!!
  + 
 +1 (310) 820-5555  letschat@1mcybersecurity.com
 •••, , •0
# 1:M Cyber Security Update 4/5/19
Hi everyone,
Here are some recent cyber security news I think are interesting/relevant for you guys to check out:
**———**
***Firefox ‘Send’ allows you to encrypt and send large files for FREE via your browser***
Using any browser of your choosing, simply go to . and you can now **send password-protected, and fully encrypted large files for free, and up to 1GB in size (or 2.5GB if you have a Firefox account)**. Upload or drag and drop files, and Send will generate a link that you can set to expire after a certain number of downloads—up to 100—or a certain amount of time, ranging from five minutes to seven days. For  comparison, the biggest Gmail attachment you can send is 25 megabytes, so this is most useful. There are already ways to share large files e.g. Google Drive, Dropbox, but you have to first store the file in the cloud, before you share it with others. With Firefox Send it is **sent DIRECTLY from you to the receiver with end-to-end encryption**, so not even Mozilla Firefox can see the contents of what you’re sharing. You can go to that website, and it will load JavaScript inside the browser, and all the encryption is done right there in your browser for you. Thanks Firefox 🙂
———–
***Google revealed that it took down 2.3 BILLION bad ads in 2018, including 58.8 million phishing ads***
As also mentioned in ‘Training Module 14 Search Engine Optimization’, Google has a serious issue when it comes to displaying malicious ads in its search results. Google now says it pushed out a bunch of new Ad policies in 2018, and as a result, **managed to catch 6 MILLION bad ads a day!** Incredible. Most of these malicious ads revolved around 3rd-party tech support, ticket resellers, cryptocurrency and local services (garage door repairmen, bail bonds and addiction treatment facilities). As noted in the training module, **please do NOT click on any Google ads for now**, until Google finds a very effective fix for this serious issue.
***Fake Google Ad leads to malicious tech support scam***
Case in point about malicious Google ads, apparently there was a **malicious eBay ad displaying in Google search results for a WEEK,** without being noticed. When one clicked on it, it would display a fake tech support scam. Please void all Google Ads until they fix this issue!
***How to make DuckDuckGo your default Chrome search engine***
As we mention in the training, DuckDuckGo is a fantastic replacement for Google Search, if you do not want your **search queries to be tracked and profiled.** DuckDuckGo does **NOT do any user tracking at all**. They still gets their revenues from displaying ads, but they do this based on immediate searches rather than building data profiles of us. Keep in mind that Safari and Firefox have both supported DuckDuckGo since 2013, but now you can configure Chrome to use DuckDuckGo by default as well
“To switch to DuckDuckGo as your default search engine, in the Chrome menu select Preferences, then scroll down to the search engine section. Select DuckDuckGo in the Search engine used in the address bar section. If you don’t see it, click Manage search engines and select it from the longer list.”
***2/3 of all Android Antivirus apps are fraudulent!***
According to a recent study, 170 out of 250 Android antivirus apps found in the Google Play Store **failed the most basic detection tests, and were basically a complete fraud**. They either “failed to meet that benchmark, frequently mistook benign apps for malware, or have been pulled from the Play Store altogether.”
What’s worse, they were uploaded to Google Play as a way to steal user data once downloaded onto mobile phones (antivirus apps by nature ask for, and generally receive, many permissions, so they have access to a LOT of user data). However, some of the apps, such as **F-Secure, Bitdefender and Symantec** did very well in their detection rates. So please make sure to download an Android Antivirus app from a **REPUTABLE COMPANY** only.
***Facebook apps expose millions of users’ Facebook data***
Once again, Facebook’s platform has been found exposing private user data. This time, it was **millions of our records stored on an open cloud server for all to see**. The data was gathered by 3rd party apps that have access to Facebook. This is common when you give a 3rd party app, or website, access to your Facebook account – a major no no!  **Please review your Facebook apps and their permissions** right now, and update the info they can request, or remove the apps and websites you no longer want connected to your Facebook profile. Also **review your privacy settings**, by using the Privacy menu item on the Settings screen to access the Privacy Settings and Tools page. And don’t forget to set up 2FA!  (We cover all this in Training Module 20 and 22).
***BEC Scammers using SMS texts to scam you***
BEC scammers are now trying to **move over to SMS text messaging to scam you**. This way, they can talk directly with you on your phone via SMS text, and have you send pictures of purchased gift card barcodes to them directly” (we cover BEC scams in Training Module 7). Please be aware, and **ALWAYS verify all transactions/wire transfers by calling the authorizing party directly,** not over SMS or email.
<
Please be safe out there everyone.
#ClickGameOver
0Shares
#### Leave a Reply 
You must be  to post a comment.
I’m Reza Zaheri, a cyber security professional with over 21 years of leadership and hands-on experience working cyber security with Fortune 100 companies. 
### Useful Links
### Contact Us
 +1 (310) 820-5555
 letschat@1mcybersecurity.com
2024 © 1:M Cyber Security. All Rights Reserved.
# 1:M Cyber Security Update 3/7/19
***It Takes Russian State-Sponsored Hackers Only 19 Minutes to Start Spreading Throughout a Breached Network***
According to Crowdstrike, a Security Incident Response firm well-versed in investigating cyber hacks, it takes only **19 MINUTES** to start **spreading throughout a company’s network,** after someone has clicked a link in a targeted posing email 🙁
I repeat: **19 minutes**
***Google Chrome Will Start Warning you About Lookalike Websites***
Bravo to Google for offering this soon: the upcoming version of Chrome’s **will warn you if you’re about to visit a ‘lookalike’ website** e.g. g00gle instead of google
This couldn’t come any sooner, as this is a very common way of hackers social engineer you. They will try to send you to a site that looks identical to the one you want to visit, and then trick you into providing your credentials/money/secrets. Here is a photo of what that looks like:
***Deepfakes Will Amplify Misinformation***
You will start hearing about ‘**Deepfakes**’ A LOT in the news soon. as it’s going to become a HUGE issue for us as a civilization (and I mean that in all honesty) **Deepfakes are basically videos and images that have been altered**, using **Artificial Intelligence**, to be able to “*combine and superimpose existing images and videos onto source images or videos*” (according to Wikipedia).
So what this means, is you will be watching a video of, say a politician or celebrity, ***saying or doing something on camera that they NEVER said or did***. There are already a number of Deepfake videos circulating the Internet, and their accuracy is absolutely astounding. Most people wouldn’t know the difference.
These could be used to **affect elections, kick off civil unrest, and generally cause untold amount of trouble** for humans. If we thought we have issues today with circulating fake news articles, wait until fake videos and images become common.
When we are **unable to truly trust what we see**, how will that affect us as a civilization?
Scary thought really, but luckily there are many people tackling this issue now and trying to create ways to detect and remove Deepfakes from the Internet before they go viral and cause major issues.
***Facebook Will Be Merging All 3 Messaging Apps***
There is news that Facebook will be **integrating all 3 messaging platforms it owns: Instagram, WhatsApp and Facebook Messenger**. This makes sense from a commercial standpoint as their users can all talk entirely within Facebook soon, rather that using all 3 separate platforms, But from a privacy standpoint it could have major issues for us, because as you already know, Facebook doesn’t **score well at all** when it comes to user privacy.
The issue lies in the encryption used on these apps. As mentioned in the training, **WhatsApp has “end-to-end” encryption BY DEFAULT**, meaning you conversations are **completely scrambled and unreadable** to anyone who intercepts your messages.
However, **Instagram does NOT have end-to-end encryption**, and Facebook Messenger only offers this encryption feature **if you turn on “Secret Conversations**.
So Facebook could , in theory ‘***snoop***’ on your conversations, and **analyze them for data they can then use to sell your targeted ads in the future**.
Hopefully Facebook will keep their promise and upgrade Instagram and Messenger **encryption to** **match WhatsApp** when they all merge, and not vice versa (by the way it never hurts to keep super secrets chat off Instagram and Messenger for now until this is resolved)
***New Cliqz and Ghostery Browsers are very privacy-focused***
In addition to the privacy-focused Brave Browser that is discussed several times in the training, I wanted to let you know about **Cliqz and Ghostery browsers** (yes the same Ghostery we discuss in the training that blocks trackers so well).
They are both very similar to Brave, and are **VERY privacy-focused.** They all aim to **block ads, trackers and 3rd party cookies, as well as warn you about malicious websites.** This is great news for us all, and many steps in the right direction. I’m sure Chrome and Edge are taking note…
***We Are Moving Towards a Password-less Web***
**Google’s Android phones that are version 7.0 and up will now support FIDO2,** which is a huge deal. FIDO2 is a new technology that is being welcomed by the major tech companies like Microsoft, Mozilla, Google, Apple etc., and to put it simply, what it does is **allow you to log into a website or mobile app with your *face ID, fingerprint, or security key*,** **RATHER than typing in password** (You will learn more about security keys in the 2FA section of the training). You may have already **noticed some banking apps logging you in this way**, and you will likely see a lot more of this in the future.
Everyone is tired of managing 100000s of passwords, for obvious reasons, so kudos to FIDO2 for making this happen securely.
Another cool thing about FIDO is that **it won’t allow you to log into a fake phishing site.** It will **ONLY** present your credentials to the ***real website*** e.g. Amazon, and not a fake one like Amaz0n.
A password-less Internet is definitely where the future is heading…:)