A response to a phishing email has resulted in the PHI of 2,789 Kaleida Health patients being made accessible Attack.Databreach to cybercriminals . Kaleida Health discovered the attack on May 24 , 2017 , prompting a full investigation which involved hiring a third-party computer forensic firm . An analysis of its systems showed that by responding to the phishing email , the employee had provided access Attack.Databreach to his/her email account . While access Attack.Databreach to Kaleida Health ’ s EHR was not gained Attack.Databreach , the email account contained a range of protected health information of a small subset of its patients . The types of data in the account varied for each patient , but may have included names , dates of birth , medical record numbers , diagnoses , treatment and other clinical data . However , no financial information or Social Security numbers were exposed Attack.Databreach at any time . While access Attack.Databreach to the email account was possible , no evidence was uncovered to suggest that the emails were accessed Attack.Databreach or any protected health information was viewed or copied Attack.Databreach . However , since the possibility of data access could not be ruled out with a high degree of certainty , all affected patients have been notified of the incident by mail . Phishing Attack.Phishing has grown to be one of the most serious threats to healthcare organizations . As we have already seen this year , record numbers of successful W-2 phishing attacks Attack.Phishing have been reported and many healthcare employees have fallen for these phishing scams Attack.Phishing . Providing security awareness training to employees can help to reduce risk , although a single training session every year is no longer sufficient . Training must be an ongoing process .

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

A series of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . A wave string of phishing campaigns Attack.Phishing is targeting airline consumers with messages crafted Attack.Phishing to trick Attack.Phishing victims into handing over personal or business credentials . The phishing messages pretend to be sent from Attack.Phishing a travel agency or a someone inside the target firm , they include a weaponized document or embed a malicious link . “ Over the past several weeks , we have seen a combination of attack techniques . One , where an attacker impersonates a travel agency or someone inside a company . Recipients are told an email contains an airline ticket or e-ticket , ” explained Asaf Cidon , vice president , content security services at Barracuda Networks . According to Barracuda Networks , aviation-themed phishing attacks Attack.Phishing contain links to spoofed Attack.Phishing airline sites , threat actors personalize Attack.Phishing the phishing page in a way to trick Attack.Phishing victims into providing business information . The attackers show a deep knowledge of the targets , hackers are targeting logistic , manufacturing and shipping industries . “ It ’ s clear there is some degree of advanced reconnaissance that takes place before targeting individuals within these companies , ” Cidon added . Recently the U.S. Computer Emergency Readiness Team issued an alert of phishing campaigns Attack.Phishing targeting airline consumers . “ US-CERT has received reports of email-based phishing campaigns Attack.Phishing targeting airline consumers . Systems infected through phishing campaigns Attack.Phishing act as an entry point for attackers to gain access Attack.Databreach to sensitive business or personal information. ” reads the US-CERT warning . “ US-CERT encourages users and administrators to review an airline Security Advisory ( link is external ) and US-CERT ’ s Security Tip ST04-014 for more information on phishing attacks Attack.Phishing . ” The US-CERT specifically references the security advisory published by Delta Air Lines that warned its consumers of fraudulent activities . “ Delta has received reports of attempts by parties not affiliated with us to fraudulently gather customer information in a number of ways including : fraudulent emails , social media sites , postcards , Gift Card promotional websites claiming to be Attack.Phishing from Delta Air Lines and letters or prize notifications promising free travel , ” states the Delta Air Lines warning . Barracuda confirmed that these campaigns have a high success rate : “ Our analysis shows that for the airline phishing attack Attack.Phishing , attackers are successful over 90 percent of the time in getting employees to open airline impersonation emails , ” concluded Cidon . “ This is one of the highest success rates for phishing attacks Attack.Phishing . ”

'Cloud Hopper ' campaign by sophisticated APT10 hacking group uses advanced phishing Attack.Phishing and customised malware to conduct espionage . A Chinese hacking group with advanced cyber-espionage capabilities has been targeting managed IT services providers across the globe in a campaign to steal Attack.Databreach sensitive data . The cybercriminal gang is using sophisticated phishing attacks Attack.Phishing and customised malware in order to infect victims ' machines and then gain access to IT providers and their customer networks . Dubbed Operation Cloud Hopper , the cyber-espionage campaign has been uncovered by security researchers at PwC , BAE Systems , and the UK 's National Cyber Security Centre . The researchers say the campaign is `` highly likely '' to be the work of the China-based APT10 hacking group . The group has been focusing on espionage since 2009 and has evolved from targeting US defence firms as well as the technology and telecommunications sectors to targeting organisations in multiple industries across the globe . The group was behind the Poison Ivy malware family and has evolved its operations to include using custom tools capable of compromising Attack.Databreach high volumes of data from organisations and their customers , and stealthily moving it around the world . It 's because of the sophisticated nature of the campaign that PwC 's Operation Cloud Hopper report describes how APT10 `` almost certainly benefits from significant staffing and logistical resources , which have increased over the last three years '' . The group 's work shifted significantly during 2016 , as it started to focus on managed service providers , following the significant enhancements to its operations . The move enabled APT10 to exfiltrate Attack.Databreach data from multiple victims around the world as part of a large scale campaign . Managed service providers ( MSPs ) represent a particularly lucrative target for attackers , because as well as having access Attack.Databreach to their clients ' networks , they also store significant quantities of customer data , which can provide useful information or be sold for profit . Researchers note that the spear phishing campaign Attack.Phishing undertaken by APT10 indicates that the group conducts significant research on targets , in order to have the best chance of tricking Attack.Phishing them into opening malicious documents attached to specially crafted emails . Once the hacking group has infiltrated a network , it conducts reconnaissance to ensure legitimate credentials have been gained Attack.Databreach , before deploying tools such as mimikatz or PwDump to steal Attack.Databreach additional credentials , administration credentials , and data from infected MSPs . The shared nature of MSP infrastructure enables APT10 's success , allowing the hackers to stealthily move between the networks of MSPs and clients -- hence the name Cloud Hopper . Using this approach , the group has been able to target organisations in the US , Canada , the UK , France , Switzerland , Scandinavia , South Africa , India , and Australia . `` The indirect approach of this attack highlights the need for organisations to have a comprehensive view of the threats they 're exposed to -- including those of their supply chain , '' Kris McConkey , partner , cyber threat detection and response at PwC , said . `` This is a global campaign with the potential to affect a wide range of countries , so organisations around the world should work with their security teams and providers to check networks for the key warning signs of compromise and ensure they respond and protect themselves accordingly . '' The National Cyber Security Centre has issued guidelines following the global targeting of enterprises via managed service providers , and notes how the activity detected `` likely represents only a small proportion of the total malicious activity '' .

Google has come up Vulnerability-related.PatchVulnerability with a fix for the phishing scam Attack.Phishing that affected users . A Chrome browser update , which has been rolling out Vulnerability-related.PatchVulnerability since February , now issues a warning when you 've landed on an page with the scam . In your browser address bar , look out for `` not secure '' to the left of the address . Fortune reports that in the future , Google will present this warning and indicate unprotected sites more aggressively with a red triangle . According to Satnam Narang , Senior Security Response Manager at Norton by Symantec , here 's how the Gmail phishing scam Attack.Phishing works : You 'll see an email in your inbox from one of your contacts who has already been hacked . The email looks like it contains an attachment . But if you look closely , as this Twitter user did , you 'll notice that the image preview for the attachment looks slightly fuzzy . This is because there is n't actually an attachment , just an image designed to look like Attack.Phishing one . If you click on the image you 'll be directed to a page that looks like the standard Google sign-in page . If you log-in there , the damage is done : The hacker can read and download Attack.Databreach all of your emails and could also access Attack.Databreach accounts elsewhere . In the past , you might have recognized a scam by the language in the email . But Narang says that there are reports that these hackers are sending Attack.Phishing emails that look realistic . In one school district , for example , team members received what looked like Attack.Phishing a copy of a practice schedule . Still , there are things you can look out for to spot a fake . `` The best way to identify this attack is to look at the address bar . In this case , look for the words 'data : /text/html ' at the beginning of the URL , '' Narang says . `` If you see this , close the browser tab and alert your friend that their account has been compromised Attack.Databreach . '' Narang also recommends setting up two-step verification for your Gmail account ( find out how to do so here ) . And follow these rules for boosting your password strength . In a statement about the attack , a Google spokesperson said , `` “ We 're aware of this issue and continue to strengthen our defenses against it . We help protect users from phishing attacks Attack.Phishing in a variety of ways , including : machine learning based detection of phishing messages , Safe Browsing warnings that notify users of dangerous links in emails and browsers , preventing suspicious account sign-ins , and more . Users can also activate two-step verification for additional account protection. ” Above all , think twice before clicking on something . We 're starting to see more sophisticated scams , so being vigilant will only help you in the long-run .

US prosecutors have charged a Lithuanian man with engaging in an email fraud scheme in which he bilked Attack.Phishing two US-based companies out of more than US $ 100 million by posing as Attack.Phishing an Asian hardware vendor . Evaldas Rimasauskas , 48 , was arrested late last week by Lithuanian authorities , Manhattan federal prosecutors said on Tuesday . Rimasauskas does not yet have legal counsel , a spokesman for the prosecutors said . The alleged scheme is an example of a growing type of fraud called “ business email compromise Attack.Phishing ” , in which fraudsters ask for money using emails targeted at companies that work with foreign suppliers or regularly make wire transfers . It is a variation on the common “phishing” scam Attack.Phishing , but on a massive scale . The FBI said last June that since October 2013 , US and foreign victims have made 22,143 complaints about business email compromise scams Attack.Phishing involving requests for almost US $ 3.1 billion in transfers . In an indictment unsealed on Tuesday , prosecutors said that to carry out his scheme , which they said began around 2013 or earlier , Rimasauskas registered a company in Latvia with the same name as an Asian computer hardware manufacturer . He then sent Attack.Phishing emails to employees of the two unnamed victim companies , described as Attack.Phishing multinational internet firms , asking them to wire money that they actually owed to the Asian company to the sham Latvian company ’ s accounts , prosecutors said . The victim companies are described as Attack.Phishing a multinational technology company and a multinational social media company . After they wired money to Rimasauskas ’ s Latvian company , Rimasauskas quickly transferred the funds to different accounts around the world , including in Latvia , Cyprus , Slovakia , Lithuania , Hungary and Hong Kong , prosecutors said . In order to conceal his fraud from banks that handled the transfers , Rimasauskas forged Attack.Phishing invoices , contracts and letters purportedly signed by executives at the two victim companies , according to prosecutors . Rimasauskas is charged with wire fraud and money laundering , which each carry a maximum prison sentence of 20 years , and identify theft , which carries a mandatory minimum sentence of two years . Acting US Attorney Joon H. Kim said : “ From half a world away , Evaldas Rimasauskas allegedly targeted multinational internet companies and tricked Attack.Phishing their agents and employees into wiring over US $ 100 million to overseas bank accounts under his control . “ This case should serve as a wake-up call to all companies – even the most sophisticated – that they too can be victims of phishing attacks Attack.Phishing by cyber criminals . ”

Hacking has long been thought of as a sort of black magic whose incantations are made using keyboards . That is , until 2016 , when the John Podesta email hack made big enough news that hackers ’ dirty secret got out : many breaches have less to do with coding skills and much more to do with classic trickery , albeit in digital form . Web users simply get duped Attack.Phishing into entering their username and passwords onto fake websites . With that information , it doesn ’ t take any special cleverness to hack a system . The attacker has the keys . The chief tool hackers use to lure Attack.Phishing unsuspecting people to these phony websites is email . When the victim works at a company of some kind , those credentials might provide cyber-criminals with access to more than just email . The same credentials might also provide access to intranets , servers and sensitive data . Executives are looking hard for ways to protect their operations today without cramping employee productivity . One method many might be looking at is virtual machines , workspaces that run software on the cloud but looks to the user just like a normal desktop . As counter-measures go , muckraking news outlet The Intercept has sung its praises . As it happens , Amazon Web Services announced a new offer on its blog Thursday—40 hours of virtual machinery free to users and companies that might want to try it out . Windows 7 and Windows 10 experiences are available . Working inside a window into the cloud protects physical devices from evil code a user might get tricked into initializing . Called WorkSpaces , it can give staff access to all of a company ’ s data and tools from anywhere . If an employee is working from home and gets hit Attack.Ransom by ransomware , it encrypts everything on the hard drive and demands payment Attack.Ransom in bitcoin to set data free . If the ransomware got run on the employee ’ s actual machine , all the music , photos and personal documents stored there would be locked up too . On a virtual machine , though , only the virtual device gets hit . All that personal data stays safe . If a user clicks on a link in a malicious email and accepts a prompt to enter their user name and password on a phony website , there is nothing about a virtual machine that will prevent that information from getting lost . That ’ s why it ’ s good for companies to have more robust sign-ons , such as using two-factor authentication . More sophisticated hackers might try to get specific credentials for high level employees in order to impersonate them digitally . For example , an attacker could send Attack.Phishing an email from an executive ’ s email address , Jakobsson explained , directing bookkeepers to wire money to a specific account for phony services , Jakobsson explained . The FBI has estimated that such scams have cost companies $ 5 billion over the last few years . A virtual machine can ’ t prevent that trick . Carbon Black delivers security services over the crowd , spotting attacks and detecting intruders . “ The majority of leading cybersecurity researchers are not yet ready to give all the power to the machines just yet , ” Rick McElroy , a security strategist there wrote the Observer , via a spokesperson . “ User awareness and education continue to major best practices when it comes to defending against phishing attacks Attack.Phishing . Computers will help , but not yet replace , human decision making. ” Desktop-as-a-service systems like WorkSpaces can turn clunky computers into lean , mean , totally updated machines . They might even be digital Sir Lancelot ’ s , protecting companies ’ IT castles well , but one knight won ’ t be enough—firms will still need a full roundtable .

A new attack campaign Attack.Phishing has been flinging Attack.Phishing phishing messages as well as ransomware-laced spam emails at potential victims in massive quantities . The attack campaign involves crypto-locking Locky ransomware . `` Beware . Do n't fall for this . Locky is horrid , '' says Alan Woodward , a computer science professor at the University of Surrey . The campaign began Monday , according to cloud-based cybersecurity provider AppRiver , which counted more than 23 million related spam emails having been sent Attack.Phishing in less than 24 hours . That makes it `` one of the largest malware campaigns that we have seen in the latter half of 2017 , '' says Troy Gill , manager of security research for AppRiver , in a blog post . Finnish security firm F-Secure says that the majority of the spam messages that its systems are currently blocking relate to Locky . It notes that some spam contains links to infected sites , while other messages carry malicious attachments . If a system becomes infected with this strain of Locky , crypto-locked files will have the extension `` .lukitus '' added , which is a Finnish word variously translated by native speakers as `` locking '' or `` locked , '' according to F-Secure . The Lukitus variant of Locky was first spotted last month . Rommel Joven , a malware researcher with security firm Fortinet , warned that it was being distributed via email attachments as part of a massive spam campaign being run by the one of the world 's biggest botnets , Necurs , which has historically been the principle outlet for Locky attacks . Spam Can Carry Locky Attachments AppRiver says emails related to the new Locky campaign have featured a variety of subject lines , including these words : documents , images , photo , pictures , please print , scans . `` Each message comes with a zip attachment that contains a Visual Basic Script ( VBS ) file that is nested inside a secondary zip file , '' Gill says . `` Once clicked , [ the ] VBS file initiates a downloader that reaches out to greatesthits [ dot ] mygoldmusic [ dotcom ] to pull down the latest Locky ransomware . Locky goes to work encrypting all the files on the target system and appending [ . ] lukitus to the users now-encrypted files . '' The ransomware then drops Attack.Ransom a ransom note on the victim 's desktop . `` The victim is instructed to install the Tor browser and is provided an .onion ( aka Darkweb ) site to process payment Attack.Ransom of 0.5 bitcoins '' - currently worth $ 2,400 - Gill says . `` Once the ransom payment Attack.Ransom is made the attackers promise a redirect to the decryption service . '' As of Friday , meanwhile , Xavier Mertens , a freelance security consultant and SANS Institute Internet Storm Center contributor based in Belgium , says he 's seeing a new wave of malicious spam that uses emails that pretend to carry voice messages . Internet Storm Center reports that some malicious messages tied to Locky are showing fake alerts Attack.Phishing stating that the HoeflerText font needs to be installed . Not all of the Locky spam emails arrive with malicious attachments ; some are designed as phishing attacks Attack.Phishing that redirect users to real-looking but malicious sites . Peter Kruse , an e-crime specialist at CSIS Security Group in Denmark , says some emails related to this ransomware campaign are skinned to look like Attack.Phishing they 've come from Attack.Phishing Dropbox . Some will attempt to trick Attack.Phishing recipients into clicking on a `` verify your email '' link . Kruse says the attacks are being launched by the group tied to the Affid=3 [ aka affiliate ID=3 ] version of Locky . If victims click on the link , they 're redirected to one of a number of websites . Clicking on a link can result in a zipped attack file being downloaded , per the VBS attack detailed above , according to security researcher JamesWT , a former member of the anti-malware research group called Malware Hunter Team . Alternately , clicking on the link may result in the site attempting to execute a malicious JavaScript file that functions as a dropper , meaning it then attempts to download a payload file . In some attacks , this payload file is Locky . But JamesWT tells ISMG that malware from the campaign that he uploaded to malware-checking service VirusTotal was identified as being Shade ransomware .

Google has announced Vulnerability-related.DiscoverVulnerability a crackdown on intrusive pop-up advertisements on its Chrome web browser after a previous update failed Vulnerability-related.PatchVulnerability to stop them . The ads open users up to phishing attacks Attack.Phishing that attempt to scam Attack.Phishing people into giving private information such as bank details to online fraudsters . Google says the ads create an 'abusive experience for users ' , including fee messages , unexpected clicks , phishing attempts Attack.Phishing and misleading site behaviour . The firm tried to stop Vulnerability-related.PatchVulnerability manipulative adverts in an update last February but now admits that it 'did not go far enough ' . Chrome currently has an option to enable a pop-up blocker but fraudsters have quickly found ways around this . The company declined to name the companies involved in the crackdown but said that the update will block Vulnerability-related.PatchVulnerability ads from a 'small number of sites with persistent abusive problems ' . Pop-ups are small windows that tend to show system warnings which are difficult to close , as well as 'watch video ' buttons . When the company announced its previous crackdown back in February , critics were quick to point out that the firm wanted to make ads more tolerable - so that their own could get past filters . Some said that the aim was to persuade people to disable their ad block so as not to deprive publishers ( including Google ) from displaying their advertisements and thus depriving them of revenue . Although they did not go into detail about why the previous block did n't work , Chrome product manager Vivek Sekhar said : 'We 've learned since then that this approach did not go far enough . ' 'In fact , more than half of these abusive experiences are not blocked by our current set of protections , and nearly all involve harmful or misleading ads . ' Advertisements also tend to be a hotbed for malicious software or scams where fraudsters trick Attack.Phishing people into giving out their personal information . Once a pop-up is clicked on , the ad can take you to a separate web page asking you to download an application and actually triggers an onslaught of more pop-up ads

A flaw in certificate pinning exposed customers of a number of high-profile banks to man-in-the-middle attacks on both iOS and Android devices . A vulnerability in the mobile apps of major banks could have allowed attackers to steal Attack.Databreach customers ' credentials including usernames , passwords , and pin codes , according to researchers . The flaw was found Vulnerability-related.DiscoverVulnerability in apps by HSBC , NatWest , Co-op , Santander , and Allied Irish bank . The banks in question have now all updated Vulnerability-related.PatchVulnerability their apps to protect against the flaw . Uncovered Vulnerability-related.DiscoverVulnerability by researchers in the Security and Privacy Group at the University of Birmingham , the vulnerability allows an attacker who is on the same network as the victim to perform a man-in-the-middle attack and steal information . The vulnerability lay in Vulnerability-related.DiscoverVulnerability the certificate pinning technology , a security mechanism used to prevent impersonation attacks and use of fraudulent certificates by only accepting certificates signed by a single pinned CA root certificate . While certificate pinning usually improves security , a tool developed by the researchers to perform semi-automated security-testing of mobile apps found that a flaw in the technology meant standard tests failed to detect attackers trying to take control of a victim 's online banking . As a result , certificate pinning can hide the lack of proper hostname verification , enabling man-in-the-middle attacks . The findings have been outlined Vulnerability-related.DiscoverVulnerability in a research paper and presented Vulnerability-related.DiscoverVulnerability at the Annual Computer Security Applications Conference in Orlando , Florida . The tool was run on 400 security critical apps in total , leading to the discovery Vulnerability-related.DiscoverVulnerability of the flaw . Tests found Vulnerability-related.DiscoverVulnerability apps from some of the largest banks contained the flaw which , if exploited Vulnerability-related.DiscoverVulnerability , could have enabled attackers to decrypt , view , and even modify network traffic from users of the app . That could allow them to view information entered and perform any operation that app can usually perform -- such as making payments or transferring of funds . Other attacks allowed hackers to perform in-app phishing attacks Attack.Phishing against Santander and Allied Irish bank users , allowing attackers to take over part of the screen while the app was running and steal Attack.Databreach the entered credentials . The researchers have worked with the National Cyber Security Centre and all the banks involved to fix Vulnerability-related.PatchVulnerability the vulnerabilities , noting that the current version of all the apps affected Vulnerability-related.DiscoverVulnerability by the pinning vulnerability are now secure . A University of Birmingham spokesperson told ZDNet all the banks were highly cooperative : `` once this was flagged to them they did work with the team to amend it swiftly . ''

As thousands of freshmen move into their dorms for the first time , there are plenty of thoughts rushing through their minds : their first time away from home , what cringey nickname they 're gon na try to make a thing , if there are any parties before orientation kicks off . One thing that probably is n't on their minds is whether they 're going to get hacked . But that 's all Carnegie Mellon University 's IT department thinks about . Back-to-school season means hordes of vulnerable computers arriving on campus . The beginning of the semester is the most vulnerable time for a campus network , and every year , with new students coming in , schools have to make sure everything runs smoothly . Carnegie Mellon 's network gets hit with 1,000 attacks a minute -- and that 's on a normal day . Cybersecurity is an increasingly important aspect of our everyday lives , with technology playing a massive role in nearly everything we do . Universities have been vulnerable to attacks Attack.Databreach in the past , with cybercriminals stealing Attack.Databreach student and faculty databases and hackers vandalizing university websites . Students are often targets for hackers , even before they 're officially enrolled . Considering how much money flows into a university from tuition costs , along with paying for room and board , criminals are looking to cash in on weak campus cybersecurity . A bonus for hackers : Admissions offices often hold data with private information like student Social Security numbers and addresses , as well as their families ' data from financial aid applications . Phishing Attack.Phishing happens when hackers steal Attack.Databreach your passwords by sending Attack.Phishing you links to fake websites that look like Attack.Phishing the real deal . It 's how Russians hacked the Democratic National Committee during the presidential election , and it 's a popular attack to use on universities as well . The latest warning , sent Monday , called out malware hidden in a document pretending to be Attack.Phishing from Syracuse University 's chancellor . Digging through my old emails , I found about 20 phishing Attack.Phishing warnings that had gone out during the four years I 'd been there . Syracuse declined to comment on phishing attacks Attack.Phishing against the school , but in a 2016 blog post , it said the attacks were `` getting more frequent , cunning and malicious . '' The school is not alone . Duo Security , which protects more than 400 campuses , found that 70 percent of universities in the UK have fallen victim to phishing attacks Attack.Phishing . Syracuse , which uses Duo Security , fights phishing attacks Attack.Phishing with two-factor authentication , which requires a second form of identity verification , like a code sent to your phone . But it just rolled out the feature last year . Kendra Cooley , a security analyst at Duo Security , pointed out that students are more likely to fall for phishing attacks Attack.Phishing because they have n't been exposed to them as frequently as working adults have . Also , cybercriminals know how to target young minds . `` You see a lot of click-bait phishing messages like celebrity gossip or free travel , '' Cooley said . All students at Carnegie Mellon are required to take a tech literacy course , in which cybersecurity is a focus , said Mary Ann Blair , the school 's chief information security officer . The school also runs monthly phishing campaigns Attack.Phishing : If a student or faculty member falls Attack.Phishing for the friendly trap Attack.Phishing , they 're redirected to a training opportunity . When your network is being hit with at least two phishing attempts Attack.Phishing a day , Blair said , it 's a crucial precaution to keep students on guard . `` It 's just constantly jiggling the doorknobs to see if they 're unlocked , '' Blair said . `` A lot of it is automated attacks . '' It 's not just the thousands of new students that have university IT departments bracing for impact , it 's also their gadgets . `` All these kids are coming on campus , and you do n't know the security level of their devices , and you ca n't manage it , because it 's theirs , '' said Dennis Borin , a senior solutions architect at security company EfficientIP . A lot of university IT teams have their hands tied because they ca n't individually go to every student and scan all their computers . Borin 's company protects up to 75 campuses across the United States , and it 's always crunch time at the beginning of the semester . `` If I was on campus , I would n't let anybody touch my device , '' Borin said . `` So if somebody has malware on their device , how do you protect against an issue like that ? '' Instead of going through every single student , Borin said , his company just casts a wide net over the web traffic . If there 's any suspicious activity coming from a specific device , they 're able to send warnings to the student and kick him or her off the network when necessary . Keeping school networks safe is important for ensuring student life runs smoothly . A university that had only two people on its team reached out to EfficientIP after it suffered an attack . All of the school 's web services were down for an entire week while recovering from the attack , Borin said . Scam artists love to take advantage of timing , and the back-to-school season is a great opportunity for them . There was an influx of fake ransomware protection apps when WannaCry hit Attack.Ransom , as well as a spike in phony Pokemon Go apps stuffed with malware during the height of the game 's popularity . If there 's a massive event going on , you can bet people are flooding the market with phony apps to trick Attack.Phishing victims into downloading viruses . A quick search for `` back to school apps '' in August found 1,182 apps that were blacklisted for containing malware or spyware , according to security firm RiskIQ . Researchers from the company scanned 120 mobile app stores , including the Google Play store , which had more than 300 blacklisted apps . They found apps for back-to-school tools ; themes and wallpapers for your device ; and some apps that promised to help you `` cheat on your exams . '' Though most of the blacklisted apps are poorly made games , others pretend to help you be a better student . Other warning signs to watch out for when it comes to sketchy apps are poorly written reviews and developers using public domain emails for contacts , Risk IQ said . For any educational apps , like Blackboard Learn , you should always check the sources and look for the official versions . New students coming to school have enough to worry about . Let 's hope a crash course in cybersecurity is enough to ensure they make it to graduation without getting hit by hacks .

As thousands of freshmen move into their dorms for the first time , there are plenty of thoughts rushing through their minds : their first time away from home , what cringey nickname they 're gon na try to make a thing , if there are any parties before orientation kicks off . One thing that probably is n't on their minds is whether they 're going to get hacked . But that 's all Carnegie Mellon University 's IT department thinks about . Back-to-school season means hordes of vulnerable computers arriving on campus . The beginning of the semester is the most vulnerable time for a campus network , and every year , with new students coming in , schools have to make sure everything runs smoothly . Carnegie Mellon 's network gets hit with 1,000 attacks a minute -- and that 's on a normal day . Cybersecurity is an increasingly important aspect of our everyday lives , with technology playing a massive role in nearly everything we do . Universities have been vulnerable to attacks Attack.Databreach in the past , with cybercriminals stealing Attack.Databreach student and faculty databases and hackers vandalizing university websites . Students are often targets for hackers , even before they 're officially enrolled . Considering how much money flows into a university from tuition costs , along with paying for room and board , criminals are looking to cash in on weak campus cybersecurity . A bonus for hackers : Admissions offices often hold data with private information like student Social Security numbers and addresses , as well as their families ' data from financial aid applications . Phishing Attack.Phishing happens when hackers steal Attack.Databreach your passwords by sending Attack.Phishing you links to fake websites that look like Attack.Phishing the real deal . It 's how Russians hacked the Democratic National Committee during the presidential election , and it 's a popular attack to use on universities as well . The latest warning , sent Monday , called out malware hidden in a document pretending to be Attack.Phishing from Syracuse University 's chancellor . Digging through my old emails , I found about 20 phishing Attack.Phishing warnings that had gone out during the four years I 'd been there . Syracuse declined to comment on phishing attacks Attack.Phishing against the school , but in a 2016 blog post , it said the attacks were `` getting more frequent , cunning and malicious . '' The school is not alone . Duo Security , which protects more than 400 campuses , found that 70 percent of universities in the UK have fallen victim to phishing attacks Attack.Phishing . Syracuse , which uses Duo Security , fights phishing attacks Attack.Phishing with two-factor authentication , which requires a second form of identity verification , like a code sent to your phone . But it just rolled out the feature last year . Kendra Cooley , a security analyst at Duo Security , pointed out that students are more likely to fall for phishing attacks Attack.Phishing because they have n't been exposed to them as frequently as working adults have . Also , cybercriminals know how to target young minds . `` You see a lot of click-bait phishing messages like celebrity gossip or free travel , '' Cooley said . All students at Carnegie Mellon are required to take a tech literacy course , in which cybersecurity is a focus , said Mary Ann Blair , the school 's chief information security officer . The school also runs monthly phishing campaigns Attack.Phishing : If a student or faculty member falls Attack.Phishing for the friendly trap Attack.Phishing , they 're redirected to a training opportunity . When your network is being hit with at least two phishing attempts Attack.Phishing a day , Blair said , it 's a crucial precaution to keep students on guard . `` It 's just constantly jiggling the doorknobs to see if they 're unlocked , '' Blair said . `` A lot of it is automated attacks . '' It 's not just the thousands of new students that have university IT departments bracing for impact , it 's also their gadgets . `` All these kids are coming on campus , and you do n't know the security level of their devices , and you ca n't manage it , because it 's theirs , '' said Dennis Borin , a senior solutions architect at security company EfficientIP . A lot of university IT teams have their hands tied because they ca n't individually go to every student and scan all their computers . Borin 's company protects up to 75 campuses across the United States , and it 's always crunch time at the beginning of the semester . `` If I was on campus , I would n't let anybody touch my device , '' Borin said . `` So if somebody has malware on their device , how do you protect against an issue like that ? '' Instead of going through every single student , Borin said , his company just casts a wide net over the web traffic . If there 's any suspicious activity coming from a specific device , they 're able to send warnings to the student and kick him or her off the network when necessary . Keeping school networks safe is important for ensuring student life runs smoothly . A university that had only two people on its team reached out to EfficientIP after it suffered an attack . All of the school 's web services were down for an entire week while recovering from the attack , Borin said . Scam artists love to take advantage of timing , and the back-to-school season is a great opportunity for them . There was an influx of fake ransomware protection apps when WannaCry hit Attack.Ransom , as well as a spike in phony Pokemon Go apps stuffed with malware during the height of the game 's popularity . If there 's a massive event going on , you can bet people are flooding the market with phony apps to trick Attack.Phishing victims into downloading viruses . A quick search for `` back to school apps '' in August found 1,182 apps that were blacklisted for containing malware or spyware , according to security firm RiskIQ . Researchers from the company scanned 120 mobile app stores , including the Google Play store , which had more than 300 blacklisted apps . They found apps for back-to-school tools ; themes and wallpapers for your device ; and some apps that promised to help you `` cheat on your exams . '' Though most of the blacklisted apps are poorly made games , others pretend to help you be a better student . Other warning signs to watch out for when it comes to sketchy apps are poorly written reviews and developers using public domain emails for contacts , Risk IQ said . For any educational apps , like Blackboard Learn , you should always check the sources and look for the official versions . New students coming to school have enough to worry about . Let 's hope a crash course in cybersecurity is enough to ensure they make it to graduation without getting hit by hacks .