishing trends.

They looked at more than 8,500 attacks that bypassed spam filters, from m= ore than a hundred of their customers covering over half a million mailbo= xes, to better understand phishing, attack patterns, and phishing techniq= ues & tools.

Here are some key findings:
  • About 77% of the attacks targeted 10 m= ailboxes or less
  • One third of the attacks targeted just= one mailbox
  • Nearly half of the attacks lasted less= than 24 hours
  • But 35% spanned 12 months or more, in = drip-campaign style
  • Hyper-personalized targeting has prove= n effective at social engineering people susceptible to emails written wi= th a personal touch
Their point is that phishing attacks are g= etting more sophisticated and are micro-targeted so that they easily bypa= ss rule- and signature-based spam filters.

We agree. You can get their full report here:
https://ironscales.com/trendreport2017/
Interesting News Items This Week

Bateleur, the new malware backdoor targeting restaurant chains, from the = makers of Carbanak:
https://www.grahamcluley.com/bateleur-new-malware-backdoor-targeting-rest= aurant-chains-makers-carbanak/

JS_POWMET malware is 100% fileless, from infection to payload:
https://www.scmagazine.com/js_powmet-malware-is-100-fileless-from-infecti= on-to-payload/article/679357/

Persistent Persian Prince learns from takedowns - now avoids sinkholes: https://www.scmagazine.com/persistent-persian-prince-learns-from-takedown= s--now-avoids-sinkholes/article/679615/

Fake Vodafone Bill Spreads Trojan Malware:
http://www.informationsecuritybuzz.com/news/fake-vodafone-bill-spreads-tr= ojan-malware/

Taking down the energy grid is not as easy as it may sound:
http://money.cnn.com/2017/07/28/technology/future/crashoverride-black-hat= -blackouts-energy-grid/
Cyberheist 'Fave' Links=
This Week's= Links We Like, Tips, Hints and Fun Stuff
  • With time to spare in the air, a Boein= g test team got creative, flying a route that outlined a 787-8 in the ski= es over 22 states:
    http://www.boeing.com/features/2017/08/787-outlines-the-sky-08-17.page

  • This is Eagle Prime, America's entrant= into the Giant Robot Duel, in its first-ever live-fire combat trial:
    = https://www.youtube.com/watch?v=3DePINYZK4p5Y&feature=3Dyoutu.be

  • We took a new group picture of the 300= + crew of KnowBe4, almost everyone made it in! Check it out:
    https://www.knowbe4.com/hubfs/300_Woo_Hoo.jpg

  • Life on earth. Amazing pictures and GI= FS of animals, places, people and nature, some of them super funny:
    https://twitter.com/planetepics

  • If you watch the news, you might think= that the world is becoming less safe. You'll be pleasantly surprised whe= n you look at the actual facts:
    http://www.flixxy.com/you-are-being-brainwashed.htm?utm_source=3D4

  • How did he do it? How did it disappear= ? Richard Wiseman reveals his optical illusion magic tricks:
    http://www.flixxy.com/optical-illusion-magic-tricks.htm?utm_source=3D4

  • See this magical tilt-shift, time-laps= e, 4K view of Niagara Falls by Joerg Daiber:
    http://www.flixxy.com/nano-niagara-falls.htm?utm_source=3D4

  • From the archives: F-18 display pilot = Mike Bryan demonstrates the impressive maneuverability of the Boeing 787 = Dreamliner at the Farnborough International Airshow 2012:
    http://www.flixxy.com/what-a-boeing-787-dreamliner-can-do-in-the-hands-o= f-an-f-18-fighter-pilot.htm?utm_source=3D4

  • Amazing truck drivers. Near misses, mi= raculous saves, and sheer skilled driving:
    https://www.youtube.com/watch?v=3D93ijA26mCHI

  • This handheld printer can create label= s and print them on practically anything:
    https://mobile.twitter.com/businessinsider/status/893189731520872448/vid= eo/1
Twitter | LinkedIn | Google | YouTube
Copyright =C2=A9 2014-2017 KnowBe4, Inc. All rights reserved.<= /div>
=C2=A0
=C2=A0
=C2=A0 This email was sent= to edward@transocean.com by feedback@knowbe4.com

33 N Garden Ave, Suite 1200 Clearwater, FL 33755 USA
=C2=A0 		=C2=A0
----==_mimepart_5989c757e596a_5c5c6b846642054061b4--