Tag Archives: WI-FI

Avast

Are the hacks on Mr. Robot real?

Leave a comment

Last night the pilot episode of MR. ROBOT, a new thriller-drama series aired on USA Network.

The show revolves around Elliot who works as a cyber security engineer by day and is a vigilante hacker by night.

I watched the episode and then sat down with Avast security expert Pedram Amini, host of Avast’s new video podcast debuting next week, to find out if someone like you or me could be affected by the hacks that happened in the show.

In the second minute of the episode we see Elliot explaining to Rajid, owner of Ron’s Coffee, that he intercepted the café’s Wi-Fi network, which lead him to discover that Rajid ran a child pornography website.

Stefanie: How likely is it that someone can hack you while you’re using an open Wi-Fi hotspot?

Pedram: Anyone with a just a little technical knowledge can download free software online and observe people’s activities on open Wi-Fi. We went to San Francisco, New York, and Chicago for a Wi-Fi monitoring experiment and found that one-third of Wi-Fi networks are open, without password-protection. If you surf sites that are unprotected, meaning they use the HTTP protocol, while on open Wi-Fi, then anyone can see, for example, which Wikipedia articles you are reading, what you’re searching for on Bing, and even see what products you are browsing for on Amazon and eBay, if you do not log in to the site.

Stefanie: Wow! That’s a bit frightening… How can I protect myself then?

Pedram: You can stay safe while using any public Wi-Fi network by using a Virtual Private Network (VPN). A VPN creates a virtual shield and tunnels traffic to a proxy server. The proxy server protects your personal data, thus preventing hackers from accessing your files and other sensitive information stored on your device.

We actually found that more than half of Americans connect to free and open Wi-Fi networks and that of the 55% who do, 76% prefer networks that don’t require registration or a password to connect, yet only 6% use a VPN or proxy while connected to open Wi-Fi.

Fast forward to minute 10:55. We see Elliot with his therapist Krista, whom he hacked (hacking people is clearly his hobby ;) ).

Stefanie: Elliot says that hacking Krista was simple, because her password was her favorite artist and her birth year backwards. We know that you should always use a complex password, more than eight characters and that your password should include letters, numbers, and symbols, but do most people really have complex passwords? Could having simple passwords really put you at risk?

Pedram: Most people, unfortunately, do not have complex passwords. For example, we found that one-third of American’s router passwords contain their address, name, phone number, a significant date, and their child’s or pet’s name. Not only that, but last year we found that most hackers’ passwords were only 6 characters long and that the most frequently used word in their passwords was the word “hack”.

Having a simple password that is either a dictionary word or that is comprised of personal information can put you at risk

If you think about it, bits and pieces of our private lives are scattered on the Internet. Someone can easily do a quick Google search, check out some of your social media sites and with a little time and patience, they can figure out your simple password. Even worse, if you use the same password for multiple sites, you really make it easy for hackers to hack all of your accounts.

Moving forward to minute 25, Angela, Elliot’s friend and colleague, calls him for help because their client, E Corp, a multinational conglomerate, has been hit with a DDoS attack.

Stefanie: What is a DDoS attack? Can this affect the average computer user?

Pedram: DDoS stands for distributed denial of service attack and is used to make a service unavailable. In the end we discover that the attack on E Corp was actually based on rootkits that had subverted a variety of servers, but I’ll continue to describe a DDoS attack.

DDoS attacks are sent by two or more people, but more often by an army of bots AKA a botnet. These bots send so many requests to a server that the server becomes overloaded and cannot provide its service anymore. DDoS attacks target large businesses, so the average computer user does not become affected, unless the service they want to use is not available because it has been hit by a DDoS attack.

However, the average user can help facilitate a DDoS attack unknowingly. We researched home routers and found that millions are vulnerable. Routers are connected to the Internet 24/7 and can be easily exploited and used as a bot, which, as I explained, can be used in a DDoS attack. A famous example is the hack of the Sony Playstation Network and Xbox Live last Christmas – the hacker group claimed they used a router botnet for the attack.

To prevent this from happening, people should make sure their router firmware is always up-to-date and perform a router scan to check if their router is vulnerable or not.

In minute 55, Elliot tries to hack Krista’s new boyfriend, Michael. He calls Michael pretending to be a from his bank’s fraud department, confirming his address and asking him security questions to verify his account: what his favorite baseball team is, his pet’s name. Using the information he gathered combined with a dictionary brute force attack he attempts to get Michael’s password.

Stefanie: What is a brute force attack? Can this happen to the average user?

Pedram: A brute force attack is password guessing which systematically checks all possible passwords until the correct one is found. Think of it like a machine going through a huge dictionary of passwords that types each one into an account to unlock it.

Brute force was likely one of the techniques used in hacking the iCloud accounts which eventually lead to the nude celebrity pics from stars like Jennifer Lawrence and Kirsten Dunst being distributed over the Internet. This type of attack is not exclusively used against celebrities. Hackers can use brute force attacks to hack any user accounts, given they have account email addresses. Typically, they would target accounts that hold credit card or other financial information they can abuse for financial gain. This is why, again, it is vital you use strong passwords for all of your accounts.

Stefanie: Thank you for the chat Pedram. I look forward to discussing Mr. Robot’s next episode, Ones and zer0es with you next week!

You can watch MR. ROBOT on USA Network Wednesday nights 10/9 central.

Follow Avast on Facebook, Twitter and Google+ where we will keep you updated on the new Avast video podcast hosted by Pedram Amini.

Avast

Samsung phones vulnerable to hacker attack via keyboard update

Leave a comment
Samsung Swiftkey vulnerability puts Samsung devices at risk

600 million Samsung mobile devices are at risk. Image source: gadgets.ndtv.com

We rely on our apps. Everyday we use our favorite ones to check news, the weather for our next trip, and communicate with our loved ones. Some apps, especially the system ones, are continuously in use, even if they are not the foremost app on your screen. The keyboard is one of them.

Recently, a dangerous vulnerability was discovered in the most popular keyboard, SwiftKey. If you have a Samsung S6, S5, and even a S4 running the stock operating system, you’re at risk. The app always checks for language updates, but this process is not performed in a secure way. If you’re connected with an open or public Wi-Fi, your phone is at risk of a very common and dangerous Man-in-the-middle attack. Your connection will be compromised and all the Internet traffic could be eavesdropped upon. That includes the passwords you’re typing in the very same keyboard, your financial information, everything.

To insure your security, you need to use a VPN when on Wi-Fi, since that’s when most updates are scheduled to occur. You probably already know what a VPN is and how it works. If not, you can find a lot of information in our blog. Our product, Avast SecureLine VPN, creates an encrypted tunnel for the inbound and outbound data of your Internet connection, blocking any possibility of a Man-in-the-middle attack.

But the story does not end here. If you use SwiftKey on an unsecured Wi-Fi, the attacker could also download malware into your phone or tablet. That’s a job for Avast Mobile Security & Antivirus (AMS). Some users think that we don’t need a security product for our phones. They also think that security companies exaggerate the need for a security app just to sell their products. AMS not only scans the installation process of apps but also checks the Internet sites you’re visiting and malicious behavior of any file in your device. You can install Avast Mobile Security & Antivirus on your Android device for free from the Google Play store.

NOTE: At the writing of this post, a patch for the vulnerability was provided to mobile network operators by Samsung. SwiftKey wrote on their blog, “This vulnerability is unrelated to and does not affect our SwiftKey consumer apps on Google Play and the Apple App Store.”

 

 

Avast

How to stay safe when using public Wi-Fi hotspots

Leave a comment

Many of the Wi-Fi hotspots you use in your hometown and when you travel have major security flaws making it easy for hackers to see your browsing activity, searches, passwords, videos, emails, and other personal information. It’s a public Wi-Fi connection, meaning that you are sharing the network with lots of strangers. Those strangers can easily watch what you’re doing or steal a username and password to one of your accounts while you sip your latte.

An easy and affordable way to maintain your security whenever you use free Wi-Fi is to use a virtual private network (VPN). It sounds techie, but Avast has made it simple.

A VPN service, like our SecureLine VPN, routes all the data you’re sending and receiving through a private, secure network, even though you’re on a public one. That way, SecureLine makes you 100% anonymous while protecting your activity.

Avast SecureLine VPN has servers worldwide

We have servers all over the world so you can connect to our virtual locations anytime you don’t want anyone to monitor or log your Internet activity. We just expanded SecureLine with an additional 10 servers to ensure you have a faster connection speed.

One of the great bonuses of SecureLine is that it allows you to visit local websites restricted to visitors from abroad. With SecureLine connected to a local server, you can watch your favorite shows or listen to streaming radio in another country. That’s because SecureLine makes it look like you’re connected from the right location to access the content. (You know those countries that have blocked Facebook, YouTube, and Twitter? A VPN is how people can still connect.)

When you connect SecureLine on your PC, Mac, or Android phone, here’s what you can expect.

1) Privacy protection – hides your Internet activity anywhere on the web

2) Bypassing geo-restricted content, so you can watch your favorite content

3) You are anonymous – we don’t log what users do when connected through SecureLine

4) Ease of use – only one click and you are connected to one of 24 servers worldwide

How to use SecureLine VPN

SecureLine VPN is part of Avast Antivirus. Simply open your Avast user interface, choose the Tools option in the left menu, then click the SecureLine VPN button. Licenses for Windows, Android, and iOS versions of Avast SecureLine VPN are separate.

Supports: Windows,  iOS 7.0 or later, Android 4.0 and up

Servers: North America – Chicago, Dallas, Miami, New York, Salt Lake City, San Jose, Seattle, Montreal, Mexico City; Europe – Prague, Frankfurt, Madrid, Paris, London, Amsterdam, Warsaw, Bursa, Saint Petersburg; Asia/Oceania – Hong Kong, Tokyo, Seoul, Singapore, Melbourne

AVG

Four tips for safer Wi-Fi surfing

Leave a comment

Here’s what you can do to stay protected while hopping from hotspot to hotspot—or at home.

 

Make sure you’re connected to a real network 

You may never have wondered if the coffee houses you walk into really have a network. After all, if your computer’s found a network, they must have one, right? Think again. Hackers can easily create a fake hotspot imitating the name of your favorite coffee house, library or other establishment. Connect to one of these fake hotspots, and then everything you do online would be going through them.

Always confirm the name of the network with the owners before you connect to it.

 

Use HTTPS encryption 

What a mouthful, right? But it’s really quite simple. Most Internet URLs (the addresses or links that you use to navigate the web) start with the four letters http. This is short for Hypertext Transfer Protocol. Well, some web sites offer to connect with a secure, encrypted version of this protocol, called HTTP Secure (or HTTPS for short). Whenever you connect with a website via this secure method, your data to and from it are encrypted so no one else on the same network can see it.

HTTPS

 

Most important websites like Google, Facebook and more support HTTPS automatically, but keep an eye out for s in the address, and add it if it doesn’t appear. Some browsers have extensions like HTTPS Everywhere that make sure your browser is always seeking the secure connection.

This kind of encryption only works for what happens in your browser. If you have other applications that connect to the Internet, like a mail client such as Outlook or Apple Mail, you’ll need to make sure they have some form of encryption and that its settings are on.

 

Adjust your settings for maximum protection 

Free Wi-Fi hotspots are high in demand, so you’ll rarely be the only one connected to a network. That means others can reach out through the network and connect to your device if you haven’t changed your sharing and network discovery settings (network discovery lets others find you).

Here’s how you do it:

On Windows: open the start menu (or press the windows key) and type “Manage advanced sharing settings”, then type enter. Make sure that any sharing options are switched off, and that network discovery is also off. Some versions of Windows automatically change these settings for you when you specify you are on a public network vs a home or work one.

Sharing settings

 

On a Mac:  Open System Preferences and choose Sharing. Make sure all the boxes are unchecked. Head back to the main System Preferences menu, select Security & Privacy and then the Firewall tab. In the Firewall Options, make sure that stealth mode is checked.

 

Use a clean browser 

You probably have a favorite browser that you use for everything you do online—and that’s exactly why you should use a “clean browser”. Your usual browser is probably set up to give you a lot of handy features like remembering your passwords and keeping cookies from your favorite websites to load them with your personal settings faster. This is all sensitive information worth stealing. A clean browser knows none of that, so there is nothing there for anyone on the same network to steal.

 

Use a VPN

Virtual Private Networks (VPN) make sure that anything coming in or out of your device is wrapped in strong encryption—not just your browser or email client. This is the safest method of connecting to the Internet when in public. Traditionally used by businesses and governments, VPNs have become affordable for individuals concerned with their security and privacy.

Even with these precautions, however, you should avoid any sensitive browsing like accessing your online bank accounts or making online purchase with your credit card while in public. If it can wait, you should probably do it at home.

How to secure your home network

If you’re looking to protect your home network from strangers, there are really two main things to keep in mind when setting up your Wi-Fi router:

  • Make sure you are using WPA2 encryption.
  • Make sure your password is long.

Our own Michael McKinnon has more on how to protect your network:

Video

Securing your home network

Avast

Your SMB’s Biggest Security Threat Could be Sitting in Your Office

Leave a comment

This article is a re-print from the April 1, 2015 edition of Silicon India.

Educate your employees about data security.

Careless employees, not hackers, are the biggest threat to your company’s data security.

Security threats are evolving quickly, making it difficult to pinpoint just one threat that is currently affecting small and mid-size businesses.

From the threats we have observed in the past and the ones we anticipate for the future, we have learned that while malware can be damaging to businesses, so can human decisions. This makes it vital for small and mid-size business owners to discuss possible threats with their employees and share basic IT guidelines with them, but more importantly, to implement a strong security solution that holds up dangers before they become a real threat.

Taking Advantage of Human Nature: Social Engineering

Hackers understand that it is human nature to make mistakes, which is why they often turn to social engineering. Social engineering is a tactic that tricks people into revealing their personal information, like log in details, or into performing actions, like downloading malware disguised as an attachment or link.

Phishing emails are a popular form of social engineering that can easily sneak their way into your employees’ inboxes, disguising themselves as yet another offer, promotion, or even customer, if you do not have anti-phishing protection. Phishing campaigns come in many forms; they can either use scare tactics to make people believe they are in trouble or that they have won a prize.

In the last few months we have seen Trojans like Pony Stealer and Tinba make their rounds. Both Pony Stealer and Tinba attempted to convince people they owed money and to download an invoice, which was of course not an actual invoice, but a Trojan.

Falling for phishing scams can have devastating effects on businesses; they could not only steal personal information, but also attack Point of Sale (PoS) systems to steal customers’ financial information, thus not only affecting the business itself, but its clients as well.

Lack of security awareness: Beneficial for hackers, bad for your business

Not taking proper security precautions, like choosing weak passwords or ignoring security updates, is another human flaw cybercriminals like to abuse to access accounts and networks. To gain control of a system, hackers can enter common or weak passwords or simply look up hardware’s default administrative log in credentials.

Neglecting to update software is another gateway for hackers, leaving vulnerabilities and loopholes wide open for them to take advantage of. Similarly, connecting to public and open Wi-Fi connections while on a business trip is like sending hackers a personal invitation to snoop around your business.

India’s SMBs are getting technology ready – hackers are getting ready, too

According to Indian consulting firm, Zinnov, 20% of India’s 50 million small and mid-size businesses are technology ready. Cybercriminals will take note of this and are probably preparing plans at this very moment, which is exactly what you should do, too.

Set up basic security guidelines for your employees, teach them about possible threats and make sure they understand how imperative their role plays in securing your business. For example, your employees should be encouraged to choose strong passwords for their devices and accounts, to keep their software updated – if that’s not what you manage centrally – and to use a VPN when connecting to unsecure wireless networks.

You cannot, of course, rely solely on your employees to protect your business – humans innately make mistakes. To protect your business and to provide your employees with a safety net, you need to have a proper business security solution. Small to mid-size businesses should look for security solutions that include anti-phishing, firewall to control network traffic, and server-side protection. If employees are required to travel frequently, it also makes sense to implement a VPN solution on their laptop, smartphone, and tablet. If connecting to open Wi-Fi at an airport, hotel or café, a VPN can be used to encrypt valuable business data and protect it from hackers.

As humans do make mistakes, you cannot rely on your employees to implement and manage the security solution themselves. It is recommendable to choose a solution that empowers you to remotely manage the security on your employees’ computers.

Whether your business is a two-man show, or an army of 2,000, awareness, paired with the right security technology are essential.

AVG

Is Hotel Wi-Fi Safe?

Leave a comment

Recently, a new authentication vulnerability was identified in the firmware of routers that are used in hotels around the world.

This means that new files can be written to the routers and then potentially all connected machines (meaning hotel guests) could become infected.

Public Wi-Fi is not a new risk as these networks are unencrypted and send all your data in clear text, unless of course the web site you are visiting offers encryption.

Why does it matter that your data is unencrypted? Imagine all your regular post arriving at home written on postcards so that anyone in the delivery chain could read them. It would be a huge invasion of your privacy and unacceptable.

The risk of similar but you just can’t see that it was all sent for others to read, should they be so inclined.

Stay safe while using public Wi-Fi

  • When using public Wi-Fi in café’s, airports, hotels or even when visiting a place of work that has guest Wi-Fi you should always be cautious on which services you use while connected.
  • Where possible use a virtual private network (VPN). This will encrypt the data being send over the public Wi-Fi network that you are connected to, or put another way it will put your mail back in envelopes.
  • Many scammers set up fake Wi-Fi networks to conduct what is known as a man in the middle attack. If you are in a hotel or airport, make sure you are using the legitimate free Wi-Fi  service.

For more tips on keeping your data safe while using public Wi-Fi, check out the infographic below.

WiFi

Avast

Stay safe during March Madness using Avast SecureLine

Leave a comment
Avast SecureLine VPN lets you watch March Madness while traveling.

Avast SecureLine VPN gives you access to geo-restricted programming and protects you from unsecured Wi-Fi.

Stay safe on public Wi-Fi while watching the game from anywhere in the world with Avast SecureLine VPN.

March Madness is in full swing — this year’s NCAA Tournament is now in its second week and we’re already down to the Sweet 16. When you think about March Madness, you probably think about your bracket, your favorite college basketball teams, and the bets you’ll place on those who you think will win the tournament.  Although it’s easy to get caught up in the spirit of March Madness, it’s the betting process that you should really be paying attention to: this popular activity serves as the perfect opportunity for hackers to access your personal information.

Since most people watch the NCAA games in bars or cafes with friends, they make the majority of their bets using their mobile devices while connected to public and often unsecured Wi-Fi networks. Public Wi-Fi networks are convenient, but they‘re not safe. Cybercrooks can easily access and steal personal data when you‘re connected to these unprotected networks. Even if you’re transmitting data from one HTTPS site to another, it’s the connection in-between the two sites that really puts your data at risk. Additionally, developments such as real-time betting make the odds for getting hacked even greater.

During March Madness, a time of year when so many financial transactions are being made, cybercrooks are especially likely to steal your banking info (e.g. your credit card and/or account numbers) and personal info (e.g. your social security number, social media accounts, etc.). Avast SecureLine VPN for Android and updated for iOS devices keeps these cybercrooks at bay and securely allows you to use your PCs, smartphones, and tablets on unsecure Wi-Fi networks while participating in March Madness at your favorite bar or cafe.

“Unfortunately hacking isn’t a complicated process – there are tools available online that anyone can easily use to steal personal data,” says Ondrej Vlček, COO at AVAST. “We created Avast SecureLine VPN to allow users to browse the web anonymously and safely, especially while using open Wi-Fi.”

Watch content from all over the world

You don’t have to miss a single game or your favorite program while you are traveling. SecureLine VPN makes it look like you’re connected from a different location, allowing you to view ‘local’ content anywhere because your shown geo-IP address will be different from your real one.

Play geo-restricted content from all over the world.

Play content from all over the world while connected via SecureLine VPN.

 

Keep your data and identity safe using Avast SecureLine

VPN stands for Virtual Private Network. Avast SecureLine VPN creates a private ‘tunnel’ through the internet for your data to travel through, and everything – your web browsing history, your email, your IMs, your VOIP, everything –  inbound and outbound through the tunnel is encrypted. Even if your data is intercepted, your identity is protected, since Avast SecureLine masks your IP address.

For those of you interested in technical specs, here are the highlights:

  • Avast Secureline VPN uses OpenVPN protocol.
  • The encryption used is 256bit AES.
  • Communication on all ports is encrypted.

How to get Avast SecureLine

Avast SecureLine VPN is available for Android on Google Play and for iOS in the Apple App Store.

 

Avast

Avast hacks devices at Mobile World Congress

Leave a comment

MWC15 Avast logoThe Avast Mobile Security team demonstrated how easy it is to hack smartphones and tablets at the Mobile World Congress.

 

The sleekest smartphones, the coolest wearable devices, and the best in mobile security were debuted at the Mobile World Congress in Barcelona last week. But it was hacking user’s devices at the Avast booth that had the journalist’s buzzing.

Hacking unsecured Wi-Fi is easy enough for any IT college student

Filip Chytry, a mobile malware researcher that you are familiar with if you visit our blog, set up a wireless hotspot in the Avast booth that allowed visitors to track the online activity of any device that connects.

“The site will let Avast capture passwords, messages and other information people type on the websites, and Chytry can even create dead ringers for Gmail or Facebook sign-in screens – – down to the little green padlock icon that indicates a secure connection…,” reported Bloomberg Business in The Easiest Way to Get Hacked: Use Phone at Phone Show.

The hacking demonstration illustrated what Avast found out during a global Wi-Fi hacking experiment conducted right before MWC.

“The study found that people around the world overwhelmingly prefer to connect to unsecured and unprotected Wi-Fi networks instead of password-protected networks,“ wrote Help Net Security in Global experiment exposes the dangers of using Wi-Fi hotspots.

Avast at MWC15

Most people connect to a completely unsecured public Wi-Fi hotspot without a second thought.

Security experts from Avast traveled to 9 cities on 3 continents, and found that Wi-Fi users in Asia are the most prone to attacks. Chicago and London are the most vulnerable in the USA and Europe. Avast’s spokesperson Marina Ziegler told E&T Engineering and Technology magazine, “…in London we found that 54 per cent of routers were weakly encrypted and easily accessible to hackers.”

“That means that if a hacker walks into a pub, he can access the router’s settings and for example reroute the traffic via another malicious server,” said Chytry. “That’s very easy. Every IT college student can do that.”