Netflix is one of the most popular and well-known streaming services. It has nearly 231 million subscribers around the world. It has been growing steadily for almost a decade.

The platform has become an essential part of many people’s daily entertainment routines. They fire up their devices, log in, and pick right back up on their favorite shows.

Unfortunately, like any online service, Netflix accounts can be vulnerable to hacking. It’s a baked-in risk when you have a service that is only protected by a username and password.

If you experience an account hack, it can be shocking, confusing, and infuriating. You may not know exactly what to do and may react without thinking first. This is a dangerous space to be in because it can cause you to do things that only make things worse.

In this article, we’ll give you the steps to take when you suspect someone has hacked your Netflix account. Let’s first cover how hackers typically operate when deploying an account takeover.

How Does a Netflix Hack Typically Work?

Phishing overload is a problem that hackers take advantage of in these types of breaches. People receive fake emails all the time that spoof brands like Netflix. One common phishing ploy is an email stating, “There has been suspicious activity on your account.” It will include a link to log in to a spoofed site that looks like the brand’s normal login page. This is a classic trick to steal your login credentials.

Hacked Netflix accounts typically go for $12 each on the dark web.

People get numb to these emails because they get so many of them. They tend to tune them out, knowing that clicking on them could be dangerous. Hackers take advantage of this, hoping you’ll ignore the real ones from Netflix that warn you of a suspicious login (theirs!).

They lay low and don’t take any action yet that will lock you out. They wait for you to receive a few more of these emails, so you’ll completely ignore them. Then they attempt a takeover.

Accounts hacks can go in various ways. Here is one typical scenario of a Netflix hack:

• The account owner gets an email about a suspicious login. Often it will be from a different country.
• They may log into their Netflix account to see if there are any unknown devices logged in. Usually, none will show yet. The hacker logs back out. The goal is to get you to check and see that nothing is wrong, and assume the real notice is phishing.
• This same scenario may happen 2-4 more times in the span of a month.
• Once the hacker feels the user is ignoring the Netflix warnings, they’ll make their move.
• They add their credit card to your account. This is so they can call Netflix and give them a method of verification.
• They may increase your subscription plan to a higher level.
• They also usually replace any user profile names on your account with numbers (1, 2, 3, etc.)
• At this point, the account owner will typically receive an email. It will note a change in account information. This could be the account email, password, phone number, etc.
• The hacker is now trying to lock the account owner out of their account.

What Do You Do If Someone Has Hacked Your Netflix Account?

1. Go to the Netflix site & try to log in.

If you suspect a hacked account, visit the Netflix site directly from your browser. Do not go through a link you received via email, DM, or SMS.

See if you can log in using your password. You may be able to if you caught the hacker before they’ve locked you out. If not, then skip to Step 4 below, calling Netflix support.

2. If you can log in, change your password immediately.

If you can log into your account, change the password right away. Ensure it’s a strong password that is at least 10-12 characters in length. It should also include a combination of letters, numbers, and symbols.

Do not use a variation of the breached password. You should not use any part of your old password to create the new one.

3. If you can log in, remove any strange payment methods

If you can still access your account and settings, go to the payment methods area. Often hackers will add another payment card to your account. They use it to verify the account to Netflix support.

Remove any strange payment method that is not yours. But if you remove your own payment card, you will need another way to verify your account with Netflix. So, at this point, you may want to call before you do that.

4. Call Netflix support. (Don’t skip this step)

Everyone’s experience may be different. Some users that have gone through a hack have praised the fast and helpful support from Netflix.

Contact Netflix support whether you have or have not succeeded in logging in. There may be things the hacker has done that you aren’t aware of. They may have changed subscription information.

Let the support representative know you think you’re the victim of an account hack. They’ll walk you through the process of undoing what the hacker has done.

5. Watch your bank statements.

Continue to watch your bank statements for any unusual charges. You should do this after any account hack.

6. Change the password for other accounts that used the same one as your Netflix account.

People often use the same or the nearly same password for several accounts. Make sure to change the password for any accounts that used the one that was just hacked.

Get Help Securing Your Passwords & Accounts

Don’t wait until a hack happens to you. Give us a call today to schedule a chat about our password security solutions.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

You wouldn’t think a child’s toy could lead to a breach of your personal data. But this happens all the time. What about your trash can sitting outside? Is it a treasure trove for an identity thief trolling the neighborhood at night?

Many everyday objects can lead to identity theft. They often get overlooked because people focus on their computers and cloud accounts. It’s important to have strong passwords and use antivirus on your PC. But you also need to be wary of other ways that hackers and thieves can get to your personal data.

Here are six common things that criminals can use to steal your information.

Old Smart Phones

People replace their smartphones about every two and a half years. That’s a lot of old phones laying around containing personal data.

Just think of all the information our mobile phones hold. We have synced connections with cloud services. Phones also hold banking apps, business apps, and personal health apps. These are all nicely stored on one small device.

As chip technology has advanced, smartphones have been able to hold more “stuff.” This means documents and spreadsheets can now be easily stored on them. Along with reams of photos and videos.

A cybercriminal could easily strike data theft gold by finding an old smartphone. They often end up at charity shops or in the trash. Make sure that you properly clean any old phones by erasing all data. You should also dispose of them properly. You shouldn’t just throw electronics away like normal garbage.

Wireless Printers

Most printers are wireless these days. This means they are part of your home or work network. Printing from another room is convenient. But the fact that your printer connects to the internet can leave your data at risk.

Printers can store sensitive documents, such as tax paperwork or contracts. Most people don’t think about printers when putting data security protections in place. This leaves them open to a hack. When this happens, a hacker can get data from the printer. They could also leverage it to breach other devices on the same network.

Protect printers by ensuring you keep their firmware updated. Always install updates as soon as possible. You should also turn it off when you don’t need it. When it’s off it’s not accessible by a hacker.

USB Sticks

Did you ever run across a USB stick laying around? Perhaps you thought you scored a free removable storage device. Or you are a good Samaritan and want to try to return it to the rightful owner. But first, you need to see what’s on it to find them.

You should never plug a USB device of unknown origin into your computer. This is an old trick in the hacker’s book. They plant malware on these sticks and then leave them around as bait. As soon as you plug it into your device, it can infect it.

Old Hard Drives

When you are disposing of an old computer or old removable drive, make sure it’s clean. Just deleting your files isn’t enough. Computer hard drives can have other personal data stored in system and program files.

Plus, if you’re still logged into a browser, a lot of your personal data could be at risk. Browsers store passwords, credit cards, visit history, and more.

It’s best to get help from an IT professional to properly erase your computer drive. This will make it safe for disposal, donation, or reuse.

Trash Can

Identity theft criminals aren’t only online. They can also be trolling the neighborhood on trash day. Be careful what you throw out in your trash.

It’s not unusual for garbage to enable identity theft. It can include pre-approved credit card offers that you considered “junk mail.” Your trash can also hold voided checks, old bank statements, and insurance paperwork. Any of these items could have the information thieves need to commit fraud or pose as you.

A shredder can be your best friend in this case. You should shred any documents that contain personal information. Do this before you throw them out. This extra step could save you from a costly incident.

Children’s IoT Devices

Electronic bears, smart kid watches, Wi-Fi-connected Barbies… all toys that hackers love. Mattel’s Hello Barbie was found to enable the theft of personal information. A hacker could also use its microphone to spy on families.

These futuristic toys are often what kids want. Parents might think they’re cool, but don’t consider their data security. After all, these are children’s toys. But that often means they can be easier to hack. Cybercriminals also zero in on these IoT toys, knowing they aren’t going to be as hard to breach.

You should be wary of any new internet-connected devices you bring into your home. That includes toys! Install all firmware updates. Additionally, do your homework to see if a data breach has involved the toy.

Schedule a Home IT Security Audit & Sleep Better at Night

Don’t let the thought of identity theft keep you up at night. Give us a call today and schedule a home IT security audit. You’ll be glad you did.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

It’s a common theme. You begin seeing these amazing CGI images of your friends on Facebook or Instagram. You think, “How can I make one?”

Filters and self-portrait apps have come a long way. You can now make yourself look like Hollywood’s version of a character in the next hit animated film. It still kind of looks like you, only a dream version with “perfect” hair, skin, and facial features.

The latest of these modern vanity marvels to make the rounds is Lensa AI. You upload about 10 photos so the app can feed that data into its AI algorithm. Then, once it maps your facial features, it generates several fantasy selfies of you.

These magical avatars don’t come for free though. While you can download the app for free and use it in a limited fashion, you need to pay to do more. To get unlimited access for one week, it’s $2.99. There are several pricing tiers for its avatar packs and membership access. These range from $3.99 for Avatars Pack 1 to $35.99 for full membership.

It sounds like a little harmless digital fun, right? That’s what many companies making apps like this like you to think. Vanity is an easy sell, and who doesn’t want to have a fabulous profile pic?

But for Lensa AI and several similar self-portrait apps, you’re paying more than you know. The cost comes from the data privacy rights you’re giving up. And these can go far beyond the app itself.

Why Worry About Data Privacy with Lensa AI & Similar Apps?

Thanks to laws like GDPR, software and app developers need to tell you what they do with your data. Looking at the app at the Mac App Store, a few alarming things jump out.

Data Used to Track You

Once you download the Lensa AI app, it can track your phone activity. The app store states that the app may use purchases and unique identifiers to track you. And this doesn’t mean only tracking you while in Lensa AI. It can track you across websites and apps owned by other companies.

Data Collected

Lensa AI scours your device for a lot of different data points. By downloading it, you permit it to do this. Some of the tracking links to you personally (such as linked to your name, IP address, or phone number). It collects a lot of other data, but not with your name or another identifier on it.

Data collected and linked to you:

• User content (such as the images you upload)

Data collected, but not linked to you:

• Purchases you make on websites or apps
• Usage data for apps, etc.
• Identifiers (this isn’t specified, but could mean things like city or gender)
• Diagnostics from your device

Loss of Rights to Your Uploaded Images

What apps like Lensa AI do with your data is a grey area. Many tech companies, such as Facebook, have been known to act irresponsibly with user data. Many are purposely vague in their terms and conditions, leaving the door open.

One section from the Lensa AI Terms that users agree to states the following:

“…solely for the purposes of operating or improving Lensa, you grant us a time-limited, revocable, non-exclusive, royalty-free, worldwide, fully-paid, transferable, sub-licensable license to use, reproduce, modify, distribute, create derivative works of your User Content, without any additional compensation to you…”

For the sole purpose of “operating” Lensa, could mean anything. It could mean that to make more money to operate the business, the company needs to use your images. Note that it also states it can modify, distribute, etc. YOUR user content.

Things You Can Do to Protect Your Data Privacy

Don’t Immediately Jump on Every Fad

This one may be hard when you see all your friends using a new app. It’s natural to want to be a part of that. But try waiting a week. Most likely those avatar images from the latest selfie app won’t be blowing up your feed anymore.

Read App Terms & Conditions

Take the time to read an app’s terms. You are often giving up more data privacy rights than you realize. This includes giving an app the ability to track just about everything you do on your device. Be aware of what’s at risk before you download a new app.

Restrict Data Collection

If you can’t resist an app’s charms, at least make it as secure as possible. This includes taking the time to restrict its data collection features, where possible.

Use your phone’s privacy and security settings to turn off data sharing. For the Lensa AI app, you can also contact the company to request that it delete your data from its servers. Its privacy policy states to email privacy@lensa-ai.com for questions and concerns.

Get a Device Privacy Checkup

The more apps you use, the more complicated data privacy can get. Don’t leave it to chance. We’ll be happy to help. Give us a call today to schedule a device privacy checkup.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Technology vulnerabilities are an unfortunate side effect of innovation. When software companies push new updates, there are often weaknesses in the code. Hackers exploit these. Software makers then address the vulnerabilities with a security patch. The cycle continues with each new software or hardware update.

It’s estimated that about 93% of corporate networks are susceptible to hacker penetration. Assessing and managing these network weaknesses isn’t always a priority for organizations. Many suffer breaches because of poor vulnerability management.

61% of security vulnerabilities in corporate networks are over 5 years old.

Many types of attacks take advantage of unpatched vulnerabilities in software code. This includes ransomware attacks, account takeover, and other common cyberattacks.

Whenever you see the term “exploit” when reading about a data breach, that’s an exploit of a vulnerability. Hackers write malicious code to take advantage of these “loopholes.” That code can allow them to elevate privileges. Or to run system commands or perform other dangerous network intrusions.

Putting together an effective vulnerability management process can reduce your risk. It doesn’t have to be complicated. Just follow the steps we’ve outlined below to get started.

Vulnerability Management Process

Step 1. Identify Your Assets

First, you need to identify all the devices and software that you will need to assess. You’ll want to include all devices that connect to your network, including:

• Computers
• Smartphones
• Tablets
• IoT devices
• Servers
• Cloud services

Vulnerabilities can appear in many places. Such as the code for an operating system, a cloud platform, software, or firmware. So, you’ll want a full inventory of all systems and endpoints in your network.

This is an important first step, so you will know what you need to include in the scope of your assessment.

Step 2: Perform a Vulnerability Assessment

Next will be performing a vulnerability assessment. This is usually done by an IT professional using assessment software. This could also include penetration testing.

During the assessment, the professional scans your systems for any known vulnerabilities. The assessment tool matches found software versions against vulnerability databases.

For example, a database may note that a version of Microsoft Exchange has a vulnerability. If it detects that you have a server running that same version, it will note it as a found weakness in your security.

Step 3: Prioritize Vulnerabilities by Threat Level

The assessment results provide a roadmap for mitigating network vulnerabilities. There will usually be several, and not all are as severe as others. You will next need to rank which ones to address first.

At the top of the list should be those experts consider severe. Many vulnerability assessment tools will use the Common Vulnerability Scoring System (CVSS). This categorizes vulnerabilities with a rating score from low to critical severity.

You’ll also want to rank vulnerabilities by your own business needs. If a software is only used occasionally on one device, you may consider it a lower priority to address. While a vulnerability in software used on all employee devices, you may rank as a high priority.

Step 4: Remediate Vulnerabilities

Remediate vulnerabilities according to the prioritized list. Remediation often means applying an issued update or security patch. But it may also mean upgrading hardware that may be too old for you to update.

Another form of remediation may be ringfencing. This is when you “wall off” an application or device from others in the network. A company may do this if a scan turns up a vulnerability for which a patch does not yet exist.

Increasing advanced threat protection settings in your network can also help. Once you’ve remediated the weaknesses, you should confirm the fixes.

Step 5: Document Activities

It’s important to document the vulnerability assessment and management process. This is vital both for cybersecurity needs and compliance.

You’ll want to document when you performed the last vulnerability assessment. Then document all the steps taken to remediate each vulnerability. Keeping these logs will be vital in the case of a future breach. They also can inform the next vulnerability assessment.

Step 6. Schedule Your Next Vulnerability Assessment Scan

Once you go through a round of vulnerability assessment and mitigation, you’re not done. Vulnerability management is an ongoing process.

In 2022, there were over 22,500 new vulnerabilities documented. Developers continue to update their software continuously. Each of those updates can introduce new vulnerabilities into your network.

It’s a best practice to have a schedule for regular vulnerability assessments. The cycle of assessment, prioritization, mitigation, and documentation should be ongoing. This fortifies your network against cyberattacks. It removes one of the main enablers of hackers.

Get Started with a Vulnerability Assessment

Take the first step towards effective vulnerability management. We can help you fortify your network against attacks. Give us a call today to schedule a vulnerability assessment to get started.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.

Misconfiguration of cloud solutions is often overlooked when companies plan cybersecurity strategies. Cloud apps are typically quick and easy to sign up for. The user often assumes that they don’t need to worry about security because it’s handled.

This is an incorrect assumption because cloud security is a shared model. The provider of the solution handles securing the backend infrastructure. But the user is responsible for configuring security settings in their account properly.

The problem with misconfiguration is huge. It’s the number one cause of cloud data breaches. It’s also an unforced error. Misconfiguration means that a company has made a mistake. It hasn’t adequately secured its cloud application.

Perhaps they gave too many employees administrative privileges. Or, they may have neglected to turn on a security function. One that prevented the downloading of cloud files by an unauthorized user.

Misconfiguration covers a wide range of negligent behavior. It all has to do with cloud security settings and practices. A finding in The State of Cloud Security 2021 report shed light on how common this issue is. 45% of organizations experience between 1 and 50 cloud misconfigurations per day.

Some of the main causes of misconfiguration are:

• Lack of adequate oversight and controls
• A team lacking security awareness
• Too many cloud APIs to manage
• No adequate cloud environment monitoring
• Negligent insider behavior
• Not enough expertise in cloud security

Use the tips below to reduce your risk of a cloud data breach and improve cloud security.

Enable Visibility into Your Cloud Infrastructure

Do you know all the different cloud apps employees are using at your business? If not, you’re not alone. It’s estimated that shadow IT use is approximately 10x the size of known cloud use.

When an employee uses a cloud app without authorization, it’s considered “shadow IT.” This is because the app is in the shadows so to speak, outside the purview of the company’s IT team.

How can you protect something you don’t know about? This is why shadow cloud applications are so dangerous. And why they often result in breaches due to misconfiguration.

Gain visibility into your entire cloud environment, so you know what you need to protect. One way you can do this is through a cloud access security application.

Restrict Privileged Accounts

The more privileged accounts you have, the higher the risk of a misconfiguration. There should be very few users that can change security configurations. You don’t want someone that doesn’t know better to accidentally open a vulnerability. Such as removing a cloud storage sharing restriction. It could leave your entire environment a sitting duck for hackers.

Audit privileged accounts in all cloud tools. Then, reduce the number of administrative accounts to a least needed to operate.

Put in Place Automated Security Policies

Automation helps mitigate human error. Automating as many security policies as possible helps prevent cloud security breaches.

For example, if you use a feature like sensitivity labels in Microsoft 365, you can set a “do not copy” policy. It will follow the file through each supported cloud application. Users don’t need to do anything to enable it once you put the policy in place.

Use a Cloud Security Audit Tool (Like Microsoft Secure Score)

How secure is your cloud environment? How many misconfigurations might there be right now? It’s important to know this information so you can correct issues to reduce risk.

Use an auditing tool, like Microsoft Secure Score. You want a tool that can scan your cloud environment and let you know where problems exist. It should also be able to provide recommended remediation steps.

Set Up Alerts for When Configurations Change

Once you get your cloud security settings right, they won’t necessarily stay that way. Several things can cause a change in a security setting without you realizing it. These include:

• An employee with elevated permissions accidentally changes them
• A change caused by an integrated 3rd party plug-in
• Software updates
• A hacker that has compromised a privileged user credential

Be proactive by setting up alerts. You should have an alert for any significant change in your cloud environment. For example, when the setting to force multi-factor authentication gets turned off.

If an alert is set up, then your team knows right away when a change occurs to an important security setting. This allows them to take immediate steps to research and rectify the situation.

Have a Cloud Specialist Check Your Cloud Settings

Business owners, executives, and office managers aren’t cybersecurity experts. No one should expect them to know how to configure the best security for your organization’s needs.

It’s best to have a cloud security specialist from a trusted IT company check your settings. We can help ensure that they’re set up to keep your data protected without restricting your team.

Improve Cloud Security & Lower Your Chances for a Data Breach

Most work is now done in the cloud, and companies store data in these online environments. Don’t leave your company at risk by neglecting misconfiguration. Give us a call today to set up a cloud security assessment.

—
Featured Image Credit

This Article has been Republished with Permission from The Technology Press.