Stay up-to-date with our monthly newsletter direct from the CISO.
Use the Search Bar to search all Self-Service Articles.
You may also narrow your results by clicking on the categories below. Click once to select, click again to deselect.
The FBI has recently issued a warning about an increase in scam websites that offer free online file conversion services. Rather than providing genuine conversions, these sites often download malware onto victims’ computers. The FBI emphasized the risk of malware leading to ransomware attacks and the installation of browser hijackers […]
Attackers frequently target help desks to gain unauthorized access to user accounts. This is achieved through social engineering tactics, where scammers impersonate legitimate users and request password resets. Scammers will fabricate scenarios that require immediate password resets. They often use urgency or authority to pressure help desk personnel into bypassing […]
Preauthorized purchase scams involve fraudsters posing as representatives from well-known retailers like Walmart, Amazon, or Apple. They falsely claim a large unauthorized purchase has been made on the victim’s account, often creating a sense of urgency to pressure them into action. “A preauthorized purchase of an Apple MacBook Pro and […]
Have you ever clicked on the top search result only to find yourself on a website that looks a little…off? You might have encountered SEO (search engine optimization) poisoning. SEO poisoning is a sneaky tactic cybercriminals use to manipulate search engine results, effectively abusing the public’s trust of the internet. […]
As the holiday season approaches, we would like to bring some old topics to the front of your mind and introduce a new scam to watch out for. We have already warned you of some sneaky scams to watch out for around the holiday season, like Juice Jacking in airports while traveling […]
October is National Cybersecurity Awareness Month, a nationwide effort between government and industry to raise awareness about the importance of cybersecurity and help provide the resources we all need to be safer and more secure online. While the message about cybersecurity may seem repetitive, it’s crucial to remain alert and […]
A new variety of phishing emails have been targeting people across the country. This new spin on a very old extortion scam uses Google Maps Street View images to intimidate victims. The email threatens to release compromising photos and videos (which they likely do not possess) unless a substantial amount […]
The rise of AI has ushered in a new era of digital deception, and Etsy has become a battleground. Once a haven for handmade treasures, the platform is now inundated with computer-generated images of products that simply don’t exist. These AI-generated images are designed to dupe unsuspecting buyers into purchasing […]
Late last week one of our vendors released a faulty update impacting millions of Windows machines worldwide. Errors happen, this was a big one. But the company, a trusted cybersecurity firm, has responded extremely well with a high degree of transparency and a fast response to help its clients, including […]
The world of personal tech has just gotten a little more privacy-focused. In a surprising move, Apple and Google, the usual smartphone giants locked in fierce competition, have announced a joint effort to combat unwanted Bluetooth tracking. This collaboration tackles a growing concern: the misuse of Bluetooth trackers, like Apple […]
Security researchers have uncovered an online criminal ring named BogusBazaar. This threat actor group has spun up a web of fake online stores, targeting fashionistas hungry for luxury brands at bargain-basement prices. Think “steal of the century” turned “identity theft in a click.” Here’s what’s happening in the scam Victims are […]
The FBI has recently warned of a prolific smishing campaign (think phishing, but through text messages) that uses road toll collection as a pretext to trick victims into handing over their personal information and money. This scam, which has been ongoing since March 2024 and has already been spotted in […]
We wrote about the dangers of “SIM Swapping” back in September of 2018, and now the term is making headlines again. This time with a somewhat happy ending, with the suspect facing a potential five-year prison sentence and a hefty fine for altering the SIM card data of customers. Let’s quickly […]
Tax season is here, and while it might mean a sweet refund, it also means scammers are out in force trying to steal your hard-earned cash. Often, these scams first come in the form of phishing emails and social engineering. Here’s a list of popular scams and how to spot […]
As we gear up for a season of cheer and gift-giving, let’s be aware of the sneaky little grinches who are trying to steal your holiday spirit (and your hard-earned money) with the “gift card draining scam.” Gift card draining is a term used to describe when scammers steal money […]
October is National Cybersecurity Awareness Month, a nationwide collaboration between government and industry to raise awareness about the importance of cybersecurity. This year the overarching theme, set forth by the Cybersecurity and Infrastructure Security Agency (CISA), is Secure Our World. The theme promotes behavioral change across the nation with a […]
In our December 2022 issue, we discussed the emerging AI technology ChatGPT. Later in our July 2023 issue, we wrote about how cybercriminals were leveraging AI to circumvent phishing filters, write malware, or weaponize trusted AI technologies. This month we highlight how cybercriminals have further hijacked these rising technologies for no good […]
In December 2022 our CISO Update discussed the emerging AI technology, Chat GPT. Now only seven months later Chat GPT and dozens of other consumer AI apps are readily available and widely used. This game-changing technology has hit the consumer market for designers, writers, coders, and content creators with staggering speed. From […]
The frontman for the Smashing Pumpkins, Billy Corgan, was in the news recently after revealing he paid a ransom when a hacker stole the band’s songs and threatened to leak them. The amount of the ransomware payment was not released. In the band’s view, the leak could have devastated the […]
First coined by security expert Brian Krebs in 2011, “juice jacking” occurs when mobile devices are compromised by using free, publicly available USB power charging stations often found in airports, hotels, and shopping malls. This month the FBI released a PSA via Twitter about avoiding these free stations. Bad actors have figured […]
With an average cost to businesses of $5 million per breach, it’s no surprise that the FBI has named business email compromise (BEC) as a critical multibillion-dollar scam. Earlier this month, a prominent email security firm reported an 81% increase in BEC attacks between the first and second half of […]
Ransomware continues to be a significant challenge for colleges and universities across the country, according to a new report. Emsisoft, a New Zealand–based anti-virus software company, has published “The State of Ransomware in the US: Report and Statistics 2022,” and the results are in: At least 44 universities or colleges […]
By now you probably have heard about this new AI technology, ChatGPT that is sweeping social media and was perhaps a topic of debate at this week’s Holiday parties. GPT-3 [Generative Pretrained Transformer 3] is a state-of-the-art language processing AI model developed by the company OpenAI. This month they released […]
The holiday season is here and as always there will be an increase in online shopping activity. Security researchers at Zscaler say “e-skimming attacks” are something to watch out for, and they predict they will be even more lucrative for threat actors this holiday season. “Skimming” or “card skimming” was […]
This month, in recognition of National Cybersecurity Awareness Month and Halloween, we wanted to cover some spooky Internet of Things (IoT) attacks that may lead you to thinking you have a ghost in your house. While we have covered this topic in past updates, recent research has measured the rapidly growing […]
A new password-free option for iPhone users will soon be available, but beware of being an early adopter. Apple’s new iOS update is attempting to make iPhones the most secure device so far. First announced in June at Apple’s Worldwide Developers Conference, iOS 16 launched this month and is making […]
The purpose of the CISO Update was—and continues to be—to highlight incidents in the world of cybersecurity that are interesting to the FIT community because they are applicable to higher education, dangerous, or particularly quirky. All of this is to raise interest and awareness, to help our community protect itself […]
This is our 50th CISO Update. Each month over the last four years, we’ve published installments in this series of articles, sometimes to educate, sometimes to amuse, but always to underscore the importance of cybersecurity and to give the FIT community concrete examples of steps they can take to be […]
This series of monthly updates has touched on the Internet of Things (IoT) many times. The IoT consists of all those non-computer devices, from smart speakers to thermostats, that exist on the internet. A few years ago we did a piece on how hackers in England had broken into the remote control […]
One of the recurring themes in these CISO newsletter updates is that hackers are not lone wolves, but instead are often affiliated with and supported by well-organized gangs or state actors. So, a recent New York State Intelligence Center Bulletin about how “Ransomware groups continue to innovate and find new […]
Here’s a story about a malicious application that almost seems like it needs to be an April Fools’ Day joke, but unfortunately it’s all too real. Security researchers have uncovered a strain of Android malware that can secretly intercept your phone calls. Disguised as a mobile app from popular South […]
It sounds like a monster movie from the 1940s, maybe Frankenstein Meets the Wolfman. (In that one, by the way, Bela Lugosi played Frankenstein’s monster rather than Dracula. Who knew?) In our 2022 version we find two major themes in cybersecurity coming together: attacks against critical infrastructure and attacks against […]
Many of us depend increasingly on our phones to do all kinds of things, from keeping in touch with friends to executing financial transactions. Cyberattackers follow the crowd, so if we spend more time on our phones, they will find more scams that target phone users. This month we will […]
One of the coolest gadgets to emerge in recent years and may have even been on your Christmas list is the small Bluetooth tracker fob. The device, about the size of a scrabble tile, can be attached to almost anything and then the item can be tracked by a smartphone […]
Over the last several months you may have heard about disruptions caused by cyberattacks on critical infrastructure. In May, an attack shut down Colonial Pipeline, causing gasoline shortages across the east coast of the United States. By the way, the attack vector was a VPN account that didn’t use two-factor authentication […]
Amazon recently launched a new product, called Amazon One, that claims to simplify the everyday shopping experience by putting your payment method quite literally in the palm of your hand. Walk into any one of several Amazon four-star locations around the country to set up this service—all you need is […]
This month, in recognition of National Cybersecurity Awareness Month and Halloween, we wanted to outline a “spooky” vulnerability in Apple’s Express Transit feature. Cybersecurity researchers from the University of Birmingham and University of Surrey have revealed a flaw which could allow hackers to bypass Apple’s security functions and make contactless payments even […]
This month we’re going to look at a growing phenomenon that pulls together a couple of themes that we’ve touched on in these updates and in other aspects of our Cybersafe campaigns: online misinformation, attackers taking advantage of crises in the news, and oversharing online. Recently an industry has emerged […]
One of the recurring themes of these monthly updates has been the growing arsenal of methods that bad guys have at their disposal to attack us. This month brings together two of those methods: IoT devices and unverified content. IoT stands for “internet of things” and refers to all those […]
A number of people around the college community have seen coverage of the latest hacks on the news and have asked me, “Why do all these hacks keep happening? Can’t something be done?” There are many answers to that question. A few are below: We do A LOT to stop […]
Everyone has heard of “phishing” but what is “smishing” all about? “SMS” phishing attacks, also nicknamed “smishing”, are phishing messages that appear as text messages on your mobile device. Just like with email phishing attacks, the criminals masquerade as government entities, tech support representatives, financial institutions, or most recently reported: […]
Social Media is an inescapable part of our personal and professional lives. We use career-oriented services to post articles and update resumes, and we use personal services to share family information and talk about issues of the day. LinkedIn, the career-oriented social media site, is all about building your network […]
The IT Division subscribes to a number of information feeds from government agencies, and details we received on April 8 from the N.J. Cybersecurity and Communications Integration Cell (NJCCIC) particularly piqued our interest—for two reasons. The first was simply the topic: that the NJCCIC has observed a sharp increase in […]
From time to time we invite guests to provide their insights on topics in this monthly column. Online meetings are becoming more central to how we work together during the pandemic and beyond. As a result, attackers are finding new ways to disrupt them. We asked Rick Hoar, executive director […]
New threats emerge in the world of cybersecurity every day. For example, in early February Google patched a 0-day vulnerability in Chrome. A “0-day” basically means that the bad guys found the vulnerability and used it before the vendor did, and now the vendor is catching up. The good news […]
Welcome back after what we hope was a restful holiday break. This edition of the CISO Update will cover two topics: one a reminder and another a new and important initiative. First, many of us shortly will begin another semester of remote work due to the pandemic. We hope everyone […]
For those who have been receiving this newsletter for a while, you’ll recall that our December update usually focuses on ways to protect yourself from holiday-themed phishing scams—and of course, that’s still very relevant this year. (Visit it.fitnyc.edu/holidayscams2017/ for some of our holiday guidelines and remember our “4 Dont’s” of phishing protection.) […]
Often we use this monthly column to let you know about cybersecurity trends and events in the higher education space or in the world at large. This month we’re going to focus on something that happened here at FIT, because it illustrates several key points about how each of us […]
October is National Cyber Security Awareness Month (NCSAM), and as we close the month out it seems like whoever decided back in 2004 that NCSAM would occur every October must have had a crystal ball tuned directly to 2020. Never before has information security been so clearly a front-and-center topic. […]
We hope you are all having a safe and enjoyable start to the fall semester. As we continue working, teaching, and learning remotely, we would like to keep providing tips and best practices to keep your home computers and home networks secure. To secure your home computer and home network: […]
Welcome back! We hope you all had a safe and enjoyable summer. FIT’s plan for reopening in fall 2020, which prioritizes the health and safety of the FIT community, includes the online safety of FIT digital information, data, and resources. This is the second of our monthly campuswide information security […]
We’re thrilled to be bringing you the monthly CISO update. We’ve been putting this newsletter out for some time now on a subscription basis, but are excited to have partnered with Communications and External Relations to make this College-wide. Every month we’ll highlight stories about cybersecurity that […]
This month focuses on fake domain names. A domain name is an entity’s identity on-line, like FITNYC.EDU. It’s been a long-standing practice among hackers to register domain names that mimic those of legitimate businesses such as 1BM.com instead of IBM.com. However, recently attackers have taken this to a new level. […]
This is our last CISO update before many of you break away from FIT for the summer, and we certainly hope it’s a safe and enjoyable one. If the last 9 weeks has taught us anything, it’s that the line between our personal and FIT lives can get pretty thin. […]
The human and economic losses associated with Covid-19 are seen as tragic by most of us. However, just as they always do, hackers are using the crisis as an opportunity. They are taking advantage of distraction and disruption to gain footholds and to attack more people and institutions. By hijacking […]
CISO Update #22 Many of us have been following the progress of the spread of the Coronavirus with concern. Unfortunately, in the same way that the virus jumped from another species (most likely bats or pangolins) to humans, attackers are now finding ways to leverage the virus to infect our […]
CISO Update #21This is the time of year when many of us are out shopping or travelling, and our phones and portable devices get used a lot. We’re comparison shopping in malls, GPS-ing to find alternate routes on crowded roads, and killing time in airports and on planes. Keeping our […]
CISO Update #20Peace on earth, goodwill towards everyone, and cybercrime. Unfortunately those three things go together. People are shopping furiously, hungry for a bargain and eager to jump on something that seems too good to be true. And of course, it is. Here’s one of my favorite examples, because every […]
CISO Update #19We mentioned in an earlier update that we would occasionally ask other members of the campus community to bring their insights as guest contributors. Since October is Cyber Security Awareness Month, and at FIT October is also highlighted by Civility Week, we asked Dr. Ron Milon, Chief Diversity […]
This month’s update focuses on social engineering schemes. In one case attackers have been successful in getting victims to believe a pretty implausible lie, and in another attackers leverage seemingly benign social media platforms to generate viral postings for money or to spread malware. Our first story comes from […]
Passwords continue to be the most universal credential in our use of technology. Sure, some phones can authenticate you via thumbprint or facial recognition, but most of the time, most of us sign on to most things with a password. For years security standards bodies have recommended changing passwords […]
Over the last few weeks, there has been quite a bit of discussion about ransomware, and specifically about an incident at Monroe College in Westchester. Monroe was hit by a ransomware attack that severely impacted a wide variety of college activities, including classes. The attacker is demanding $2 Million to […]
Earlier this week a powerful malware known as “MobOk” was found hiding in seemingly legitimate photo editing apps available on the Google Play store. The photo editing apps “Pink Camera” and “Pink Camera 2”, once installed can take complete control over your mobile device and can steal personal data from […]
In order to gain a wider perspective on the world of Cybersecurity, I’ve decided to periodically ask guests to contribute to the CISO Update. This month’s Update is written by Patty Krakow, who works with me in IT and is the thought leader behind much of our Cyber Awareness and […]
In the 2-plus years since we formally launched the Cybersafe program at FIT, the reaction has been almost exclusively positive and receptive. We’ve had the chance to talk with students, faculty, and staff, about what Cybersafety is, why it’s important, and what they can do to safeguard their information and […]
I write this on the Ides of March, a day historically associated with warnings to Beware, which is certainly a common theme in these monthly updates. Particularly, we’ve discussed the risks associated with the Internet of Things: the collection of billions of devices other than computers that are connected to […]
Welcome to tax season. It feels like almost every season is a prime one for various online scams, but tax season is particularly active. Crooks take advantage of victims’ confusion and stress about filling out complex forms filled with sensitive information, and they steal money, information, or both. The Center […]
Happy New Year! I hope you had a wonderful holiday break, and are enjoying all the presents you received. This month’s update brings us back to the Internet of Things, a topic we discussed several times last year. Specifically, we’ll talk about two instances in which “smart” devices that you […]
Most of us carry smartphones and rely on location-based apps to help us get through our day. Navigation apps help us find the best route through traffic, and search engines help us find “Restaurants near me”. However, a recent New York Times article explores the issues surrounding location services in […]
In a world in which phrases like “Fake News” dominate the airwaves and fraudsters are trying to steal our money and information, we all need to be more vigilant about verifying the authenticity of what we see on the Internet or other information sources. But, what do you do when […]
This month we’re going to focus on a close cousin of Information Security: Information Privacy. Increasingly, whether it’s social media or use of wi-fi, you’re being asked to trade your information for some free service. A few months ago we talked about those social media quizzes that ask you what […]
What do a spate of hacked Instagram accounts, a $220 million lawsuit against AT&T and a bustling underground crime ring have in common? They all started with SIM card swaps, a scam in which hackers steal your mobile identity—and use it to upend your life. At its most basic level, […]
They look harmless, and maybe even kinda fascinating. I’m talking about the little interest stories and quizzes that appear at the bottom of news stories, or sometimes on Facebook. Sometimes they are called “sponsored content” or something similar, and they usually have captions designed to draw you in. Maybe it’s […]
How do computers get viruses? There are two prerequisites. First, the computer has to be vulnerable to the virus, usually because the owner hasn’t kept it updated and/or installed antivirus software. We’ll discuss that in a future update. For now we’ll focus on the second prerequisite: someone or something needs […]
In the time I’ve been at FIT, one of the questions I get asked most frequently is “Who would hack a college?”. As it turns out there are lots of reasons that someone would launch a cyber attack against colleges and universities: Political motives: Someone might want to make a […]
Welcome to our second Cybersafe CISO Update, where we highlight interesting and emerging topics in the world of cybersecurity. Last month we talked about the Internet of Things (IoT): the collection of devices other than computers that are connected to the Internet. These include everything from cell phones to home […]
Thanks for attending our second annual Cybersafe Day event and for subscribing to the monthly CISO Update. The Update will focus on new trends in cybersafety that could impact the FIT community. There was a lot of talk during the panel discussions about the Internet of Things (IoT). IoT […]
You may also narrow your results by clicking on the categories below. Click once to select, click again to deselect.