hacking – Page 454 – STE WILLIAMS

NSA, DHS Call for Info Sharing Across Public and Private Sectors

library
crime | hacking | security

Industry leaders debate how government and businesses can work together on key cybersecurity issues.

If money were no object, and you didn’t have to worry about bureaucracy or politics, what would you have your organization do to make a difference in the public-private sector discourse on cybersecurity? How would you improve tactics and techniques?

“The thing I’d love to be able to do is share in real time,” said Neal Ziring, technical director for the National Security Agency’s Capabilities Directorate. The question was posed to him, and two other panelists from the public and private sectors, in the RSA Conference panel “Behind the Headlines: A Public-Private Discourse on Cyber-Defense,” last week in San Francisco.

Ziring explained how if policy were not an issue, he would want to take NSA’s foreign intelligence and turn it into actionable warnings in real time. “That’s not easy. We’re trying to work in that direction,” he said, adding that there are “considerable policy obstacles to that right now.”

Defenders are overwhelmed with an onslaught of threat data, user error, poor endpoint protection tools, and myriad other factors making their jobs harder. This discussion brought together security experts to put the spotlight on which threats should be prioritized and how the government and private sector can better improve their relationships to address them.

John Felker, director of the DHS’s National Cybersecurity Communication Integration Center (NCCIC), outlined the security threats that are top-of-mind for government. China, he said, is a big one: It continues to engage in cyber espionage despite a 2015 agreement to stop. Industrial theft is a primary concern as China’s long-term strategy is to improve its economy, he said.

“We’ve seen lots and lots of threats from Iran,” Felker continued. Iran is now heavily focusing on oil and gas, primarily in the Middle East. “We believe they’re posturing for future activity.”

Next up: Russia. “Part of the Russia threat relates to keeping their economy strong and the things they want to participate in to allow their form of government to continue,” he explained. There is “significant potential for mischief” as there remains a possibility Russia will segregate itself from the Internet as a threat. Finally, Felker pointed to North Korea, which is primarily financially motivated and needs funds to develop domestic IT infrastructure and industry.

A Call for Info Sharing
Information sharing was a key theme of the talk, and all panelists emphasized a greater need for the public and private sectors to share threat intelligence. “It doesn’t do us any good to exchange business cards in the middle of a cyber incident,” Felker said. He encourages organizations to reach out if they’re hit. “Make sure someone knows it’s OK to do that,” he added.

While the NSA doesn’t have the public facing role the DHS does, Ziring noted the organization does interact with the public and business communities. His advice: “If we go to the trouble to publish advice, take it,” he said. “We don’t publish all that frequently, and when we do there are really good reasons behind it.”

He also advised businesses to collaborate with the NSA on a technical level. “The goal we’re trying to achieve is shared visibility into the cyberspace where we all have to operate,” Ziring continued. Threat actors have visibility over all of us; it would help businesses to do the same.

Security teams need to establish trust before an attack takes place. Part of building relationships involves conducting internal and external exercises across the organization so senior leadership knows what’s happening and what to do. If you implement a security framework, blog about it, said Curtis Dukes, executive vice president and general manager for the Security Best Practices and Automation Group at the Center for Internet Security.

“You are a target – it’s not if but when you’re attacked,” Dukes explained. “Communicate ‘here’s what happened and why.’ That way, we all learn from your misfortune, but more importantly we can protect ourselves.”

Modern C-suites are more aware of cybersecurity and the effect it can have on a business, he added. Major incidents have taught them how poor security can affect a bottom line, and now they’re asking for board members who have cybersecurity expertise.

However, “where we’re falling short is we still haven’t done an adequate job of translating cyber-risk to business risk,” he added. Businesses will place high value on certain business processes but fail to recognize the impact of losing that process in a cyberattack.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance Technology, where she covered financial … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/nsa-dhs-call-for-info-sharing-across-public-and-private-sectors/d/d-id/1334130?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Cryptominers Remain Top Threat but Coinhive’s Exit Could Change That

library
crime | hacking | security

Coinhive has remained on top of Check Point Software’s global threat index for 15 straight months.

Cryptominers continue to dominate the malware landscape, just as they did all of 2018. But a decision by cryptocurrency mining service Coinhive to shut down last week could change that soon, security vendor Check Point Software said in its latest malware threat report, released Monday.

Coinhive has topped Check Point’s global threat index for 15 straight months, including this February.

Coinhive’s software is designed to give website owners a way to earn revenue by using the browsers of site visitors to mine for Monero cryptocurrency. The software itself — like many other cryptominers — is not malicious. However, cybercriminals have been using Coinhive extensively to surreptitiously mine for Monero on hacked websites, making it a top threat to website operators globally in the process. Many websites that have installed Coinhive also have done so without explicitly informing site visitors about it.

“For now, I assume that Coinhive’s shutdown will only cause its disappearance from the top 10 list,” says Maya Horowitz, threat intelligence and research director at Check Point. Other coin-mining tools will likely remain a threat or become more widely distributed as criminals start using those tools instead of Coinhive, she says. Check Point’s report shows that at least two other coin miners — Cryptoloot and Authedmine — moved up in the top 10 malware rankings last month, compared with January 2019.

However, the declining values overall of major cryptocurrencies (such as Monero and bitcoin) could soon begin affecting the will of threat actors to use miners, Horowitz notes. This could result in fewer cryptomining attacks overall and a greater focus by threat actors on more lucrative targets such as scalable cloud environments. Attackers could also start “finding new, yet unknown, paths to monetize on their attacks,” Horowitz says.

In a blog post last Friday, security vendor Avast said Coinhive’s decision to discontinue its service is not entirely surprising given the declining value of cryptocurrencies and the fact that security vendors were routinely blocking the software because of misuse.

The big question now is whether or not browser-based cryptojacking will decline altogether or whether some other crypto tool will rise to replace Coinhive. “Ultimately, Coinhive going out of business is a good thing for security, privacy, and transparency,” according to the Avast blog post.

Totally, five of top threats in Check Point’s global index currently are cryptomining-related. The other threats in the index include the GandCrab ransomware tool and two banking Trojans that have been around for some time — Ramnit and Emotet.

According to Check Point, its researchers have observed several campaigns distributing a new version of GandCrab widely in Canada, Germany, Japan, and Australia. The new version incorporates a key encryption change that renders ineffective a decryption tool that was developed for previous versions of the malware, Check Point said. One reason for GandCrab’s growing popularity is the fact that the ransomware is offered as a service and is thus easily available to attackers, Horowitz says.

Check Point’s report also shows that the most actively targeted vulnerabilities last month were once again issues that were disclosed and patched some time ago. One of the vulnerabilities in February, for instance, was an information disclosure flaw in Open SSL (CVE-2014-0160; CVE-2014-0346) that was first disclosed and patched in 2014.

“Threat actors often use the least sophisticated solution that would work,” Horowitz says. So as long as many users do not patch their servers for these vulnerabilities, they would keep exploiting them. “Our yearly security report demonstrates that only a third of the attacks during 2018 exploited vulnerabilities disclosed in 2017–2018,” she says.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/cryptominers-remain-top-threat-but-coinhives-exit-could-change-that/d/d-id/1334131?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Just a reminder: We’re still bad at securing industrial controllers

library
crime | hacking | security

Bug hunters have discovered yet another set of flaws in industrial control systems used by electric utilities, oil and gas companies, and shipping and transportation providers.

The Positive Technologies trio of Ivan Boyko, Vyacheslav Moskvin, and Sergey Fedonin were credited with sussing out and reporting a series of 12 different security vulnerabilities in controllers from Moxa.

The bugs range in severity and impact, though Positive Tech noted that even something as simple as a denial of service issue could have a profound impact when it comes to industrial control systems (ICS).

“A vulnerable switch can mean the compromise of the entire industrial network,” Paolo Emiliani, Positive’s analyst for Industry and SCADA research, said today.

“If ICS components are parts of the body, you can think of network equipment as the arteries that connect them all. So disruption of network interactions could degrade or even stop ICS operations entirely.”

A number of the bugs were found in the web interface for the Moxa devices. In the EDS-405A, EDS-408A, and EDS-510A series controllers, the Positive researchers found web console passwords stored in plain text, predictable session IDs for web server cookies (those cookies could be used to recover administrator passwords), and unlimited authentication rules that allow for brute force attacks on the switches.

The switches were also found to be sending sensitive data via “proprietary protocols” that were not secure and would allow for man-in-the-middle or DDoS attacks should an attacker have network access.

Meanwhile, the IKS-G6824A series of backbone switches was subject to seven unique vulnerabilities of its own, including multiple cross-site-scripting bugs, buffer overflow errors, and cross-site request forgery errors. The box’s web interface was also found to be improperly configured, allowing users who were set to read-only mode the ability to change configurations.

For most of the flaws, Moxa is recommending customers update their firmware to the latest version, though there are other steps that will need to be taken to close up all of the holes.

For the EDS-405A, EDS-408A, and EDS-510A, admins will need to set their web configuration to “HTTPS only” in order to close a predictable session ID problem. For the IKS-G6824A, admins are advised to disable HTTP access altogether and use SNMP/Telnet/CLI to manage the devices. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/11/industrial_controllers/

Hapless engineers leave UK cable landing station gate open, couple of journos waltz right in

library
crime | hacking | security

Journalists were able to bimble into a UK cable landing station almost completely unchallenged after security gates were left open and unlocked.

Two reporters from the Mail on Sunday walked straight into the nondescript hut where the Hibernia Express cable reaches the British mainland in Southport, 30km north of Liverpool on the Irish Sea coast. The cable is the fastest transatlantic fibre optic route for internet traffic between the UK and North America.

“A terrorist or foreign agent would have been free to plant explosives or force their way inside,” reported the paper.

The hut, the precise location of which El Reg is not disclosing (even if we described it in great detail it’s a right sod to find on Google Earth), “stands at one end of a car park used to store about 20 caravans”, according to the Mail on Sunday. A group of visiting engineers had rather carelessly left all of the doors and gates wide open behind them, allowing the reporters to stick their heads in and ask questions.

However, although CCTV had been installed on site, the reporters’ snooping was not immediately challenged. A few years ago the then-head of the Armed Forces, Air Chief Marshal Sir Stu Peach, warned that undersea fibre optic cables were at risk from Russia and similar enemies of the West. But the air marshal was referring to military action at sea – cutting or tapping cables – instead of targeting them on land.

Hibernia was bought out by GTT Communications in 2017. A spokesman told the Mail that its cable landing stations “have security built into their core and resilience measures in place that mean any interruption of service would not materially impact internet traffic”.

When The Register exclusively revealed that spy agency GCHQ had established a cable-tapping base in Seeb, Oman, we named Hibernia Atlantic as one of the domestic cables that was subject to illicit interception. Intriguingly, given the current situation around security, Hibernia was told to stop construction work on Hibernia Express in 2013 over the involvement of Huawei Marine in providing some of the equipment for its operation. Huawei was duly replaced by TE Subcom, a US firm.

Physical security is increasingly overlooked in British national cybersecurity considerations. Last week the government published its response to a Parliamentary report demanding greater software skills and training for critical national infrastructure companies. While unquestionably of vital importance, it’s no good being able to fend off all the North Korean botnets in the world if Bogdan the Church Spire Tourist can knacker the nation’s comms with a handful of plastic explosive. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/11/southport_cable_landing_station_wide_open/

NASA’s crap infosec could be ‘significant threat’ to space ops

library
crime | hacking | security

NASA’s Office of the Inspector General has once again concluded the American space agency’s tech security practices are “not consistently implemented”.

Confirmation that the US government department’s infosec abilities are not up to scratch was a repeat of last year’s federally mandated security audit, which also found that processes and procedures were below par.

Oversight personnel from the Office of the Inspector General (OIG) criticised NASA staff for the “untimely [sic] performance of information security control assessments”, saying it “could indicate control deficiencies and possibly significant threats to NASA operations, which could impair the Agency’s ability to protect the confidentiality, integrity, and availability of its data, systems, and networks.”

Jim Morrison, assistant inspector general for audits within NASA’s OIG, said in a letter:

“In sum, we rated NASA’s cybersecurity program at a Level 2 (Defined) for the second year in a row, which falls short of the Level 4 (Managed and Measurable) rating agency cybersecurity programs are required to meet by the Office of Management and Budget in order to be considered effective.”

Two areas were of immediate concern to Morrison’s inspectors: NASA system security plans “contained missing, incomplete, and inaccurate data” and control assessments were not carried out “in a timely manner”, something the auditors described as “an indicator of a continuing control deficiency”.

The OIG’s annual review assessed “61 metrics in five security function areas,” it said, testing “a subset of information systems to determine the maturity of their agency’s information security program.”

Drilling down, OIG inspectors looked closely at seven “judgmentally selected Agency information systems along with their corresponding security documentation” to arrive at their verdict.

A rating of “Level 2 (Defined)” means, according to the NASA OIG, that “policies, procedures, and strategies are formalized and documented but not consistently implemented”. This contrasts with Level 4, where successful American government agencies have “Quantitative and qualitative measures on the effectiveness of policies, procedures, and strategies [that are] are collected across the organization and used to assess them and make necessary changes”.

More details are scheduled to emerge in the full US Federal Information Security Modernisation Act (FISMA) review of NASA for fiscal year 2019. ®

Sponsored:
Becoming a Pragmatic Security Leader

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/03/11/nasa_infosec_office_inspector_general_fisma/

IT Security Administrators Aren’t Invincible

library
crime | hacking | security

IT security administrators and their teams are responsible for evaluating an organization’s security tools and technologies, but are they armed with the proper tools, considerations, and budget to do so? Fourth in a six-part series.

IT security administrators, who often have titles such as director of cybersecurity or director of security operations, are mid- to senior-level managers who typically report directly to the CISO, CSO, or CIO. They usually manage a team of security analysts or security managers, and their core responsibilities often include managing the operations of the organization’s security operations center, managing network, application, cloud, and systems security; vulnerability and risk management; penetration testing; and employee security awareness. They’re expected to work closely with IT, security leadership, compliance, legal, and other stakeholders. They act as interpreters between technical analysts and non-technical executives, and they have access to organizational infrastructure, tools, and technologies.

Common Mistakes
Security directors are in the middle of everything security-related, and it can be a major challenge to balance all of the responsibilities, especially on a limited budget. Because security directors are stretched so thin, they often must rely on the dashboards from their security products to provide their key performance indicators (KPIs) and metrics, and they limit technology purchases to familiar brands instead of conducting merit-based evaluations, perhaps of lesser-known products and companies.

Security teams strapped for time struggle to perform comprehensive evaluations of all available products that include non-functional but critical issues such as how successful the product is at its given function, its impact on system performance, how it works in the production environment, and how it compares with other vendors’ offerings. And while security directors may be responsible for evaluating security technologies, security may not be their specialty; therefore, taking a risk on a startup with more advanced technologies may not seem prudent.

Additionally, security directors sometimes have a good understanding of infrastructure but lack in-depth understanding of cyberattacks and insight into how modern adversaries operate. Without clearly understanding the threats their organization faces and why, security directors may have a myopic view of operations and not properly look at long-term strategy.

Repercussions
Because of time concerns, budget constraints, inexperience with security, or lack of proper evaluation criteria, security directors may select tools that don’t properly address their organization’s needs. Whether they choose according to brand, price (as in inexpensive solutions that fit the budget or expensive options that represent perceived value), or pressure from senior leadership, the result is a product purchase that may not best suit their organization’s concerns. The solution may be ineffective or overly complicated or create a security stack with too many products, increasing the administrative overhead and likelihood of interoperability issues.

Security directors who depend on out-of-the-box KPIs that provide “safe” metrics may not accurately assess the security posture of the organization — or all the hard work that the security team does. This can result in incorrect prioritization, inaccurate allocation of resources, and a complete misunderstanding of the organization’s security posture. Combined with a lack of long-term vision, the organization won’t be able to improve the situation.

Minimize Mistakes
Security directors must work with leadership to determine their organization’s risk profile and security posture before making new technology investments. They must also have and deploy the resources necessary to ensure due diligence and thorough product evaluations (including proof-of-concept trials). Considering the plethora of vendors and products, organizations must assess which products will have the biggest impact and yield the best return on investment to strengthen security posture.

Security directors should also be able to bring in outside help for such assessments. Only a few organizations are equipped to measure non-functional requirements such as efficacy, impact on system performance, and false positives. Experienced third-party professionals can conduct such evaluations. Less-sophisticated organizations with limited budget and resources can refer to neutral third-party evaluations to determine whether vendors have performed consistently well in multiple tests. Security directors should also advocate for professional services budgets to ensure correct deployment and configuration as well as proper use based on vendor-recommended best practices.

When it comes to setting KPIs for the security team, security directors must make time to create both metrics for leadership that indicate the organization’s security posture, and the team’s efforts, as well as metrics that provide honest insight into how operations are running so that the KPIs become a basis for where improvements can be made. Suggested KPIs might combine data from several products using some type of automated collection and/or calculation to make the process of retrieving the numbers on a regular basis manageable.

Change the Paradigm
We must dispel the notion that more products equal more security. Organizations need a layered approach that incorporates operational simplicity, minimal redundancy, integrated management, and interoperability.

It’s also important for security directors to continue in their education. We must recognize that security directors — and the teams that evaluate, purchase, deploy, and manage security technologies — must stay up-to-date on the cybersecurity landscape — and technology advancements like machine learning and big data analytics — to properly consider all options for the purchase and management of security products and services and effectively run security operations.

In addition, we must accept the fact that improving an organization’s security posture does not happen exponentially or even linearly. For many reasons, KPIs may not improve quarter over quarter. Security directors must be able to report such KPIs without fearing the perception of failure. KPIs may appear disappointing because the security director made a decision that turned out to be off-target. But remember, these KPIs provide an opportunity to course-correct. And that needs to be acceptable because security directors make mistakes, too. What separates successful organizations from the rest is the ability to identify and correct their mistakes.

Keep a lookout for the fifth perspective in our series: programmers. Previously, we’ve covered end users, security leaders, and security analysts.

Related Content:

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Roselle Safran is President of Rosint Labs, a cybersecurity consultancy to security teams, leaders, and startups. She is also the Entrepreneur in Residence at Lytical Ventures, a venture capital firm that invests in cybersecurity startups. Previously, Roselle was CEO and … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/it-security-administrators-arent-invincible/a/d-id/1334067?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Georgia’s Jackson County Pays $400K to Ransomware Attackers

library
crime | hacking | security

The ransomware campaign started March 1 and shut down most of Jackson County’s IT systems.

Jackson County, a rural area of Georgia located about 60 miles from Atlanta, has paid $400,000 to regain access to systems and data locked down in a recent ransomware campaign.

The cyberattack was first confirmed by officials on March 1. It shut down the county’s network and knocked computers, email services, and websites offline. While the website and 911 emergency system were reportedly unharmed, Jackson County was mostly disconnected.

“Everything we have is down,” said Sheriff Janis Mangum to StateScoop. “We are doing our bookings the way we used to do it before computers. We’re operating by paper in terms of reports and arrest bookings. We’ve continued to function. It’s just more difficult.”

Following the attack, Jackson County alerted the FBI and a cybersecurity response consultant, who communicated with the attackers and negotiated a $400,000 price for the decryption key.

Paying ransom is a controversial topic among cybersecurity experts. Businesses that pay are still subject to downtime, incomplete transactions, and unhappy customers following a ransomware attack. Further, the return of data isn’t guaranteed, and payment encourages criminal activity.

Still, in this case and many others, the ransom is a small price to pay compared with the cost of rebuilding the infrastructure from scratch. “We had to make a determination on whether to pay,” said Jackson County manager Kevin Poe to OnlineAthens. “We could have literally been down months and months and spent as much or more money trying to get our system rebuilt.”

Hackers Break into System That Houses College Application Data

library
crime | hacking | security

More than 900 colleges and universities use Slate, owned by Technolutions, to collect and manage information on applicants.

As if applying to college wasn’t nerve-wracking enough: Last week hackers broke into a system that houses prospective students’ application data, then promised students access to their files — for the price of a single Bitcoin.

More than 900 colleges and universities use Slate, owned by Technolutions, to collect and manage information on applicants. Three colleges were affected by the breach: Oberlin College in Ohio, Grinnell College in Iowa, and Hamilton College in New York. Prospective students were sent emails promising access to confidential information, including comments from admissions officers and tentative acceptance decisions, upon payment of a Bitcoin. Later emails offered limited subsets of student files for $60.

No other universities were affected by the breach, Technolutions said. Oberlin, Grinnell, and Hamilton advised prospective students not to pay the attackers and said they are working with law enforcement on the case.

Read here and here for more.

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry’s most knowledgeable IT security experts. Check out the Interop agenda here.

Article source: https://www.darkreading.com/attacks-breaches/hackers-break-into-system-that-houses-college-application-data/d/d-id/1334125?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

FTC says taxpayer voice phishing scams are up nearly 20x

library
crime | hacking | security

Have you gotten a (fake!) call from a (not!) US Social Security Administration rep? Maybe one in which you’re told that your Social Security number (SSN) has been suspended because of “suspicious” activity, or because it’s been involved in a crime?

Sometimes, the real Social Security Administration (SSA) phone number – or a number that’s close to it – shows up on your caller ID.

All you have to do to clear up the mess is to confirm your taxpayer ID, the scammer will sometimes say. Or maybe you can take care of it by paying a fine… via gift cards, the codes for which you can read to the imposter over the phone.

Of course, you never want to do any of that: if you hand over your SSN, you’re setting yourself up for identity fraud. If you buy gift cards and hand over the codes, you can kiss that money goodbye. We should never give our SSN, credit card or bank account number to anyone who contacts us.

Unfortunately, some people do. And given that we’re in tax fraud season right now, in the months leading up to the April US filing deadline, it’s time for an updated report from the US Federal Trade Commission (FTC).

Losses through taxpayer scams total $16.6 million

The news isn’t good: the frequency of taxpayer scams are going up, the FTC said last week. It’s seen a spike in reports of fake SSA calls, 3% of which have led to victims getting taken to the cleaners.

Since January 2018, the FTC says, it’s received more than 63,000 reports of this scam. Reported losses totaling $16.6 million, with a median loss of $1,484. That’s an enormous jump: it’s nearly 20x the numbers reported in 2017 when 3,200 people told the FTC about experiencing SSA imposter scams. The total amount they reported losing in 2017 was close to $210,000.

The scammers are adept at pushing our fear buttons. They might tell us that our bank accounts are on the brink of being seized, our SSN is about to be suspended, or that we’re about to be arrested.

String that all together, and you get something that sounds like this demonstration of voice phishing (vishing) posted by the FTC in December.

Rat out the rats!

If you’ve received one of these vishing calls, the FTC asks that you report it at ftc.gov/complaint.

If you’ve already handed over your SSN and you’re worried about identity theft, visit IdentityTheft.gov/ssa.

The FTC asks us all to remember these things if we ever do get one of these calls:

Your Social Security Number is not about to be suspended. Your bank account is not about to be seized.
The real SSA will never call to threaten your benefits or tell you to wire money, send cash, or put money on gift cards.
You can’t believe the numbers on your caller ID. Scammers can easily fake those. But if you’re worried, call the real SSA at 1-800-772-1213. You can trust that number if you dial it yourself – just not on your caller ID.
Never give your SSN, credit card or bank account number to anyone who contacts you. Ever.

Caller ID spoofing: Why isn’t it illegal?

Many times, people wonder: why in the world is it possible, or even legal, for callers to change the number that shows up in caller ID?

It is, in fact, illegal… but only sometimes.

The Truth in Caller ID Act prohibits spoofing when it comes to “transmitting misleading or inaccurate caller ID information with the intent to defraud, cause harm or wrongly obtain anything of value.”

There are many examples of when callers legitimately, and legally, spoof their caller ID number with no intention of ripping us off. For example, when a doctor calls a patient from her personal mobile phone, she may choose to display the office number rather than her personal phone number. Another example is when a business displays its toll-free call-back number.

Unfortunately, it’s very easy for scammers to download automated phone-calling technology, spoof numbers to make it look like calls are coming from whoever they choose – be it the SSA or a local neighbor – and robo-drag victims into their scam spiels.

Just ask the so-dubbed “robocaller kingpin”, Adrian Abramovich, who was fined $120 million for the nearly 97 million spoofed calls his marketing companies made to sell vacations at resorts that, surprise surprise, turned out to be anything but the Marriott, Expedia, Hilton and TripAdvisor vacations initially mentioned.

What Abramovich told the Senate Commerce, Science Transportation Committee after it subpoenaed him to explain how he did it:

There is available open source software, totally customizable to your needs, that can be misused by someone to make thousands of automated calls with the click of a button.

May you and yours get through tax season without being victimized by one of those button clicks. But if you do, make sure to report it. As the story of the robocall kingpin clearly shows, these crooks don’t always get away with it. Reporting them helps to make the legal case that can shut them up.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/A_IhmEEDl8g/

Booking a restaurant? Let Google’s Duplex AI make the call for you

library
crime | hacking | security

What’s the easiest way to book a restaurant table by phone?

If you own a Google Pixel smartphone and live in one of 43 US states, the new answer to that question might be to ask Google Assistant to make that call on your behalf.

It’s as simple as telling it to “book a table for four people at [restaurant name] tomorrow night”, confirming details such as party size and preferred time. You can then leave Google’s deeply clever Duplex AI system to confirm details with the restaurant. Helpfully, writes Google:

Once your reservation is successfully made, you’ll receive a notification on your phone, an email update and a calendar invite so you don’t forget.

If you’re wondering what that conversation might sound like, that’s the clever bit – Google’s Duplex neural network AI is designed to sound and respond like a human being.

Not long after Google played this voice demo, it found itself in the middle of a backlash about creepy AI systems that simulate humans in ways that (it was argued) risked being deceptive.

To counter this, Google now says the system will announce that “the call is from Google,” while the call will also be recorded and offer the option to talk to a human if people feel intimidated.

There don’t appear to be any limitations on which restaurant users will be able to phone although restaurants with Google My Business accounts will be able to opt out of receiving AI-generated calls.

The major limitation right now is that it won’t work in some states (Indiana, Kentucky, Louisiana, Minnesota, Montana, Nebraska, and Texas) and initially will only support Pixel, Pixel 2, and Pixel 3 smartphones.

After the bedding-in period, Google says the service will be extended to any Android 5.0 or later smartphone, or Apple iPhone running Google Assistant (and presumably countries beyond the US too).

Bon appétit, Dave

What hasn’t gone away is the ethical debate about AI systems that simulate human conversations, which presents Google with a bit of a bind.

If Duplex natural language processing is too good, critics fret about its eeriness and the ethics of deception. On the other hand, if it’s not natural enough – which ironically usually equates to disfluency – Google reckons humans might hang up or be put off using it.

There’s a lot at stake. While right now it’s only for making restaurant reservations, it’s clear Google thinks it could be used for lots of everyday mundane phone calls some people would rather have a digital entity make for them.

For now, it looks as if it’s more of an experiment to see what humans will and won’t put up with.

The answer might be confusing and very human – a lot of people tolerate or love it while a lot of others hate it.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/7Dts4k1uECg/