A Week in Security (Aug 10 – 16)

Here’s a review of last week’s posts on Malwarebytes Unpacked:

Check. Connect. Repeat. (Online Security) This post is a short study on bank site domain typosquatting. Domain sites were randomly picked, URLs were misspelled on purpose as part of the testing phase, and data was collated and presented in a table. Nasty redirects found when visiting some misspelled URLs was also discussed.
ATM Skimming: A Refresher (Fraud/Scam Alert) Reports of a local policewoman losing all her pension to ATM skimmers inspired this post. It contains useful reminders to readers on not let their guard down but instead remaining vigilant in keeping one’s data (and money) secure.
Beware of Risky Ads on Tumblr (Malvertising) Tumblr is one of the many social networking sites that allows ads. And when there are ads, there is always the possibility of malvertising.
More Dot-Gov Sites Found Compromised (Hacking) Two government site pages in Taiwan and Ukraine were hacked some time ago, serving up potentially malicious content and a phishing page, respectively.

Top news stories:

Forget Car Hacking: Phone Calls and Web Bots Are the True Security Threat. At Black Hat last week, Pindrop Security co-founder and CEO Vijay Balasubramaniyan disclosed that about 228 gangs use social engineering to steal money from banks and other financial organizations. They do this by simply calling call centers and pretending to be someone else. (Source: Motherboard)
Smart Nest thermostat easily turned into spying device. Independent researchers were able to hack into a smart thermostat, which was manufactured by Nest, a home automation company, by easily bypassing the device’s OS’s security feature. (Source: Help Net Security)
CryptoWall! crooks! ‘turn! to! Yahoo! ads! to! spread! ransomware!’ “Typically, when someone clicks on an ad, the site displaying the advert, and the advertising network serving it, take a small fee for referring the visitor to the advertiser’s website. It appears CryptoWall victims are lured into clicking on adverts, which refer the browser along a chain of websites until it reaches a server that exploits a vulnerability to infect the computer.” (Source: The Register)
US financial protection agency warns against Bitcoin, Dogecoin use. Although virtual currency has been hot and continues to remain so these past few months, Consumer Financial Protection Bureau (CFPB) warned the public of its use since they are likely targets of hackers. (Source: Ars Technica)
Click Fraud Malware Found Lurking Inside Image Files. Lurk, a recently discovered fraud malware, is a downloader that utilizes stenography, the art (and science) of hiding information in media files such as digital images, videos, and audio. (Source: InfoSecurity)
One-fifth of work PCs harbour malware – study. “…there was no correlation between size and infection, with large organisations – which ought to have better resourced IT and computer security departments – seemingly no better protected than small and medium-sized businesses.” (Source: Computing.co.uk)