Today is April Fool’s Day, and I still remember when a rubber band around the kitchen sink sprayer was the height of hilarious pranks.
Newspapers, radio, TV, and Google have pulled off some noteworthy hoaxes in good fun over the years, but plenty have backfired as well. And given the state of the world today with deepfakes and AI-created content that people can’t tell is real or not, it’s getting tempting to distrust everything every day of the year, not just April 1st.
But I’m not here to trick you. In keeping with the expanded scope I introduced last month, please find your revamped security brief below to stay ahead of threats, scams, and upcoming security changes that may impact your business.
Awareness is the key to protection, so arm yourself and your colleagues with this information.
Thank you.
– Chuck
Seasonal Scam Alert
Be on the lookout for tax-related scams.
- Emails with a fake W-2 link
- Threats of your social security number getting cancelled
- Emails about liens on your assets
Click the IRS logo to get more info direct from the source.
Banking Failures Increase Risk of Scams
As you most likely know, two large banks, SVB and Signature, failed a couple of weeks ago. A third bank, First Republic, remains on the brink of failing as well. Given the global visibility of the situation, bad actors will take advantage to steal information and ultimately money.
Whether you previously banked with SVB, Signature, or First Republic, these scams will be non-discriminant. Exercise increased vigilance to protect yourself and your organization from possible scams and fraud.
What Does This Mean for Your Business?
While we have not seen specific attacks impact customers yet, we encourage you to take extra precautions in light of this news.
Here are some best practices and tips to keep in mind always, but especially over the next few weeks as the threat of email and text scams are likely to be on the rise:
- The FDIC does not send unsolicited email notifications or offers to increase deposit insurance. If you are a customer of SVB or Signature Bank, correspond with them via the FDIC Claims Portal.
- Check that your account information is accurate, and keep an eye out for unexpected changes.
- If you receive emails regarding changes to vendor deposit information, call a representative you’ve worked with in the past to confirm the information before making any changes.
- Avoid using a search engine when visiting websites that hold sensitive personal information. Criminals pay for sponsored links that show up at the top of search results and look legitimate but will redirect you to their spoofed sites. Manually type in the URL or set a browser bookmark.
- Verify the website’s secure domain in your browser address bar to ensure you’re on the intended website.
- Use strong and unique passwords and use multi-factor authentication whenever possible.
Remember, as the general public is questioning the stability of their financial institutions, scammers are taking advantage of the situation by sending fraudulent messages in an attempt to capture your personal or account information.
In general, if someone presents you with information designed to make you afraid and then proposes that you give them money or personal information to make that fear go away, be extremely suspicious and ALWAYS verify first.
Microsoft Security Updates
Microsoft Exchange Server
Bleeping Computer explains the new security feature being rolled out:
“Microsoft is introducing a new Exchange Online security feature that will automatically start throttling and eventually block all emails sent from ‘persistently vulnerable Exchange servers’ 90 days after the admins are pinged to secure them.
“The new system’s primary goal is to help Exchange admins identify unpatched or unsupported on-prem Exchange servers, allowing them to upgrade or patch them before they become security risks.
“However, it will also be able to throttle and eventually block emails from Exchange servers that haven’t been remediated before reaching Exchange Online mailboxes.”
The Exchange servers that will be impacted by this include on-premise or hybrid environments that a) have reached their end of life such as Exchange 2007, Exchange 2010, and, as of April 11th, Exchange 2013 or b) are significantly behind on updates for known vulnerabilities, such as Exchange 2016 or Exchange 2019 servers that remain unpatched.
Check your server’s health. Keeping it up-to-date and protected will keep this new feature from impacting you and your team at all.
Microsoft OneNote
With rollout beginning in late April and expected to be complete by the end of May, OneNote will block embedded files with dangerous extensions. These will be the same extensions considered dangerous and already blocked in Word, Excel, Outlook, and PowerPoint.
This change only affects OneNote for Microsoft 365 on devices running Windows. It will not affect OneNote on a Mac, OneNote on Android or iOS devices, OneNote on the web, or OneNote for Windows 10.
Like the Exchange update above, this is intended to protect users and networks. When it has been rolled out to you, the change you’ll see is a popup that lets you know an administrator has blocked from opening the embedded file with a dangerous extension. Currently you get a warning popup and can click OK to continue opening the file anyway.
If the file is from a trusted sender and you need to open it, you may be able to save it to your local device and open it there. You can also ask your IT team to check it out for you, which we’re happy to do and recommend just to be safe.
Ransomware Reminders
- DISH Network, including Sling TV and Boost Mobile
- US Marshals
- City of Oakland, CA
- Tennessee State University
- Carats and Karats (gem, jeweler, appraiser business in Hawaii)
These are just the ones in the United States. And the ones making headlines.
According to independent research company Vanson Bourne, “73% of organizations polled by a new study reported being hit with at least one successful ransomware attack in 2022 – and 38% said they were hit with two or more.”
News coverage of the Hawaii business attack reported that “even her online medical records were infiltrated.”
Roseann Freitas of the Better Business Bureau Hawaii says, “We saw a huge increase of 39% of scams being done via text messaging.”
The battle against online scams will only get tougher as technology advances, and fake emails and texts look more like the real thing.
“You know how it used to be the misspellings, the incorrect grammar? Well, you have AI, you have ChatGPT — all of those resources that can help them write and make it look legitimate,” said Frietasks.
3 Final Thoughts
Speaking of Artificial Intelligence (AI), here are 3 different angles to keep in mind.
Voice Cloning Scams
The Federal Trade Commission (FTC) has issued a warning about family emergency scams. You get a call from a loved one who claims to be in trouble and need money. What makes this so difficult is that the voice really sounds like your family member.
“A scammer could use AI to clone the voice of your loved one. All he needs is a short audio clip of your family member’s voice — which he could get from content posted online — and a voice-cloning program. When the scammer calls you, he’ll sound just like your loved one.”
So how can you tell if a family member is in trouble or if it’s a scammer using a cloned voice?
Always be suspicious when someone asks for money to be wired or sent via gift cards. Don’t trust the voice. Call the person who supposedly contacted you and verify the story. Use a phone number you know is theirs. If you can’t reach your loved one, try to get in touch with them through another family member or their friends. And report any scams to the FTC.
The Pope’s Puffer Jacket [Video 3:28 min]
Did you see or hear about the photo of the Pope in a white puffer jacket last weekend? It went viral (‘mega-viral’ some outlets called it).
This CNN segment features a tech expert discussing what happened, some of the dangers of AI, and some suggestions for how we can spot created images. Watch it here: https://www.cnn.com/videos/business/2023/03/27/pope-puffer-jacket-fake-ai-generated-photo-cnntm-cprog-sot-vpx.cnn.
Content Credentials [Video 5:36 min]
This video from CBS News also starts with the Pope’s jacket, but it shows what companies like Microsoft and Adobe are doing to help us identify AI-generated images and videos.
See the tough-to-tell examples and unprecedented partnerships here: https://www.cbsnews.com/news/pope-francis-puffer-jacket-fake-photos-deepfake-power-peril-of-ai/.
