1. Don’t Get Taken Judicial Information Technology Office Protecting yourself from scams, malware, and phishing

2. What you need to know New threats are online Take the necessary steps to protects your data and yourself: ▫Back it up ▫Lock it down ▫Don’t get taken

4. Text from Previous Slide Silent Exploit Kit is an exploit pack made by serious people who want to do serious business as well as the people who do not have too much experience with exploit slaves and spreading. All you need to do is send your victim or victims the link to get them as slaves.

5. Hacking has become a business Hacking is now available by subscription ▫Criminals pay for state of the art malware ▫Minimal technical skills required ▫The payments from customers help to keep attacks fresh and subscribers get frequent updates.

6. How much would you pay?

7. Black Hole Business Model Exploit team is responsible for: ▫Developing a “crime pack” delivery service ▫Continually searching for web sites with weak security and poisoning them with the exploit ▫Monitoring their success rates and implementing upgrades to keep ahead of the latest security. ▫The most effective teams have the largest customer base and can charge more money.

8. 4 steps in an Exploit Attack 1.User is lured to poisoned webpage 2.Profiling malware downloaded 3.A profile of the user’s computer (including weaknesses) is created and sent back to the Exploit server. 4.A unique package of malware is created and downloaded to the user’s computer. Note: The attack may not trigger any alerts.

9. Common “Crime Packs” Ad Hijacking Fake Antivirus Ransom ware Financial /Identity Theft

10. Ad Hijacking

11. CBC.ca Before After

12. Zeus: Financial Theft Malware

13. Example: Zeus pop-up

14. Fake Anti-Virus

15. Pay-up or lose your files

16. “FBI” Computer Block

17. The Canadian Version

18. You Must Protect Yourself Back it up Lock it down Don’t get tricked

19. Back It Up (inexpensively)

20. Back it up (The inexpensive way) SyncToy + External Hard Drive or USB Memory Key Pro ▫A copy of your data is safe no matter what happens to your computer. Con ▫You must manually trigger each backup. If you forget, you may lose important data.

21. Back It Up (Effortlessly)

22. Back it up (The sure-fire way) Mac users: Time Capsule PC Users: Acronis Premium and a Network Attached Storage (NAS) Hard Drive Pros: ▫Automatic Backups over your home Wi-Fi network ▫Restore your entire computer if your hard-drive fails ▫Ability to retrieve previous versions of old files

23. Cloud Backup

24. What about Cloud Backup? ▫Reliable ▫Cheap ▫Convenient But: Your data is subject to foreign laws and may be accessed without your knowledge or consent. JITO recommendation: ▫Fine for public data, personal photographs, etc. Not acceptable for judicial information.

25. Lock It Down

26. Lock it Down (with Anti-Virus) Mac Users: Sophos (http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-edition/download.aspx)http://www.sophos.com/en-us/products/free-tools/sophos-antivirus-for-mac-home-edition/download.aspx PC Users (Recommend Running two): ▫Avast (for PC) (http://www.avast.com/en-ca/index)http://www.avast.com/en-ca/index ▫Sophos for PC (http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx)http://www.sophos.com/en-us/products/free-tools/virus-removal-tool.aspx ▫Malware Bytes (http://www.malwarebytes.org/)http://www.malwarebytes.org/ Tip: After you install, run a scan of your computer so that you are familiar with how it looks and works. This will help you spot a fake ant-virus message.

27. Lock It Down

28. Lock it Down (with patching) Ensure that you are getting routine patches for your operating system and your anti-virus. Install patches whenever they become available. PC Users: consider Secunia PSI ( https://secunia.com/vulnerability_scanning/personal/) to alert you when any software is not up-to-date) https://secunia.com/vulnerability_scanning/personal/ Consider using the Chrome Browser (which automatically updates key plug-ins)

29. Lock It Down

30. Lock it Down (With User Controls) Malware can take advantage of your user rights. 1.Have a password for the user(s) with administrative rights. 2.Create a user account without administrative rights for regular web-surfing and everyday activities. Note: This is particularly important if your computer is shared.

31. No More Blue Screens, Ever.

32. Windows XP 6 month warning: Microsoft will withdraw patching services on April 1, 2014. Afterward, there will be no automatic fixes to address newly discovered security holes in the XP Operating System.

33. Home Wi-Fi: Lock It Down

34. Lock It Down (Home WiFi) All providers (Bell, Rogers, etc.) now install your Wi-Fi with password protection by default. Unfortunately the passwords to control your router are still defaults (and easily discovered). ▫If your Wi-Fi router is not locked, call your provider and a technician will help you turn on password protection and change the administrative password on your router. Tip: Tape your Wi-Fi password and administrator password to bottom of your router.

35. Free Wi-Fi: It can cost you more than a Double-Double

36. Lock it Down (On Free Wi-Fi) Free Wi-Fi in coffee shops, airports and hotels may allow others to “sniff” your passwords If possible, avoid using websites and services where you log-in Good Idea: Install HTTPS Everywhere for your browser Better Idea: If you are concerned about security, log in to GoRemote VPN on a PC, MAC or iPad (Requires free Junos (https://itunes.apple.com/ca/app/junos-pulse/id381348546?mt=8) app).https://itunes.apple.com/ca/app/junos-pulse/id381348546?mt=8 All your activity will be encrypted over the Wi-Fi

37. Don’t Get Taken

38. Email Don’t click links in an email you didn’t expect to receive. Hover over a link and look to see if it leads where you expect it would. Never click on a banking link e-mailed to you ▫Call the number or visit the website listed on your bank card.

39. Pop-ups Never enter passwords or other data into a pop- up.

40. Pop-Ups Never click on a pop-up to update a browser plug in (e.g. Adobe Flash). ▫Download new software directly from the company or the browser website.

41. Pop-Ups Always close unexpected pop-ups by clicking the upper right-hand corner:

42. Malware Exploits Need Your Help They are counting on you To be lax about security To fall for their tricks To pay up when your data is threatened

43. Don’t Be The Weak Link Back it up Lock it down Don’t get tricked

44. Links to Checklists and More Information