Phishing Email - Wells Fargo Online Banking Alert

Phishing Email - Wells Fargo Online Banking Alert

Recently an email with "Note:This is a service message with information related to your Wells Fargo account(s). It may include specific details." email is circulating.
It's a  phishing email. But I walk you through how to tell for sure. 
What to do? Report them

Report Phishing URLs at Google now 

If you have recievied this email take further action now by click these links

1. https://www.google.com/safebrowsing/report_phish/?hl=en&url=updatewells.net

Text of the phishing email; 

Dear Wells Fargo Online Customer: We're writing to let you know that your account needs to be updated and verified immediately. To proceed, Click on to Update If this is not done your account may be disabled or blocked. Please don't reply directly to this automatically-generated e-mail message. Sincerely, Online Banking Team

How to tell this is a Phishing email ?

1. Is email is from you to you, then it's phishing.
2. Hover over all links in email, if it's not from the wellsfargo.com site then forget it.
   
   
   In above example, the Online Privacy Policy link points to wellsfrago.com, but the action link Update is to updatewells.net which is a spam collecting site.
   
   
3. The best way is to look at message source, see below.

How to examine Email Message Source ?

Now lets look at message source

1. Outlook.com->Actions->View Message Source. 
2. Gmail.com->More (down arrow to top right)->Show original.

For this phony email, well look at the top 50 lines of the message, known formally as the "message header".




At line 50 you have Return-Path: 233571@service-node-13.ng.hostnet.nl
and is suspect because domain was registered in Neatherlands (.nl).
Why look at "Return-Path"? When the e-mail is put in the recipient's mailbox, a new mail header is created with the name "Return-Path:" containing the address on the MAIL FROM command. So it's a quick hit to determine authenticity.

Report Phishing Email (not as Spam)

1. Outlook.com->Junk (at Top)->Phishing Scam
2. Gmail.com->More (downarrow to top right)->Report Phishing 

Report Phishing URLs at Google now 

If you have recievied this email take further action now by click these linksHover over the iforgot.apple.com link and match the URL and click on the match link to report them as phishing to Google.

1. https://www.google.com/safebrowsing/report_phish/?hl=en&url=updatewells.net

If you don't see your URL here add a comment below.

Report phishing at Microsoft and government agencies

1. http://www.microsoft.com/security/online-privacy/phishing-faq.aspx

Windows 10 - Set Time Automatically (from the internet)

The trend in Windows 10 of the Metro design is the simplification of user interfaces design, whose goal is universal access to non-technologist. However, too many times the balance between simple and loss of information to make decisions is lost. Let's take for classic example, the need to set time on your computer accurately. 

Windows 10 has a nice slide button that says to Set Time Automatically. Well that's vague, right. The first question now is set time automatically according to what?

Just adding "Set Time Automatically from internet" might be clearer or hover over with the additional information could have saved me from writing this post. 

Let's drill in, this setting auto-magically allows you to synchronize your Windows 10 time from a centralized time server.  All time server use Network Time Protocol (NTP). The default NTP server set by Microsoft is times.windows.com, which does a great job.

However, for privacy and accuracy you may want to change that to your own country.

How to change Windows to get time from your country

Choose Region & language and scroll to bottom then; 

1. Choose Additionally date, time & region settings
2. Click Set the time and date
3. Indicates current time server.

Choose "Change settings..." button. 
Now you can change the value in Server with your new NTP Time Server URL. 

Remember, to click Update now.

Each respectable nation in the world, has their own NTP Servers, and here's a brief list; 

1. USA - time.nist.gov
2. Canada -  time.nrc.ca
3. UK - ntp2c.mcc.ac.uk  University of Manchester
   (UK Nation Physics Lab  NTP Server is no longer funded) 

How to test NTP Timer Server in the command line (cmd.exe); 

w32tm /config /update /manualpeerlist:"time.nrc.ca"
w32tm /query /peers

More NTP Servers listed here for more country selection 
http://support.ntp.org/bin/view/Servers/StratumOneTimeServers

Windows 10 is spying on you - opt out ads using privacy settings

Windows 10 has an unprecedented level of privacy controls. Unlike other companies, you can opt out of many of privacy settings. If you want to go the extra mile, check the last two URLs.

In Windows 10 - goto ‘Settings’ -> ‘Privacy’. It may seem like allot of options, but all 13 different sections you have a choice to control your privacy setting. 

Turning everything of your concern to ‘off’.

One last thing you can turn of adds in your browser by opt out of personalized ads from Microsoft here

https://choice.microsoft.com/en-US/opt-out

What is Windows telemetry?

Windows telemetry is vital technical data from Windows devices about the device and how Windows and related software are performing. It's used in the following ways:

• Keep Windows up to date
• Keep Windows secure, reliable, and perform and Improve Windows  through the aggregate analysis of the use of Windows
• Personalize Windows engagement surfaces

Here are some specific examples of Windows telemetry data:

• Type of hardware being used
• Applications installed and usage details
• Reliability information on device drivers

What is NOT telemetry?

Telemetry can sometimes be confused with functional data. Some Windows components and apps connect to Microsoft services directly, but the data they exchange is not telemetry. For example, exchanging a users location for local weather or news is not an example of telemetry it is functional data that the app or service requires to satisfy the users request.

There are subtle differences between telemetry and functional data. Windows collects and sends telemetry in the background automatically. You can control how much information is gathered by setting the telemetry level. Microsoft tries to avoid collecting personal information wherever possible (for example, if a crash dump is collected and a document was in memory at the time of the crash). On the other hand, functional data can contain personal information. However, a user action, such as requesting news or asking Cortana a question, usually triggers collection and transmission of functional data.

https://docs.microsoft.com/en-us/windows/configuration/configure-windows-telemetry-in-your-organization#security-level

To go the extra level you can turn all of these off; 

http://lifehacker.com/what-windows-10s-privacy-nightmare-settings-actually-1722267229

https://prof77.wordpress.com/2015/08/26/windows-10-is-spyware-that-you-cannot-turn-off-uploading-your-activities-to-various-servers-without-your-knowledge-and-without-your-permission/

Update Nov 3, 2016

From
https://www.ghacks.net/2016/11/23/microsoft-gives-third-parties-access-to-windows-10-telemetry-data/?PageSpeed=noscript

but the article seems to contradict itself.

Microsoft struck a deal with security company FireEye recently according to a report on Australian news magazin Arn which gives FireEye access to all Windows 10 Telemetry data.

but the article seems to contradict itself.

Update: Microsoft told Betanews that it is not sharing Windows 10 Telemetry data with the company.

The nature of the deal between Microsoft and FireEye is to license threat intelligence content from FireEye iSIGHT Intelligence. This additional layer of intelligence includes indicators and reports of past attacks collected and edited by FireEye and enhances detection capabilities of Windows Defender Advanced Threat Protection (WDATP). The deal does not include the sharing of Microsoft telemetry.

The report states that FireEye in return will provide Microsoft with the company's iSIGHT Intelligence software for Windows Defender Advanced Threat Protection on Windows 10 devices.

FireEye iSIGHT Intelligence is a proactive, forward-looking means of qualifying threats poised to disrupt business based on the intents, tools and tactics of the attacker.

Windows Defender is built-in to Windows 10 and enabled by default unless other security software is recognized by the operating system.

Pro and Enterprise customers may upgrade to Windows Defender Advanced Threat Protection featuring endpoint behavioral sensors, cloud security analysis and threat intelligence.

The news article suggests that the partnership benefits Microsoft, and specifically the reputation and credibility of the commercial version of Windows Defender.

A press release by FireEye on November 3, 2016 provides additional details on the deal. The company's iSIGHT Intelligence software is available through Windows Defender Advanced Threat Protection (WDATP) but not the free version of Windows Defender.