# MA-893.112022: MyCERT Alert - Security Best Practices and Guidelines

**Date:** 30 Nov 2022  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-893.112022  
**Advisory ID:** MA-893.112022

---

**1.0 Introduction**
MyCERT has observed incidents involving data breaches belonging to the public. Sensitive and private personal information, such as names, phone numbers, email and home addresses, are exposed and might be traded on the dark web by cyber criminals. Such data breaches are likely to cause phishing attacks through various methods such as “smishing” and “vishing”. Smishing and vishing are scams where criminals try to get users to click on a fraudulent link through a phone, text message, email, or voicemail.
**2.0 Impact**
Victims of phishing attacks are usually lured and tricked into clicking and entering confidential and sensitive information such as the OTP or security codes, log in details, passwords and many more. Once the perpetrators gain this information, they will use this information to hijack further the victims' accounts for monetary purposes. This can be done by impersonating the victim or abusing the stolen account for other malicious activities.
**3.0 Recommendations**
MyCERT anticipates data breaches would contribute to an increase in attempts to scam the general people via the internet. Hence, MyCERT recommends that users remain extra cautious of any calls from unknown numbers and never entertain such calls, unsolicited calls and text messages (including SMS and WhatsApp). Clicking on or responding to any such voice or text-based messages can be dangerous, leading to users losing money or personal data exposure.
3.1 Here are some security best practices and guidelines to help protect users from releasing their personal information to external parties and falling victim to scam activities.
- Users should always be cautious of individuals or organizations that ask for personal information. Most companies will not ask for sensitive data from their customers. If in doubt, users should verify with the company itself to avoid any potential issues.
- Users should always take a close look at the sender’s display name when checking the legitimacy of an email. Most companies use a single domain for their URLs and emails, so a message that originates from a different domain is a red flag.
- As a general rule, users should not click links or download files even if they come from seemingly “trustworthy” sources.
- Check for mismatched URLs. While an embedded URL might seem perfectly valid, hovering above it might show a different web address. In fact, users should avoid clicking links in emails unless they are certain that it is a legitimate link.
- Users should always be on the lookout for any grammatical errors and spelling mistakes. Legitimate companies will often employ proofreaders and editors who ensure that the materials they send out are error-free.
- Phishing emails are designed to be sent to a large number of people, so they need to be as impersonal as possible. Users should check whether the message contains a generic subject and greeting, as this can be a sign of a phishing attempt.
- Although not every end user has access to advanced anti-phishing software, they can still use the built-in protection of their email clients to filter messages. One example is setting the email client to block all images unless approved.
- Legitimate companies will never send confirmation emails unless there are specific reasons for doing so. In fact, most companies will avoid sending unsolicited messages unless it’s for company updates, newsletters, or advertising purposes.
- Users should always take the context of an email or message into account. For example, most online accounts do away with viewable member numbers, so users should be wary if they receive emails containing a “member number” for services that generally don’t use them.
- If it seems suspicious, it probably is. Users should always err on the side of caution when it comes to sending out personally identifiable information through messages and emails.
- For incidents involving monetary loss, the public is advised to report immediately to NSRC within 24 hours. Contact the **National Scam Response Center (NSRC)** via dialling the hotline number at **997** (Operating Hours: 8 am - 8 pm).
- File a report to [Jabatan Data Perlindungan Peribadi, JPDP](https://www.pdp.gov.my/jpdpv2/), if users receive such calls asking for their personal information at:
Jabatan Data Perlindungan Peribadi
Aras 6, Kompleks Kementerian Komunikasi dan Multimedia
Lot 4G9, Persiaran Perdana, Presint 4 Pusat Pentadbiran Kerajaan Persekutuan
62100 Putrajaya, Malaysia. 
Telephone: 03-8000 8000
Fax: 03-8911 7959
Email : aduan[at]pdp[dot]gov[dot]my
Generally, MyCERT advises users to follow security best practices and guidelines as measures to safeguard their personal information and from becoming victims of scams.
3.2 MyCERT also advises System Administrators on the following best practices and guidelines to deal with data breach incidents in their organisations:
- Verify reported leaked data with the application & database team.
- Perform a compromise assessment to indicate if the system is being compromised.
- Perform a vulnerability assessment of the affected system.
- Perform updates/patches/bugfix to OS, application, and antivirus/edr.
- Continuously monitor security logs to ensure the system is safe from cyber threats.
- Follow and implement security policies, guidelines and best practices in the organisation.
- Ensure systems, applications and third-party add-ons are updated with the latest upgrades and security patches.
- To block and set rules in the firewall, IDS or IPS of the IOC found.
- If using older versions of operating systems or software, ensure they are upgraded to the latest versions, as older versions may have some vulnerabilities that intruders can manipulate. Aside from that, please make specific web-based applications and network-based appliances are patched accordingly.
- Refer to respective vendors' websites for the latest patches, service packs and upgrades. Otherwise, you may also refer to MyCERT’s website for the latest advisories on software vulnerabilities with pointers to patches, service packs and upgrades.
- Ensure the Anti-virus software deployed on hosts and email gateways is updated with the latest signature files and is enabled to scan all files.
- Ensure systems are configured appropriately to avoid incidents such as information disclosure and directory listing caused by system misconfiguration.
- Ensure systems logging is always enabled, especially for critical systems.
- Perform regular backups of all critical information to limit the impact of data loss or destruction and help expedite recovery. Ideally, the backup must be done daily, on independent media and stored offline at an alternate site.
- Organisations are recommended to apply a defence-in-depth strategy in protecting networks. Firewalls, intrusion prevention systems (IPS), and network and host-based intrusion detection systems (IDS) can prevent malicious activities by blocking and dropping if it does occur and keeping track of most of the generic attacks.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**4.0    References**
1. <https://www.mycert.org.my/portal/advisory?id=MA-790.072020>
2. <https://www.mycert.org.my/portal/advisory?id=MA-690.122017>
3. <https://www.mycert.org.my/portal/advisory?id=MA-695.012018>
4. <https://www.mycert.org.my/portal/advisory?id=MA-694.012018>
5. <https://notes.netbytesec.com/2022/05/scam-and-malicious-apk-targeting.html>
6. <https://www.welivesecurity.com/2022/04/06/fake-eshops-prowl-banking-credentials-android-malware/>
7. <https://www.trendmicro.com/vinfo/it/security/news/cybercrime-and-digital-threats/best-practices-identifying-and-mitigating-phishing-attacks>