Category Archives: Panda Security

Panda Security

How cookies work?

Cookies

We all know the ‘Allow cookies?’ message. This option now appears in practically all websites. In fact, nowadays more people associate the term ‘cookies’ with its Internet use rather than with its edible origin.

Cookies are small data packets which Web pages load on to browsers for a whole range of reasons. Every time you return to the same URL, the computer sends back this little package of information to the server, which detects that you have returned to the page.

When you access your email account or Facebook profile, it is cookies that allow your user name and password to be saved, so the next time you won’t have to enter them again.

But apart from storing strings of digits and letters, webmasters can use these tools for monitoring the activity of Internet users.

These virtual spies collect information about your Internet habits: the pages you visit frequently and the topics that interest you. The problem is that they usually share this information with data analysis firms or those that design targeted marketing campaigns.

If, say, an ad for a food product appears on your screen after you visit a restaurant page, don’t be too surprised. Thanks to cookies, advertising can be tailored to consumers’ preferences.

Even though cookies are safe and won’t usually infect your computer with malware, it is not always clear in whose hands the collected data ends up or where it is stored.

A team of researchers from Queen Mary University, London, has managed to shed some light on this in one of its studies. They have basically been spying on the spies. They analyzed where the data of Internet users from around the world ended up in order to draw up a data circulation map.

The experts have focused on who is running cookies on user’s browsers. External companies (such as those marketing and data analysis firms mentioned above) send these data packets from a domain different to the site so they can be detected when they do this. With this methodology they were able to analyze the 500 most popular pages in 28 countries.

The results have shown that this practice extends across the world. You can also see in the image the areas of the planet where Internet user privacy is most compromised.

cookies map

While in Europe, South America and Oceania the amount of local companies accessing user data is quite similar, the number is greater in Turkey and Israel. The origin of the snoopers is also interesting: most come from Russia or Germany. Those based in the USA often end up on browsers in the Middle East.

Scientists believe that this distribution reflects Internet privacy legislation in different countries. In most European countries, where there are laws regulating third-party access to user data, there aren’t so many ‘spies’ as in China or Turkey, where such rules are scarce. But spies are everywhere, so experts continue to call for tougher measures to combat the trafficking of personal information.

 

The post How cookies work? appeared first on MediaCenter Panda Security.

WhatsApp Oro, a new scam related to the world famous messaging app

whatsapp oro

 

Be careful! The Spanish National Police have reported a new type of scam related to WhatsApp. That’s right, another one! We’re beginning to lose count of how many times we’ve reported these types of stories.

It appears that cyber-criminals have invented a new version of the messaging app: WhatsApp Oro (WhatsApp Gold). As you can probably imagine, there is no ‘Gold’ version of WhatsApp, and it’s really just another fraud to subscribe you to Premium SMS services.

Seemingly, criminals have been advertising this service on Twitter and more than a few users have fallen for it.

As you know, the success of WhatsApp has made it a prime target for criminals, so take care and don’t fall into the trap!

The post WhatsApp Oro, a new scam related to the world famous messaging app appeared first on MediaCenter Panda Security.

Hacker Experience. The game about IT security caused a sensation on the Internet

A developer created a game that became an Internet sensation in just a few hours. Overwhelmed by the success of his work, he decided to sell it.

This is similar to what happened with Flappy Bird. Vietnamese game developer Dong Nguyen, decided to sell the famous app as soon as it became successful.

Yet in this case the game is not about birds and tubes, rather viruses and IT security. The game is called Hacker Experience and its creator, a computer science student at the University of Winnipeg, has been saturated by the response to this simulator.

hacker experience

I’m tired. So I’m selling my game that just went viral “. With these words, Renato Massaro, who is just 21 years old, has terminated his relation with ‘Hacker Experience’, the game he was working on for two-and-a-half years.

The game is a hacking simulator, where players can play the role of a cyber-criminal trying to become rich and powerful working for an evil corporation. In this game, you can hack virtual servers, develop new software, mine bitcoins, work on missions, hack banks, etc.

But it’s only a game; everything that happens is just a simulation, so players are not really handling viruses that could damage their computers or destroying the hardware on other people’s systems. It’s all a work of fiction, a simulator that you can play online and which became an incredible success within just a few hours.

“It went viral in a matter of minutes,” says Massaro, who goes on to explain how he launched ‘Hacker Experience‘ at 4pm on September 13 and, “…by the end of the day, it had 2000 registered users and 1000 online.”

This instant success was largely down to two news aggregators: Hacker News and Reddit who made the name of this game spread like wildfire and the number of users rocket in no time at all.

What this Brazilian student had been working on for so long, suddenly became a sensation. “Now, about 30 hours later, there are 6000 registered users and 1500+ online,” said Massaro, as he realized that the situation was simply too much for him.

hacker experience success

In just a few hours the situation had become unbearable for the young student having received thousands of emails and messages. Overwhelmed by the situation, the creator of the simulator decided to put ‘Hacker Experience’ up for sale.

What was the asking price? There wasn’t one. Massaro waited for offers via email. He was selling the game, the code and the NeoArt Labs brand, under which he had launched the game, but as he had never before sold software, he had no idea what price to put on his game.

He did however tell potential buyers that this was the result of more than two and a half years work and that ‘Hacker Experience’ was already a lucrative source of income.

hacker experience game

 

According to his calculations, revenue from Google AdSense and Premium account users (‘Hacker Experience’ is based around the ‘freemium’ model, where players pay for certain features that give them an advantage or make the game quicker) would offer a minimum return of $1000 (about 800 euros) a month. However, Massaro also claims that with a few adjustments and offering more advantages to Premium users, ‘Hacker Experience’ could soon be offering returns of up to $5000 (almost 4000 euros) per month.

Nevertheless, any potential buyer should also be aware the game’s users have already found flaws and have been sending them via email to the creator as well as publishing them on the Hacker Experience wikipedia page and forum.

The game is still operating, though probably it is now under new ownership. In exchange, the creator will have received a decent sum (according to his own calculations, Massaro suggests that a price of some 60,000 dollars for the game would be easily recovered within the space of one year) and above all he can now enjoy the peaceful life that was so rudely interrupted by ‘Hacker Experience‘, the virus game that went viral.

The post Hacker Experience. The game about IT security caused a sensation on the Internet appeared first on MediaCenter Panda Security.

JP Morgan acknowledges that 76 million accounts were hacked

jp morgan chase

US bank, JPMorgan Chase has acknowledged that 76 million current accounts and 7 million small business accounts were affected by a hacker attack last August.

The bank presented an official report to the Securities and Exchange Commission (SEC), specifying the type of data that had been compromised in the attack on the Web and mobile apps of JPMorgan Chase.

Data obtained by the cyber-criminals included customers’ names, addresses, phone numbers and email addresses, as well as internal company data. There is still no evidence that this data theft has compromised account numbers, passwords, ID numbers, dates of birth or social security numbers.

Cyber-attack on JP Morgan Chase

JPMorgan Chase was one of five US organizations to suffer an attack, the real purpose of which is still under investigation.

The FBI have been trying to determine the origin since August and determine whether the motive is purely financial or if it is part of an international espionage operation.

The bank has also asked customers to come forward if they are aware of any irregular transactions, though for the moment, they have no evidence of any fraud related with this data theft.

 *** Update

Luis Corrons, technical Director of PandaLabs, has drawn similarities between this attack and the one suffered by Orange some months ago. In neither case were passwords stolen, which is typically the prime target of cyber-criminals, probably because this data is stored on systems with greater security.

Nevertheless, Luis Corrons has also pointed out that companies are attacked every day around the world and a small percentage of these attacks are successful. This should serve to remind businesses that they need to improve defenses against cyber-attacks and ensure they have the best business antivirus.

More | 10 reasons why you need the best business antivirus

The post JP Morgan acknowledges that 76 million accounts were hacked appeared first on MediaCenter Panda Security.

Facebook set to hand over users’ information to third-party advertisers

facebook advertising

Facebook will hand over users’ information to advertisers to enable them to advertise more effectively on third-party portals. This will be done through the Atlas platform that compiles data from the social network and uses it on external websites.

This way, if you click ‘like’ on a clothing website, you will begin to see adverts for similar products when you visit other pages.

So, with the data gathered from Facebook a history of likes and preferences is compiled which helps advertisers identify potential customers.

Advertising on Facebook

Until now, advertising on Facebook was done using cookies that registered your ‘likes’ as you visited other Internet pages. So when you were in Facebook you would be shown adverts in accordance with your preferences.

The aim of this latest methodology is to improve the effectiveness of advertising, and to track people’s preferences on mobile devices, which is what Atlas can do through Facebook.

What do you think? Are we losing privacy with these kinds of initiatives?

More | Android users under attack through malicious ads in Facebook

The post Facebook set to hand over users’ information to third-party advertisers appeared first on MediaCenter Panda Security.

Parental Control. What is it? How is it installed?

parental control

The safety of children on the Internet is one of the greatest concerns for adults when their kids use computers.

The content they can access, the Web pages they can see or the people who can contact them is a serious worry for parents.

How can you protect your kids on the Web? No doubt you have heard of ‘parental control’, but do you know how it works? Are you aware of all that you can do with this feature?

What is parental control?

Parental control lets the administrator user of a computer, in this case the parents, deny access to inappropriate content. In addition to this, the new Panda 2015 products also include the option to monitor kids’ Internet activity.

They offer a summary of the pages and categories that the children have visited most, along with a detailed report of all the pages accessed (page, category, date/time).

The technology used in this parental control feature is independent of the Web browser, so simply deleting the history or changing browsers won’t affect the monitoring of kids’ online activity.

Similarly, parental control lets you block pages according to content by using categories or blacklists.

Sounds useful, doesn’t it? Well, you’ll find this feature in the most comprehensive antivirus solutions: Panda Internet Security 2015, Panda Global Protection 2015 and Panda Gold.

Are you concerned about activating it? Here you have the instructions how to install parental control on your computer.

The post Parental Control. What is it? How is it installed? appeared first on MediaCenter Panda Security.

LinkedIn: How to avoid being scammed

secure linkedin

Nowadays, practically everyone has a profile on LinkedIn. This is a useful tool for letting companies know who you are, your work experience, your present position and the best way to contact you. Along with other personal details, it is common to include an email address.

Yet despite these benefits, the platform also has its drawbacks, at least when it comes to security. The tool is not only useful for human resources managers, but also for spammers and cyber-criminals on the lookout for email addresses to which to send fraudulent messages.

More often than not, the real target of these attacks is not the owner of the email account, but the company where they work, and its data. For a cyber-criminal, this social network is like an address book containing the company email addresses of thousands of users, who use these addresses instead of their personal ones for any professional business.

Once they have found several accounts with the same company name, they make a note of the address structure (usually [email protected]). Then, with a slightly more refined search, they can get a list of all employees’ email addresses.

linkedin panda security profile

 

If the hacker knows the structure of the network that the company uses, they can access the system by sending an email to the employees in their address book. This mail might include, say, a link to a page where the recipients are asked to enter the username and password to access the organization’s platform. Once they have them, they have free reign to spy on internal information.

Those often excluded from the attack are the IT department, as they might rumble what’s going on. However, customer services, marketing, accounts, and human resources are much more attractive targets for hackers.

If the criminals manage to enter the systems, this is just the first step to getting other type of information: personal details, account numbers, passwords and databases can all be compromised.

linkedin profile

Companies often encourage employees to have a presence on Linkedin. Yet saying where they work, looking for new customers and employees and increasing brand visibility on the Internet has its risks.

How to keep unwanted messages out of your professional inbox

  • Stay up-to-speed on IT security. It’s a good idea to go on courses or for companies to organize workshops. If employees can recognize scams it can help prevent them from falling into the traps set by criminals.
  • Employees should be clear about what kind of data they will be asked for on the company’s ICT platforms so as not to enter personal information on external websites. Recognizing the email account used for internal memos is also a useful aid for distinguishing suspicious messages.
  • Another thing you should consider when protecting your company (and also yourself) is to understand the mechanisms that are available to alert technicians to any strange items. IT managers can also play their part, warning about the importance of these actions. A timely warning can prevent someone from clicking a fraudulent link or revealing personal data.
  • Use a personal email account in LinkedIn. This makes it more difficult to identify, although the same advice still applies: don’t open emails from unknown senders, don’t click on the links to unknown content and be careful where you enter your data.

The post LinkedIn: How to avoid being scammed appeared first on MediaCenter Panda Security.

The Craigslist scams

craigslist

Craigslist is a website hosting classified ads for jobs, houses, cars… To give you an idea, there are around 10 million new Craigslist ads every month.

As sometimes happens with these kinds of pages, Craigslist has become a hunting ground for fraudsters trying to scam the people who read these ads.

In fact, there’s even an “Avoid scams & fraud” section on the website offering advice on how to improve security in transactions. 

avoid craigslist scams

How to recognize scams on Craigslist

  • If the reply sent by the person you have contacted comes from another country, be wary.
  • They often ask for payment via platforms such as Western Union or Money Gram or a check or money order as surety on the transaction.
  • The other party can’t meet you in person to make the transaction.
  • There is a ‘third-party’ who will make the transaction.

Example of fraud on Craigslist

  • Companies offering work but who ask for an advance payment from the employee.
  • Rental of apartments that don’t exist.
  • Sale of cars that ask for payment in advance without you having seen the vehicle.

Tips for avoiding fraud on Craigslist

  • Read the ad carefully.
  • Don’t buy or rent anything without having physically seen it.
  • Take payment in cash. PayPal is also a secure way of receiving payment. Don’t accept checks or money orders.
  • Don’t give any type of personal or financial information.
  • Be wary of incredible bargains. If you find a low-priced apartment in an up-market area, it’s probably a scam.
  • Have a good look at photos. Many scams include photos of things that look too good for the asking price.

We know that criminals are becoming increasingly devious in disguising their scams, so, with your Internet security in mind, please take great care when buying online.

Have you ever fallen victim to a similar scam?

The post The Craigslist scams appeared first on MediaCenter Panda Security.

Shellshock, the security hole in Bash that affects Linux and OS X

Shellshock

A security hole has been discovered in Bash that jeopardizes the security of Linux and Mac users. This vulnerability, dubbed ‘Shellshock’, affects the command interpreter in these operating systems.

So what does this mean? To give you an idea, this flaw could allow a cyber-criminal to remotely access a system using Bash and insert spyware designed to steal confidential information or even take control of the system.

The hole was discovered by Stephane Schazeblas and it would appear that it is more serious than Heartbleed, the vulnerability discovered in the OpenSSL library last April. According to the CVSS rating of the security hole, Shellshock has a score of 10, while Heartbleed was rated 5.

What can you do to protect yourself from the Bash vulnerability? Update your software and keep your operating system up-to-date.

* Many thanks to our colleague from Critical Malware, Daniel Garcia, for his help.

The post Shellshock, the security hole in Bash that affects Linux and OS X appeared first on MediaCenter Panda Security.

Have you got an account with Viator? Change your password!

tripadvisor hacked

Viator has been hacked by cyber-crooks who have managed to access users’ bank details. Of the 1.4 million customers, it is still not known how many have been affected by the attack.

The company has confirmed that it has hired IT experts to discover what happened and how the criminals were able to hack the system. Although there are still not too many details about the incident, it has been confirmed that the attack took place between September 2 and 3.

It appears that Viator became aware of the attack through complaints from users about unauthorized payments with the cards they had used on its service.

To prevent further data theft, Viator is asking users to change their account passwords and keep a close eye on their credit card transactions.

More| How to create strong passwords

The post Have you got an account with Viator? Change your password! appeared first on MediaCenter Panda Security.