Phishing Scams and Attacks. How to Prevent CEO Phishing

Spear phishing has been on the rise as cyber criminals have been exploiting it in many ways and on many levels nowadays, especially by utilizing social engineering. It’s been estimated the number of victims of CEO phishing scams has gone up 270% since the beginning of 2015, totaling over $2.3 billion in losses to 17,000+ organizations. Pretty staggering, huh?

How does CEO phishing work? Unlike regular phishing emails, which are sent out in great numbers to potential victims who have no relationship to each other, CEO spear phishing emails are highly targeted and sent to only a few select victims at a specific organization. E.g., a CFO working at company X gets an urgent email from the president from company X requesting to transfer money or a CEO imposter asks an employee to provide sensitive financial information leading up to eventual monetary losses. Since these requests seem to come from the C-level executives the employees tend to act quickly to please their superiors.

CEO Phishing Detrimental Results

Source: knowbe4.com

A real life example. One of our customers has almost fallen for this phishing trick a few years back. One morning the company’s controller received an email from the company’s CEO requesting to wire 10K to an account. The CEO tends to communicate with staff mostly via email and she’s usually on the go, out of town type of boss, so it seemed OK at first glance. However, the controller called her boss to confirm the legitimacy of the request and – lo and behold – it turned out to be fake.
Then the investigation by the CEO started and IT was first on the grill: “Why did we get this email into our system in the first place? We have spam and content protection system after all?!?!?” Yes, it turned out to be a spoofed email that it should have been intercepted by spam filter, but their definitions were not up to date and it was left through and delivered to user’s mailbox. What’s more interesting and worth noting here is that we discovered then that the company had posted contact info of their key staff (including all VPs) along with their titles, direct phone numbers and individual email addresses on their website! It doesn’t take much to plot such a scam attack. Although it was a good lesson learned for our client, they still chose to keep all the individual contact details on their website…
[…]

FortiClient VPN Connection getting stuck at Status: 98% (Solved)

Problem

When connecting to VPN network using FortiClient users occasionally are unable to make the connection as the VPN client seems to be malfunctioning. The connection gets stuck at Status: 98% and they get disconnected. This problem appears to be affecting FortiClient version 5.3.xxx as well 5.4.1.0840 running on Windows 8 and 10 that we are aware of.

It’s s been determined that there is a problem with the Windows operating system WAN miniport driver and not specifically with a Forticlient issue.

[…]

CrashPlan crashing (itself) and the host machines

We run CrashPlan for Business (PRO) on several Windows servers and wanted share some of the observations about the local app and the service itself.

The good

Pricing
Pricing is straight forward: it is a flat rate for unlimited data backup. $10/m per machine is dirt cheap. Additionally, the CP client app allows you to back up your data to the CrashPlan cloud but also to the other computer or folders (at no additional free).

Encryption
CP uses Blowfish for encrypting your backed data and it’s a client-side encryption. There’s an ability to reset the encryption password through a security question.

Versioning
CrashPlan, support versioning and it’s enabled by default.

Efficiency
Crashplan utilizes a sophisticated delta-update algorithm along with automatic compression. Which means that CP splits your files into small data chunks. Then each chunk is compressed and encrypted accordingly to your settings. It also supports de-duplication, which means that duplicated files are only uploaded to the backup server only once. This also means that of you move / rename files CP does not need to upload it all over again.

The bad & the ugly

Crashing
On numerous occasions throughout the 2016 Crash Plan updates seemed to have failed crippling the CP instance on many servers. Just last in July we had a situation with two instances of the CP PRO installed and running on the Windows 2012 R2 server. After having removed on from Programs and Features it ran for a few week and it had crashed completely.
Attempting to start the CP service failed so we resorted to “the usual” (recommended by very scarce tech support): download the most recent version,reinstall it and reboot…

Strangely we’ve found that some machines were running two instances of Crash Plan; apparently one 64-bit and the other 32-bit version.
[…]