Telephone Systems

FBI Warning Vishing Attacks

Vishing AttacksFBI Warn of Increased Vishing Attacks

There is a new form of phishing being used against corporations, and it has gained the attention of the FBI. Vishing is a form of phishing using a phone call or Voice over IP (VoIP). This technique is yet another way hackers are taking advantage of employees working from home during the pandemic.

The increase in vishing attacks began in mid-July. Criminals registered domain names of companies they were interested in targeting. From there, they built fake VPN sites that looked similar to the target company’s own VPN login site. Hackers were also able to spoof phone numbers, so the number they were calling from appeared to come from within the corporation. The next step was to find an employee to target. Hackers went looking for information on social media sites and were able to find names and email addresses for employees of target companies.

Krebs on Security reported hackers would typically target new employees, and even create fake LinkedIn pages to gain their trust. Many of the attackers would pose as in-house IT helpdesk employees, convince a user they needed to use a different site for VPN access, and then ask for two-factor authentication (2FA) or one-time passwords (OTP) in order to help the new employee with a technical issue. Once the criminals gained access to the internal systems, they could basically move about freely. Hackers could collect customer data to be released later or encrypt data to be ransomed back to the company.

The FBI Cybersecurity Advisory does not list individual companies targeted, but many believe this is the method used in the recent Twitter hack. The FBI recommended some tips for companies including restricting VPN connections to managed devices only, and employing the principle of least privileged, where employees only have access to the data they need to do their job.

For employees the FBI report recommends checking web links carefully for misspellings. Bookmarking the correct VPN page, and do not deviate from that page. And being suspicious of unsolicited calls or emails asking for login credentials. Unfortunately new employees are likely not familiar with internal IT practices and norms.

Download the entire FBI report here.

Quanexus IT Support Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Recent Posts, Small Business, Telephone Systems

Feature Newsletter

This week we are featuring our current newsletter. This newsletter has a security checklist on the back page, which is a great checklist for your business. It also has some tips on security awareness training, indicators of a hack on your infrastructure, and a simplified explanation of our layered security system.

Click here for the Newsletter

You can also subscribe to our email list and receive the newsletters when they are published. Read previous Newsletters and subscribe to our email list by clicking here.

Quanexus IT Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Jack Gerbs in Cybersecurity, Information Security, Physical Security, Recent Posts, Small Business, Telephone Systems, Virtualization, Wireless

Welcome to 2020

Looking back, 2019 was a very good year for Quanexus.  I am thankful every day, for the awesome team that I get to work with and our many wonderful clients.  As I look forward to 2020, I’d like to share a list of what I think we can expect to see in the IT landscape:

Threats

  • Significant increase in the amount of successful ransomware attacks.
  • Continued increase on the sophistication of social engineering attacks.
  • Increased attacks against small and medium size organizations.
  • Increase in banking and ATM system attacks.
  • Increase in the Internet of Things (IoT) attacks

Technology Improvements and Adoption

  • Increased use of cloud solutions.
  • Increased cloud telephone implementations.
  • Increase in use of multi-factor authentication.

Challenges

  • Increased board member liability for IT compliance within the organization.
  • Increased audit requirements for every organization. We have seen a big increase with our clients needing to be compliant with their vendor’s requirements.
  • Increased supply chain requirements.

Wishing everyone a healthy and successful 2020 from the Quanexus Team!

Quanexus IT Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Jack Gerbs in Cybersecurity, Information Security, Physical Security, Recent Posts, Small Business, Telephone Systems, Virtualization, Wireless

STIR/SHAKEN, The Technology Fighting Robocalls

Last week we did a blog post on robocalls and what telecom companies and now the Federal Government is doing to combat them. Since our blog post, the bill passed the Senate and is expected to be signed into law. As a follow up we want to go more in depth on the technology named in the bill and how it is helping to end robocalls.

The big issue with robocalls is number “spoofing.” This is the technology criminals use to make the number they are calling from appear as if it is closely related to your phone number, or at least from your same area code. Criminals can also spoof known numbers, like the phone number of your bank, or the IRS. This technology makes it harder for users to identify a scam, and makes them more susceptible to giving the criminal personal information.

The technology named in the Senate bill is STIR/SHAKEN. STIR (Secure Telephone Identity Revisited) is an internet-based process that verifies a calling party’s authorization to use a particular phone number. SHAKEN (Secure Handling of Asserted information using toKENs) is a framework to verify the calling number and how it will be transported. These two technologies work together to authenticate a phone call, and pass that information on to the service provider of the person receiving the call.

When a phone call is made the call first goes to the service provider of the person making the call. This originating service provider now assigns the call an authentication token based on what they know about the number and the caller. The easiest token is, “this person owns this phone number, we assigned it to them.” The second level of authorized calls are, “this person has permission to use this phone number.” This second category could be from a business call center who wants all of their outbound calls to come from one phone number. This type of call should also pass through without issue. The third level of authorization is, “minimal or questionable knowledge about the authorization of this call.” These are the calls the technology is trying to put an end to.

Each call is assigned a token from the originating service provider, and then this token is passed from service provider to service provider until the call reaches the terminating service provider. Then, the terminating service provider has to make a decision on what they want to do with the third level of authenticated calls. The terminating service provider can forward the call with a messaged attached for the user. This is where some cell phone users are noticing calls come through as “Fraud Risk” or “Telemarketer.” The terminating service provider could also choose not to deliver the call at all, or dump it to a voice mail box. Telecom companies are still experimenting with what users would like done with these calls at this point.

All of the major telecom companies have already implemented some version of this technology, but the new law should help to push the technology forward and make sure all of the telecom companies are working together in this fight.

Quanexus IT Services for Dayton and Cincinnati

Request your free network assessment today. There is no hassle, or obligation.

If you would like more information, contact us here or call 937.885.7272.

Follow us on FacebookTwitter and LinkedIn and stay up to date on by subscribing to our email list.

Posted by Charles Wright in Cybersecurity, Information Security, Recent Posts, Small Business, Telephone Systems, Wireless