Limbtec Limited > Blog > Security

This is the category that you will find blog posts that include or are about cyber security, all platforms and all manufacturers.

Phishing Emails are getting better thanks to AI

20th February 2023
AI is making phishing scams more dangerous

AI chatbots have taken the world by storm in recent months. We’ve been having fun asking ChatGPT questions, trying to find out how much of our jobs it can do, and even getting it to tell us jokes.

But while lots of people have been having fun, cyber criminals have been powering ahead and finding ways to use AI for more sinister purposes.

They’ve worked out that AI can make their phishing scams harder to detect – and that makes them more successful.

Our advice has always been to be cautious with emails. Read them carefully. Look out for spelling mistakes and grammatical errors. Make sure it’s the real deal before clicking any links.

And that’s still excellent advice.

But ironically, the phishing emails generated by a chatbot feel more human than ever before – which puts you and your people at greater risk of falling for a scam. So we all need to be even more careful.

Crooks are using AI to generate unique variations of the same phishing lure. They’re using it to eradicate spelling and grammar mistakes, and even to create entire email threads to make the scam more plausible.

Security tools to detect messages written by AI are in development, but they’re still a way off.

That means you need to be extra cautious when opening emails – especially ones you’re not expecting. Always check the address the message is sent from, and double-check with the sender (not by replying to the email!) if you have even the smallest doubt.

If you need further advice or team training about phishing scams, just get in touch.

Read more

Is you Cyber Security looking at the right things?

15th February 2023
Is your security focusing on the right things

When we look to protect our homes, we start with shutting and locking the doors and windows. Then we will add extra measures like alarms, security lights, fences etc.

But there’s no point going to all that effort if someone’s already broken in and set up camp in the basement.

Yet, by deploying the latest must have cyber security product to protect your business and it’s data that is exactly what you may be doing.

What businesses currently do.

Businesses generally do many of the right things. They invest in security software. They take a strong, multi-layered approach to security – including all the things we recommend, like multi-factor authentication, encryption, reliable backup systems and staff training.

But they don’t pay enough attention to detection and response. That involves constantly scanning systems for any sign that a crook may have gained entry somewhere, and having a process to stop an attack in its tracks.

A new study shows that only a third of businesses place detection as their main priority, while two thirds say prevention is their primary focus.

That means, they could be building 10-foot walls around their systems with intruders already inside.

In-house security teams might be super-confident in the security measures they’ve put in place. But the data suggests that they’re being too complacent. The study reveals that more than eight in ten businesses experienced more than one data breach last year – even with good security in place.

Criminals are constantly finding ways to evade security. That tells us that we need to take a rounded approach, with strong prevention AND detection policies providing the best protection against today’s determined criminals.

If you need world-class security, get in touch today.

Read more

Young Employees, what is their attitude to cyber crime.

7th February 2023
Young Employees, have different attitudes to cyber crime

Do you employee staff aged 16 to 19? then read on and take notes!

If the above statement applies to you then you need to pay special attention to the cyber security training you are providing them.

A new study has revealed that a host of worrying online behaviour has become almost normalised among many young people. And much of this activity is illegal.

This isn’t the serious cyber crime such as ransomware attacks or stealing data.

But one in three 16 to 19-year-olds have admitted to digital piracy; and a quarter have tracked or trolled someone online.

Most of these behaviours may not directly affect your business. But some are so commonplace that too many young people view them as a part of everyday life.

That’s not something you want them bringing to work.

Casual software piracy or illegal downloads on devices used for work could open the door to a massive security breach.

What is the answer

The answer is simple: Hold cyber security training for all your employees on a regular basis.

This training should:

  • Highlight the impact of bad online behaviour and potential for security breaches
  • Help everyone understand how this kind of activity can harm people – and your business
  • Make everyone aware of the scams and attacks that your business is vulnerable to, as well as the part they play in keeping everyone protected
  • Make the consequences clear for anyone found to be engaging in this behaviour

If this is something you need some expert help with, it’s what we do. Get in touch.

Read more

Devious new Phishing Scam – Take action to avoid

30th January 2023
Devious new phishing scam - take action to avoid.

New day, new scam, and this one is very sneaky.

Cyber criminals are getting smarter. And this recent malware threat is very smart. It impersonates a highly trusted brand name to get a foot in the door.

What happens

Targets receive a convincing looking email that appears to come from a widely used e-signature platform.

This email has a blank image attached. The image is loaded with empty svg files, which are carefully encoded inside an HTML file attachment. (Sorry for getting slightly technical, hang on we are getting there).

In short, it’s very clever and it’s tricking its way past a lot of security software.

And because it is getting past a lot of security software, it is putting businesses like yours at risk. Because code within the image sends people to a malicious URL.

Open the attachment and you could unwittingly install malware onto your device – or even your network – which risks exposing your data and leaving you open to a ransomware attack.

Recently, there’s been a wave of HTML attachment attacks on small and medium sized businesses, so it’s clear that companies need to take action to stay ahead of the criminals.

What you can do

If you use software to sign documents electronically, double-check that emails are genuine before opening any attachments.

There’s a reason why the criminals have chosen to impersonate a trusted name.

Taking things a step further, you could block all emails with this type of attachment, to prevent employees from being exposed to scam emails in the first place.

If you’d like any further advice, or help implementing extra security measures, get in touch.

Read more

When did you last have a health check?

23rd January 2023
When did you last have a health check?

Did you start a January Health kick? How is it going?

January is that time of year when a lot of us take our health seriously, well for a month or so! It is a good thing to look after yourself, and do something about it.

Your doctor would probably like to see you once a year for a health check, just to find any small problems and stop them from progressing.

It is the same principle with your technology.

So why not book in for an IT check-up, to make sure everything is in great shape for the coming months.

After all we do this for Ourselves, or our car, and it’s a good plan to do the same with your workplace tech. After all it might be working really hard in the year ahead.

What would we do

We will help pick up any minor-but-urgent fixes, that could help prevent a disastrous breakdown in a few months time. (we have just seen this where we identified an issue with a server, which went on the break, and was unable to be repaired just 4 months later)

If there are bigger, but no-urgent jobs that you can safely leave for another day, we will tell you that too.

And if you get a clean bill of health, you can carry on with confidence for the coming months.

It may also be a great time to think about new technology and prioritise your IT projects. We can look at what you need to do with your systems as your business grows.

Our experts carry out top to toe IT health checks for all kinds of businesses, and we will give you honest jargon-free advice on the best solutions for a trouble-free tech set up.

To book your check-up, get in touch

Read more

Holiday Cyber Attacks

15th November 2022
Holiday Cyber Attacks.

Holiday time is coming and so are the Holiday cyber-attacks!

Before working in IT, and Cyber Security, I was in the Military, and whenever we were operating during holiday periods, we knew in the back of our minds that if something was going to happen it would happen during holiday time.

The same is true of cyber-attacks and cybercrime. This year we might see more than previous years, already in early October there was an attack on some of America’s largest airports websites.

It isn’t just the Christmas holiday period that we see the increase

  • Colonial Pipeline (Mother’s Day Weekend (US))
  • Kaseya 4th of July
  • Sony and Microsoft Christmas Eve)

Holiday Cyber Attacks, why and what you can do.

The bad guys are aware that during holiday periods there are fewer employees around to look after the infrastructure. Also we are all preoccupied with thoughts of the festive season. So may click on items that we might not normally do.

Security tips:

  • Train empolyees in cybersecurity and phisihing awareness.
    User error is still the number one cause of malware attacks, make sure all employees undergo an annual social engineering training.
  • What are the internal threats, including scanning and patching software?
    If you are able to make sure these are taken care of this will help in securing your organisation from exploits whilst there is limited supervision during this period.
  • Who has access to your Systems.
    Have you implemented a strategy to restrict who has access to data stores, and applications. Only allowing team members access to what they need and having the right levels of privileged access will help.
  • Protect the Network
    Although perimeter firewalls will assist in a strong defence, you should also deploy firewalls at the endpoint, and this should block applications and traffic, unless it is required.

Don’t get caught out this year! If you need any help on this please call 01752 546967 and we will be happy to help.

Read more

Are you sure you are downloading Zoom?

10th October 2022
Is that Zoom....Or is it malware.

Are you downloading Zoom or Malware. When you think about tools for remote working and chatting online, one of the first names in your mind is Zoom.

But its popularity has opened the door for cyber criminals. They’re using its name to steal sensitive data.

Researchers have discovered at least six convincing-looking download sites. They’re not the real thing. They’re designed to tempt you into downloading FAKE Zoom software, containing ‘info stealers’ and other forms of malware (malicious software).

Outcomes!

Accidentally use one of these sites thinking that you’re downloading a Zoom update… and you risk having sensitive data stolen. Possibly your banking info, passwords or browser history.

Some can even steal your multi-factor authentication details. That could give cyber criminals access to your most sensitive data.

The research also found these ‘stealer logs’ for sale on the dark web, where criminals can buy this information and use it to gain access to business networks.

Once a cyber criminal has access to your network, every piece of data you have stored becomes a target. In extreme cases, this can leave you vulnerable to ransomware attacks, or data theft.

While these fake sites can be incredibly convincing, take these simple steps to avoid being fooled.

  • Before you download the Zoom application (or any application), double check the address of the website you’re on. Is it what you’re expecting? If you clicked an email to get to that site, are you 100% sure it’s from the real company?
  • Study the rest of the web page too, looking for anything that doesn’t ring true, such as spelling mistakes or a clunky layout.
  • Make sure your security software is up to date and is actively scanning for malware and suspicious downloads.
  • Have a plan to roll out this advice across your business.

If you need any help or advice to keep your business protected from malware and other security threats, get in touch.

Published with permission from Your Tech Updates.

Read more

Malicious browser extension are you using them?

30th August 2022
Malicious Browser Extensions

There are hundreds of thousands of browser extensions designed to help us to save time, be more productive, and personalise our online experience.

And while the majority of them do what they’re supposed to, some are not designed to help you at all…

If you’re unfortunate enough to download a malicious browser extension without realising, it could harm your productivity and even flood your work with unwanted advertising.

This is known as adware. It’s a form of malware (malicious software) that’s designed to bombard you with unwanted adverts.

It can also change your search engine and send you to affiliate pages when you’re making purchases. These activities generate revenue for the extension’s creators.

In a recent report from a cyber security company, it revealed more than 4 million of its customers have been attacked by adware hiding in browser extensions over the last couple of years.

And often people didn’t realise they were under attack.

There’s a darker scenario where these malicious extensions are hiding actual malware which can infect your computer.

This can lead to sensitive data such as your logins or even payment details being stolen. And of course malware can spread across an entire network.

To keep your business and its data safe from the risk of malicious browser extensions, it’s important you only ever download them from reliable and trusted sources.

What to do

Read reviews and look at ratings. If a browser seems too good to be true it probably is.

As the business owner, you might also look into controlling which extensions can be installed by your team.

We can help with this, as well as looking at up-to-date software protection and (fun) security training for your team.

Published with permission from Your Tech Updates.

Read more

Passkeys could improve the way you work.

22nd August 2022
Passkeys could improve the way you work, forever

Passkeys could improve the way you work, a few months back we looked at passkeys as the successor to the password.

Now, we’re hearing that Apple will start rolling out Passkeys in the next few months in iOS 16. And we’re excited.

Though it’s caused a bit of confusion. Apple is going to great lengths to market the Passkey, and understandably, people have assumed that it’s a feature exclusive to Apple.

That’s not the case.

In fact, Passkeys will be used in a joint effort to boost online security by Apple, Microsoft and Google. The reason Apple is promoting this new feature so hard is to get the message out there.

Microsoft and Google are also keen to spread the word so that people understand how Passkeys work.

The more people take advantage of Passkeys, the safer our businesses are online.

Passkeys could improve the way you work

Passkeys – otherwise known as FIDO authentication – work by letting you log into an app or website with just your username and your pre-authenticated device, most probably your phone.

Your device generates a cryptographic token, which makes the second part of a cryptographic key pair. When the pair matches, you’re allowed access to the app or website.

What that means in practice is when you’re logging in, you just use your phone to prove its really you. You’ll just unlock it using your face, fingerprint or PIN.

So long as your phone is within Bluetooth range of your computer it will work.

And without needing a password… bliss…

It’s a far more secure way to access apps and keep your accounts safe from cyber criminals. You never see your cryptographic token, so it takes away a lot of the danger of having your login credentials stolen.

Cyber criminals will be unable to use their normal tactics – such phishing emails, brute force attacks, or key loggers – to steal your credentials.

They’ll need your physical device, making remote hacking much less likely.

If you use Windows Hello, you’ll see that Passkeys are already supported. And it won’t be long until all three tech giants roll out support across their entire product range.

Before then, if you’d like any help or advice on keeping your apps and accounts safer, just give us a call.

Published with permission from Your Tech Updates.

Read more

Are you under pressure to take action.

8th August 2022
Pressure to take urgent action

Phishing scams are one of the biggest security threats to your business right now. As we all get used to these emails the scammers are upping the pressure to take urgent action.

A massive 83% of organisations said they suffered successful attacks last year. And with just under a third of phishing emails being opened, the chances that someone in your business will be fooled are high.

But to make matters more difficult, cyber criminals have borrowed a technique from ransomware groups that is designed to panic people into taking action and giving away their login details.

This phishing attack begins like most others, then the pressure to take urgent action.

You get an email alerting you to potentially suspicious activity on your account. It might say someone is trying to login from a different location or device and the attempt has been blocked.

You’re then asked to click a link to verify your email address and password.

That’s worrying enough, right?

But what makes this phishing attack even more dangerous, is the countdown timer that appears on screen.

Typically, it’s set at one hour, and you’re asked to confirm your details before the countdown ends, otherwise your account will be deleted.

Yes, deleted! That catches a lot of people’s attention.

This is a powerful manipulation tactic designed to scare people into taking immediate action – and think later.

In reality, if that countdown hits zero nothing will happen. But watching the seconds count down can give you a sense of urgency that makes you forget to check whether an email is the real deal or not.

The page you’re entering your details on is fake. Criminals will steal your details and login to your real account. That’s a major problem you don’t ever want your business to face.

You’ll be at risk of data theft, financial loss, or malware, as well as potentially putting other accounts at risk (if you’ve reused your password).

Your login details may even be sold on the dark web, giving other cyber criminals the opportunity to break into your account.

Here are some basic phishing protections for you and your team.

Look at the email address the email was sent from. Make sure the spelling and grammar are both correct, and hover over links to see what website address they are trying to send you to.

If you think you’ve fallen for this kind of scam, it’s important you change your login details immediately. Don’t click a link in an email – type in the website address in your browser.

We’d also recommend using a password manager. This is software that creates long and strong random passwords that are impossible to guess for every account you have.

It will store these passwords for you. And autofill login boxes to save you time (yes, password managers detect when they’re being asked to fill in details on a different page, such as a fake phishing page).

Share this article with your whole team right now. And if anyone ever clicks a link they’re not sure about, ask us how to keep your business safe.

Published with permission from Your Tech Updates.

Read more
Recent Comments