hacker

How Do I Know If My Phone Is Hacked?

2020-01-03 by Michelle Dvorak

How to Tell If A Phone is Hacked – Hacked Phones May Make Strange Noises – Your Phone or the Apps Installed on it May Not Function as Well as They Used To

Are you wondering if your Phone is hacked? Although we all complain about short battery life and apps that work slowly, they aren’t necessarily a sign that your phone is hacked. Often when a phone manufacturer or wireless provider pushes an operating system update or an app developer adds new features, we are left with a less than ideal user experience. Security apps can help protect a phone.

A hacked phone or the apps installed on it may not function as well as they used to. But sometimes, a slow phone is not just the result of a bad update. Hacked phone often have hot batteries, reduced battery life, apps that won’t open or close, or a phone that won’t shut down. These are all serious concerns that may require the use of antivirus software to clean up your hacked phone.

READ: 13 Signs Your Phone Is Hacked

READ: Apple Pay Mobile Wallet – How to Add a Card

Ways Your Phone Can Be Hacked

Malicious Charging Stations
If you think those convenient charging stations and airports and hotels are simply charging stations then guess again free charging stations found in restaurants airports and hotels can track your device ID and your location and send it back to the vendor who sells that information to advertisers even if the charging station is perfectly legit it’s possible that a hacker can use the charging station to install malware on your Phone you should only charge your Phone using a standard electrical wall outlet it’s OK to use USB charging cords at home but not in public places USB cords can transfer in charge of device but can also transfer data including malware.
Malware
Malware is any unwanted software or app installed on a phone, tablet, laptop, router, or other electronic device. Malware includes computer viruses, ransomware, adware, or any other computer code that has an undesired result or causes damage to a device. Ransomware is a type of malware that locks up files or an entire device and demands payment of a ransom, often in Bitcoin, to relinquish control. Adware is it type of malware that uses a phone for click-fraud or sends numerous. uncontrollable pop-up advertisements.
Malicious Apps
Malicious apps are often unintentionally downloaded from within games or during other app downloads. A malicious app is any unwanted app that. It may be malware, ransomware, adware, or other malicious code. Frequently hackers encourage people playing mobile games on their phones, to try out a new game by downloading it from within their current game. This is one of the most common ways to insert a malicious app and to a users’ device.
Smartphone users should never download apps outside an official app store. Although there’s no guarantee that Google Play or the Apple Store are virus free, they certainly offer more protection then downloading from third-party, untrusted websites.
Text Messages
Text messages are an easy way for a hacker to send links to malware file downloads or to malicious websites. With an SMS text message, the hacker or spammer sends a brief message to random phone numbers. The messages encourage the recipients to click on links. If the message recipient clicks on a malicious link, they begin a malware download or end up on a hacker’s spoof website that attempts to infect the phone, phish sensitive information, or steal money.
Phishing email
Phishing emails are another very common way to hack a phone. A phishing email is sent to a victim. If they open the phishing email, the message encourages tricks the reader into clicking on a link or replying with personal information. Just like the malicious text message, clicking on a link begins a malware download, steals login credentials to financial accounts, or sends the reader to a spoof website.
You’ll know that your phone is hacked by a phishing email because the phone begins to function differently right away. Often the phishing email links to a hacker website that loads pages very slowly because it’s actually using up your data connection to download malware or upload your personal information.
Someone Accessed Your Phone
Accessing your physical phone in person is one of the least tech savvy ways to hack a device. Someone might get a hold of your phone and install spyware which monitors all activities including calls, contact lists, text messages, and even location. If you lose or misplace your phone or leave it unattended in a public place, someone could also access all the information apps on your phone including credit card and banking apps.

To prevent your phone from being hacked by someone who gets breaks into it, use a password vault app or biometric login protection to keep the phone and all the information on it protected.

READ: How to Secure Your Android Phone from Hackers

Signs That Your Phone Is Hacked

New Apps Are Installed on Your Device–And You Didn’t Install Them
If you log into your Phone one day and find that there are new apps on your screen or listed under settings then your Phone is hacked sometimes with an operating system update the Phone manufacturer or your wireless provider may install new apps are update old ones period this can cause them to look different or function differently but if you see apps that seem very unfamiliar and won’t let you uninstall them then that’s a sign that your Phone is hacked
Your Device Runs Hotter Than Before
Another sign that your phone is hacked is that it feels much hotter than normal. Ransomware, adware, and spyware can run constantly. They use up a lot of system resources and can cause the phone to feel warm or even hot to the touch. Anytime your device is feeling strangely hot to the touch, it’s a sign that is doing something without your interaction or knowledge. It’s possible that’s receiving and sending data in the background are keeping apps open after you think they are shut down.
Low Battery Screenshot
Shorter Battery Life
Just like with a device feeling abnormally hot, shorter battery life is a sign that a phone is hacked. Malicious apps tend to stay open and run continuously, even when you think the phone is locked. Malware may run in the background without any notifications or windows open on top so you the user is unaware. Shorter battery life is a sign that your processor and data are being used constantly at the behest of malware or a rogue app.
You Receive Strange Messages
If you receive strange text messages this may be an attempt to hack your phone. Hackers send messages to phone to trick recipients into clicking on links to infect their phone or use it as part of a bot net.
Your Phone Sends Messages
If your phone is sending messages to people on your contact list or even phone numbers that you don’t recognize, that’s a sign that your phone has been hacked . Although hackers are out to make money, they may first try to use and hacked phone to infect as many other devices as possible. Once the phone is hacked, it can be used to attempt to infect even more phones, tablets, or laptops. If you’re phone is sending messages that you did not initiate, then this is a sure sign that your Phone is compromised.
Websites and Apps Look Different or Strange
If a hacker installed malware on your phone and is intercepting messages, calls, recording information, or using data, it may be affecting how things look. Apps and websites may look strange. The colors and resolution on the screen may look different than they did before. If your phone just doesn’t look the same and it has not received a major operating system update recently, your phone might be hacked.
Pop-up Windows or Notifications Appear on Your Phone
We’re all familiar with annoying pop-up windows, advertisements, or notifications that appear on websites or from apps. If you haven’t installed anything new or made any settings changes and pop-up windows or other notifications start appearing on your phone, then that’s a sign that your phone is hacked by malware or adware. Look for new icons on your phone’s screen. Go into your phone’s settings and look at the list of apps to see if there’s anything suspicious or new. You may need antivirus software to help remove it.
Apps Stop Working Properly
When your phone is hacked, some apps may stop working properly or not function altogether. This includes apps that won’t open or are very slow to function. You may not be able to shut down apps or close web browsers. Malware is often programmed to resist being closed or uninstalled. If the user manages to close the app, it simply starts up again. if some apps are not working properly try to locate the malware and uninstall it. If you can’t, then get a good antivirus software with mobile device protection.
Your Wireless Service Provider Bill Has Unexpected Charge
Hacked phones often run constantly sending data back and forth in the background without your knowledge. If you notice that your phone is using a lot of data or see on your cell phone bill that there are high data charges, this is a sure sign that your phone is hacked. Although it’s possible there just may be a rogue app that has given itself permission to run in the background all the time excessively high data charges, a hot phone case, and a short battery life are often the sign of a hacked phone. If you cannot remove the malicious app, then install antivirus software to clean up your phone. It’s best to have antivirus software installed on the phone before you ever need them.
Your Email from The Device Is Getting Blocked by Spam Filters
If you find that your email from your phone was blocked by spam filters or friends are saying they never received your email, it may be because your email address is associated with spamming. When your phone is hacked, a spammer might use your text messages or email accounts to infect more phones. This may result in your email being blocked by email services and their spam filters.

READ: iPhone Upgrade – How to Safeguard Your Money and Wipe Data

My Phone Is Hacked – What Do I Do?

Verify that there is no money missing form your bank account, fraudulent transaction on your credit card, or app store purchases that you don’t recognize. Notify your bank and credit cards that you’ve been hacked. You can also get identity protection and antivirus software for your phone. Change all of your passwords and use two-factor authentication (2FA) and including biometrics if your phone or apps use them.

How to Prevent Your Phone from Being Hacked

Use A Mobile Security App
Do not “Root” or “Jailbreaking” Your Phone
Keep Your Accounts Secure by Using Unique and Complex Passwords for Every Account
Don’t Use Public WiFi for anything except web browsing
Never Click on a Link in a Text, Message, or Email from an Unknown Number

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

Eight Ways to Protect Your Money from Gas Station Credit Card Skimmers

2019-12-16 by Michelle Dvorak

Gas Station Credit Card Skimmers – How to Spot a Payment Card Skimmer and Protect Your Money from Card Skimmers at Fuel Stations

Gas station credit card skimmers are devices that hackers use to read credit card credentials at fuel station pumps. An electronic credit card reader is installed on a fuel pump to read and record the information from all payment cards used at the pump. The hacker then retrieves data collected by the reader. Visa is warning consumers of a new genre of gas station credit card skimming hack which requires no physical hacking device to be installed, making it imperceptible to the buyer.

After the hacker retrieves stolen card numbers from the reader, they clone the payment card numbers onto physical cards and sell them. They may also steal your identity or sell the card numbers on the dark web or use the cloned cards to make purchases for themselves. In the case of bank cards, the scammer may withdrawal your money at an ATM if they can capture the PIN number too.

READ: Deep Web vs Dark Web – What’s the Difference?

What Is A Gas Station Credit Card Skimmer?

With gas station credit card skimmers, hackers install an electronic payment card reader either on the inside or outside of the fuel pump. The reader reads and records the payment card numbers and stores them. A single fuel pump card skimmer can capture data from 30 to 100 cards each day. The information must be retrieved from the reader meaning the thief must return to the scene for each download. Hackers makes money by cloning the stolen card numbers onto physical cards and selling them. They may also sell the credit card numbers on the dark web.

The Leatherman FREE – The Ultimate Problem Solver
Up To 75% Off Leatherman Gear!

Gast Station Credit Card Skimming Malware

VISA stated that the company is aware of gas station POS malware that has compromised five North American fuel merchants. The malware infects the fuel seller’s network. If an employee clicks on a link in a phishing email, a malware download is initiated. Once infected , the malware steals payment card information from the fuel pumps.

Using phishing emails, the scammers target merchant employees. When the employee clicks on an email link, malware is downloaded to their computer and infects the entire network. When a customer buys gas the POS terminal on the fuel pump sends unencrypted data to the company’s network where it is also read by the malware.

READ: How to Unlink a Payment Method from Android Wallet

What Does a Gas Station Credit Card Skimmer Look Like?

Gas Station Credit Card Skimmers are installed on the inside of the fuel pump. The pump door or dispenser door must be opened to place the reader inside. Internal readers are hooked up to the payment card reader and PIN pad to capture postal codes and PIN numbers. External card skimmers are installed over the top of the card reader that the buyer uses to swipe or dip their payment card. An external gas station credit card reader is in plain sight but may be hard to spot as the skimmers are designed to fit snugly over the scanner.

A more discreet version of an external credit card readers, called a shimmer, is inserted directly into the card reader slot. The shimmer reads the information from any card that is dipped in the card reader, like cards with a chip, for example.

Gas Station Card Skimmer — Photo credit: Royal Canadian Mounted Police in Kamloops, Canada

How to Spot a Credit Card Skimmer

Look for signs of tampering on the fuel pump door or panel. Make sure the gas pump panel is closed and undamaged. Many states seal the pump with a security seal. Make sure it is intact. Look at other nearby pumps to see if they look the same or have a seal.
Look at the dispenser handle casing and make sure it is intact too. Internal card readers can be slipped inside the panel surrounding the pump handle.
Check for any loose parts, wires, or damaged casing on the payment credit reader. If it’s hard to insert your card, a skimmer may be present.
Look for hidden cameras that could record you as you enter your PIN.
Inspect the keypad. Hackers can install fake keypads to record your PIN.
Look at the card reader and pump. Does it look different than other at the station?
If the housing around the card reader or pump is loose, scraped, or otherwise damaged the fuel pump may be compromised.

What Is Card Skimming?

Gas station credit card skimmers involve thieves attaching electronic card reading devices on gas pumps. Skimmers can also be attached to cash machines and POS terminals at checkouts in stores.
Credit card skimmers read all of the data from the magnetic strip on a payment card. This gives the hacker the cardholder’s name, credit card numbers, and the expiration date. Internal readers may be attached to the PIN pad. In the case of an external reader, the scammer may also install a camera in hopes of capturing the PIN numbers from bank debit cards.

Most gas station credit card skimmers require that the hacker return to the fuel pump to collect the stolen payment card data. The hacker may need to open the pump again to download the data to a USB flash drive. More modern versions can send transmit the stolen payment information over Bluetooth, so the hacker only has to be close to the fuel pump to download the stolen payment cards. But some can even send the data via SMS text message, meaning the thief does not have to return to the scene until they want to remove the skimmer.

How to Protect Yourself from Gas Station Card Skimmers

No precaution of foolproof but common sense can o a long way.
Use fuel pumps in highly-visible locations within the attendant’s view. Hackers need an opportunity and time to install a credit card skimmer. They are often discovered on fuel pumps that are furthest away from the attendant, out of view.
Monitor your credit card account and add fraud protection.
Enable SMS Text messages on your credit card so you know when the card was used
Do not use a bank card or debit card as a gas station for payment. A credit card adds a layer of protection in between the hacker and your money
When in doubt, pay inside.
Pay with cash which is hacker proof but not very convenient.
Pay with a credit card rather than a debit card. Most credit cards offer consumer protections against fraud.

Michelle Dvorak

www.metrony.com/

The Mueller Report – Russian Spear Phishing Emails

2019-04-23 by Michelle Dvorak

The Mueller Report – How the Russians Hacked the DNC

The famous Mueller Report is out and if you are working your way through the redacted version, then you should have come across the section on Russian interference with the 2016 US Presidential election. This interference involved multiple cyber security attacks. The vectors come from a few different Russian Army Units and involve custom malware as well as hundreds of email spear phishing attacks. It was no secret that the spear phishing attack snagged the login credentials of Clinton Campaign chairman John Podesta as well as passwords from Democratic IT workers.

The Report On The Investigation Into Russian Interference In The 2016 Presidential Election, Volumes I and II, by Special Counsel Robert S Mueller, III are collectively and affectionately known as the Mueller Report. The deep dive into the various cyber security attacks during the 2016 US Presidential election, Trump versus Clinton, and how much Russian interference went on begins on page 36 of the Mueller report, Volume I. A redacted version of the Report was released to the public by the Department of Justice on April 18, 2019.

The Russian intelligence service is known as the Main Intelligence Directorate of the General Staff of the Russian Army or GRU. The Mueller Report explains that GRU began hacking the email accounts of Democratic Presidential candidate Hillary Clinton’s campaign workers – both volunteer and employees in the spring of 2016. The most infamous infiltration was the successful breach of Clinton campaign chairman John Podesta’s email. The Russian GRU also hacked the IT systems of the Democratic Congressional Campaign Committee (DCCC) and the Democratic National Committee (DNC). With access to email accounts and the IT system, GRU stole hundreds of thousands of documents, according to the Mueller Report. In June 2016, the GRU released hacked documents through DCLeaks, and Guccifer 2.0. In July 2016, hacked documents were also released through WikiLeaks with Podesta’s emails being released later in October 2016.

One GRU Unit infiltrated US targets with malware, while another GRU Unit launched spear phishing campaigns. According to page 37 of the Mueller Report, Volume I, GRU Unit 26165 hacked the DCCC and the DNC along with the email accounts of Clinton campaign workers. GRU hackers sent hundreds or targeted spear phishing emails and were successful at tricking recipients into giving up login credentials.

What Is a Spear Phishing Email?

Most are familiar with the term phishing email. That’s an email sent to hundreds or thousands of email accounts. Phishing emails ask, or fish (phish), for more information. The goal is to get the recipient to give up some persona data or financial information. A common phishing email tactic asks the user to respond to the email and simply enter in bank account or credit card details in the reply email. Another frequent phishing email strategy encourages or even threatens the recipient to click on a link in the email. Clicking the link takes the reader to a website page that prompts, or phishes, for more information. The users could be asked for personal data like birthdate, government ID numbers, or credit card numbers. The user might also be asked to reset a password as they were in the case of the Clinton campaign phishing attack. Of course, because the website was a spoofed website, no one was resetting their passwords, they were giving them to the hackers.

A spear phishing campaign is the same as a phishing campaign, except that they are sent to a smaller, very focused group of recipients. Spear phishing emails may be sent to one or more people. In the case of the Russian GRU spear phishing, the emails were sent to hundreds of work and personal email addresses known to belong to Clinton campaign workers. In a spear phishing campaign, the hacker already knows a few details about the recipient – most likely, where they work, first name, job title, or location. Spear phishing is a multi-step process where the hacker attempts to learn more about the target with each round of contact. Personal details may be gleaned from corporate websites, social media, and public records. Because a spear phishing campaign is personalized with information the hacker has learned about the recipients, the emails seem legitiate to the victim and thus are more effective in getting the victim to act.

How Did the Russian GRU Spear Phishing Attack Work?

Russian GRU officers sent spear phishing email to Clinton campaign workers email addresses. This included official campaign emails associated with the candidate’s website, hillaryclinton.com. It also included spear phishing attack on Gmail accounts used by campaign workers. The emails were targeted at employees of the campaign at all levels as well as volunteers. Campaign chairman John Podesta and junior volunteers on the advance team were also targets. Access to a DCC server was gained by successfully spear phishing a DCCC employee and stealing login credentials.

How Was John Podesta’s Email Hacked?

Podesta was spear phished successfully. Russian hackers sent Podesta a spear phishing email on March 19, 2016. The email appeared to be a Google security alert and contained a shortened link that supposedly would secure his account. Podesta clicked on the link and it led him to a spoofed website that directed him to confirm his email credentials. Once he entered his email account and password, the hackers had access to all his emails. True, Podesta did forward the phishing email to the IT department asking for help. But IT responded incorrectly to the incident and marked it as “legitimate.” That employee later said that he meant to mark it as illegitimate.

Over 20,000 pages of Podesta emails were subsequently release by WikiLeaks in October and November 2016. Podesta and the Clinton campaign never spoke to the authenticity of the emails.

How to Tell If an Email is a Phishing Email

If you think you may have a phishing email or a spear phishing email – don’t do anything. Do not open the email (if you haven’t already). Don’t click on any links and don’t forward it to anyone but your IT department. Obviously, if you receive a phishing email at your personal email address, you don’t have an IT department to send it to. When I receive Amex phishing emails I send it to their IT department. If you can, telephone the person who supposedly sent it. If it’s not from someone you know, then mark it as SPAM and delete it. If you are concerned that this email is from a legitimate company or person, just go straight to their website and find contact information there.

Read our guide on how to spot a phishing email.

Michelle Dvorak

www.metrony.com/

DHS Warns of Tragedy Related Scams

2019-03-18 by Michelle Dvorak

Avoid becoming a victim of cybercrimes by taking caution with tragedy related online requests, data, and information

The US Department of Homeland Security (DHS) warned the public through its Cybersecurity and Infrastructure Security Agency (CISA) about potential scams and malware connected to the recent New Zealand mosque shootings. A CISA post advised that hackers capitalize on tragedies and attempt to scam the public, usually for money. Typical online scams include soliciting donations for fake aid organizations or sending phishing emails, text messages, or calls to trick readers into visiting spoof websites that download malware or ask for money. Internet users should be especially wary of hackers and scammers attempting to defraud the public online using recent tragedies like the New Zealand shooting and the two 737 plane crashes.

Phishing emails often look legitimate. They can appear to originate from national or global charities when in fact, they have nothing to do with any legitimate organization. Internet users must be careful when opening any email or responding to a social media post related to the shooting, even if it appears to originate from a trusted source. Phishing emails might appear to solicit donations for a charity or cause. In reality, they contain malware or links to spoof websites that initiate malware downloads.

Boeing 737 Malware Scam

Unscrupulous cyber criminals take no pause and will prey on emotions after mass tragedies like hurricanes, typhoons, shootings, and commercial airline accidents. A Boeing 737 accident related malware has emerged. The new malware campaign is circulating online and uses the tragic Lion Air and Ethiopian Boeing 737 Max plane crashes as a conduit to spread malware with spam emails. The spam emails contain supposed “leaked” documents about other imminent airplane crashes. The documents supposedly disclose to the public data about other airline companies that will suffer crashes in the near future. The attachments are malware that infects the user’s computer.

The email encourages the recipients to review and of course, kindly forward the email with family and friends, so they too may be informed. The only thing the recipients will receive from these emails is more malware.

The spam emails originate from the email address info @i sgec.com, a fake intelligence analyst. The subject lines vary but contain something like “Fwd: Airlines plane crash Boeing 737 Max 8”. They also contain a JAR file as an attachment with names like MP4_142019.jar.

What is a Phishing email?

Phishing emails are ordinary emails sent by hackers with malicious intentions. A phishing email contains false information. It may prompt a recipient to replay with payment information, download malware to a computer, or direct the reader to a spoof website where information is gathered, or more malicious apps are encountered.

What is Malware?

Malware is any software or hardware that intends to steal data from or take control of a device, network, router, or IT system. Malware campaigns aim to infect as many computers as possible. Ransomware is a form of malware that takes control of a device until a ransom is paid.

Michelle Dvorak

www.metrony.com/

Ukrainian Charged for Hacking SEC’s EDGAR

2019-01-22 by Michelle Dvorak

Ukrainian Hacker Charged for Hacking SEC’s EDGAR

Ukrainian hacker Oleksandr Ieremenko was charged by US Officials for his part in hacking into the Securities and Exchange Commission (SEC) EDGAR financial filing system. The hacker allegedly stole stock market reports before they were released to the public. The SEC also charged three Ukrainian traders, a Russian trader, two traders in California, and two entities for their role in the cyber security hack.

Ieremenko allegedly hacked EDGAR files that contained nonpublic earnings results. In total, 157 earnings releases were hacked and used to make stock trades valued at more than $4.1 million in profits between May and October 2016.

Hacker Ieremenko allegedly sent phishing emails to SEC employees to gain access to the SEC network. He then infected machines with malware that extracted the financial filings. The malware hacked test filings that companies submitted to EDGAR before actual filings that were intended to be made public.

The traders used an offshore entity and nominee accounts to conceal their identities when they placed trades. Financial information not yet released to the public provides a window of opportunity for the traders to use the data to place profitable securities trades before the information is made public.

“The traders compensated the hackers, including Ieremenko, for the information by either paying regular fees for access to the hacked press releases or by kicking back a portion of their trading profits,” the SEC indictment reads.

What is EDGAR?

The Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system is the SEC’s online filing system. Companies submit their required financial filings to the SEC via EDGAR. The system processes around 1.7 million electronic filings per year.

EDGAR lists millions of corporate disclosures including earnings results, annual and quarterly earnings reports, pre-IPO data, and confidential information on mergers and acquisitions

The Ukrainian hacker and some of the traders were previously charged in 2015 for stealing over100,000 unpublished press releases from PRNewswire, Business Wire, and Marketwired. The information in the still unpublished releases was used to make money on stock market trades.

The SEC investigation was conducted by the Market Abuse Unit and the Cyber Unit. The U.S. Attorney’s Office for the District of New Jersey also announced related criminal charges. Hackers Ieremenko and Radchenko were charged with 16 counts of hacking- and fraud-related charges. The NJ U.S. Attorney’s Office intends to seize all property tied to the alleged conspiracy.

Ieremenko remains at large in Ukraine.

Michelle Dvorak

www.metrony.com/

Marriott Hack Impacts 500 Million – Are You One of Them?

2018-11-30 by Michelle Dvorak

Marriott Hack – Marriott reports data breach of Starwood hotels guest database

Hackers compromised Marriott’s Starwood Hotels guest reservation system. Marriott International Inc. announced that hackers compromised their Starwood Hotels guest reservation system beginning in 2014. The data of about 500 million hotel customers was hacked over a span of years. Hotel customer information including passports and credit cards were compromised along with other personal information.

The hack began before Marriot merged with Starwood. Marriott officials stated that hackers had “unauthorized access” to the Starwood reservation system since 2014 until the cyber security breach was discovered last week. The numbers, so far, making this the second largest hack in US history. Many times, data breach numbers are revised upward as the investigation carries on.

Marriott Hack – Am I Affected?

Marriott officials will be sending emails to the 500 million customers affected by the data hack. There was no timeframe given. I did stay at Aloft during the period when hackers were in the guest reservation system. I’m also a Marriot rewards member. I have not received an email.
The last time I emailed Marriot regarding the rewards programs merger, it was over three months before they responded. Just sayin’ ?

What Marriot Brands are Affected by The Hack?

The hack affects Marriott’s Starwood hotels. Customers that made a reservation at these Starwood hotel brands, since 2014, may be affected:

Starwood Brands

Westin
Sheraton
The Luxury Collection
Four Points by Sheraton
W Hotels
St. Regis
Le Méridien
Aloft
Element
Tribute Portfolio
Design Hotels

In its quarterly filing dated November 6, Marriott added information about cyber security concerns. The filing stated, “We have experienced cyber-attacks, attempts to disrupt access to our systems and data, and attempts to affect the integrity of our data, and the frequency and sophistication of such efforts could continue to increase.”

What Information was taken by Marriot Hackers?

The Marriott hack affects an estimated 500 million Starwood hotel guests. The name, mailing address, phone number, email address, passport number, Starwood Preferred Guest (“SPG”) account information, date of birth, gender, arrival and departure information, reservation date, and communication preferences of about 327 million of the 500 million customers was stolen by hackers. Marriott also said that some credit card numbers may also be compromised.

The credit card numbers were encrypted in the guest reservation system. However, Marriott said it may be possible that hackers can decrypt the credit card numbers. There are two components needed to decrypt data secured with Advanced Encryption Standard encryption. Marriott has not been able to rule out the possibility that both were hacked.

Marriott Hack – What Do I do next?

Marriott’s phone number is In the USA & Canada is 1-800-535-4028

The main Marriott.com reservation webpage conveniently does not mention the hack at all. The press release can be found elsewhere on thier website. Although the Marriott press release lures you into thinking that the information can be found on the old Starwood.com website (which has not run in some months.) It’s not on Starwood. It is actually on a third-party cyber security firm’s site.

Here is what Marriott is offering to help impacted hotel guests.

Marriott Dedicated Call Center

Here are the perks that Marriot is supposedly offering hacked customers.

A Dedicated Call Center
Marriott established a dedicated call center -although no phone number for that call center was given. A+ customer service. The website also proactively excuses itself for its anticipated high-call volume. Sounds like they plan of staffing with enough people to answer right away? Message me if you can find the dedicated call center number.
If you’re looking for Marriot’s phone number, In the USA & Canada Marriott’s phone number is In the USA & Canada is 1-800-535-4028.
I called the number since I have rewards member status. My call to Marriott customer service was met with a phone tree and no mention of the data hack or what to do. The menu selection did not give an option to find help with the data hack. The voice prompt did not recognize “data hack” as a dialing option either. If you want to blow by the phone tree press #5 at the voice prompt for the need help with “something else” option. After being transferred, the phone line rang busy and was disconnected. Good job once again Marriott. Sounds like my friends who transferred to Hilton last summer were on to something.
Email Notification
Marriott supposedly began sending emails on a rolling basis on November 30, 2018 to affected guests from the Starwood guest reservation database. I’m still waiting for mine.
Free WebWatcher Enrollment
Marriott is providing hacked guests one-year of WebWatcher service which monitors websites for black market data. The link to begin the enrolment process goes nowhere. Nice work again Marriot.

When Did Marriot and Starwood Merge?

Marriot International, Inc bought Starwood and its brands in September 2016. The sale was valued at about $13.6 billion. The deal created the world’s largest hotel chain with 1.3 million rooms and more than 110 million loyalty program members. Marriott completed the merger of the two brands’ loyalty programs in August 2018.

Michelle Dvorak

www.metrony.com/

How to Become a Cyber Security Expert

2018-11-06 by Michelle Dvorak

How to Start a Cyber Security Career

A career as a cyber security expert can take a few paths. It is possible to acquire the training you need in a university setting, but many cyber security expert are self-taught. There are others who have a blend of formal education combined with self-training. This may involved hacking into computer systems (legally) that belongs to you and evolve into working your way around more complex machines and internet systems. Like many other trades, cyber security experts learn by reverse engineering and then reassembling someone else’s work. Hackers learn their skills by working though hardware and software. Cyber security professionals are often white hat hackers.

A hacker is a person who breaks into hardware, software, apps, or IT systems unlawfully. Generally the goal is to grab money or valuable data from the victim. This is a more modern meaning of the word. In the 1980s, the word hacker meant anyone who was working around, or “hacking”, an IT system for the sake of making something work or to improve it. Sometimes programmers “hack together” a solution to a problem. The word hacker now indicates – a hacker is someone that breaks into an IT system or machine with malicious intentions.

Learn to Code

Those who choose to become cyber security experts are often programmers or system administrators. An established IT career is a good starting point to becoming a cyber security expert. System administrators typically have college degrees – a Bachelor’s or MIS degree – plus a few years of experience working on IT systems. Experienced IT professionals easily transition to cyber security careers after some additional training which may include certificates and vendor sponsored training.

If you are not already a programmer, then consider picking up some knowledge of coding. This will enable you to be able to hold a conversation about computing environments so you can act as a go-between in corporate teams. Even if you don’t plan on being the forensics person, a basic knowledge of programming will allow you to communicate effectively with IT teams and management.

Read Cyber Sec News

Set up an RSS feed and follow trending cyber sec topics and stay relevant by reading daily IT news. You should definitely read cyber security news to stay on top of current and upcoming laws and regulations. Get certified from IIPA to learn more about regs or try CompTIA for world class certifications. Read the current cyber security laws and become an expert. For example, Chicago and California both already both have data protection laws.

Cyber security experts may be former hackers themselves in the literal sense of the word. At times, companies have held hack-a-thons or offering a bounty for hackers to break into a system. Large corporations looking to secure a high level of cyber security are know to invite hackers to break into their systems either to cause a certain action to occur or sometimes to acquire certain data. The best or winning hacker, might receive a prize and sometimes they may become an consultant to the very same company they just broke into.

Universities are offering college degrees, becoming a cybersecurity expert does not necessarily require a college degree.

Steps to Become a Cyber Security Expert

Earn a Bachelor’s Degree. A bachelor’s degree may be required by large corporations to work as a computer security expert
Consider certificate programs for cyber security specialty knowledge
Practice programming and hacking (lawfully) on your own
Increase your level f expertise through continuing education and hands-on experience

Michelle Dvorak

www.metrony.com/

Cyber Security News Update 10-20-2018

2018-10-20 by Michelle Dvorak

Cyber Security News Update October 20, 2018

A North Korean hacking group known as Lazarus has stolen cryptocurrencies valued over than half a billion dollars. The hacks were carried out in 14 separate cyber attacks. Lazarus hacked cryptocurrency exchanges with spear phishing, social engineering, and malware attacks.
Source: khaleejtimes

According to the Associated Press, hackers breached a government computer system that is connected to HealthCare.gov. The hacked system is an insurance agent and broker portal used by insurance agents to directly enroll their clients. It contains extensive personal data including Social Security numbers, income, and citizenship status. The hacked system is connected to the IT system that US citizens use to apply for healthcare under the misnamed Affordable Care Act. The system is expected to be up and running in time for the open enrollment period that begins on November 1st. All users with hacked data will be notified in the future although a date was not specified.
Source: AP

Michelle Dvorak

www.metrony.com/

Uber Fined $148M For Data Breach

2018-09-27 by Michelle Dvorak

Uber Fined $148M Following 2016 Data Breach

Uber was fined $148M this week. The sanctions were levied after the ride-sharing company took a year to disclose a major data breach. The hack occurred in late 2016 yet Uber did not disclose the breach to the New York State Attorney General’s Office and the Federal Trade Commission until November 2017. Uber failed to inform affected drivers, customers, and the public that hackers had accessed the personal data of Uber drivers and customers. Previously, the New York Attorney General fined Uber $20,000 in January 2016 for failing to disclose a 2014 data breach. The new settlement was announced on yesterday.

The names, email addresses, and phone numbers of about 50 million Uber riders were compromised in the 2016 hack. The personal information of 7 million drivers was hacked including the driver’s license numbers of some 600,000 U.S app users. A forensic investigation, a common practice for data breaches, showed that rider trip histories, credit card numbers, bank account information, Social Security numbers, and birth dates were not downloaded

The hackers sent an email to Uber demanding a ransom of $100,000. Instead of reporting the hack, Uber hid the evidence of the theft and paid the ransom to keep news of the hack quiet.

How Did the 2016 Uber Hack Happen?

Two former Uber employees accessed a GitHub repository used by current Uber software engineers. The hackers used login credentials obtained from GitHub to gain access to data stored on an Amazon Web Services (AWS) which was also used by Uber engineers. The AWS cloud service contained the rider and driver personal information.

Not the First Time for Uber

At the time of the 2016 data breach, Uber was already under scrutiny for multiple privacy violations involving its ride-sharing app. The Uber app was used to track employees’ spouses and significant others. The app also had a mode known as Greyball that had helped drivers identify and avoid local officials and law enforcement in cities where Uber was meeting resistance.

Uber has a history of violating ethical concerns and pushing legal boundaries. The FTC had issued a complaint against Uber for violating data privacy standards when their app continued to track users who had uninstalled the app from their phones.

In October 2017, the Uber app was found to have constant access to iPhone screens even when the app was closed. Apple had granted the Uber app exclusive access to iPhones, using the Apple only entitlement “com.apple.private.allow-explicit-graphics-priority.” Entitlements are like the permissions on Android phones -asking users to access the camera, microphone, or contacts. The entitlement that Uber has employs allows their app to place things on your screen, usually images or maps.

Uber reached the agreement about the fine with all 50 states and the District of Columbia. The money from the settlement will be distributed based on the number of drivers in each state.

What is Uber?

Michelle Dvorak

www.metrony.com/

Spammer vs Hacker – What’s the Difference?

2018-09-11 by Michelle Dvorak

Spammer vs Hacker – Is there a Difference?

Lately, I’ve written quite a lot about phishing emails. While explaining how phishing scams work, I noticed that some use the terms “hacker” and “spammer” interchangeably. Although a hacker might be a spammer because there is no way out of that email list, not all spammers are hackers. Let’s understand the differences by examining how they both operate.

The Motives of Hackers and Spammers

A hacker is a person or group of people who break into IT systems, apps, and hardware to steal data or money from others. Hackers may also lock up websites or IT systems in exchange for ransom. They may also be at work skimming credit card information and transferring files with sensitive information. The goal of a hacker is to take something – money, control, or data.

Spammers have similar goals, but it is usually about the money. A spammer is a person or group, that sends large quantities of unsolicited emails to a list of users. Spammers are usually out to make money through legitimate or bogus offers.

What do spammers and hackers have in common?

It’s about their goals. Both the spammer and the hacker generally are looking to gain some cash from their efforts, but not always. Sometimes the spammer is trying to increase website traffic or build an email list to use in the future. The spammer might be after passwords, files, or other private information.

Since the 1980s, the word hacker has been warped by pop culture to indicate something with criminal intention. The original definition of the word hacker indicated any computer programmer or system administrator who is developing (or hacking) a workaround for a difficult computing issue. Hackers “hack” together solutions. In everyday use, the word hacker now means someone that is hacking into or breaking into a system with malicious intentions. Like many other technology terms there are degrees or flavors of hackers – “black hat”, “white hat” and “gray hat” all indicate level of criminal activity. Black is the shadiest and implies criminal intentions or complete rule-breaking. Another word for a criminal hacker is “cracker” but no one uses that word anymore. If you told someone a cracker broke into your IT systems, they’d think Saltines were at hard at work scamming credit card numbers!

There is such a thing as a white hat hacker. This is a person who is hired by an enterprise IT system administrator to break into their own network. The idea is to allow someone who is unfamiliar with an IT system free reign to find weaknesses in a system. The white hacker is for hire. Their results are used to strengthen the system.

Spam emails, referred to simply as SPAM, are emails that are unsolicited. In other words, no one wants them. They are associated with scams, but don’t always have to be completely illegitimate. Sometimes they are marketing emails from completely legitimate service provides. But still, they are unwanted.

Spammers are people who send mass emails generally with the goal of making money. They don’t set with the intention of taking over your laptop and maintaining control until a certain ransom is paid. They don’t try to steal credit card numbers – that’s the line between spammer, scammer, and hacker. Spammers send out groups of emails, usually advertisements of some sort. The hope is to get the recipient to click on a link and respond to some offer. It’s true that many spam emails contain legitimate offers like real estate listing and fitness equipment. The recipients’ purchases make money for the spammer. The email contains legitimate products or services. The buyer does receive their purchase and he spammer gets a cut. The reasons SPAM is illegal is because the emails are cleverly disguised and unsolicited. The FTC requires that advertisements be disclosed to the reader.

It is true that many spam emails contain scams. Like other old school scams, they frequently targeted the elderly with malicious intentions to separate them from their money. These spam emails can trick a recipient into to signing up for a bad reverse mortgage, an unnecessary insurance policy they don’t need, or some other shady financial deal. Like black hat hackers, spammers are criminals.

Spamming and hacking are both crimes. The Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act) was signed into law in December of 2003. Its goal is to prevent spammers from using and abusing email addresses of business and private citizens. Note, the CAN-SPAM Act doesn’t require senders to obtain an email recipients’ permission to before sending them an email. It does however, require that they be removed from the list and not sent any additional emails as soon as they opt-out. This is why buying an email list is not a good idea for marketing purposes. Many reputable email providers won’t allow purchased lists to be used on their email servers.

That’s where it can get shady tricky discerning a spammer from a hacker. Both a spam email and a phishing email may have an unsubscribe button. It is possible the spam email does have a functioning unsubscribe button (but not likely.) The phishing email sent by a hacker might also have an unsubscribe button. If it does, that will confirm your email address is working and monitored and cause more emails rather than removing you from a list.

Hacking is prosecutable under a number of federal and international laws, depending on the crime and evidence. Wire fraud, obtaining information from a protected computer, identity theft, possession of unauthorized access devices, and intentional damage to a protected computer are all common charges.

Michelle Dvorak