EXECUTIVE SUMMARY

New Business Email Compromise (BEC) attacks targeting wire transfers cost organizations billions annually. Threat actors have developed new techniques to bypass even sophisticated email protection filters in organizations like yours and can use new AI deepfakes as a new way to bypass voiceprint protection at the banks.

This article reveals these new threats. So that you can have more wire transfer security in one document, this article covers several key components to have in your organization’s wire transfer process to help protect against new and old threats. It also includes some new protective changes your IT Team can implement in your computer systems and processes, including ways to protect against both existing and new threats.

The losses can be devastating – one organization lost hundreds of thousands and a top executive. Review your wire transfer policy today, and conduct a tabletop exercise this quarter. Your organization’s financial survival may depend on it.

It is Time to Update Your Wire Transfer Process Policy and Procedure Documentation

Fraudulent wire transfers, part of an attack referred to as Business Email Compromise (BEC), are very frequent and expensive for organizations that fall prey to these attacks. The FBI IC3 reports that BEC costs organizations billions of dollars each year. I want to help you avoid being a victim.

Something new that’s related to wire transfer fraud: The threat actors have a new technique that successfully bypasses spam filters. We’re receiving concerned email questions, as we should be, like this one from a very savvy IT Pro who wrote in frustration: “The email bypasses one of our main filters for external mail.” The “main filter” he is referring to is a very expensive email protection service that is very effective at preventing external phishing. At least it was, until now. Attackers found a way through not just his, but any systems not protected by the new technical fix we gave him right away, which is included below. Your protection may be vulnerable too. The need for you to know what to fix is the primary reason I penned this article.

In another new development, Sam Altman, CEO of OpenAI, which makes ChatGPT, is warning the Federal Reserve: Fraudsters can use improved AI-generated voice to completely defeat voice-print authentication. He says that threat actors will be able to call a bank, pass the voice recognition test for access to their victim’s accounts, and move money wherever they want.

One of our customers got compromised. When one of their vendors called asking about hundreds of thousands in unpaid bills, the company realized they’d been paying a fraudster for a year.

Our customer had a strict protocol: The vendor must fill and sign a specific form, then, following separation of duties, one person approves the change and another updates the routing and account numbers. Unfortunately, fraudsters breached the victim company’s email and easily identified the process by tracking a legitimate request.

The hackers breached the email system of one of the victim’s largest suppliers. They immediately sent an email from that company to the person who approves transfers and another directly to the person who changes the routing and account number using a forged approval signature.

It was almost impossible to catch that, and they only found out after a year when the large vendor contacted them, saying they’d had a glitch that resulted in no statements being sent, and asked about the hundreds of thousands of dollars the victim company owed the vendor. And, of course, the victim company had been paying all along, but the money was going to a happy fraudster who enjoyed a significant income for their efforts. The loss was devastating. A top executive, one of the smartest and kindest people I’ve ever known, left the company soon after.

Threat actors successfully bypass spam protection by tricking anti-phishing systems into believing their message, sent from an external server, came from inside your network. The duped spam filter doesn’t check the message and allows it through because, by default, all internal email messages are allowed. This trickery removes the need for the threat actors to breach the victim company’s email system.

You’ve seen the online videos of deepfakes and how difficult it is to tell some of them apart from a real human. Although it isn’t common yet, threat actors could theoretically use AI to use deepfake voices that sound very convincing during an approval process. OpenAI is specifically warning banks about this risk right now. Threat actors are using deepfake video in job interviews now, so it is reasonable to expect that they will use audio impersonation to fake a vendor representative’s voice to successfully and fraudulently complete the approval process.

Have a Wire Transfer Process Policy that your team adheres to. Be sure there is extensive training and regular samples. If your team knows there could be a test message at any time, they’re more likely to stay vigilant.

I know you can use AI to write one, but here is a sample wire transfer policy we’ve spent a lot of time compiling that you can adjust to fit your organization:

1. Receive and log the request into whatever logging system you’re using now. Even a spreadsheet would work. Record:
   1. Entity requesting the transfer
   2. How they contacted you: email, phone, etc.
2. Look for Obvious Problems:
   1. Carefully check the email address to confirm the text after the @ sign matches the company’s domain. If they don’t, check your email history to see what domain name they typically use. And of course, you already know the source and reply-to email addresses can be spoofed anyway. If anything is off in the addresses, consider the message fraudulent.
   2. Does the request indicate some urgency? If so, be very suspicious that it is fraudulent.
   3. Does it ask you to keep something secret, such as a surprise or gift? If so, be very suspicious of this, too.
   4. Do you already have different payment details on file for that company? If so, be extra careful.
   5. If something feels “off” about the request, trust your gut feeling and escalate it for secondary review. Sometimes our brains can detect subtle clues that aren’t obvious, and fraud is so expensive that you must honor all indications, even when it is just an odd feeling about the message. It is better to err on the side of safety than lose a fortune to fraud.
   6. If someone phones you, keep in mind that AI is excellent at helping threat actors create deep-fake audio impersonations. If you’re unsure, start a casual conversation and ask specific questions about their city. If they can’t answer even simple ones, or they make an excuse like having just moved there, that is a big red flag. If a threat actor is using a voice chatbot responding to you directly, it will know the answers to your questions right away, but at least it gives you more time to see if the voice sounds AI-ish.
   7. Just because you confirm that an email is from a company, that doesn’t mean it is valid. Threat actors earn lots of money if they succeed, so they are motivated to invest a lot of time and use sophisticated techniques to hack into the email of one of the companies you already transfer money to. Then they can send and receive email via the company’s actual mail servers. The company whose email they hacked has no idea.
   8. Tell other members of your team about messages that concern you so they can spot them quickly.
3. Mandatory Callback Verification if the message passed the initial review
   1. Verifications must be conducted out-of-band, meaning in a different way than the request arrived. For example, if the request arrived by email, verify it in a different way
   2. If your organization utilizes secure communication methods, such as encrypted email or a secure portal, contact the person that way to confirm the transfer or account number update.
   3. If you need to use email, forward, not reply, the request to the supposed person at the company domain (not another domain; watch for minor typos in the domain name) and ask if they sent that message.
   4. Call the person requesting the transfer or account number update. Avoid calling the phone number provided in the email message. Find the phone number you typically use or look up the phone number at the company’s website or another independent way.
   5. Ask the person to call you back so you can verify that the phone number matches the one on the company’s website. If the number doesn’t match exactly, the area code, prefix, and first one or two numbers should.
   6. If this is a new setup, or a change in account number, contact a second person at the organization to independently confirm the worker’s identity whom you contacted.
   7. Document all of this in your log.
4. Dual Approval for transferring money
   1. See if your bank will allow you to set up dual approval so that two people must confirm each wire transfer. If your business processes dozens of wire transfers every day, consider setting a threshold where you only need two people if the transfer is over a specific amount.
   2. Even if your bank doesn’t have the two-person verification option, you can still use that process internally on your own by having the person who is about to make the transfer get the sign-off of another worker who can verify it.
5. After you make the transfer or update the routing and account numbers, send a confirmation to the user at the company using the email address you independently verified. Do not assume the email address or the “reply to” address is accurate. Update the log entry that corresponds with the transaction you started when the request arrived, so you’ll be able to review the details if you need to.
6. Immediately activate the response plan described below if you suspect fraud has happened. Speed is of the essence because the sooner your bank and the authorities know about the fraud, the more likely it is that they can recover some or all of the money. There are no guarantees, but act quickly anyway.

Here is a list of other essential steps we created for you. Some are more technical, but you can always lean on your IT team to help:

1. By default, most spam filters allow all internal messages between your workers to pass through without inspection. As mentioned above, attackers can successfully trick your email systems into believing the sender is inside the company. They can trick your anti-fraud tools to pass their wire transfer requests without scrutiny. Ask your IT Department to change the settings to remove this bypass and require all messages, internal and external, to be tested thoroughly.
2. Thoroughly educate your team about preventing BEC and wire fraud.
3. Check your regulatory and legal requirements for your industry and your situation. There is a chance that there are specific wire transfer regulations that will apply to your organization.
4. Ask your bank and your application providers what forms of fraud protection services they offer. AI is empowering banks and other financial institutions to watch for suspicious behaviors. The tools can watch trends with all of the transactions they process and also watch for irregularities from your organization’s typical usage. AI is getting better and better at catching fraud quickly. Make sure yours is set at the highest level.
5. You can utilize the security principle of “separation of duties” by ensuring that the person approving the transfer is different from the one making the transfer. This is the “separation of duties” principle that can help catch fraud since more than one person has a chance to recognize an issue.
6. An attacker might use deepfakes to dupe you into thinking everything is legitimate. After all, if they stand to make a mint, they will go to great lengths, the stuff Hollywood is made of. Someday, it might get to the point that some transactions must happen in person. If going in person is not practical, an alternative that would be very difficult, as of today, for an attacker to simulate would be a video call with multiple people whom you recognize from the other organization in the same online meeting at the same time, especially if the vendor’s representatives are in a setting you recognize. The threat actor would have to accurately depict the background, animate all the people at the company and give them the right voices and the right things to say in a very human way. The technology just isn’t that good yet.
7. Ensure your IT Department has configured alerts that will trigger the moment a new email rule is created. It is very common for threat actors to breach a company, configure email forwarding rules, and then get out before they’re noticed, all to prepare for lucrative fraudulent email requests. In post-incident forensics processes, we frequently discover that the threat actor was only in the network for a few minutes and was gone before even the best EDR, XDR, and other automated detection tools could notice. To the system, it appeared to be a typical user logging in and logging out, nothing out of the ordinary.
8. Be sure you set up MFA at your bank. Ask if they support you logging in with a physical token, an authenticator app on your phone or using a passkey, all of which are more secure than a text message. Even then, know that hackers can bypass MFA, so it cannot positively prevent a threat actor from accessing your account. But use MFA anyway.
9. Here’s the technical stuff to send to IT, but executives, please read the next section after this section.
   1. Ask them to enable Spoof Intelligence in Microsoft 365 Defender
   2. Ensure Anti-Spam Policy > Spoof settings blocks failed SPF and DMARC internal spoof attempts
   3. Enable domain and user impersonation protection in an Anti-Phish Policy for your Accepted Domains
   4. Disable or at least restrict any inbound connectors that accept mail from untrusted IPs
   5. Add an Exchange Mail Flow transport rule so that if a message is authenticated as Anonymous but claims to be from inside your domain, check the message: If AuthAs=Anonymous AND InternalOrgSender=True, treat it as external and run spam and phishing filters again.
   6. Be sure your IT Department has configured technology they will recognize called SPF, DKIM, and DMARC to help protect you from fraudulent email messages. But they need to implement it in phases to ensure you don’t lose essential messages and that your company’s outbound email messages don’t get blocked due to the settings. They can start SPF with ~all (soft fail) while monitoring, then move to -all (hard fail) for SPF after they’ve identified all the approved sources of email, and separately configure DMARC to progress from p=none > p=quarantine > p=reject over time. Important: Don’t move DMARC to p=reject until both SPF and DKIM are properly configured and aligned, as this could block legitimate emails.
10. You already have incident response plans for what happens if there is a security breach, and be sure to have one for fraudulent wire transfers, too.
    1. Include immediate notification of your bank, cyber-insurance carrier, the FBI, your data breach lawyer, and the executives of your organization. Include all contact information right in the plan so there are no delays. Sometimes, when money gets transferred to a fraudulent account, the threat actors cannot access the full amount right away; they must remove the money in smaller increments. Sometimes you can recover some of the money if you act quickly. Other times, the funds are moved immediately to overseas mule accounts.
    2. Include an instruction to ask your IT department to immediately run an Exchange message trace on the specific messages related to the fraud; they’ll understand the request.
    3. Ask IT to also check the admin audit logs for recent rule/connector modifications.
11. To combat the voice-print dangers, you need to consider both someone impersonating your company to the bank, and someone pretending to be the bank calling you. For the former, ask your bank to require multiple forms of authentication, not just voice-print. They will probably suggest pre-arranged code words or security questions that only you and your bank know. Here’s something many people learn the hard way: Do not answer with a fact. In other words, you might say your high school was Sea of Tranquility High on the Moon. Good luck to any attacker trying to find that on your LinkedIn profile, even if they are using AI to assist them! And if someone calls you claiming to be from your bank, hang up and call the bank back on a number you can verify as being legitimate.
12. And last, it is an excellent idea to ensure everyone who pays you by wire transfer does everything in this document and more. After all, if they pay all the money they owe you to a fraudster, they might not have enough money left to pay you, too. We’ve seen that happen to some of our best clients; their customers suffered a BEC and transferred money to threat actors, and then couldn’t afford to pay our customers. This is an example of how another company’s breach can hurt your organization, too.

This simple process could save you many hundreds of thousands of dollars, as fraudulent emails requesting wire transfers are becoming too frequent. Review your policy today and have a table-top exercise this quarter.

About the Author

Mike Foster, CISSP®, CISA®
Cybersecurity Consultant and Keynote Speaker
📞 805-637-7039
📧 mike@fosterinstitute.com
🌐 www.fosterinstitute.com

Mike Foster is a leading cybersecurity consultant with decades of experience helping organizations across North America secure their digital assets. He holds CISSP® and CISA® certifications and is the author of The Secure CEO. As the founder of The Foster Institute, Michael has delivered over 1,500 keynote presentations and consulting engagements, equipping executives and IT leaders to strengthen their cybersecurity posture and defend against evolving threats.

The post Wire Transfer Fraud Just Got Smarter – Your Defenses Need to Catch Up appeared first on Foster Institute.

Keep Personal Matters Out of Company Email:

Attackers sometimes gain access to websites used for personal activities like watching movies, paying utility bills, personal checking accounts, and more. Bad actors leverage this information to craft convincing email messages, enticing users to click on malicious links or open harmful attachments.

If your workers avoid using their business email for personal activities like online shopping or personal social media, then a phishing email related to these topics would immediately stand out as suspicious. They are much more likely to recognize the message as fake.

On the other hand, if they have used their business email for personal tasks like online shopping or social media, they’re at a higher risk for spear phishing when an attacker knows details about their activities. If they receive an ‘urgent message’ related to these personal tasks in their business email account, they might be more easily deceived into thinking it’s legitimate.

Worsened Notification Burden:

Another drawback of using work emails for personal matters is the heightened risk of exposing sensitive personal data. If employees use their work email to conduct personal business, such as insurance applications or other private matters, the likelihood of sensitive personal data residing on your servers increases. In the unfortunate event of a data breach, their sensitive information could necessitate you sending notification letters to affected parties, increasing your company’s expenses and vulnerability to potential lawsuits.

Personal Webmail on Company Devices is a Significant Security Risk:

The above situations refer to workers using their work address for personal use. But you must also address the issue of allowing employees to access personal webmail on company devices. IT departments have no control over the security of these personal email accounts. While your business email systems can have robust filters to block malicious links and attachments, allowing workers to access personal webmail sites can significantly reduce the overall security of your network, making your organization’s security as weak as the weakest personal email account.

To Enhance Security:

1. Ask your IT Team to limit email access on company devices to approved business email servers only.
2. Continuously remind employees to use their company email address exclusively for work-related matters.
3. Ask your IT team to block access to all webmail sites except those essential for business. If employees need to access personal email, they should do so on their personal devices. If connectivity is an issue and you must allow employees to connect personal devices to your Wi-Fi, use a separate “guest” network instead of the primary company network.

Conclusion:

By drawing clear boundaries between personal and professional email usage, you can reduce the risk of cyber threats and help protect your company and your employees. Please tell your associates and friends; spread the word.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

(Image source: Bing. Learn more at [Bing.com].)

The post Executives, Guard Your Company’s Future: Why Ensuring Email Boundaries is Crucial for Security. appeared first on Foster Institute.

The race is on. They’ll step around a corner, unlock your phone with your passcode, click on settings, Apple ID, and reset your Apple ID password. All they need to know is your passcode to the phone. Your phone asks them, “Sign out other devices using your Apple ID?” Of course, they know to say yes.

Update on January 27, 2024: Apple has a new feature called Lost Device Protection released with iOS version 17.3 that helps solve this problem. Learn more here: https://fosterinstitute.com/safeguard-your-apple-iphones-and-ipads-activate-the-latest-theft-protection-setting-now/

They know that if you put the phone in Lost Mode, they have the passcode and can unlock the phone immediately. You might have your Apple ID protected with two-factor authentication; good work! But the second step of the verification process displays a verification code on your trusted devices. Unless you set your phone otherwise, the thief has a trusted device. Unless you posses a trusted device tied to your Apple ID, you won’t see the verification code, and your attempt to log in will fail.

At this point, only they can perform any functions that require you to enter your Apple ID and password.

Strive to Intervene:

The process only took seconds. It is unlikely you can stop their next moves quickly enough.

Perhaps your friend walked up as the thief was running away. Thinking you might win the race, you grab in a friendly way, of course, any device they have with Internet access and open https://appleid.apple.com. Enter your Apple ID and your password quickly! Remember, the bad guy is around the corner racing you. Then, guess what? Unless your friend’s device is a trusted device on your Apple ID account, you won’t see the secret code you need to log in. The thief will see the code on your stolen phone’s screen, and they’re laughing but admire your trying. You never had a chance in that race. Read more below about setting up Recovery Contacts and Recovery Keys.

But a way to win and be faster than the thief is if you have your second iPhone in your pocket booted up and connected to the Internet. If so, scramble to be the first to open settings, Apple ID, scroll down through the devices, and log out the stolen device. Reset your Apple ID password. Great job! You did it! They can use the phone and most apps, but at least they cannot take over your Apple ID. Keeping two iPhones connected to your Apple account with you will help if one gets stolen.

Or, a more likely scenario than having two phones, maybe you happen to have your Mac open on the table in front of you the moment the phone is stolen. Assuming you weren’t using the phone as your hotspot, quickly click on the apple symbol in the top left corner, choose system settings, Apple ID, password & security, change password, find the stolen device in the list at the bottom of the menu, log it out, and reset your Apple ID password. Whew! They’re not going to gain control over your Apple ID. But they can still use your apps, log in to bank accounts, and access your company email, so you’ll need to reset all those passwords too.

Will you win the race, or will they? Maybe you want to practice the process a few times.

More Things the Thief Can Do to Affect You:

As you read this, do not be terrified. You can relax and remember this scenario assumes a thief has stolen your phone after watching you enter your passcode and memorized it. Hopefully, that will never happen to you, and it is good to be aware of some consequences, your response, and some preventative measures so you can educate your friends.

Since the thief knows the phone’s passcode, they can reset the Apple ID password. Then they can log in to your Apple account and affect your other Apple devices, including Mac laptops and computers connected to your account.

Then the bad actor can access your device’s Keychain, Apple Pay, Apple Cash, and other sensitive information. They can reset the Apple account’s recovery key. The thief can turn off location services so the phone cannot be tracked. They can change the Apple ID account’s trusted phone number and email address to make it even more difficult for you to regain access to your Apple account. They can change Face ID and Touch ID to their face and finger. They devastated your digital world and will start to steal your money and wreak havoc in your life. And don’t blame Apple; blame the bad guys.

Chances are that most of the apps on your phone will still work even if you log the device out of your Apple account. If the apps remember your passwords for you, then the attacker can use the apps. If you have a password manager that automatically fills in passwords without asking you to prove you are you, the password manager will also fill in passwords for the thief.

And if any of your apps, bank, email, or other services send a text message to your phone to verify your identity, and the thief has your phone, they will get the text message to authenticate and can impersonate you.

And any tools you have that rely on Apple’s Face ID or Touch ID to confirm your identity, if the thief resets Face ID or Touch ID on your phone to their face or finger, they’ll have access to those tools too.

Continue Immediate Steps:

You’d better rush to reset passwords to financial and other sensitive services. See the section on multi-factor authentication below.

Contact your phone service provider and convince them to disable your stolen phone’s ability to call or receive text messages until you buy your new phone.

Reset Passwords on all your other accounts for email, online payment tools, social media, cloud storage, and more. Apple devices, including the stolen phone, are very powerful for running apps, accessing email, using web applications, and more, even if the thief does not know the password for your Apple ID. If a thief has your phone, you have many passwords to reset quickly.

Keep trying to regain control over your Apple ID account. You can download the Apple Support App on your friend’s Apple device and initiate a process that will allow you to set a different phone number for the Apple ID verification process. Still, you must have access to the email address associated with your Apple ID to receive an emailed verification code. If you pass that verification, then endure a waiting period of at least 24 hours. The recovery process is similar to recovering your account at https://iforgot.apple.com/. The thief can cause much trouble during the day or longer wait. Read more below about the preventative step of setting up Recovery Contacts and Recovery Keys. More information about the recovery process: support.apple.com/en-us/HT204921. Apple’s guidance if someone gains control of your Apple ID: support.apple.com/en-us/HT204145.

Some people would advise you to not remove the stolen phone from your Apple ID account. If you do, you will lock yourself out of many ways to recover the phone, although the thief can block many of the protections because they know the passcode.

Multi-Factor Authentication:

An essential protection strategy is configuring multi-factor authentication, such as facial recognition, on apps and websites that support MFA. However, many two-factor authentication techniques rely on you having access to your phone.

It can be complicated to reset passwords on your sites and apps using multi-factor authentication if the second factor goes to the stolen phone’s phone number or relies on you having your phone for some other step. If you set up the MFA to send a text message to the phone, and the thief has your phone, they will see the text message, and you will not.

That might spur you to get a new phone and transfer the phone number to your new phone ASAP before the attacker logs into your apps and sites and changes the verification phone number to a number only they can access, and locks you out.

For websites or services that only support text messages for the second step, consider having text messages go to a device other than your phone.  Consider investing in an inexpensive flip phone with a different phone number to receive text messages. If the website or app supports other options for the second factor besides only text messages, consider how a phone thief could bypass them.

For example, if MFA involves an email message, if the thief can easily access your email on your stolen phone, it defeats the purpose of MFA. If you set up email as the second step, use an email address that requires some other form of authentication or is unavailable on the phone. Ensure email messages do not pop up on the preview screen when received.

Or, do everything possible to prevent an attacker from stealing your phone and knowing its passcode.

If you use passkeys, be sure to see this blog posting: https://fosterinstitute.com/the-risk-iphone-theft-poses-to-your-passkeys-and-what-to-do-now/

Prevention:

To Apple’s credit, and they deserve a lot of credit, they are taking many steps to fight this problem. They must balance the phone’s usability with security, and their multiple advanced security controls are extraordinary, and their responses are highly effective. In the constant game of cat and mouse between those who want to protect you and those who wish to harm you, there might be better defenses when you read this. As of now, here are some essential steps to protect yourself:

One of the most helpful defenses is to be cautious about where and when you enter your passcode. Hence, attackers never find out your passcode. An attacker must know the passcode to the phone as part of resetting the Apple ID password. Using an alphanumeric passcode would be more difficult for a bad actor to read from a distance than a four or six-digit passcode.

Another strategy is to use facial or fingerprint recognition to unlock the phone. That would be Face ID, or Touch ID when available, on Apple devices. If the user doesn’t type their passcode into the phone, nobody can “watch the victim type their code” into the phone. If Face ID won’t work due to lighting conditions or some other factor, rather than entering the passcode, you could move somewhere safe where Face ID works.

Even if the attacker holds the phone in front of the victim’s face and the phone unlocks, the attacker still won’t know the passcode to reset the Apple ID account password. Furthermore, Apple’s Face ID settings have an option called “Attention Detection,” so if the user is unconscious or drugged, the facial recognition will refuse to unlock the phone. Unless the thief coerces the victim to tell them the passcode, the thief cannot reset the Apple ID password.

Consider using a password manager rather than the Keychain that is tied to the Apple ID. If the user doesn’t use the Keychain to store passwords and uses a password manager such as 1Password, LastPass, NordPass, or others, then the thief knowing the phone’s passcode does not give them access to passwords stored outside of the Keychain. Ensure your password manager’s settings force you to enter a passcode and do not use the same passcode as the phone.

Before everything seems hopeless, remember this disaster starts when a thief sees you enter your passcode and steals your phone.

Be Proactive:

Erase your SSN, NI, DL, Passport, or other sensitive information anywhere you’ve stored it, whether in text, contact records, photos, and everywhere else. The thief will search for that information and use it to open accounts, take out loans, and perform other identity theft compromises.

And obviously, don’t share your passcode with anyone other than, if you are going to share it, a family member or close friend you can trust with the key to your digital world.

If you’ve not done so recently, visit appleid.apple.com to update all of your personal or security info. Look for an email address that is not yours. Be sure you recognize the devices in your account.

While you are there, consider setting up someone you trust who has an Apple device as a Recovery Contact who can vouch for you and generate a code to help you recover your Apple ID. They cannot access your data, only verify your identity if you lose access to your Apple ID. Details: support.apple.com/en-us/HT212513

You could set up a 28-character Recovery Key to print out and store in multiple secure locations to help you recover your Apple ID. But be careful. If you choose to have a Recovery Key, and lose the 28-character key, even Apple cannot help you recover your Apple ID. Details: support.apple.com/en-us/HT208072

You’ll see an option to set up a Legacy Contact who, with access to your death certificate, can access your photos and text messages but not passwords. Details: support.apple.com/en-us/HT212360.

Stay current on updates. Rarely do updates create security issues; more often they provide protection against ways attackers find to bypass security.

If you lose access to your Apple ID, you could permanently lose access to your photos of you, your friends, and your family. This underscores how important it is to keep backups of your Apple photos and videos in case someone takes over your Apple account: https://support.apple.com/en-us/HT209454.

Reality Check:

Rather than go through life fearing what could happen, reduce the damage you can suffer and the likelihood of something terrible happening. Continue to recognize and avoid dangerous situations and locations. Keep your phone secure, never enter your passcode when someone can see you, and take the preventative and proactive steps above. Now that you know the risks, your subconscious will alert you to dangers more than before.

Examine your risk tolerance. Balance the likelihood of someone stealing your phone against the damage a phone thief can cause you. If you need to be super-secure, you can reevaluate your practices based on the information contained within. Some people might take some steps to reduce the danger and accept what risk is left. Others might leave their phone locked safely at home more often when they go out.

With the advent of AI, attackers will find new ways to steal, but AI will also help develop new ways to prevent attacks. Everything is changing so quickly on both sides. When you read this, perhaps additional protections are available to help keep you, your organization, and your loved ones safe.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

Disclaimer: The information provided in this blog is for general informational purposes only. Technology changes constantly, and some of this information might become obsolete or incorrect. We do not endorse or receive compensation for mentioning products, services, or brand names. Any outbound links provided are for your convenience and to get you started, but we cannot guarantee the security or safety of those external websites. Conducting your research and making an informed decision about any products or services mentioned here is essential. We shall not be held responsible for any actions taken based on the information provided.

The post Be Prepared: Know the Impact of iPhone Theft and What to Do Right Now appeared first on Foster Institute.

If you want to know more about passkeys: https://fosterinstitute.com/the-rise-of-passkeys-a-paradigm-shift-in-authentication-technology/

To gain the most value out of the information below, first review the details about how a stolen phone creates an authentication disaster: https://fosterinstitute.com/be-prepared-know-the-impact-of-iphone-theft-and-what-to-do-right-now/

As mentioned above, if your phone with passkeys is stolen, the thief can access your accounts and deny you access. Because passkey technology and strategies are constantly evolving, there might be more solutions when you read this. As of now:

One possible solution would be storing the passkeys in a password manager, not the Keychain. Then, as long as the attacker cannot unlock the password manager, the attacker will not have access to the passkeys. And if an attacker destroys the passkeys in the Keychain or blocks access to your Apple ID and thus Keychain, you would still be able to access your passkeys since the passkeys are stored in the password manager. The password manager NordPass advertises allowing users to create, store, and share passkeys between their devices. The password managers 1Password and LastPass have announced they will support storing passkeys soon. As you read this, other password managers might support storing passkeys too.

Without using a password manager to store passkeys, another way to protect passkeys would be to set up passkeys in multiple environments. Many iPhone users have a Windows desktop or laptop too. Or they might purchase an Android device where they could configure passkeys. Even if an attacker resets the Apple ID password or deletes the passkeys from the Keychain, thus blocking the victim’s access from all their Apple devices, the victim can still access their sites protected with a passkey generated using their Windows or Android device. Then they can revoke the passkeys created in their Apple ecosystem to prevent the attacker from authenticating from the stolen phone.

But unless users have them already, it is extra trouble and expense to buy a Windows computer or Android phone and remember to set up passkeys on two different devices. Someday, the technology created for convenience might allow the same passkey to function across Apple, Windows, and Android devices. That would render this strategy ineffective, but it could be a long time before such cooperation comes to fruition. A drawback of having more than one device is it gives thieves more opportunities to steal. Thus, using a password manager to store passkeys is a better option for many unless they distrust the security of password managers.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

Disclaimer: The information provided in this blog is for general informational purposes only. Technology changes constantly, and some of this information might become obsolete or incorrect. We do not endorse or receive compensation for mentioning products, services, or brand names. Any outbound links provided are for your convenience and to get you started, but we cannot guarantee the security or safety of those external websites. Conducting your research and making an informed decision about any products or services mentioned here is essential. We shall not be held responsible for any actions taken based on the information provided.

The post The Risk iPhone Theft Poses to Your Passkeys and What to Do Now appeared first on Foster Institute.

Realize Even Photos Can Give an AI Attacker All they Need to Know:
AI-based facial recognition enables bad actors to link you to locations, people, and your daily activities. Some photos you take with your phone contain exact location data. Protect yourself and inform your friends:
-Adjust privacy settings on social media, making profiles private and sharing only with trusted connections.
-Be cautious when posting photos that reveal sensitive details about you and your loved ones.
-Disable geotagging on your smartphone’s camera app to prevent automatic location embedding.

Verify the Identity of the Caller:
Attackers can change their Caller-ID to match whomever they’re impersonating. When receiving a suspicious call, verify the caller’s identity by asking a question that only they would know the answer to. Avoid questions that could be answered with information on social media or online. If you receive a call from a loved one in distress, hang up and call them back on a known number.

Set a Code Word with Loved Ones:
Set a ‘code word’ with your kids, family members, or trusted close friends that only you and they would know. They can use this code word to confirm their identity in a genuine emergency and contact you.

Educate Yourself About Deepfakes:
Deepfakes are AI-generated videos or audio that can convincingly mimic real people. Familiarize yourself with the signs of a deepfake, such as suspiciously good voice recording quality, no discernible background noise, unnatural blinking patterns, poor lip-syncing, or anything that seems a little off. People can use AI to put your face on a scantily clad body doing embarrassing things. The deepfake videos look convincing, and the bad actors will threaten to share the pictures online or with your friends or family and demand money. Cyberbullying is real.

Be Aware of Current AI Scams:
Common scams include a caller claiming they are from the IRS or that you have a warrant out for your arrest. The IRS provides an updated list of scams here: https://www.irs.gov/newsroom/tax-scams-consumer-alerts. One of the most prominent organizations in the UK that provides information and guidance on scams is the “Action Fraud” website: www.actionfraud.police.uk

Recognize AI Hallucinations:
Another red flag is inconsistency in the story or information provided. Like when using a chatbot, you sometimes identify responses sounding goofy. If you notice contradictions or a seemingly confused train of thought, that is a clue that AI might be generating the audio.

Teach Your Youngsters:
Teach them that AI can allow attackers to figure out lots about them, and they should not share their real names, family members’ names, city names, addresses, phone numbers, school names, or birthday information. They must assume that every person they chat with or meet in games may not be who they claim to be, even if they sound like friends from school, due to knowing accurate details. You don’t want to terrify your young people to the point that they cannot sleep, so you might choose to limit the number of and how frequently you share horror stories.

Use Verified Communication Channels:
Whenever possible, use verified communication channels, especially for sensitive conversations. For example, use your bank’s official app for financial transactions instead of a link sent via email. Use encrypted email to communicate sensitive information.

Keep Your Cool:
Scammers often impersonate trusted individuals or organizations in some crisis or drama to trigger your brain into fight or flight mode. Attackers try to freak you out so you make poor choices. Beware of urgent, unexpected, or out-of-character phone calls.

Please forward this to your friends and coworkers so they know these top strategies to protect themselves from falling victim to AI-generated scams.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

The post AI Scams in the Spotlight: Essential Tips to Protect You and Your Family appeared first on Foster Institute.

Passkey authentication can be configured to be very secure based on four conditions:

1. You must have your mobile device with you. (An attacker is unlikely to have the device with them.)
2. You must be able to log in to your mobile device using facial recognition, a fingerprint, PIN, pattern, USB token, etc. Some people call passkeys a “Face” or “Fingerprint” sign-in.
3. Your device must have a unique key assigned to you that ties to a unique key at the site or application.
4. If you log into a site or application from a computer, the mobile device must be physically close to the computer where you’re logging in.

Passkeys are new, and there is varying support for specific browsers, operating systems, and devices.

Tips for Using Passkeys:

1. Start setting passkeys up on your mobile device, such as a smartphone, before you use your computer.
2. If the website or application does not allow you to set up a passkey on your computer:
   • Look for and select an option on the computer that says, “Use a passkey to log in,” Your computer will display a QR code image.
   • Use your phone’s camera to scan the QR code image displayed on your computer.
   • After scanning the QR code, your phone completes the passkey login process.
3. It’s essential to confirm that passkeys work on all devices and browsers before disabling the old login method for each website or application. This way, you can avoid problems accessing your account if the passkey login method doesn’t work on some of your devices or browsers.

As the adoption is just starting, you might discover limitations or frustrations, but they’ll disappear soon. Some people have great luck experimenting with setting up their first passkey at best buy dot com even if they don’t shop there.

Apple uses the Apple Keychain to store a passkey that should work on all your Apple devices after enrolling one. Google uses the Google Password Manager in the Chrome browser and Android. Microsoft uses Microsoft Hello. Some password managers store keys.

Mobile device backups and some password managers are designed to back up the passkeys in case you lose your phone. If you do lose your phone, it is a good idea to go to the apps and sites to set up a new key and disable your old key. One concern is that, if an attacker can access your backups or the passkey manager and obtain a key from there, they might find a way to bypass passkey protection. But that doesn’t necessarily make passkeys less secure than other authentication methods; they may well be the best protection available when implemented properly since they offer so many benefits:

1. Users cannot be tricked into giving away passkey values they do not know in social engineering and phishing attacks.
2. Since passkeys come in unique pairs, users cannot re-use passwords, another user mistake that leads to compromised passwords.
3. Keyloggers cannot capture passwords since users are not typing passwords.

Your IT team might choose to eliminate your existing Multi-Factor authentication process since using passkeys involves multiple factors already. Unlike SMS text messages, passkeys cannot be redirected to attackers. Passkeys are immune to MFA Fatigue addressed here https://fosterinstitute.com/mfa-fatigue-the-hidden-danger-and-how-to-combat-it/

Please forward this to your friends so they can explore eliminating passwords and eventually start adopting passkeys as Passkey support expands.

Prepare yourself for what would happen if an attacker steals a phone containing passkeys: https://fosterinstitute.com/the-risk-iphone-theft-poses-to-your-passkeys-and-what-to-do-now/

Technical Details – If You are Interested

You do not need to know this to use passkeys. But if you wonder how these keys can be so secure, read on.

Passkeys are much more secure because passkeys come in key pairs. When you use one key of the pair to lock something, you must use the paired key to unlock it. Only the paired key can unlock what the first key locked.

So for each site or application you set up to use a passkey, your mobile device generates a pair of keys:
– A unique private key for that site or application is stored on your device.
– A paired key that your device sends to the site or application which stores the key just for you.

If you have a passkey set up for 100 sites or applications, your device will store 100 keys. Sites that have 100 million users will have 100 million keys. Each key is half of a pair. The private key must be kept secret on your device to be secure. Even if attackers access all the keys for a site or application, your account is still protected since they won’t have the second key stored solely on your device.

If you want to get more technical and understand why passkeys are so resistant to person-in-the-middle attacks: Websites that start with https:// and most web applications use PKI encryption to protect data during transit. SSL (deprecated) and TLS (use the newest version) protocols use public-private key pairs to initiate a multi-step process to secure traffic to websites or web applications. Attackers can use person-in-the-middle attacks to defeat that encryption. They generate key pairs to make the user’s connection think the attacker is the website and make the website believe the attacker is the user’s connection. Bad actors insert themselves between the user and the website and can access the data as it goes through their connection.

When a user creates a passkey, the user’s device generates a key pair. It stores one key locally on the device and sends the other to the site or application for passkey authentication. The site or web application stores a unique key for each passkey a user generates. The secret key never leaves the user’s device during the authentication process, and the unique paired key is stored at the website or application. Hence, passkeys are extremely resistant to person-in-the-middle attacks.

Where supported, consider using passkeys. Hopefully they’ll be the common standard soon.

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

The post The Rise of Passkeys: A Paradigm Shift in Authentication Technology appeared first on Foster Institute.

When you eliminate passwords:
– You don’t need to worry about creating, forgetting, or re-using passwords because you don’t use passwords.
– IT Helpdesk Professionals save time since they don’t have to help users who forget their passwords.
– Hackers will not try to trick users into disclosing passwords because the user won’t know passwords.

Microsoft, and others, continue to make their big push for people to go passwordless.

Alternatives to Passwords:

Today, determine where and how you can eliminate passwords from your life. Focus on using:

Something you have:
– A USB Token such as a YubiKey
– A proximity badge you wear around your neck or carry in your pocket
– An authenticator app on your smartphone or tablet
– A text message, phone call, or email with a one-time code

Or, something you are:
– A fingerprint scan
– Facial recognition
– Eye recognition

And the real magic is when you combine two for multi-factor authentication (MFA) without passwords.

Note that USB tokens can include fingerprint scanners for built-in MFA. Your IT Team might need to get creative using mobile phone technology to accomplish both. If you decide to use push notifications, be sure to refer to https://fosterinstitute.com/mfa-fatigue-the-hidden-danger-and-how-to-combat-it/

There are few ways attackers can exploit some of these login methods, and your IT Team can help you shore up weaknesses. Visit with your IT Team about ways you can eliminate passwords. Be sure they’ve seen this post: https://fosterinstitute.com/the-risk-iphone-theft-poses-to-your-passkeys-and-what-to-do-now/

Know About Passkeys:

Be sure you, and your IT team, know about passkeys. Passkeys are the future, and the future is arriving now: https://fosterinstitute.com/the-rise-of-passkeys-a-paradigm-shift-in-authentication-technology/

Subscribe to maximize your executive potential with Foster Institute’s E-Savvy Newsletter, packed with practical IT security solutions and actionable strategies for success: https://fosterinstitute.com/e-savvy-newsletter/

The post Ditch Passwords for Good: The Ultimate Guide to Passkeys and Passwordless Authentication appeared first on Foster Institute.

Most people I encounter talk about their fun with ChatGPT, and I can relate. Type “Write a Valentine’s day note to my lover who likes (activities). I’m attracted to their (attractions) and want them to know (details).” Keep adding details. And, of course, you can say, “Make it rhyme” or “write it like Shakespeare.” You’ll have a smile on your face.

Be sure to select “New chat” whenever you change topics. After you get a surprisingly fun Valentine’s message, open a new chat to ask, “Remind me of the Excel formula to return the first twenty characters of a string.” ChatGPT remembers conversations in chat segments, so avoid mixing topics to get the best results.

AI has given a new meaning to the term Virtual Assistant. Sometimes I compose long email messages and want to shorten them. I first compose the message with no sensitive information, give it to ChatGPT, and say, “Write this shorter.” It is stunning how capable it is at combining sentences and summarizing ideas while mostly keeping the whole meaning. Sometimes it elaborates and incorporates new ideas into the message. I find that amusing and occasionally helpful. I must re-read the output carefully and often make changes since ChatGPT is not perfect at knowing precisely what I mean, but for long messages, it sometimes helps me make them concise, saving the recipient time.

Do not be duped – AI does not know everything and can accidentally produce inaccurate information that sounds very convincing.

When I hear people discussing the risks of ChatGPT, they usually focus on students using it to write their essay assignments for them. They have not considered more severe concerns. If you are interested, search the web for: chatbot ai can be used to create ransomware video.

Fortunately, ChatGPT is implementing safeguards to help prevent malicious use, and there are ways to trick it. Values and ethics vary from person to person, and some people, or governments, might feel justified in using AI to help create weapons, influence elections, or help them with strategies to harm.

Before his death, the famous physicist Stephen Hawking warned that AI could “end mankind.” Elon Musk has donated millions of dollars to OpenAI but intensely voiced concerns about the dangers of AI.

Some of our clients now block access to ChatGPT on company networks and devices. Some won’t.

Please forward this to your friends so they will consider the risks and enjoy AI-related fun. ChatGPT is impressive, and the business world will never be the same.

The post Cybersecurity Concerns and Fun with ChatGPT appeared first on Foster Institute.

In North America, System Intrusion (Now up to 80%) attacks surpass Social Engineering (down to 20%). System Intrusion is when attackers gain access to networks, plant ransomware, establish remote access, and otherwise compromise data and processes in a network.

90% of system intrusion attacks in North America were performed by threat actors external to the company. But the 10% of internal attacks highlights the concern of insider threats. Insider threat is when someone working for an organization accidentally or intentionally gives attackers access.

In North America, the motivation for attacks are:
For financial gain: 96%
Espionage and spying: 3%
Grudges and anger: 1%

Of attacks in North America, 14% were caused Primarily by Cloud Security Misconfigurations, highlighting the need to ensure IT professionals are familiar with the complex security settings related to cloud services. An excellent resource for Microsoft Cloud Security is https://learn.microsoft.com/en-us/microsoft-365/solutions/setup-secure-collaboration-with-teams?view=o365-worldwide#securing-teams-for-sensitive-and-highly-sensitive-data

To see statistics in other parts of the world and overall, you can find the report at https://www.verizon.com/business/resources/reports/dbir/

The post Short List of Essential Cybersecurity Statistics Exposes Attackers and Can Help You Secure Your Systems appeared first on Foster Institute.

If you know what MFA is, you can skip this paragraph. The most common first step of MFA is for users to enter their username and password. They receive a text message with a code to complete the login process. Alternatively, the user might have an authenticator app on their phone that provides a code. Another option is for the user to receive a “push” notification asking the user to approve the login through the app. The latter is sometimes referred to as one-tap login. There are other options for the factors, including approving specific computers, geo-location, USB hardware keys, and biometrics, including fingerprints, facial recognition, and iris scans. There are pros and cons to each.

Summarized steps you can take to help protect yourself from attackers bypassing multi-factor authentication:

= Know how to protect yourself against a thief stealing a phone if MFA uses text or email messages as the second step.
= If supported, instead of a code number from a text message or authenticator app, consider using a USB token, fingerprint, or facial recognition for the second factor.
= Reduce the duration a code is valid. For example, perhaps change the code every 60 seconds so an older code won’t work.
= Limit the number of failed login attempts in a specific period.
= Implement web content filtering to help protect users from being exposed to fake login screens.
= Limit logins to specific countries.
= If users primarily use the same device, restrict logins to specific devices.
= Train users to beware of fraudulent login prompts.

Please see the details below:

If MFA to sends a text message to a stolen phone, the thief might see the text message. For websites or services that only support text messages for the second step, consider investing in an inexpensive flip phone with a different phone number to receive text messages. Similarly, if MFA involves an email, and the thief can easily access your email on the stolen phone, it defeats the purpose of MFA. Therefore, if you set up the two-step login with email as the second step, use an email address that requires some other form of authentication on the phone to access email messages. Ensure email messages do not pop up on the preview screen when received.

Another way attackers bypass MFA:
Step 1: Trick the user into clicking a link that takes the user to a fake login screen for Microsoft 365, LinkedIn, or any other valuable site.
Step 2: The user enters their username and password into the fake login form. Now the attacker knows the user’s login name and password.
Step 3: The attacker’s computer pulls up the genuine login form and enters the username and password the victim just provided.
Step 4: The legitimate website sends the user the text message, sends a push notification, or performs another second factor the user is used to. The user expects this, and the process seems normal to them.
Step 5: The attacker can create a fake form for the user to enter the code from their text message or app. When the victim enters the data, the attacker’s computer inserts the data into the genuine website. If the user received a push notification, they could approve the login because the user believes they are indeed logging into the site.
Step 6: The attacker is logged in and has the user’s full access. The attacker needed no previous knowledge of the user’s username, password, or text key.

One strategy to fight his kind of attack is to use a second factor that isn’t a text code. For example, a user doesn’t need to enter a code if the second factor is a fingerprint or USB token plugged into the computer. The user cannot enter that information into a fraudulent login screen.

Another common strategy attackers use to bypass MFA is to reduce the time an OTP (One Time Password) code can work without the user requesting and receiving a new text message or generating a new code in the authenticator app. Shorter expiration times mean the attackers must use the stolen credentials and second factor to log in more quickly.

Another strategy, though slightly less effective but can be used in conjunction, is to limit the number of failed login attempts within a period. An example rule is if there is a failed login attempt for a user account three times in a row within five minutes, lock their account so they cannot try logging in again for ten minutes.

A useful cybersecurity control that is underutilized is conditional access by country. If your users will always log in from specific countries, block logins from all other countries. That will make it more difficult for foreign adversaries to compromise your users’ accounts. Identifying a user’s location is sometimes referred to as geolocation.

Another method to bypass MFA is to use social engineering to trick the user into disclosing their username, password, and code or another second factor. A typical example is for a bad actor to contact a user, impersonate a technical support person, and ask the user to provide the information to help prevent some fake problem that doesn’t exist. Some trusting users walk the attacker through the login process, bypassing the protection of MFA.

Another strategy bad actors use is called MFA fatigue. The hacker will make so many attempts to log on that the user finally tires of receiving push notification alerts. The fatigued user approves the login to make their phone be quiet, and the attacker is in the system.

Attackers could use SIM Swapping to reroute calls and text messages to their phones. Therefore, text and callbacks can be less secure than other second factors. However, many sites only offer those two options.

As your IT team can tell you, there are more technical ways for attackers to bypass MFA by creating person-in-the-middle attacks using something called a proxy. Another strategy attackers can utilize is captured authentication cookies or tokens. Authentication can rely on digital key values that must be kept secret inside servers. If attackers get access to the keys, they can gain access.

Your IT Team can implement some form of web content filtering and configure it to block communications with known malicious sites and attacker command-and-control servers. This isn’t perfect because attackers frequently change command servers, but it helps.

Using SSO (Single Sign On) reduces the number of opportunities an attacker has to trick the user. Of course, the flip side is that if an attacker successfully gains access to the single sign-on, the attacker won’t need any other credentials to access everything the user can access.

User training is essential, as is keeping the computer safe.

As you can see, using MFA does not mean your authentication process is secure. Whenever a new security control is invented, someone finds a way to break it. The strategies above will help you be more secure.

Alert your friends to some of the ways attackers can bypass MFA. They might decide to consider using USB keys, biometrics, or cryptographic codes stored in a computer or hardware.

The post How Attackers Break Your Multi-Factor Authentication Protection and 7 Strategies to Protect Yourself appeared first on Foster Institute.