SECURITY: No technology needed for this hack; just call up and lie

Sunday, August 17, 2025

https://www.wnd.com/2025/08/helpdesk-havoc-why-clorox-is-suing-indian-company/

Why Clorox is suing Indian company for $380 million

  • In Clorox’s telling, the hacker didn’t crack advanced encryption or spear-phish executives. He just called Cognizant on the phone and lied

By Amanda Bartolotta  —  August 7, 2025

*** begin quote ***

In a San Francisco courtroom, the Clorox Company recently dropped a legal bombshell – a $380 million lawsuit against Indian-American information technology company Cognizant, alleging gross negligence in a 2023 cyberattack.

In the complaint dated July 22, 2025, Clorox contends a hacker simply called Cognizant’s helpdesk, lied about being an employee and was handed network credentials – no identity verification, no oversight, just a password transfer. The resulting cyberattack ended up paralyzing Clorox’s operations, costing upwards of $49 million in remediation and much more in lost business.

*** end quote ***

Way back when I ran an information security desk, long before “password managers”, in the “yellow sticky note” era, I was challenged to reduce the number of password resets my group was doing.  Not for security; a cost saving attempt.  (We figured that every call cost the company about 50$ in lost productivity.)  So my team came up with a great solution, when a call came in for a forgotten password, we’d just have the person have his supervisor call in for a reset.  Laugh!  Calls dropped dramatically.  It was trivial to verify the supervisor since we’d just call them back at their number listed in the company phonebook.  (Those still existed.)  Then the supervisor would connect the employee and we’d do the reset.  Call dropped so much we had weekly pool when the next one would come in.  (Dollar a head per week.  Pool grew about 20$ per week.)  Sometimes we went a month without a reset.

Guess outsourcing your help desk was NOT so cost effective?

— 30 — 

Leave a Comment » | SECURITY | Tagged: , , , , | Permalink
Posted by reinkefj

SECURITY: Your own domain can prevent phishing

Saturday, July 12, 2025

An Original Thought

May I suggest that you have your own domain?

The common wisdom, or is that common whizdumb, is to own your own name as a domain name. I own “reinke.cc”. (I like saying “sea sea me at reinke.cc”! me@reinke.cc will actually work!) 

It gives one quite a bit of control. And, it’s very cheap. I know three solutions: wordpressdotcom with gmail, email only with 1and1, and domain+email+webspace also at 1and1. 

My point is not that you should use 1and1. http://www.1and1.com/?k_id=9113251 I could care less which one you use. It’s that getting on to your own domain with email is cheap and easy. 

And, it’s not aol, hotmail, yahoo, or gmail. It IS your own “personal brand”. And, the “bad guys” can’t fool you!

If you have your own domain, you can “bulletproof” your email from phishing and frauds!

Let’s assume that you have “your own domain” named “yourowndomain.com”, and you bank at “your bank” at “yourbank.com”.

You give “yourbank.com” your email address as “yourbankcom@yourowndomain.com”.  (Be prepared for some strange looks when you do this because the folk never heard of such and email address.)

Then you can set up an email filter  — let’s use Gmail as an example  —  that says:

  • Comes from “yourbank.com” and
  • Is addressed to “yourbankcom@yourowndomain.com” and 
  • You specify an label of “yourbank”

So all your email comes into GMAIL and gets assigned a label “INBOX”.

  • Anything that comes in that purports to be from “yourbank” MUST have the GMAIL assigned label of both “INBOX” and “yourbank”.
  • You can also set up an email filter for addressed to “yourbankcom@yourowndomain.com” and NOT addressed from “yourbank.com” and label it “PHISHING ATTACK”.
  • You can also set up an email filter for addressed NOT to “yourbankcom@yourowndomain.com” and addressed from “yourbankcom@yourowndomain.com” and label it “BANK GAVE OUT YOUR EMAIL ADDRESS”.

Pretty tricky and quickly eliminates PHISHING ATTACKS and identifies when the “BANK GAVE OUT YOUR EMAIL ADDRESS”.

Applause please?  

Why the email providers can’t protect you by using the appropriate internet protocols is beyond me!

*** begin quote ***

Email authentication methods and protocols 

  • SPF (Sender Policy Framework)

    A sender policy framework (SPF) is a record published in your DNS that lists all the IP addresses that are allowed to send emails on behalf of your domain. When an incoming email is received, the recipient server will check the SPF record to verify if the sending IP address is authorized to send emails for that particular domain. If it’s not listed in the SPF record, there’s a higher chance that the email will be marked as spam or blocked altogether. While SPFs can help to prevent spam and phishing attempts, they also may reject legitimate emails in situations where the sender’s domain SPF records aren’t properly configured.

  • DKIM (DomainKeys Identified Mail)

    DKIM stands as a pivotal technology in the battle against email spoofing by attaching a digital signature to each outgoing email, linked directly to the sender’s domain name. This signature enables the recipient’s email server to verify whether an email purportedly sent from a specific domain is authorized by that domain’s owner. Given that emails often undergo multiple hops—redistributed by mailing lists or forwarding rules—DKIM ensures that signed messages can be reliably relayed by any server, maintaining their integrity and authenticity throughout their journey.

  • DMARC (Domain-based Message Authentication, Reporting, and Conformance)

    The DMARC protocol was built on top of SPF and DKIM, and relies on senders and receivers sharing information to ensure a smooth validation process. DMARC refers to SPF and DKIM records to validate a sender’s identity, along with testing whether the domain they use is found in the “from” address. If an email does not pass the validation test, DMARC provides rules on how to treat the message based on certain conditions. This protocol can help domain owners block phishing attacks by filtering such messages into spam, or rejecting them altogether.

  • BIMI (Brand Indicators for Message Identification)

    If you’ve ever seen an email from a brand that included their logo right in the sender column, that brand was using BIMI. Improving email security with BIMI involves using an authentication system that enables trusted senders to display an icon of their choice directly in senders’ inboxes. BIMI can boost recipients’ trust in your messages, while heightening visibility of your brand.

  • MTA-STS (Mail Transfer Agent Strict Transport Security)

    MTA-STS is a security standard that enables you to send and receive messages securely over an encrypted SMTP connection. The MTA-STS protocol enhances email security by enabling an SMTP client to confirm the server’s identity during the TLS handshake. It does this by requiring the server to present its certificate fingerprint, which the client then matches with a trust store of certificates from verified servers. This process ensures the client does not connect to fraudulent servers, maintaining secure communication. 

  • TLS reporting

    TLS reporting is a mechanism that enables email senders to report issues with TLS connectivity.

    T is more effective when used alongside MTA-STS. The strict enforcement mode of MTA-STS will prevent email delivery if TLS issues are detected, ensuring a higher level of security and reliability in email communications.

  • ARC (Authenticated Received Chain)

    ARC acts as a “chain of custody” for email messages. It enables every entity involved in processing the message to clearly see which entities have previously interacted with it. At every stage of handling, it provides a detailed authentication assessment. The primary advantage of ARC, now adopted by the majority of mail servers, is its solution to a significant issue: previously, when a DMARC-protected email was forwarded, it would fail DKIM authentication and, consequently, DMARC. ARC preserves all original authentication information, allowing the final recipient’s mail server to verify that the email was DKIM authenticated before being forwarded.

*** end quote ***

— 30 —

Leave a Comment » | SECURITY | Tagged: , , | Permalink
Posted by reinkefj

SECURITY: SMS is not a good 2FA (Second Factor Authentication)

Saturday, May 10, 2025

https://www.makeuseof.com/security-apps-protect-your-data/?utm_medium=newsletter&utm_campaign=MUO-202505090800&utm_source=MUO-NL&user=cmVpbmtlZmpAZ21haWwuY29t&lctg=7e6c3cd411d6a815afa18582d54bd455914c43c5f69df1448b8ec20ee4959f71

Install These 5 Security Apps Now to Protect Your Data
Jowi Morales

<< EDITOR ADDED DATE 2025-05-07>>

*** begin quote ***

Authenticator

Usernames and passwords are no longer as secure as you might think; that’s why you should switch to two-factor authentication (2FA)to help secure your online access. You can easily set this up on most accounts, including your accounts on Google, Meta, and more, ensuring that any potential hacker who has compromised your username and password combination still needs a one-time password to gain access.

However, we don’t recommend using SMS for your 2FA code because of its many disadvantages. For example, if you’ve been specifically targeted by personal identity thieves, they can trick your mobile provider into transferring your number to a SIM card that they have (called SIM swap), meaning they will receive your OTP codes on their device. Furthermore, SMS messages can be intercepted, meaning someone targeting you can easily steal your OTPs even if you did not lose access to your SIM card. And if you lose your phone signal (or your service provider runs into problems), you won’t get your codes and will be unable to access your accounts.

*** end quote ***

Personally, I use Google Authenticator. But I have AUTHY, LASTPASS, and BITWARDEN. Can’t say I prefer one over another, but given how stuff gets “deprecated” (i.e., abandoned), I’m ready to switch.

I have a running debate with my bank about their use of SMS.  So far, I’m losing but I’m still nagging.

Argh!

—30—

Leave a Comment » | SECURITY | Tagged: , , | Permalink
Posted by reinkefj

SECURITY: Don’t just take your power from any source?

Wednesday, April 30, 2025

https://arstechnica.com/security/2025/04/ios-and-android-juice-jacking-defenses-have-been-trivial-to-bypass-for-years/

SON OF JUICE JACKING ARISES

  • iOS and Android juice jacking defenses have been trivial to bypass for years
  • New ChoiceJacking attack allows malicious chargers to steal data from phones.

Dan Goodin – Apr 28, 2025 7:00 AM 

*** begin quote ***

Word that juice-jacking-style attacks are once again possible on some Android devices and out-of-date iPhones is likely to breathe new life into the constant warnings from federal authorities, tech pundits, news outlets, and local and state government agencies that phone users should steer clear of public charging stations.

As I reported in 2023, these warnings are mostly scaremongering, and the advent of ChoiceJacking does little to change that, given that there are no documented cases of such attacks in the wild. That said, people using Android devices that don’t support Google’s new authentication requirement may want to refrain from public charging.

*** end quote ***

This reinforces my personal preference for having an external battery for recharge.  All my cars and my EDC pack have an ANKER power block, my own power plug, and 3 short USB-A cables.  My SOP is to not use “public ports” unless I have no other choice.  Suggest that anyone who values their security should do the same.

—30—

Leave a Comment » | SECURITY | Tagged: , , , | Permalink
Posted by reinkefj

SECURITY: may verify “authentic” accounts

Friday, April 25, 2025

https://bsky.social/about/blog/04-21-2025-verification

A New Form of Verification on Bluesky
April 21, 2025 by The Bluesky Team

*** begin quote ***

In 2023, we launched our first layer of verification: letting individuals and organizations set their domain as their username. Since then, over 270,000 accounts have linked their Bluesky username to their website. Domain handles continue to be an important part of verification on Bluesky. At the same time, we’ve heard from users that a larger visual signal would be useful in knowing which accounts are authentic.

*** and ***

During this initial phase, Bluesky is not accepting direct applications for verification. As this feature stabilizes, we’ll launch a request form for notable and authentic accounts interested in becoming verified or becoming trusted verifiers.

*** end quote ***

Interesting that they MAY verify real people. 

With or without a “subscription”?

Often thought that ISPs if they wanted could tie a User’s identity to the credit card they pay with.  Also, they COULD, but don’t allow such an identity to create sub accounts for children and young adults.  

Wouldn’t this cut down on the number and kind of bots that spam the inet with trash?

Seems so simple to me.

Argh!

—30—

Leave a Comment » | SECURITY | Tagged: , | Permalink
Posted by reinkefj

SECURITY: Time to end credit card number and social security numbers

Tuesday, February 18, 2025

https:///174085/cyber-crime/google-tag-manager-gtm-e-skimmer-software-in-magento.html

https://securityaffairs.com/

Crooks use Google Tag Manager skimmer to steal credit card data from a Magento-based e-stores

Pierluigi Paganini

February 11, 2025 

*** begin quote ***

Crooks use Google Tag Manager skimmer to steal credit card data from a Magento-based e-stores

Threat actors are using Google Tag Manager (GTM) to install credit card skimmer malware on Magento-based e-stores, according to Sucuri researchers. The malware hides in a website’s database and steals credit card information entered during the checkout process, sending it to the attackers’ server. This sophisticated attack demonstrates how criminals are using legitimate platforms like GTM to deploy malicious code that is difficult to detect. 

*** end quote ***

Isn’t it about time to retire the concept and strategy of using numbers for identification?

Social Security Numbers, credit card numbers, account numbers, or any kind of numbers are just not secure enough any more.  I even have my doubts about crypto keys used for “wallets”.

The Gooferment and Visa are the primary actors that we need to lead the change. 

Medicare transitioned from a number to an alphameric string to stop the frauds.  Why can’t social security?  

I’m not sure what should take its place but how about a secure hash of your name?

“John Q Public” could easily become “9YWJSN0BSVR3IKNV11A2HZM 8X70I24JXUA6REACFTXYD7WC436”!

Go ahead hackers guess that!

—30—

Leave a Comment » | SECURITY | Tagged: , , , | Permalink
Posted by reinkefj

SECURITY: Why doesn’t the Gooferment mandate not using SMS for 2FA?

Saturday, January 25, 2025

https://www.makeuseof.com/why-sms-2fa-insecure/?user=cmVpbmtlZmpAZ21haWwuY29t&lctg=7e6c3cd411d6a815afa18582d54bd455914c43c5f69df1448b8ec20ee4959f71

Why I Don’t Use SMS for 2FA (and What I Use Instead)
By John Awa-abuon
Published Dec 14, 2024

  •     SIM Swaps Allow Hackers to Steal Your Phone Number
  •     SMS Messages Can Be Intercepted
  •     SMS Is Tied to Your Phone Number
  •     What I Use Instead: Authenticator Apps

Two-factor authentication (2FA) adds a vital layer of security to your online accounts, but unfortunately, not all methods are created equal. Many people rely on SMS-based 2FA, assuming it’s a safe choice. Unfortunately, SMS is far from foolproof. Here’s why I’ve stopped using SMS for 2FA and what I use instead…

*** begin quote ***

What I Use Instead: Authenticator Apps

Rather than relying on SMS for 2FA, I’ve switched to 2FA authenticator apps. Apps like Google Authenticator, Microsoft Authenticator, and Authy generate time-based one-time passwords (TOTP) directly on your device, offering a much safer and more reliable alternative to SMS.

The first major advantage of authenticator apps is security. Unlike SMS, these apps generate codes locally on your phone, meaning they’re not transmitted over networks that could be intercepted or exploited. They’re also protected by additional layers of security—many apps require a passcode, fingerprint, or face scan to access the codes.

Another reason I prefer authenticator apps is their offline functionality. Since the codes are generated directly on the device, you don’t need a cellular connection to use them. Whether you’re in a remote area with no service or simply indoors with poor reception, you can still access your codes as long as you have your device.

I prefer Authy over other authenticator apps because it offers cloud backups, making it easy to recover my accounts if I lose my phone. At the same time, it secures these backups with encryption, ensuring that only I can access them. Google Authenticator is another popular choice. Both options are free, widely supported, and easy to set up.

Using an authenticator app is straightforward. Once you’ve set it up, usually by scanning a QR code provided by the website during the 2FA setup process, you simply open the app to access a code whenever you log in. The codes refresh every 30 seconds, so even if someone manages to steal one, it becomes useless almost immediately.

Two-factor authentication is essential for keeping your accounts secure, but the method you use matters. While SMS-based 2FA might seem convenient, it’s riddled with vulnerabilities—from SIM swaps to interception methods and even practical issues like poor cellular reception. These risks make SMS an unreliable safeguard for your online security.

*** end quote ***

The Gooferment politicians and bureaucrats have warned that the phone networks have been hacked.

So why not MANDATE better security.   

Seems simple to me?

—30—

Leave a Comment » | SECURITY | Tagged: , | Permalink
Posted by reinkefj

SECURITY: Got a pin for an Affirm account I don’t have?

Thursday, January 9, 2025

You have to be kidding me!  They “are aware of the issue”?  I went into full “identify theft” mode.  

“BATTLE STATIONS.  All hands report.  Stand by to fire at any available target.  Notify CIC of any intruders.  You are authorized to fire at any unidentified objects.  THIS IS NOT A DRILL.”

I was ready to trigger password reset on all financial and email accounts.

Argh!

But they “are aware of the issue”!

*** begin quote ***

Dear Fedinand,

Thank you for contacting Affirm!

I’m Alejandra from the Customer Care team, and I hope you are doing well.

If you don’t have an Affirm account, please ignore the text message that you received. We are aware of this issue and working on a fix. Be sure to not give your pin out to anyone. Do not click on any links sent referring to OTP (one-time passwords) if you did not request it.

*** end quote ***

YMMV

—30—

Leave a Comment » | SECURITY | Tagged: , , | Permalink
Posted by reinkefj

SECURITY: Do NOT use the “Go to Apple ID.” link

Wednesday, November 27, 2024

https://www.tomsguide.com/computing/online-security/new-scam-says-your-apple-id-is-suspended-watch-out-for-this-attack?lrh=20fd2805ce1d1131c95034f150bb97a3971479cbf1c94537a55e6a39cfe362aa

New scam says your Apple ID is suspended — watch out for this attack
News
By Amber Bouman
last updated 16 hours ago

  • Don’t let hackers get their hands on your Apple ID with these tips

*** begin quote ***

Another day, another attempt to steal your log in credentials – this time courtesy of a phishing email that claims to be from Apple Support. Don’t be fooled however, this isn’t from Cupertino. It’s actually an attempt to get you to click on a link so hackers can steal your login credentials and other sensitive information.

This email, like many other phishing attempts, uses look-a-like formatting and other details to make you think it’s coming from a legitimate source. This latest threat says that your Apple ID has been suspended due to unusual activity or missing or invalid information. The email looks remarkably similar to actual emails from Apple Support and contains a blue button that says “Go to Apple ID.”

*** end quote ***

It is really amazing that this <synonym for excrement> still works.

Browsers should not automatically make emails clickable.

Argh!

—30—

Leave a Comment » | SECURITY | Tagged: , , , | Permalink
Posted by reinkefj

SECURITY: Once again, a warning to “firewall” and “air gap” personal technology from your employer

Thursday, October 17, 2024

https://www.macrumors.com/2024/10/09/do-not-use-iphone-mirroring-corporate-mac/

Here’s Why You Shouldn’t Use iPhone Mirroring on a Corporate Mac

Wednesday October 9, 2024 4:31 am PDT by Tim Hardwick

*** begin quote ***

Apple’s new iPhone Mirroring feature in macOS Sequoia might seem like a convenient way to access your phone from your work computer, but security firm Sevco has uncovered a significant privacy risk that should make employees think twice before enabling this feature on company-owned Macs, at least for now.

*** and ***

When executed in a Terminal window that has been granted full disk access without setting up iPhone Mirroring, the command returns a normal list of macOS applications. But when executed in that same Terminal window after setting up iPhone Mirroring, it also returns personal iOS applications and metadata.

For employees, this means that apps they use privately could become visible to their employer’s IT department without their knowledge or consent. This could potentially reveal sensitive personal information, such as dating apps, health-related apps, or VPNs used in countries with restricted internet access.

*** end quote ***

Your employer, their network, and their tools should NEVER be used for your private purposes.  

The easiest way to ensure that separation is to maintain a strict “air gap” (i.e., strictly never connecting anything by wire, bluetooth, or network wifi to something “corporate”).  

If for no other reason than when your employer gets hit with a virus, ransomware, or some corporate security “tool”, then it would get your hardware in its grasp.

Argh!

Don’t forget that the employer can claim your hardware is suspect of having their data on it!

—30—

Leave a Comment » | SECURITY | Tagged: , , , , | Permalink
Posted by reinkefj

« Previous Entries
Next Entries »