Physical Security

DDoS Attacks on the Rise

DDoS Attacks on the RiseDistributed Denial of Service (DDoS) attacks are getting smarter and increasing in every available vector in 2022. This style of attack was up 434% in 2021 over the previous year. Additionally, targeted smart attacks were up 31% and multi-vector attacks were up 73%. US Banks were targeted the most, but the healthcare industry, remote learning and education, and technology companies also ranked high on the list of targeted demographics. The United States also tops the list of targeted countries at 54% followed by India and Europe.

Microsoft released details over the weekend of a new record-breaking DDoS attack they fended off. The attack peaked at 3.47 Tbps and came from 10,000 sources across 10 countries. DDoS attacks occur when hackers use compromised devices connected to the internet to overload a targeted server, website, or network. IoT devices are one category of devices that can be weaponized. Read our recent blog post on IoT security here.

Criminals are also using compromised servers to amplify attack numbers causing new attacks to still break records. Hackers use open DNS resolvers to filter the data through and increase the size of the attack hundreds of times the original size.

While a DDoS attack is not a data breach, it can act as a diversion for a ransomware attack. The attacks are becoming more targeted, so criminals could use a DDoS attack to divert IT resources to give hackers more time in the network to steal and encrypt data. Typically, DDoS attacks intend to deface company or government websites, create financial hardship, or disrupt web traffic. Lately, hackers have been targeting online gaming servers because a disruption of just a couple of seconds can have a detrimental outcome in an online multi-player game.

No business is too small to be attacked. It’s important to understand the threats of a DDoS attack and discuss options with your MSP to keep from becoming an easy target. Some best practices include up-to-date firewalls, understanding your bandwidth need, and monitoring tools to alert you of an attack.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Physical Security, Recent Posts, Small Business

Ransomware – The Triple Threat Podcast 12

Jack and Chuck talk about the new trends we are seeing in ransomware attacks when the victims decide they don’t want to pay the criminal.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Physical Security, Recent Posts, Small Business

Missouri Teachers’ SSN Exposed

Missouri Teachers SSN ExposedThe St. Louis Post Dispatch reported a flaw in a Missouri state website maintained by the Department of Education. Reporters for the newspaper discovered teachers’ Social Security numbers were embedded in the source code of a web application that allowed the public to search for teachers in the state. The Post Dispatch warned the department of the vulnerability and waited for them to take it down before reporting on the issue.

Governor Mike Parson condemned the newspaper for their action and promised legal action against the reporters and the newspaper itself in a press conference after the reporting was made public.

“This administration is standing up against any and all perpetrators who attempt to steal personal information and harm Missourians,” Parson said. “It is unlawful to access encoded data and systems in order to examine other peoples’ personal information. We are coordinating state resources to respond and utilize all legal methods available.”

However, the cybersecurity community has a different view of the vulnerability. The newspaper warned the Department of Education of the vulnerability and held the story until the data was offline. The Social Security numbers were found in the HTML of the site, meaning they were available to anyone with a web browser. Additionally, the Governor’s comments could discourage future individuals from reporting a vulnerability.

This month the Missouri State Auditor found numerous issues with the state’s cybersecurity practices. The report dated October 2021 cited issues with weak and shared passwords, backups not being stored securely, and system access that continues to be open to former employees.

State and local governments are in the cybersecurity news often for breaches. Typically, the report after the breach shows numerous security failings. Poor password practices, unused systems being left online, and unprotected backups are patterns we have seen before.

Instead of owning the problem, the school board is looking to place blame on the media. The media handled this correctly. The school board should be focused on fixing their issues and protecting the identity of their teachers. This should serve as a lesson for others to strengthen their cybersecurity practices.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Physical Security, Small Business

Where Cybersecurity Breaks Down

Where Cybersecurity Breaks DownWe already know Phishing accounts for more than half of ransomware attacks. A new study from Bitdefender reveals poor online habits prevail after a year of cybersecurity in the news. The first topic the study explores are passwords. They found over half of users memorized their passwords, and only 24% used a password manager. This data point can be tied to another later in the report on password reuse. The study found 22% of respondents use a single password for all online accounts. Less than half of users reported they use a different password for each account.

The study cited mobile threats as the new leading threat vector. Almost a quarter of users access a personal account with a work device. A mobile phone is the primary means of using the internet for half of users. We know smishing is up 300% over last year, and users are reporting the uptick. The study shows 61% of users reported scam messages or phishing over the past year. To add to the mobile threat, 30% of users are using a simple password like “1234” or are not locking their device at all.

Users were also asked about the kind of access children in their home had on internet devices. In the US almost half of children have full access to browse and install apps on mobile and desktop devices. The youngest demographic surveyed (18-24) were more likely to share information online and were generally less worried about online threats.

Criminals are exploiting the trust we had in text messages for two-step verification and appointment confirmations. The increase in SMS Phishing or Smishing makes business tools more vulnerable and hinders legitimate businesses from using text messaging as an advertising tool. Businesses need to understand how their corporate tools are being used outside the office in order to protect customer data.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Physical Security, Recent Posts