Tech Blog

Is the Dark Web all bad?

January 20, 2020 By Jason Williams

Dark Web: (noun)

Part of the world wide web that is only accessible by utilizing special software, allowing users and websites to remain anonymous or untraceable. It exists on an encrypted network that uses masked IP addresses to maintain anonymity for users and site owners. This way, people who use the Dark Web for illegal purposes can’t be traced.

As you can see by the above definitions, the Dark Web can be a shady place where illegal transactions take place. Things like drugs, guns, counterfeit money, and credit card numbers can all be found, bought, and sold.

Chances are that if your business has been hacked, some or all of the stolen information is for sale on the Dark Web. This is why small to medium business owners need to make sure their security software is regularly updated against new and stronger threats.

But is the Dark Web only used for bad things?

Surprisingly—no. It is estimated that only about a third of the people who visit the Dark Web do so for illegal activities.

Before we go any further, I’d like to bring up a little more info on the Dark Web and some of its misconceptions.

Did you know that the internet you use every day is actually just the Surface Web? Also called the Common Web, Visible Web, or the Indexed Web, it is just the portion of the web that the general public has access to. We assume that it is the majority of the internet because we’ve labeled it the world wide web, right? Well, the Surface Web is only about one-third of the entire internet. Everything we have access to is, in reality, just the tip of the iceberg.

Underneath the Surface Web is the Deep Web. Also called the Invisible Web or Hidden Web. It is a portion of the world wide web whose contents are not indexed by standard search engines. 99% of the information on the Deep Web cannot be found through search engines like Google or Bing.

But are there positive aspects to the Deep Web and Dark Web?

The U.S. government uses both the Deep and Dark Webs to keep open channels to countries that are ruled by oppressive dictators, in case citizens of those countries want to send out news stories or ask for help. Media outlets, like the New York Times, host portals that allow people and whistle-blowers to send in news tips, anonymously.

That anonymity helps give people who are in bad situations or have no one in their lives to talk to, a means of expression and channels of help. There are groups for survivors of abuse that allow victims to name their abusers and also to get support from other survivors. There are groups for people with every type of addiction, anything from food, drugs, to gambling. Some countries punish their citizens arbitrarily, for such reasons as sexuality or religion. The Dark Web offers opportunities for people to create communities where they can share stories and tips or plan to meet in person.

You can even join a chess club and play with people from all over the world…

There are chat rooms, dating sites, and gaming forums where you can talk about anything, anytime, without the fear of being monitored. People can freely share their feelings, express their challenges and even find help from these groups.

Freedom of expression is alive and well in the crevices of the Dark Web. If you’re an artist, you can share your passion with people who truly enjoy creativity and self-expression. The same goes for writers, poets, and musicians. There’s even a site where origami lovers post their beautifully folded ornate creations, and some of them are so intricate it’s hard to believe they started as a flat piece of paper.

You’re probably thinking, “With all the negative and scary stuff on the Dark Web, I’ll never even try to access it.” You want to stay safe and keep away from it, right? Well, sorry to tell you, but some of your daily excursions on the internet already access part of the Deep Web, and even the Dark Web, because of the anonymity they provide.

For example, your company’s intranet is on the Deep Web so search engines cannot see it. There are sites you may have joined that exist behind pay-walls or require special registration. Many databases and webmail pages are also tucked away below the Surface Net, so your personal information is not exposed.

If you belong to a Facebook group—guess what? Yes, that group is on the Deep Web. Otherwise, anyone can search for that page, read the posts, and request to join. If you use online banking, that information is also on the Deep Web. Sites that host medical information and legal documents are hidden there as well. As you can see, there is a need for the Deep and Dark Webs because of the security they offer.

If you choose to go to the dark side of the web, be careful. You just might find something beautiful, or you could accidentally stumble upon the worst aspects of human nature. Like everything else the world has to offer; when you’re exploring, please use common sense and be safe.

Passwords – Outdated and Dangerous, But Necessary?

January 15, 2020 By Jason Williams

Here’s a quick test…

what do these seemingly random alphanumerical groupings have in common?

123456
password
123456789
12345678
12345
111111
1234567
sunshine
qwerty
iloveyou

That is a list of the top ten passwords used in 2019. Recognize any of these? If you don’t, you’re not necessarily in the clear, but your chance of becoming compromised or hacked is far less than someone who uses one of these passwords. If you do recognize these, you’re certainly testing your luck.

These days, creating and remembering passwords has become increasingly more challenging. If we had only one device that required a password, we could probably manage it quite easily. But with every device we use, most programs we need to do our jobs, and sites that require you to change your password every few months, it is estimated that the average person must memorize up to 191 different passwords. No wonder we often choose to take shortcuts!

The problem is over 80% of hacks are due to compromised credentials, otherwise known as stolen username and password information that are often traded on the Dark Web. In fact, in one month alone in 2019, Microsoft blocked 1.3 million attempts to steal password data, which would have led to dangerous phishing attacks, and other hacking attempts.

These harrowing statistics are why you hear the recommendations:

Never use the same password twice (IT Managers report 73% of all passwords used are duplicated in multiple applications, opening up multiple avenues for attack)
Never write down your passwords
Never share your passwords with anyone else
Never use real words or known information about yourself in your passwords
Avoid commonly used passwords (50% of all attacks involved the top 25 most used passwords)

Pay attention to that last stat: 50% of all attacks involved the top 25 most used passwords. See what we meant when we said if you recognized anything on that list you’re testing your luck?

Following all these rules and regulations, you’ll end up with passwords that are about 16-characters long, impossible to memorize, and, unfortunately, are still completely hackable (much more difficult, of course, but where there is a will, there is a way). So, what do we do now?

Password Manager

The first shortcut is a password manager. You can store all your passwords in one place. This makes remembering all your passwords much easier, but there you’re not out of the woods yet. The password manager is also protected by a password. If you’re utilizing a software like this, make sure that this password is especially complex, so that hackers aren’t even tempted, especially in the case of a brute force attack. If possible, turn on multi-factor authentication, especially on your password manager.

Multi-factor authentication

Many sites utilize multi-factor authentication. This extra layer of protection connects to your phone, email, or other authentication source, rather than relying solely on a password. We recommend enabling multi-factor authentication wherever possible. The only caveat here is make sure your secondary authentication source is equally secured with a strong password. No sense in double protecting yourself with a wide-open source.

Random Password Generators

These sites come up with secure passwords for you, but are typically a random jumble of letters, number, and symbols that are darn near impossible to memorize. If you’ve got a strong memory, this might be a good starting point, but if you’re like most of us, this may be more challenging than it’s worth.

How to craft the best password

Use a “Password Phrase” in place of random letters, numbers and symbols. Create something that’s easy for you to remember, but has no meaning to anyone else. For example I<3Fh@ck3rs43v3r!. Breaking this down, you get:

I – I
<3 – Love
F – fooling
h@ck3rs – hackers
43v3r – forever

This would be easy for you to remember because you understand the phrase, but difficult for a hacker to decipher because it’s not made up of real words. There’s no time like the present to get started and change your easy-to-hack passwords to something safer, because it’s always better to be safe than sorry.

Work at creating passwords that will be difficult to hack. Make sure to change them regularly. Never write them down, (especially on a Post-it Note stuck to your computer!). But most of all, make passwords an important part of your life. Don’t consider them a nuisance or a thorn in your side. Make a game out of creating passwords. Challenge yourself to be more creative each time you create one. Beat the hackers at their own game by making your password too time intensive to try and crack, and you’ll reduce your chance of your information showing up on the Dark Web. Worried about your information already being available due to past weak password use?

What to do now?

We will run a Dark Web Scan for you – for Free... This will let you know if your information is already in the hands of criminals, and will allow you to secure any accounts before they become sold and/or hacked. Contact us to Setup a 30 minute consultation with a security specialist from our team at no cost.

What is the Dark Web and Why Should We Care?

January 10, 2020 By Jason Williams

You’re happily humming along on the internet, thinking you’ve got a pretty good understanding. You can navigate your way around Google, Facebook, Amazon, and news sites. You’re actually only visiting four percent of the internet. There’s a whole world hiding beyond these safe surface-level sites, known as the Dark Web and it’s a much less hospitable place.

What exactly is the Dark Web?

The Dark Web is a conglomeration of websites that cannot be found on search engines or accessed via traditional web browsers because their location and identity is hidden through encryption tools such as TOR. TOR was originally created to protect military communication but now has a much broader utilization for both Dark Web purposes and highly secure communication. You typically have to access Dark Web sites utilizing TOR.

People create sites on the Dark Web in order to hide where they’re operating from, as well as to remain anonymous (TOR hides all IP information, identifying information, as well as data transfers). Over half of the sites on the Dark Web are used for criminal activities.

Why Do People Use the Dark Web?

One of the most prevalent uses of the Dark Web is buying and selling illegal goods, such as recreational drugs, weapons, fake identities, and organs. The proliferation of cryptocurrencies—like Bitcoin—has facilitated these sales. People living within totalitarian societies that restrict communication also take to the Dark Web to share their thoughts freely.

The most dangerous use of the Dark Web for businesses is the exchange of credentials (usernames and passwords) and identities. An individual’s stolen credentials can typically be sold on the Dark Web for as low as $1.

Hackers utilize these purchased credentials to:

Gain access to important financial information and steal identities (access to a Bank of America account holding $50,000 can be purchased for $500)
Access accounts for further phishing attacks
Threaten people with exposure of sensitive information (Remember the Ashley Madison hack from a few years back? Those credentials were dumped onto the Dark Web and hackers leveraged them to expose users).
Compromise other accounts using the same passwords and perpetuate the sale of personal Information

What can you do about it?

The average citizen will never have a reason to access the Dark Web, but their credentials could easily be floating around, endangering their offline livelihoods. Once your credentials are released on the Dark Web, there is precious little you can do to have them removed. However, you should, at the very least, know when you’ve been compromised so that you can immediately act, like changing your passwords and activating two-factor authentication.

We recommend utilizing a full Dark Web monitoring service that alerts you if credentials appear on the Dark Web. These services constantly scan the Dark Web for your information and alert you whenever something suspicious appears. These alerts don’t necessarily mean a breach has occurred, but they are very good heads up that something bad may be coming. You can then create a plan of attack before any damage is done. Granted, there will be your fair share of false positives, but we firmly believe in operating in the better safe than sorry camp.

How should you get started with Dark Web monitoring?

Our team can run a preliminary scan of your domain revealing the likely breaches in the last 36 months. We’ll then review that report with you and come up with a plan of action to alleviate any major dangers. Click here to request that scan.

What Is Phishing & How Are Hackers Using It?

January 8, 2020 By Jason Williams

While the number of people falling for sending personal information to the crown prince of Nigeria in hopes of receiving his promised wealth and riches seems to be dropping, phishing remains a major issue. In fact, the number of phishing campaigns pursued by hackers around the world increased 65% in the last year.

What exactly is phishing? Hackers mimic the emails, forms, and websites of legitimate companies in an effort to lure people into providing their private, personal information, like credit card numbers, social security information, account logins, and personal identifiers. The victim typically doesn’t realize they’ve been compromised until long after the event, and oftentimes only after their identity or finances are affected. In the past, an attack was carried out relatively quickly. As soon as the victim gave up their information, the hacker moved in and stole money from the compromised account. Today, it’s often more lucrative for hackers to sell that information on the Dark Web, resulting in longer-lasting and even more devastating attacks.

3 Types of Phishing Attacks

Spear Phishing

Phishing attempts directed at specific individuals or companies have been termed spear phishing. Attackers may gather personal information about their target to increase their probability of success. This technique is by far the most successful on the Internet today, accounting for 91% of attacks.

Threat Group-4127 used spear phishing tactics to target email accounts linked to Hillary Clinton‘s 2016 presidential campaign. They attacked more than 1,800 Google accounts and implemented accounts-google.com domain to threaten targeted users.

Clone Phishing

Clone phishing is a type of phishing attack whereby a legitimate and previously delivered email containing an attachment or link, has had its content and recipient address(es) taken and used to create an almost identical or cloned email. The attachment or link within the email is replaced with a malicious version and then sent from an email address spoofed to appear as though it came from the original sender. It may claim to be a resend of the original or an updated version to the original. This technique could be used to pivot (indirectly) from a previously infected machine and gain a foothold on another machine, by exploiting the social trust associated with the inferred connection due to both parties receiving the original email.

Whaling

Several phishing attacks have been directed specifically at senior executives and other high-profile targets within businesses. The term whaling has been coined for these kinds of attacks. In the case of whaling, the masquerading web page/email will take a more serious executive-level form. The content will be crafted to target an upper manager and the person’s role in the company. The content of a whaling attack email is often written as a legal subpoena, customer complaint, or executive issue. Whaling scam emails are designed to masquerade as a critical business email, sent from a legitimate business authority. The content is meant to be tailored for upper management, and usually involves some kind of falsified company-wide concern. Whaling phishers have also forged official-looking FBI subpoena emails and claimed that the manager needs to click a link and install special software to view the subpoena.

Have you ever gotten an email from your bank or medical office asking you to update your information online or confirm your username and password? Maybe a suspicious email from your boss asking you to execute a wire transfer. That is most likely a spear phishing attempt, and you’re among the 76% of businesses that were victims of a phishing attack in the last year.

Method of Delivery

Phishing scams are not always received through email and hackers are getting trickier and trickier with their preferred method of execution. In 2017, officials caught onto attacks using SMS texting (smishing), Voice phishing (vishing) or social engineering, a method in which users can be encouraged to click on various kinds of unexpected content for a variety of technical and social reasons.

Ransomware: The Consequence

Phishing is the most widely used method for spreading ransomware, and has increased significantly since the birth of major ransomware viruses like Petya and Wannacry. Anyone can become a victim of phishing or in turn, ransomware attacks. However, hackers have begun targeting organizations that are more likely to pay the ransoms. Small businesses, education, government, and healthcare often, don’t have valid data backups. Therefore they are unable to roll back to a pre-ransomed version of their data. Instead, they have to pay their way out or cease to exist. Outside of ransom costs, victims of phishing campaigns are often branded as untrustworthy and many of their customers turn to their competitors, resulting in even greater financial loss.

Why are effective phishing campaigns so rampant despite public awareness from media coverage?

Volume: There are nearly 5 million new phishing sites created every month, according to Webroot Threat Report. There are now even Phishing as a Service companies, offering phishing attacks in exchange for payment. One Russian website, “Fake Game,” claims over 61,000 subscribers and 680,000 credentials stolen.

They work: Over 30% of phishing messages get opened, and 12% of targets click on the embedded attachments or links, according to the Verizon Data Breach Investigations Report. In short, these hackers have gotten really good at looking really legitimate.

They’re simple to execute: New phishing campaigns and sites can be built by sophisticated hackers in a matter of minutes. While we think there are far more legitimate ways to be earning money, these individuals have made a living out of duplicating their successful campaigns.

Now that you have an understanding of what phishing is, our next two blogs will teach you How to Spot a Phishing Attack, and Fixing Your Weakest Link: Your Employees.

To Renew or Not Renew, That Is the Question

January 7, 2020 By Jason Williams

You’re prepared, at least mentally, to begin your migration to Windows 10 because you’ve read What Does Windows End of Life Mean to My Business? and Getting Ahead of Windows End of Life. Is your hardware ready, though? How you handle your IT (on your own, as needed support, or with a fully managed agreement) will change how you will have to deal with your transition. The following items should help you decide how to prepare your hardware for the Windows 10 migration.

Do It Yourself

If you own all of your own equipment and deal with IT issues in house, then you will want to get started on migrating your devices now. The good news is that Windows 10 is highly compatible with just about every PC out there. If you run into trouble, it’s likely a vendor incompatibility issue, not Microsoft, itself, so you’ll want to contact them directly. When you have that handled, upgrading from 7 to 10 is as simple as running the ISO file from Microsoft.com, from a USB, or DVD. The bad news is that it will take significant time migrating every PC in your business. You’ll also need to deal with a backlog of Microsoft customer service support if you happen to run into any issues. Remember that almost 70% of the world’s computers are still running Windows 7. It’s almost guaranteed that others will run into issues and need support, as well.

MSP

If you are with a managed service provider, you should be just fine. In fact, you likely already have a plan in place from your most recent business review. Over the course of the next few months, your IT company will ensure software compatibility with all of your line of business applications and contact any necessary vendors and schedule a time with you to come out and run the update once their sure everything will go smoothly. Now, would also be a good time to consider any hardware upgrades that you’ve been needing. All new PCs will automatically come with Windows 10, alleviating any upgrade issues now or in the next three years or so. The best part of it, you have to do nothing. No downtime for your business, no extra IT work for you, and no worries.

If you’re on a full managed services agreement, the upgrade is more than likely covered and any hardware needs will be handled on a new monthly payment plan (HaaS agreement). If you’re on a partial agreement or break/fix model, you’ll likely be billed for the time required to complete the upgrade. Either way, your IT company will have you completely in hand. Just remember that your service provider will soon be booked solid assisting other clients with this transition. It’s important to schedule now so you’re not left waiting.

Time to Get a Contract?

If you’re reading this blog as someone that had planned to do this upgrade on your own but have now decided that you don’t have the time or desire to do so? It’s time to contact PiedmontMSP. We’ll make sure that you’re taken care of through Windows 7 end of life and well beyond.