Lodi, Calif., Confirms Ransomware Behind Computer Troubles - Government Technology

Posted: 31 Jul 2019 03:08 PM PDT

(TNS) — Lodi City Manager Steve Schwabauer has confirmed that the computer issue that hindered the city's phone lines and data financial data systems earlier this year was, in fact, a ransomware attack.

Ransomware — a malicious software, or "malware," attack designed to block access to a computer or computer system's files — was sent to city staff as an email attachment that looked like an invoice, Schwabauer said.

After a staff member clicked on the attachment, the malware was spread through the city's network of computers. It encrypted critical files that knocked several key phone lines out of service, including the non-emergency number for the Lodi Police Department, the emergency outage line for Public Works, and the main numbers for City Hall and the finance division.

Hackers demanded the city pay a Bitcoin ransom in exchange for the encryption keys — similar to passwords — that would release the servers.

Bitcoin, an unregulated form of virtual currency, has become the most popular method for demanding ransom because transactions are anonymous. That prevents extortionists from being tracked.

"The ransom demanded 75 Bitcoins (approximately $400,000 at the time of the inquiry) be paid to restore our systems. We did not pay the ransom. Instead, we rebuilt our systems from our back-ups," Schwabauer said.

Following the attack, the city hired security experts and a legal team to conduct a series of forensic audits. Technicians who investigated the city's computer systems were able to trace information included in the malware's code, and concluded that public information was not compromised as a result of the ransomware attack.

"We did not come forward with this information because we were following the advice of legal counsel. To say anything more would be a violation of attorney-client privilege," Schwabauer said.

The problem was first discovered by city staff on April 1, and it was believed to have been corrected a month later. However, the problem returned and affected the Lodi Police Department's software network in May, which interrupted their phone lines.

While ransomware attacks have been occurring around the world since 2005, new innovations in the past several years have allowed hackers to become more deliberate and sophisticated in their attacks.

In recent years, malware distributors have targeted cities, police departments, school districts and hospitals. In their attempts to ransom large databases of personal and financial information, they have been known to incapacitate fax machines, phone lines and electrical grids.

"I have to say from my perspective, ransomware attacks were not high on my radar as city manager because there were only a few cities that this had affected, but our IT staff had their eye on it," Schwabauer said.

Although city officials did not anticipate the attack, once they were hit, they came to realize how sophisticated the malware was.

"The virus goes looking for vulnerabilities. It looks for elements of data that are valuable to you," Schwabauer said. "It attacked our phone systems, our payment data and our financial systems."

Most of the city's workstations were not affected during the attack, he said, and most of the systems affected by the malware were rebuilt quickly.

Following the attack, the city met with Assemblyman Jim Cooper, D-Elk Grove, for their annual budget meeting and requested funds to better secure the city's computer systems.

Cooper, who serves as the commander of the Sacramento Valley Hi-Tech Crimes Task Force, requested $500,000 for the city's upgrades. He has also advocated for more stringent cybersecurity regulations and better protection of constituents' personal data.

The City of Lodi has cybersecurity insurance with a capped deductible of $50,000, Schwabauer said. City staff are active in their pursuit of filing a claim on the city's behalf, he said.

He could not confirm the cost of correcting the ransomware issues or how many hours staff have had to work to repair and rebuild city systems.

Is a VPN enough for secure home networking? - The INQUIRER

Posted: 31 Jul 2019 06:12 AM PDT

USING A VPN is a solid start for protecting your online privacy at home. Nevertheless, it's not an absolute guarantee of home network security. Recognize the threats and learn how a VPN and other measures and precautions can keep your home network secure.

Not all VPNs are created equal

VPNs come in two varieties: free and paid. Why not use the free stuff? Why pay for something you can get for free, especially when there are many free services out there? Well, for the occasional VPN user who wants an encrypted connection for a specific purpose or wants privacy on a public WiFi network, the free version of a VPN will suffice.

On the other hand, paid VPN services offer a number of advantages over the free offerings:

· Paid VPNs typically offer double the encryption (256-bit vs. 128-bit offered by the free services).

· Free VPNs are less secure, while paid VPNs offer the industry-standard OpenVPN.

· Paid VPNs do not log the user's web activity.

· Free VPNs often keep track of user data and sell it to marketers, defeating the purpose of using a VPN.

So, if you want the full power of a VPN, shop around. Compare what you get for the monthly subscription fee. Does the service support an unlimited or restricted number of devices? Does it guard against leakage with automatic detection of connection drops? Also, look for a whitelisting feature that allows some of your apps or favourite websites to bypass the VPN connection.

What a reliable VPN can do for a home network user

Adding a VPN to your web browser access protects your privacy from both inside (ISPs) and outside (web surveillance) threats. By far the biggest threat is from a source you pay for: your Internet Service Provider.

ISPs, as previously mentioned, can mine user activity data. That data becomes grist for the content mills of big data analytics, marketers, and internet stalkers on the dark side. While ISP spokespersons have assured regulators that everything they collect is "anonymized," coding gurus are probably hard at work make that data more identifiable. VPNs are the first line of defense against that type of data collection.

Have you ever visited a website looking for a specific product only to have ads for that product show up the rest of the day on every website you visit? Do you really want adult content ads to show up on your browser the next time your significant other or child logs on? A VPN prevents eavesdropping on your home internet connection.

Your home VPN also offers additional protections

If you're piggy-backing on someone else's router or have any reason to keep your online activity away from prying eyes, a VPN on your home network is the solution. For example, with a VPN you can bypass geoblocking and other internet censorship. The VPN fools the blocked service into recognizing you as a local, authorized user.

Some VPN solutions cause problems, but VPN firmware is the answer

If your home is heavily into networking and has other devices controlled through your router, your VPN could interfere and cause your smart TV, security system, etc., problems. The solution is to load VPN firmware on your router. This blog post highlights the advantages of installing VPN on a home router. The top 3 advantages are:

1. VPN secures every device served by the router

2. You do not need to install separate VPN apps for each device at home.

3. You get all the benefits of a VPN without having to configure each device.

Load VPN on devices away from home

If you're taking your WiFi capable device with you and plugging into a hotspot, the best advice is don't leave home without VPN.

Hackers with sophisticated devices are on the prowl looking to steal personal data for unwary and unprotected users. Their advanced tactics include setting up fake networks. Users log in and the hackers conduct man-in-the-middle attacks, hoping their victims will log into a secure bank account or provide an opening to inject malware.

Read more about the main dangers of public WiFi usage in this Inc. article.

Does using a VPN protect you enough?

So what is a VPN in the greater scheme of home internet security? It is a great safeguard against web eavesdropping. Sending data through an encrypted VPN tunnel is an appealing and obvious privacy advantage and a great start in protecting your privacy and keeping your browsing history to yourself.

VPN, however, is not a cure-all and does not provide perfect privacy protection nor complete anonymity. Anyone with sufficient computing power can track internet traffic and pinpoint user behaviour. Encryption can be broken, and since bad actors use tools like a VPN to hide their identities, it is a safe bet that the NSA and others are hard at work cracking the VPN shell.

For the rest of us law-abiding internet denizens, a VPN provides good home security. Nevertheless, to keep your home network totally secure, you must do more, as well as practice some basic tenets of network security:

1. Your lifeline to everything secure is the quality of your password protection. By now, your passwords are likely to be far more secure than "Password" or "1234." But if you're using easy to crack, plain English passwords, or the same password for every account, you need to change your ways and heed the following advice:

· Use a different password for each online account. Hackers rely on compromised passwords for access to a victim's other accounts.

· Install a password manager that generates and stores secure, 8 (or more) digits, multi-character passwords. The password manager will get out of your way and automatically insert your user data each time you visit a particular account.

· If you want to make up your own easy to remember passwords go the 'passphrase' route. Here's an example of a passphrase: "The love of my life is named Marsha. We were married at St. Joseph's Chapel on December 12." Using upper and lower case letters for the first letter of each word, one period, the @ symbol, and two numbers: would become [email protected]

2. Beware of hackers bearing gifts. Any free software or images you install on your computer can plant spyware, Trojans, or worms. Don't download free stuff that has not been certified as safe through some reputable third party. Images can be sabotaged with all kinds of nasty coding that could enter your network as time-delayed malware.

3. Any website you visit could be spring-loaded with malware, spyware, or identity detection traps. Also, remember that if your antivirus software scans an internet URL, that the URL could be gathering up the data it needs to locate you and device.

4. Be aware of social engineering through phishing or other scams. Most network security breaches come in through the front door via email. They rely on the natural curiosity and trust of most people. In these days of spam and full in-boxes, unwary users can either get careless or gulled into:

· opening email attachments that launch executable codes for sinister intent: Look for traps disguised as PDF or Word files. Never open a file attached to an unsolicited email. If you know the sender, don't open the file until you contact the sender.

· clicking on URL links that take the user to websites with other links to other bad places: This is a favourite ploy for Ransomware culprits, who have frozen up entire networks and demanded large sums of money.

· succumbing to panic-inducing messages like "Your account has been Frozen: Click here to reinstate your account." You "click here" and a realistic but bogus login page with a form for your username, password, and PIN. You can guess the rest.

· falling for clever social engineering scams through phishing attacks and other schemes to steal your data and identity. For example, you get an authentic-looking but fake email from your supervisor authorizing you to pay a high-dollar invoice.

Summary and takeaways:

· Your home connection may be reasonably safe, but there are threats to your privacy that a VPN can safeguard against.

· Not all VPNs are equal. Paid VPNs have a higher degree of security.

· Your ISP and the websites you visit are tracking your activity. Use a VPN to keep your privacy and identity safe.

· To bypass technical problems with other IoT home devices, consider installing a VPN on your home router.

· Install a separate VPN connection on any device you use on a public network.

· A VPN provides good security, but you must do more, like using solid password practices. Also, be aware of social engineering and phishing scams. µ

This article was written by SurfShark.

Search This Blog

Android Full Encryption