IRS Warns Taxpayers, Tax Pros of New Email Scam Targeting Hotmail Users

New phishing email scam targets Hotmail users using IRS as bait. 

The Internal Revenue Service warned taxpayers and tax professionals of a new email scam targeting Hotmail users that is being used to steal personal and financial information.

The phishing email subject line reads: “Internal Revenue Service Email No. XXXX | We’re processing your request soon | TXXXXXX-XXXXXXXX”. The email leads taxpayers to sign in to a fake Microsoft page and then asks for personal and financial information.

The IRS has received over 900 complaints about this new phishing scheme that seems to exclusively target Hotmail users. The suspect websites associated with this scam have been shut down, but taxpayers should be on the lookout for similar schemes.

Individuals who receive unsolicited emails claiming to be from the IRS should forward it to phishing@irs.gov and then delete it. It is important to keep in mind the IRS generally does not initiate contact with taxpayers by email to request personal or financial information. For more information, visit the “Tax Scams and Consumer Alerts” page on IRS.gov.

The IRS reminds tax professionals to be aware of phishing emails, free offers and other common tricks by scammers. Tax professionals who have data breaches should contact the IRS immediately through their Stakeholder Liaison. See Data Theft Information for Tax Professionals.

Apple Throttles iPhones That Have Old Batteries (But Didn't Tell You About it)

"What people think is, ‘My phone is slow, I need to replace it.’ And that causes a lot of perfectly good phones to get replaced."

As the battery of your iPhone degrades, Apple throttles the speed of your iPhone. What was once just a hunch from people who feel annoyed that their old phone “feels slow” now has hard data and an Apple statement to back it up.

A Redditor noted earlier this month that his phone speed increased significantly after he replaced his iPhone 6S battery, and had benchmarks to prove it. A followup post by John Poole of GeekBench (a benchmarks company) found the same. iFixit teardown engineer Jeff Suovanen performed similar tests with iFixit employees’ phones and shared the data with Motherboard.

Suovanen found that iPhone 6S devices that still had their original batteries (they are about two years old now) had benchmark scores that were up to 57 percent lower than the GeekBench average. Replacing the battery instantly improved the benchmark scores drastically; he saw 70 percent swings in benchmark performance after swapping the old battery for a new one.

"Everyone came back a day later and said, 'Wow, it works so much faster,'" Suovanen told me on a phone call.

Phones that were performing far below the GeekBench average suddenly began performing above it after he swapped in a new battery.

“The takeaway is that the original batteries were causing a lot of CPU throttling, and replacing the batteries seems to have completely cured that,” Suovanen said. “We’re familiar with the fact that older batteries lose capacity, but we don’t expect it to cause a big hit on performance. This was an eye-opener for me.”

Apple told TechCrunch that it throttles iPhone performance to prevent the phone from being shut down if a performance spike draws too much power. Lithium-ion batteries lose capacity over time, so such a system is fine and makes sense. What doesn’t make sense and is indefensible is that Apple has not been forthright about this behavior. The statement Apple gave TechCrunch is impenetrable to the average user:

Our goal is to deliver the best experience for customers, which includes overall performance and prolonging the life of their devices. Lithium-ion batteries become less capable of supplying peak current demands when in cold conditions, have a low battery charge or as they age over time, which can result in the device unexpectedly shutting down to protect its electronic components. 

Last year we released a feature for iPhone 6, iPhone 6s and iPhone SE to smooth out the instantaneous peaks only when needed to prevent the device from unexpectedly shutting down during these conditions. We’ve now extended that feature to iPhone 7 with iOS 11.2, and plan to add support for other products in the future

What makes it worse is that Apple does not make it easy to replace the battery yourself, discourages third party repair, and doesn’t have the first party repair infrastructure to handle large numbers of in-store battery swaps, especially in states that don’t have lots of Apple Stores.

“It’s a reasonable thing to do but it’s sketchy to do it without disclosure,” Suovanen said. “What people inevitably think is, ‘My phone is slow, I need to replace it.’ And that causes a lot of perfectly good phones to get replaced.”

I just called my nearest third party repair shop; they do iPhone 6S battery replacements for $39 and it takes 15 minutes. Apple charges $79 for this service and you need an appointment (surely many people simply decide to buy a new phone they don’t need).

To be clear: You can make your old iPhone faster if you replace the battery. You can do this yourself if you’re brave, or take it to a third-party shop if you want it handled by a professional.

The scandal here is not that Apple throttles your phone. It’s that it doesn’t tell you it throttles, and makes it hard for you to fix the problem (or for you to know about your repair options). The scandal is in the design of the iPhone itself, which requires proprietary tools to open and various components to be removed in order to replace the only part of the phone that is guaranteed to go bad. The scandal is that Apple actively discourages you from trying to fix your own phone, lobbies against legislation that would make it easy for you to restore your phone to peak condition. If you’re mad about this, you’re not crazy—you have every right to be.

South Korea Cryptocurrency Exchange Youbit Shuts Down After Second Hack in 2017

The South Korea Cryptocurrency Exchange Youbit has gone bankrupt after suffering a major cyber attack for the second time this year.

The South Korea Cryptocurrency Exchange Youbit shuts down after suffering a major cyber attack for the second time this year. The company announced bankrupt on Tuesday after being hacked for the second time in the last eight months, the company declared it had lost 17 percent of its assets in the last attack.

This is the first time that a cryptocurrency exchange based in South Korean has gone bankrupt.

Eight months ago hackers stole nearly 4,000 bitcoin (5.5 billion won ($5 million) at the time of the hack) that accounted for nearly 40 percent of the Youbit exchange’s total assets.

The company blamed North Korea for the attack.

“We will close all trades, suspend all deposits or withdrawals and take steps for bankruptcy,” reads the statement issued by the company after the last attack.

In order to minimize the economic impact of the customers, all the clients will have their cryptocurrency assets marked down by 25 percent, in this way Youbit wants to cover the losses selling the remaining assets and using insurance.

The South Korean market for virtual currencies has become one of the most active,  considering that whose trades account for some 20 percent of global Bitcoin transactions. More than one million South Koreans already invested in Bitcoin.

Analysts observed that the demand is very high, for this reason, prices for the unit are around 20 percent higher than in the US.

While global bitcoin prices continue to increase, threat actors are focusing their interests on the virtual currencies.

Recently security experts from Secureworks revealed the Lazarus APT group launched a spearphishing campaign against a London cryptocurrency company.

'Starwars' Debuts on List of Worst Passwords of 2017

Many of the old standbys made this year's list of the 25 stolen - and weakest - passwords found dumped online.

Once again, the top two worst and most popular passwords of the year were "123456" and "Password." But one of the newest most commonly found compromised passwords this year was "starwars" at #16.

The 2017 Worst Passwords list, drawn from more than five million stolen and passwords found online and in plain text by researchers at password management firm SplashData, represents mostly credentials from users in North America and Western Europe. The list, now in its seventh year, doesn't include credentials exposed in the Yahoo breach, nor from compromised adult websites.

"Starwars," an apparent homage to the wildly popular Star Wars movie franchise, actually beat out the infamous "passw0rd," which came in at #17.

Morgan Slain, CEO of SplashData, says his firm basically scrapes Pastebin and other online lists for exposed passwords. "We don't buy or decrypt any lists" of stolen credentials," he says.

Some of the other usual suspects hit the top ten once again, including "12345678," "qwerty," and "football," and newcomers to the top spots include the slightly longer yet still uncreative "123456789" (#6), "letmein" (#7), and "iloveyou" (#10).

"Over time, people still don't seem to be adopting better password hygiene," Slain says. "This [list] is to encourage people to take passwords more seriously and realize how sharing passwords or using the same one can expose you to risk."

What was obvious once again with this year's list is how passwords often reflect a user's interests, he says. "If you go through the list, you can see what's relevant to people … often people's names and pets' names, and a lot of popular culture."

According to SplashData,  about 10% of users have employed at least one of the top 15 worst passwords on the 2017 list, while 3% have chosen the infamous number one password, "123456."

While Slain says his company can't definitively discern when the exposed passwords were created, some are years old, he says.

But a new survey of 1,000 Americans by Visa shows that consumers are getting a bit weary of the password drill: 70% of the respondents consider biometrics simpler than passwords, and some 46% believe biometric authentication is more secure. Close to one-third have used fingerprint authentication on one or two occasions, while 35% do so on a regular basis. Half consider the big selling point of biometrics is no longer having to remember multiple passwords.

The catch, notes SplashData's Slain, is that with Apple's biometric options, for instance, you still have a password for your device. "When you update your device, you have to use the password behind the Touch ID, and if you haven't used the password in ages because you're using a fingerprint or" facial recognition, it's harder to recall the password, he says.

SplashData recommends that users set up passphrases of 12 characters or more, with upper- and lower-case letters, and a mix of characters, and avoiding password reuse among multiple online accounts.

Table 1: Top Worst Passwords of 2017

Rank	Password
1	123456
2	Password
3	12345678
4	qwerty
5	12345
6	123456789
7	letmein
8	1234567
9	football
10	iloveyou
11	admin
12	welcome
13	monkey
14	login
15	abc123
16	starwars
17	123123
18	dragon
19	passw0rd
20	master
21	hello
22	freedom
23	whatever
24	qazwsx
25	trustno1
Source: SplashData

Massive Cloud Leak Exposes Alteryx, Experian, US Census Bureau Data

A misconfigured Amazon Web Services S3 storage bucket exposed sensitive data on consumers' financial histories, contact information, and mortgage ownership.

A major data leak resulting from yet another misconfigured Amazon Web Services S3 storage bucket has exposed sensitive information of 123 million American households. The cloud repository included data from analytics firm Alteryx, reports the UpGuard Cyber Risk Team.

Also exposed were massive data sets belonging to Alteryx partners Experian, the consumer credit reporting agency, and the US Census Bureau. Information from Experian's ConsumerView marketing database and the 2010 US Census were leaked. Home addresses, contact information, financial histories, and analyses of purchasing behavior were publicly available.

UpGuard's director of cyber risk research, Chris Vickery, found the AWS S3 bucket at the subdomain "alteryxdownload" containing sensitive data. The repository was configured to allow any AWS "Authenticated Users" to download its data, meaning anyone with a free Amazon AWS account could access the bucket's information.

"Taken together, this exposed data provide a highly detailed database of tens of millions of Americans' personal, financial, and private lives," UpGuard says. This leak is a "prime example" of how third-party vendor risk can lead to sensitive data exposure.

Read more details here.