Covid-19 Archives - Francisco Tomas Fernandez

Careful with this “legitimate” e-mail

Francisco Fernandez — Fri, 30 Oct 2020 13:43:16 +0000

As the pandemic progresses, hackers have found more and more opportunities to steal your personal information through e-mails that combine a “legitimate” look with people’s personal situations during this crisis. Don’t fall for it. Keep reading.

Your government is looking for you, or is it?

As we’ve covered in this space before, phishing is the practice of using legitimate looking e-mails to trick you into giving up your personal data, be it your passwords, bank account numbers, or any other useful data for hackers to either steal your money or sell it to other nefarious characters or groups. This is extremely common, as hackers attempt to steal your Apple ID or Paypal information or bank account. Most of those look exactly like the company e-mails, but as we’ve all smarted up to their scheme, they needed to find new e-mails to trick us.

We’ve seen the “Correos” or postal service “facturas” (invoices) before, but now, they’ve added all sorts of government agencies to their arsenals, and the number has been increasing exponentially. Here are some examples:

We've seen it all before, and we'll see it again

These are just some examples of these. We’ve blocked the images and only added where we knew the logos were, but the full versions look even better and more tempting. Some are better than others at fooling you, and though these are from Spain, they’ll include whichever country you’re located in. Most government e-mails aren’t pretty, and because of the information presented, depending on someone’s situation, they might easily fall for it and click. From there, a “legitimate” looking website will be happy to steal your information.

Some of these might seem harmless. They might only take your “address”, but when you consider that most of our private information is out there on the internet in some form or another, your “address” might be the missing piece of information for a hacker to piece all the parts together and have the data needed to empty your bank account. It might be as simple as stealing your identity to get some credit cards, destroying your credit in the process. They could even use your data to commit criminal acts or access illegal or nefarious websites.

Remember that, even if innocent, sometimes the mere appearance of guilt is enough to scar you forever.

The covid-19 crisis has only made it worse

Opportunists are always around and ready to take advantage of people, sometimes positively, but mostly negatively. Now, in these particular cases, most of the addresses hidden behind the buttons have been “.ru” addresses, which means they come from Russia, but we’ve seen them from lots of other countries as well.

Don’t let these criminal hackers take advantage of your personal, pandemic crisis, be it a fine for breaking curfew or not wearing a mask, or a late payment or defaulting of a loan, or other legal situation. Don’t let them fool you into giving them your data simply because you’re in a tough spot right now. Don’t fall for it, and in fact, you can fight back by reporting the e-mail to the company or agency they falsely claim to be or even to the police.

Most companies have a “report phishing e-mail”. Search for the company and the words “report phishing” and go to that company’s website and follow the instructions to report it. If it’s a fake government e-mail, you can report it to the “Guardia Civil” or your country’s police department. Most likely they’ll ask to “Forward as attachment” to a specific e-mail.

And remember: Don’t download the images, don’t click, most definitely DO NOT OPEN the attachments, and once reported, delete the e-mail and if you sent a report, the sent e-mail as well.

Good luck and stay safe online and off, during this pandemic and beyond.

The post Careful with this “legitimate” e-mail appeared first on Francisco Tomas Fernandez.

Don’t fall for the most common Covid-19 pandemic scams

Francisco Fernandez — Wed, 22 Apr 2020 07:59:00 +0000

Like any crisis, the Covid-19 pandemic is full of opportunists. Some are legitimate and are simply serving a market necessity, but others are taking advantage of the fear and confusion to up their scam game in order to steal our money.

Phishing looks like fishing, but isn't

We’ve all seen the e-mails. They look legitimate, almost perfect, but there’s usually something missing. Maybe it’s your name, or there’s lots of typos, or the logo is wrong, but it’s not quite Paypal or Apple or Amazon or Citibank. Still, many are so accurate that they can easily fool us into thinking they’re the real thing.

This is the problem with phishing scams, and during this Covid-19 pandemic, as companies scramble to react and communicate their plans to clients, providing special websites, and other tools to assist in managing the situation, we’re bombarded with e-mails that are not the usual company fare. That’s where the scammers are at their best, taking advantage of our confusion to aid us in misleading us towards their scam.

Got an e-mail from “PayPal” or “Amazon”? Don’t click on the links. Go directly to your browser and type in the URL. There’s a “Security Issue”? Contact your bank directly or again, go to your browser and type the bank address yourself.

Clicking on these links often take you to a website that looks real, except maybe a slight typo in the address or they’re using a subdomain to sow confusion. Don’t do it. Don’t click. Don’t open that attachment.

Social Engineering isn't what it sounds like

It sounds like some government plan to modify our behavior, and the Covid-19 pandemic can lead us down some dark, conspiracy holes. But no, social engineering in the context we’re talking about is a clever way to fool you into divulging personal or confidential information. It’s a con tactic.

Often used by phone, the scammer will use social engineering to get more information out of you than you would normally have given. During this crisis, this type of technique has grown in use along with simple impersonation to steal people’s personal information, identity, credit cards, bank info, etc.

Never give any of your personal information over the phone. Make sure you know the number calling you, and if it’s an offer, call the company yourself using their public number, not the one the caller gives you.

I know who you are... who are you?

Often, it’s easy to trust a scam. They seem to know your information, the same as a legitimate company would. They might ask for you directly, reference something personal, maybe a password even. Don’t fall for it.

Hackers have been growing in their information gathering activities, breaking into companies that hold all our information, like credit score companies such as Equifax, or data brokers. They either use that data to scam us directly and maybe even tempt us into a ransomware game, where we pay them in bitcoin to avoid losing all our data or avoid embarrassment, or they may sell our information to others who will use it to scam us into giving them money.

In the latter situation, the scammer will offer to confirm your information in order to ensure the data they have on you is valid, marking it as something to be used for social engineering with a bank or other company, identity theft, etc. If they have your info, they don’t need to confirm it, so don’t.

Always, call the company or bank directly using their publicly available number or website. Don’t fall for these scams during the Covid-19 pandemic or beyond. Stay safe!

The post Don’t fall for the most common Covid-19 pandemic scams appeared first on Francisco Tomas Fernandez.

Pandemic heroes or devils? Zoom and other video apps

Francisco Fernandez — Mon, 13 Apr 2020 07:58:00 +0000

Zoom has emerged as a savior during the Covid-19 pandemic, connecting co-workers, family members, and even allowing for impressive online performances, but as with other video conferencing apps, is it our hero? or is there a devil hiding in the background?

Ms. Congeniality

Companies have been offering some form of group video conferencing for years. Even iChat had group video conferencing back in 2004, although back then with up to only 4 people. Still, Skype, Facetime, WhatsApp, Facebook Messenger, Google Hangouts, all allow some form of group video chat with varying number of participants, features, and security. But Zoom is what’s captured our attention, suddenly becoming the go to app for video conferencing during the pandemic. Why is Zoom suddenly Ms. Congeniality? Simple: it’s reliable, low latency, easy, fun, and is platform independent, working on iOS, Android, Windows, etc. It’s also free for up to 100 participants for 40 minutes per session, and has some excellent and fun features like beautification filters, backgrounds, and breakout rooms, which are really useful for online learning.

Devil? Angel? Hmm.

To be fair, any platform receiving the level of traffic and use that Zoom has sustained since this pandemic began, is bound to have issues, but some of Zoom’s issues have more to do with business practices than technology, with privacy issues, data hoarding and sharing issues, and others that go beyond security problems such as zoombombing (a lot of which have been addressed recently).

It would seem that despite some of their security issues getting addressed, other practices have only been “fixed” when they’ve been caught and publicly shamed, or not at all. For example, while it claims to offer end-to-end encryption, they’ve chosen to define that without including content encryption, meaning the content itself is not encrypted. The iOS app was sending device data to Facebook, even when the user didn’t have Facebook installed. It was sharing personal data with Facebook and other companies and sending user names and e-mail addresses to LinkedIn. All this was without informing users of the practice or making clear what was being harvested or why.

Despite these practices, it seems like they’ve been addressing all these issues and with more scrutiny, been clearer and more open as to what they use, who they share what with and why. They’ve also attempted to gain goodwill by helping schools during the pandemic, expanding their access for free for what would’ve been paid features. In times of need, every little bit helps.

Are they devil or angel or neither? Time will tell. For now, they’re everyone’s darling service.

There are always alternatives

Zoom may have everyone beat during this pandemic, but other players not only exist, but are still popular, if not as fun or featureful. It still may be worth a look depending on your use case. The important thing during the Covid-19 pandemic is to stay connected, especially when you’re quarantined.

Just be aware of which tool you’re using, read about its security features, and weigh your needs against its policies and practices, protecting your data and that of your loved ones, co-workers, etc.

Mozilla, the non-profit that makes Firefox, has published an excellent piece about making your Zoom gatherings more private. You can read it here: https://foundation.mozilla.org/en/blog/tips-make-your-zoom-gatherings-more-private/

The post Pandemic heroes or devils? Zoom and other video apps appeared first on Francisco Tomas Fernandez.