Welcome!
Craig discusses the Hack that could cost you your business.
For more tech tips, news, and updates visit – CraigPeterson.com
—
Read More:
How to find Stalkerware on your smartphone
This Simple Hack Could Tank Your Business
7 VPN services left data of millions of users exposed online
Universities Brand ‘Drama Therapy’ And ‘Journalism’ as STEM Majors to Circumvent Immigration Policy
DoJ suggested OANN should call FBI about NPR’s tipline, emails show
Google reportedly peeks into Android data to gain edge over third-party apps
Russia’s GRU hackers hit US government and energy targets
Your next smartphone will be a lot harder to scratch
—
Automated Machine-Generated Transcript:
[00:00:00] Hey, have you been paying attention? And I know you have, ’cause you’re the best and brightest, you know about phishing and not to click on links you don’t know about. there’s another one, and this next one is taking advantage of your knowledge about phishing.
Hey Craig, Peterson here. Thanks for joining me.
Let’s talk a little bit about it. Yes, we’ve man, we’ve beaten. I think the phishing horse to death bottom line because phishing has been such a problem for so long, but for those that aren’t really up-on it, you’ve heard the term, a little bit about, don’t click on things, phishing.
It has been very effective lately. We have a lot of people working from home. That’s going to continue for months and years to come, frankly, a very high percentage of us. It’ll just be at home, in a bedroom or in the living room on the couch.
[00:01:00] That’s been happening a lot. those of us who are sitting at home.
Are probably not as aware as we should be to all of the problems that are going on out there. Now we have some training for employees. A lot of places have stuff. I really love what we have and we have training for if you’re in HIPAA. if you are CMMC I tar D FARs, right? All of these different regulations that are out there, even PCI training that walks people through and gives them questions and reminds them about the training.
If your business does not have this sort of training. Get it right? Whether you get it from me or you get it from someone else, please get that training so that you can keep up on all of these techniques. The bad guys are using phishing is where they are sending out messages, trying to get you to do
[00:02:00] something right.
Trying to get you to react. what kind of reaction are we talking about here? They can be just a link that you click on. The email looks legit, right? I’ve been getting every week email, supposedly from Amazon telling me that my. Amazon Prime membership has expired. it hasn’t the card did. And now because my credit card on file has been expired.
So has my Amazon membership, right? no, none of that’s true, but some of these emails you take a second glance. You say, Whoa, wait a minute then. Okay. That looks legit. It’s got Amazon’s logo. It’s worded like Amazon might word it. And then if you click on it, it’s going to take you to a site that pretends to be Amazon and asks you for your credit card update.
So you’re going to give a credit card number you’re going to give. an expiration date, right? You’re going to put all of this stuff
[00:03:00] in, cause you don’t want to lose your Amazon prime membership. Now I’m just using Amazon prime as an example, this is happening all the way across the board with tons of.
Banks credit unions. Financial institutions are a really great target. I’ve seen them from supposedly, right? E-bay I’ve seen them from the IRS law enforcement. All right. All the way across the board, it is a serious problem. So how do we deal with that problem while we care, but what we’re clicking on, but I want to talk about a simple hack may not have heard about before that can just destroy your business and what it is done?
What these guys are doing is called Typosquatting papal, squatting, and typos squatting is where you think you’re going to google.com, but maybe you ended
[00:04:00] up@googl.com. You forgot the E or maybe it’s Google with three O’s. Instead of google.com or if you have one of these home routers, even if you’re a business and you’re not using at least pro or hardware, like the Cisco go hardware.
Then you’ve got an additional problem because what the bad guys have been doing is taking over control of your router. So many of them have never been patched via Rob, have you ever updated your rudder? Have you ever. They did the firmware new router, right? Most people don’t and most rodders don’t do it automatically, and they only will do it for me, maybe a couple of years, even if they do it automatically, I just had a client.
We were helping out. We were grading them to the prosumer, the Cisco go hardware. And. She said, yeah, I have been, I check every week. That’s how diligent she was. So
[00:05:00] she went to the vendor’s website, checked what the latest release of firmware was, and then checked her machine to see what release of more she had.
Guess what it was the same release. But it had been two years since the manufacturer had issued any updates to the firmware. So her modem was completely vulnerable. So make sure you do have a modem that is not only up to date, but really, even for home users, you’ve got to get the prosumer stuff. I recommend the Cisco stuff.
You don’t have to get it from me. But Cisco goes something you might want to look at. You can get it online. I think it’s even available on Amazon. I’ve seen it over there before, and it’s not that much more expensive if you just buy it and do it yourself. If you want me to do it, obviously we’re going to get involved to help configure it and help you install it and everything.
So there are additional charges, but let’s get back to typesquatting. That’s
[00:06:00] different than the pad guys taking over your router. And when you type in the correct google.com, you’re going to two of them. Okay. Okay. Many of these types of domains. Are either purchased for resale. They redirect you to a real offer and it a shady way.
Many times what they’re doing is they’ll use a coupon if you will code that gives them credit for the sale. So you’re, you are actually going to the real Amazon. And what happens is there’s a referral. Bounty, if you will, that they are paid by sending you to Amazon, even though they didn’t really send you to Amazon.
So there’s a lot of stuff that they’re doing. And so forth labs found that roughly 2.7% of 15,000 domain names that they looked at. Two and a half, 2.7% were associated with some form of
[00:07:00] cybercrime, including hacking phishing online fraud or spamming. If you think that 2.7% is a small number, remember there’s at least 360 million registered domain.
So let’s do a little bit of mathematics here. If we say (360) 100-0000. Times 0.027. So that’s 2.7%. So that is nine, almost 10 million websites. If those numbers, if you can really just interpolate it across all registered domains. So there’s a lot of easy examples of type typo. Squatting. Security research has found a perfect.
Replica of reddit.com, Tom, which is one of the five most visited websites online under
[00:08:00] reddit.co. Which is.co is Columbia’s domain by the way. So they had even acquired an SSL certificate for reddit.co. So the majority of the web browsers wouldn’t even tell you that there might be a problem. So we gotta be very careful.
We’ve seen campaigns in the past for Netflix dot O M again, a typo, right? You meant to type.com Citibank dot O M. Which is, by the way, Oman’s, domain suffix. Now that doesn’t mean that Columbia or Oman are actively involved in this, or even that the people that did this are from Columbia or Amman. It just means it was the domain was registered there.
Registrars are what it’s called. Cameroon’s other popular one.cm, Hulu, Netflix, 12 million visits over a three month period. That’s pretty amazing here. So anyway, let’s not do that. Be careful with typos
[00:09:00] squatting, pay close attention. When you’re typing in the URLs. I have seen based on my website, just X, a lot of people use Google.
Instead of typing in the direct URL. So pay attention to that. All right. Stick around. When we come back, we’ve got a mortar cocktail. We’re going to get into the whole VPN story this week. I’ve got a big I told you so pink is the bottom line here and make sure you’re on my email list.
You can sign up at Craig peterson.com/subscribe.
Stick around because we’ll be right back.
—
More stories and tech updates at:
Don’t miss an episode from Craig. Subscribe and give us a rating:
Follow me on Twitter for the latest in tech at:
For questions, call or text:
855-385-5553
