Tag Archives: hackers

Juice Jacking

Posted on by
1
Photo by ThisIsEngineering on Pexels.com

While traveling is not as prevalent as it was before COVID-19, we remain mobile. That means you can still run out of juice while away from the office.

Did you know that using a charging port, borrowing a cable, or relying on someone else’s external battery can put your smartphone, tablet, or laptop at risk?

The problem is malware, in which hackers take advantage of USB connections to hide and deliver secret data payloads that a user might think was only transferring electrical power. This is called “juice jacking.” Its visual counterpart, known as “video jacking,” occurs when a hacker records and mirrors the screen of a device that was plugged in for a charge.  

Protect Yourself from Data Theft

The FBI recommends:

DoDon’t
Use AC power outlets to charge devicesUse USB charging stations in public places
Buy only from trusted suppliersAvoid cheap deals and free giveaways
Bring your own car chargerDon’t borrow car chargers
Bring your own USB cablesDon’t use someone else’s
Bring your own AC or battery backupNo borrowing!
FBI TECH TUESDAY

Best Practices

  • Consider buying a charging-only cable, which prevents data from sending or receiving while charging. 
  • Discard any free USB cables, chargers, adapters, or similar accessories that you received as a promotional item. They are too risky, warns the FBI. Microcontrollers and electronic parts have become so small these days that criminals can hide mini-computers and malware inside a USB cable itself.  
  • As we move into the holiday season, you may be tempted to buy cheap electronic accessories as stocking stuffers or gifts. Please think twice. Consider the source and the manufacturer when making your purchases. Proprietary cables, chargers, adapters, docks, or battery backups often feel like they cost more than they should. (Pssst … Are you listening Apple?) But imagine what you’d spend trying to recover from data theft and fraud if a hacker gained access to your device? It isn’t worth it.

There’s another good reason to buy genuine electronic accessories from the manufacturer. They prolong the life of your device by charging it properly and completely.

As an example, the charging cables for your iPhone and iPad are not identical. The same is true of Samsung devices. I’m not saying that switching out proprietary chargers among your devices won’t work. I am saying that doing so is not optimal. And that’s within the same device manufacturer ….

Before we had to worry about juice jacking, I fell down the path of cheapie chargers. I learned quickly that I was wasting my money. If you don’t believe me, just Google “why cheap charging accessories don’t work,” to see pages of posts and warnings.

Better safe than sorry.

All Rights Reserved 2020 Beverly Michaelis

Using Zoom for Video Conferencing

Posted on by
3

I love Zoom, but like any tech, there are potential vulnerabilities for new users.

Protect your Zoom account and avoid Zoombombing (aka hacking) by following these suggestions:

  • Be wary of links. Login at Zoom directly rather than using the meeting link. Enter the provided meeting ID to join a meeting.
  • Set screen sharing to host only. Doing so prevents your meeting from being hijacked by a hacker.
  • Use the waiting room feature to prescreen and approve attendees.
  • Try Zoom webinars instead (this is the method I use for all my CLEs). Webinar settings offer advanced controls, including several approaches to prescreening attendees.

Read more about these safety tips here.

Are Zoom Conferences Recorded?

Webinars

When I conduct Zoom CLE webinars, I record them. This is a setting I activate as host. It isn’t automatic.

Meetings

Zoom meetings are recorded by default. Zoom help explains this and instructs hosts on how to change settings. This is one area where the USA Today article is misleading. For information on Zoom encryption, see this.

Give Others a Heads Up

No matter what you do, it is common sense to give clients and others a heads up on how your video meeting will be conducted. Advise if you plan to record. Let attendees know if your conference is listen only, whether they can raise their hand, or submit questions.

Documenting Your File

Recordings have their place. For example, preserving the meeting as part of your file. Advanced settings in Zoom allow you to include all participant names, add a time stamp, save chat files, and automatically transcribe audio.

All in all, Zoom is a pretty terrific tool.

All Rights Reserved 2020 Beverly Michaelis

Imposter Fraud

Posted on by
1

Imposter fraud is perhaps the most common type of scam encountered by lawyers. As the FTC warns, it comes in many forms. Scammers pretend to be computer technicians, IRS officials, your banker, a client, or a law firm vendor. They may even pretend to be you!

No matter the method, the goal is always the same: to use social engineering to manipulate you into sending money. Here are nine tips from Webroot on how to avoid falling prey to phishing, vishing, and SMShing scams:

  1. Slow down. Spammers want you to act first and think later. If the message conveys a sense of urgency or uses high-pressure sales tactics be skeptical; never let their urgency influence your careful review.
  2. Research the facts. Be suspicious of any unsolicited messages. If the email looks like it is from a company you use, do your own research. Use a search engine to go to the real company’s site, or a phone directory to find their phone number.
  3. Don’t let a link be in control of where you land. Stay in control by finding the website yourself using a search engine to be sure you land where you intend to land. Hovering over links in email will show the actual URL at the bottom, but a good fake can still steer you wrong.
  4. Email hijacking is rampant. Hackers, spammers, and social engineers taking over control of people’s email accounts (and other communication accounts) has become rampant. Once they control an email account, they prey on the trust of the person’s contacts. Even when the sender appears to be someone you know, if you aren’t expecting an email with a link or attachment check with your friend before opening links or downloading.
  5. Beware of any download. If you don’t know the sender personally AND expect a file from them, downloading anything is a mistake.
  6. Foreign offers are fake. If you receive an email from a foreign lottery or sweepstakes, money from an unknown relative, or requests to transfer funds from a foreign country for a share of the money it is guaranteed to be a scam.
  7. Delete any request for financial information or passwords. If you get asked to reply to a message with personal information, it’s a scam.
  8. Reject requests for help or offers of help. Legitimate companies and organizations do not contact you to provide help. If you did not specifically request assistance from the sender, consider any offer to ’help’ restore credit scores, refinance a home, answer your question, etc., a scam. Similarly, if you receive a request for help from a charity or organization that you do not have a relationship with, delete it. To give, seek out reputable charitable organizations on your own to avoid falling for a scam.
  9. Secure your computing devices. Install anti-virus software, firewalls, email filters and keep these up-to-date. Set your operating system to automatically update, and if your smartphone doesn’t automatically update, manually update it whenever you receive a notice to do so.  Use an anti-phishing tool offered by your web browser or third party to alert you to risks.

All Rights Reserved 2019 Beverly Michaelis

 

 

35,000 Reasons To Avoid Online IOLTA Banking

Posted on by
Reply

For all those who ever wondered:  Why do some banks in Oregon block online access to Lawyer Trust Accounts?

From The Florida Bar News:

It was a typical Monday at the office for Kimberly Graus, until she made a chilling discovery. Someone hacked her computer, gained control of her passwords, and emptied $35,000 out of her trust account.

“It is horrible,” said Graus, a sole practitioner in Bradenton who has been working feverishly since the May 10 heist to mitigate the damage.

“These unauthorized wires were sent from my bank account through my bank’s online system, which has three layers of password logins that must be made before a wire can be sent,” Graus said.

“The bank says my IP address was the source of the wire order, but since I did not do it, it is likely that someone hacked my system and stole my passwords as I logged them in.”

It took Graus 10 days to secure loans to cover the trust account thefts. She also quickly notified her clients, creditors, malpractice insurance carrier, title insurance underwriter, and the Bar about the security breach. Graus also hired computer forensic experts to determine what went wrong.

Yet, she still considers herself somewhat fortunate in that she was hacked in the afternoon instead of that morning, when she had successfully wired out more than $400,000 from her trust account to pay off two mortgages for clients.

Read the full post here.