Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Gmail. Show all posts
Tycoon
Gmail malware MFA Bypass Microsoft 365 multifactor authentication phishing kit Safety Security Tycoon

'Tycoon' Malware Kit Bypasses Microsoft and Google Multifactor Authentication

 

An emerging phishing kit called "Tycoon 2FA" is gaining widespread use among threat actors, who are employing it to target Microsoft 365 and Gmail email accounts. This kit, discovered by researchers at Sekoia, has been active since at least August and received updates as recent as last month to enhance its evasion techniques against multifactor authentication (MFA).

According to the researchers, Tycoon 2FA is extensively utilized in various phishing campaigns, primarily aimed at harvesting Microsoft 365 session cookies to bypass MFA processes during subsequent logins. The platform has amassed over 1,100 domain names between October 2023 and late February, with distribution facilitated through Telegram channels under different handles such as Tycoon Group, SaaadFridi, and Mr_XaaD.

Operating as a phishing-as-a-service (PhaaS) platform, Tycoon 2FA offers ready-made phishing pages for Microsoft 365 and Gmail accounts, along with attachment templates, starting at $120 for 10 days, with prices varying based on the domain extension. Transactions are conducted via Bitcoin wallets managed by the "Saad Tycoon Group," suspected to be the operator and developer of Tycoon 2FA, with over 1,800 recorded transactions as of mid-March.

The phishing technique employed by Tycoon 2FA involves an adversary-in-the-middle (AitM) approach, utilizing a reverse proxy server to host phishing webpages. This method intercepts user inputs, including MFA tokens, allowing attackers to bypass MFA even if credentials are changed between sessions.

Despite the security enhancements provided by MFA, sophisticated attacks like Tycoon 2FA pose significant threats by exploiting AitM techniques. The ease of use and relatively low cost of Tycoon 2FA make it appealing to threat actors, further compounded by its stealth capabilities that evade detection by security products.

Sekoia researchers outlined a six-stage process used by Tycoon 2FA to execute phishing attacks, including URL redirections, Cloudflare Turnstile challenges, JavaScript execution, and the presentation of fake authentication pages to victims.

The emergence of Tycoon 2FA underscores the evolving landscape of phishing attacks, challenging the effectiveness of traditional MFA methods. However, security experts suggest that certain forms of MFA, such as security keys implementing WebAuthn/FIDO2 standards, offer higher resistance against phishing attempts.

To assist organizations in identifying Tycoon 2FA activities, Sekoia has published a list of indicators of compromise (IoCs) on GitHub, including URLs associated with Tycoon 2FA phishing campaigns.
Read more »
Hacking
2-Step Verification Account security Action Fraud Cyber Crime Facebook Gmail Hacking

Gmail and Facebook Users Advised to Secure Their Accounts Immediately

 



In a recent report by Action Fraud, it has been disclosed that millions of Gmail and Facebook users are at risk of cyberattacks, with Brits losing a staggering £1.3 million to hackers. The data reveals that a concerning 22,530 individuals fell victim to account breaches in the past year alone.

According to Pauline Smith, Head of Action Fraud, the ubiquity of social media and email accounts makes everyone susceptible to fraudulent activities and cyberattacks. As technology advances, detecting fraud becomes increasingly challenging, emphasising the critical need for enhanced security measures.

The report highlights three primary methods exploited by hackers to compromise accounts: on-platform chain hacking, leaked passwords, and phishing. On-platform chain hacking involves cybercriminals seizing control of one account to infiltrate others. Additionally, leaked passwords from data breaches pose a significant threat to account security.

To safeguard against such threats, Action Fraud recommends adopting robust security practices. Firstly, users are advised to create strong and unique passwords for each of their email and social media accounts. One effective method suggested is combining three random words that hold personal significance, balancing memorability with security.

Moreover, implementing 2-Step Verification (2SV) adds an extra layer of protection to accounts. With 2SV, users are prompted to provide additional verification, such as a code sent to their phone, when logging in from a new device or making significant changes to account settings. This additional step fortifies account security, mitigating the risk of unauthorised access even if passwords are compromised.

Recognizing the signs of phishing scams is also crucial in preventing account breaches. Users should remain vigilant for indicators such as spelling errors, urgent requests for information, and suspicious inquiries. By staying informed and cautious, individuals can reduce their vulnerability to cyber threats.

In response to the escalating concerns, tech giants like Google have implemented measures to enhance password security. Features such as password security alerts notify users of compromised, weak, or reused passwords, empowering them to take proactive steps to safeguard their accounts.

The prevalence of online account breaches demands users to stay on their tiptoes when it comes to online security. By adopting best practices such as creating strong passwords, enabling 2-Step Verification, and recognizing phishing attempts, users can safeguard their personal information and financial assets from malicious actors.



Read more »
User Privacy
2FA Data Breach Digital Age Gmail Google Google Apps Google Photos User Privacy

Safeguard Your Data: Google's Data Purge Approaches

Google just announced that the time is running out on a massive cleanup of defunct Gmail accounts and content from Google Photos, which is scheduled to start on December 1. Many consumers can be taken aback by this action, which is intended to manage and streamline user data. Take quick action to make sure your important data isn't lost in the cleanse.

The data purge involves Google identifying and deleting data from accounts that have been inactive for an extended period. This includes Gmail messages, attachments, and Google Photos content. The goal is to free up storage space and enhance overall system efficiency.

Several major news outlets, including Forbes, CBS News, Business Insider, and Yahoo News, have covered this impending data purge, emphasizing the urgency for users to safeguard their digital assets.

Google's initiative raises concerns for users who may have overlooked the significance of their inactive accounts. If you've been using Gmail or Google Photos but have not actively engaged with these services, now is the time to reassess and secure your data.

To prevent the loss of your digital memories and crucial information, follow these steps:
  • Access Your Accounts: Log in to your Gmail and Google Photos accounts to ensure they are active and accessible. This alone can exempt your data from the impending purge.
  • Review and Save Important Data: Take the opportunity to review your emails and photos. Save any crucial information or memorable moments to a secure location, such as an external hard drive or cloud storage.
  • Update Account Information: Confirm that your account recovery information, including your phone number and email address, is up to date. This ensures you can recover your account if needed.
  • Enable Two-Factor Authentication: Strengthen the security of your Google accounts by enabling two-factor authentication. This adds an extra layer of protection, making it harder for unauthorized individuals to access your data.
These preventative measures will help you get through Google's data purge without losing important information. We need to be aware of any developments that could affect our digital assets since we are depending more and more on digital platforms to store and share our memories and information. To secure your data before it's too late, take action right away.


Read more »
Youtune
Artificial Intelligence Brad Chatbot Cyberattacks CyberCrime Cybersecurity Documents Gmail Technology Youtune

Google's Chatbot Bard Aims for the Top, Targeting YouTube and Search Domains

 


There has been a lot of excitement surrounding Google's AI chatbot Bard - a competitor to OpenAI's ChatGPT, which is set to become "more widely available to the public in the coming weeks." However, at least one expert has pointed out that in its demo, Bard made a factual error. 

As a result of the AI competition between Google and OpenAI, the Microsoft-backed company that created ChatGPT and provides artificial intelligence services for its products, Google has now integrated its chatbot Bard into apps like YouTube, Gmail and Drive, according to a company announcement, published Tuesday. 

In New York, a Google executive said on Thursday at the Reuters NEXT conference that the company's experimental chatbot Bard represents a path to the development of another product that will reach two billion users. In an interview with TechCrunch, Google's Product Lead Jack Krawczyk commented that Bard has laid the foundation for Google to attract even more customers with the help of its artificial intelligence feature, which enables consumers to brainstorm and get information using new artificial intelligence. 

It is possible, for instance, to ask Bard to plan a trip for an upcoming date, complete with flight options and your choice of airline. Users could also ask the tool to summarize meeting notes that have been made in Google Drive documents that they have recently uploaded. Several improvements will be made to Bard this coming Tuesday, including connections to Google's other services. 

The chatbot is also capable of communicating with users in various languages, with the ability to perform a variety of fact-checking functions as well as a broader upgrade to the larger language model that is the foundation of the tool. Google's Bard has been improving its features for nearly six months after it was first introduced to the public, marking the biggest update to the program in that period. 

Among the tech giants, Google, Microsoft, and ChatGPT creator OpenAI are racing against one another, as they roll out increasingly sophisticated consumer-facing artificial intelligence technologies, and they hope to convince users of their value as more than just a gimmick to them.

It is now believed that Google, which recently issued an internal code red when OpenAI beat it to the release of its artificial intelligence chatbot, is using its other widely used software programs to make Bard more useful as a result of the code red. It’s relatively unknown that Bard has received the same amount of attention as ChatGPT. 

According to data from Similarweb, a company that analyzes data for companies, ChatGPT had nearly 1.5 billion desktop and mobile visits in August, substantially more than Google’s A.I. tool and other competitors, which had just 50 million visits. Bard recorded just under 200 million desktop and mobile internet visits throughout August, while ChatGPT by OpenAI also registered 200 million visits during the same period. 

In an interview, Jack Krawczyk, Google's product lead for Bard, stated that Google was aware of the limitations that had caused the chatbot to not appeal to as many people as it should have. Users had told Mr. Krawczyk that the product was neat and novel, but that it did not integrate very well with their personal lives. 

Earlier this month, Google released what it called Bard Extensions, which is an extension of the ChatGPT plug-in that OpenAI announced in March, which allows ChatGPT to work with updated information provided by third-party companies such as Expedia, Instacart, and OpenTable, their own web services and voice apps. 

As a result of the new updates, Google is going to be trying to replicate some of the search engine's capabilities by including Flights, Hotels, and Maps, so users can conduct travel and transportation research using Google's search engine. In addition, Bard may be closer to becoming a more personalized assistant for its users, where they can ask which emails they missed and which points in a document are of most importance to them. 

With the help of Google's large language model, an artificial intelligence algorithm trained on vast amounts of data, Bard had been able to assist students with writing drafts of essays or planning their friend's baby showers. 

As a result of these new extensions, Bard will now draw information from a host of Google services, as well. Now, Bard will be able to retrieve information from YouTube, Google Maps, Flights, and Hotels as well. According to Google, Bard can be accessed through several other services and ask the service for things like "Show me how to write a good man speech and show me YouTube videos about it for inspiration," or suggestions for travel, complete with driving directions, etc.

The Bard extensions can be disabled by the user at any moment by choosing to do so. It is also possible for users to link their Gmail, Docs and Google Drive accounts with Bard to the tool so that it will be able to help them analyze and manage their data. 

For instance, the tool might be able to help with queries such as: "Find the most recent lease agreement in my Drive and calculate how much my security deposit was," Google said in a statement. In a statement, the firm listed that the company will not use users' personal Google Workspace information to train Bard or to serve targeted advertising to users and that users can withdraw their permission at any time in case they do not want it to access their personal information. 

By giving Bard access to a wealth of personal information as well as popular services such as Gmail, Google Maps, and YouTube, Bard is, in theory, making itself even more helpful for its users and gaining their confidence as a result. Using Bard, Google posits that a person planning a group trip to the Grand Canyon may be able to get the dates that suit everyone, get flight and hotel options, provide directions based on Maps, and also take advantage of videos with a variety of useful information available on YouTube.
Read more »
Privacy
Android Artifical Inteligence Business CSE Gmail Google Google Workspace HTML iOS Mobile Privacy

Mobile Privacy Milestone: Gmail Introduces Client-Side Encryption for Android and iOS

 


Encryption is one of the most important mechanisms for protecting data exchanged between individuals, especially when the information exchange occurs over e-mail and is quite sensitive. As a result, it can be complicated for users to be able to achieve this when they use public resources such as the internet. 

Now that Gmail has added client-side encryption to its mobile platform, users may feel safer when sending emails with Gmail on their mobile devices. Earlier this year, Google announced that it would be supporting Android and iOS mobile devices with client-side encryption in Gmail too. 

Using Google's client-side encryption (CSE) feature, which gives users more control over encryption keys and data access, Gmail can now be used on Android and iOS devices, as well as web browsers. In the past few months, Gmail's web version has been upgraded to support client-side encryption. This app lets users read and write encrypted emails directly from their smartphones and tablets. 

In addition to the Education Plus and Enterprise Plus editions of Google Workspace, the Education Standard edition also offers the feature. Workspace editions that don't support client-side encryption, such as Essentials, Business Starter, Business Standard Plus, Business Pro Plus, etc., do not support client-side encryption. 

Furthermore, users who have personal Google accounts are not able to access it. For those using email via desktop through Gmail, client-side encryption will be available at the end of 2022 on a trial basis. Workspace users with a subscription to Enterprise Plus, Education Plus, or Education Standard were the only ones able to take advantage of this feature at that time. 

Client-side encryption also prevented certain features from working, including the multi-send mode, signatures, and Smart Compose, which all functioned properly when using client-side encryption. A more robust version of the feature has been added to the Google Play Store since then. 

The company added the capability to allow users to see contacts even if they are unable to exchange encrypted emails so that they can keep in touch. There is also a security alert that appears in Google Mail when users receive attachments that are suspicious or that cannot be opened because of security concerns. 

While client-side encryption will now be available under the Enterprise Plus, Education Plus, and Education Standard Workspace accounts shortly, it has remained relatively exclusive. This type of Workspace account will also be the only kind of account that will be able to take advantage of the mobile rollout of client-side encryption. 

By using the S/MIME protocol, Google said that it will allow its users to encrypt and digitally sign their emails before sending them to Google servers so that they adhere to compliance and regulatory requirements. This feature lets users access and work with your most sensitive data from anywhere with their mobile devices. 

The blue lock icon present in the subject field of Gmail for Android or iOS users allows them to enable client-side encryption while they are writing a Gmail email for Android or iOS devices. Administrators will, however, have to enable access to the feature through their CSE administration interface, as it is disabled by default. 

During the past week, the search giant celebrated its 25th anniversary by letting teens (age 13 and above) try out its generative search service. The company also announced a new tool called Google-Extended that would enable website administrators to control how Google's Bard AI can be trained on their content. It allows website administrators to control whether or not Google can access their content. 

In addition to pulling the plug on Gmail's basic HTML version, which used to support legacy browsers and users with slow connections and could be used to support legacy browsers, Google will also drop the automatic loading of Gmail's Basic view, instead loading the Standard view by default early next year. Customers who are using Google Workspace Enterprise Plus, Education Plus, and Education Standard will be able to take advantage of this feature. 
Read more »
User Privacy
AI Platform Artifical Intelligence Bard Al-chatbot Cyber Security Gmail Google Google Bard Google Maps Tech Tool User Privacy

Google's Bard AI Revolutionizes User Experience

Google's Bard AI has advanced significantly in a recent upgrade by integrating with well-known programs like Google Drive, Gmail, YouTube, Maps, and more. Through the provision of a smooth and intelligent experience, this activity is positioned to change user interactions with these platforms.

According to the official announcement from Google, the Bard AI's integration with these applications aims to enhance productivity and convenience for users across the globe. By leveraging the power of artificial intelligence, Google intends to streamline tasks, making them more intuitive and efficient.

One of the key features of this integration is Bard's ability to generate contextually relevant suggestions within Gmail. This means that as users compose emails, Bard will offer intelligent prompts to help them craft their messages more effectively. This is expected to be a game-changer for both personal and professional communication, saving users valuable time and effort.

Furthermore, Bard's integration with Google Maps promises to revolutionize how we navigate our surroundings. By understanding user queries in natural language, Bard can provide more accurate and personalized recommendations for places of interest, directions, and local services. This development is set to redefine the way we interact with maps and location-based services.

The integration with YouTube opens up exciting possibilities for content creators and viewers alike. Bard can now offer intelligent suggestions for video titles, descriptions, and tags, making the process of uploading and discovering content more efficient. This is expected to have a positive impact on the overall user experience on the platform.

In a statement, Google highlighted the potential of this integration, stating, "We believe that by integrating Bard with these popular applications, we're not only making them more intelligent but also more user-centric. It's about simplifying tasks and providing users with a more personalized and efficient experience."

This move by Google has garnered attention and positive feedback from tech enthusiasts and industry experts alike. As Bard continues to evolve and expand its capabilities, it's clear that the future of human-computer interaction is getting closer than ever before.

Enhancing user experience has advanced significantly with Google's Bard AI integration with programs like Gmail, Google Maps, YouTube, and more. Bard is poised to transform how we connect with these platforms by providing intelligent suggestions and individualized interactions that focus on the needs of the user.
Read more »
Zero Trust
2FA Artificial Intelligence Blogger Cyber Security Forbes Gmail Google Workspace Two Factor Authentication Unauthorized access Zero Trust

Google Urges Gmail Users Set Up 2FA for Enhanced Security

Google recently issued a stern recommendation to its Gmail users asking them to use Two-Factor Authentication (2FA) as a crucial step to safeguard their accounts in an effort to strengthen user security. The new security alert system from the IT giant emphasizes the significance of this step and the requirement for increased account security in an increasingly digital world.

Google's most recent project aims to give Gmail users a better defense against security threats. According to a Forbes article, the organization is actively warning its user base about serious security issues and enjoining them to adopt security measures that might considerably lower the chance of illegal access to their accounts.

The importance of 2FA cannot be overstated. By requiring users to provide two distinct forms of identification – typically a password and a secondary verification method, such as a mobile authentication code – 2FA adds an extra layer of security that is difficult for attackers to breach. Even if a hacker obtains a user's password, they would still need the second factor to gain access, making it significantly harder for unauthorized individuals to infiltrate accounts.

This news supports Google's ongoing initiatives to advance digital sovereignty and a zero-trust approach to identification and security. Google expanded its commitment to advancing zero-trust principles and digital sovereignty through AI-powered solutions in a blog post that was posted oitsir official Workspace Updates page. This action demonstrates Google's commitment to fostering a secure online environment for its users, supported by cutting-edge technology and strong security measures.

The need to emphasize cybersecurity has never been more pressing as people increasingly rely on digital platforms for communication, commerce, and personal connections. More sophisticated cyberattacks and data breaches are hitting both people and businesses. In this regard, Google's proactive approach in warning users about security problems and advising specific steps is laudable and represents the company's dedication to protecting its customers' digital lives.
Read more »
Threat actors
Cyber Security Gmail Gmail checkmark system Google Security Feature Security flaw Threat actors

Google: Gmail Users Warned of a Security Flaw in its New Feature


Google has recently issued a warning to its 1.8 billion Gmail users following a security flaw that was discovered in one of its latest security functions.

The feature, Gmail checkmark system was introduced to assist users distinguish between certified businesses and organizations and legitimate emails from potential scammers. This is made possible through a blue checkmark, included in the function.

However, threat actors were able to take advantage of this feature, raising questions about the general security of Gmail.

Chris Plummer, a cybersecurity expert, found that cybercriminals could deceive Gmail into thinking their bogus businesses were real. This way, they shattered the trust Gmail users were supposed to have in the checkmark system.

"The sender found a way to dupe @gmail's authoritative stamp of approval, which end users are going to trust. This message went from a Facebook account to a UK netblock, to O365, to me. Nothing about this is legit," says Plummer.

Prior to these findings, Google dismissed the claims, calling this to be “intended behavior.” But after the issue gained a significant response following Plummer’s tweet related to the flaw, Google finally acknowledged the error.

Later, Google admitted its mistake and conducted a proper investigation into the matter. The flaw’s security was acknowledged, with Google labeling it as a ‘P1’ fix, which indicates it to be in the topmost priority status.

"After taking a closer look we realized that this indeed doesn't seem like a generic SPF vulnerability. Thus we are reopening this and the appropriate team is taking a closer look at what is going on […] We apologize again for the confusion and we understand our initial response might have been frustrating, thank you so much for pressing on for us to take a closer look at this! We'll keep you posted with our assessment and the direction that this issue takes," Google said in a statement.

Google’s warning serves as a caution to online users that security features too are vulnerable to flaws, regardless of how much advancement they may attain. Thus it is important to have a vigilant outlook on the ‘safety’ features. Users must also be careful when involving themselves with email communication.  

Read more »
Yahoo
Cryptography Cyber Crime Email Attacks Encryption Gmail Outlook Protonmail User Privacy Yahoo

Is Data Safeguarded by an Encrypted Email Service?

Email is the primary form of communication in both our personal and professional lives. Users might be surprised to hear that email was never intended to be secure due to our dependency on it. Email communication carries some risks, but you may still take precautions to protect your inbox. 

What is encryption in email?

One of the most important applications for practically any organization nowadays is email. Additionally, it's among the primary methods for malware to infect businesses.

Email encryption is the process of encrypting email communications to prevent recipients other than the intended ones from seeing the content. Authentication may be included in email encryption.

Email is vulnerable to data exposure since it is usually sent in clear text rather than encryption. Users beyond the intended receivers can read the email's contents using tools like public-key cryptography. Users can issue a public key that others can use to encrypt emails sent to them, while still holding a private key that they can use to decrypt those emails or to electronically encrypt and verify messages they send.

Impacts of an Encrypted Email Service

1. Safeguards Private Data 

It is crucial to ensure that only intended recipients view the material sent via email as it frequently contains sensitive data and business secrets. It is also vital that cyber criminals are unable to decrypt the data being transmitted between people. 

Services for encrypted email are created in a way that protects user privacy rather than invading it. Not simply because they are run by very small teams, but also because their platforms were created with security in mind, encrypted email services are intrinsically more secure. To begin with, the majority employ zero-access encryption, which ensures that only the user has access to confidential data.

2. Cost-effective 

It is not necessary to buy additional hardware whenever the server which hosts the email service currently includes encryption. Many firms have invested in their own servers although it might not be essential.  A reliable third-party service is substantially less expensive.

3. Barrier Against Government Monitoring 

One can learn everything you need to know about Gmail and Yahoo from the fact that no major whistleblower, activist, dissident, or investigative reporter trusts them to transmit sensitive information, at least in terms of government surveillance. Google, for instance, makes it very plain on its official website that it reserves the right to accede to requests from the government and provide useful information.ProtonMail is founded in Switzerland, a country with some of the world's strongest privacy rules.

4. Prevents Spam

Spam attachments frequently contain malware, ensuring that hackers gain access. When you or another person uses encrypted email to deliver attachments, the email includes a digital signature to verify its authenticity. No individual will accept spoofed emails this way. 

Establish strong digital practices to prevent exposing oneself vulnerable. Update your hardware and software. We must improve internet security measures as our reliance on technology increases. Services for secure, encrypted email provide everything that caters to your privacy needs. 

Read more »
Security
Cyber Security data security Email Gmail Safety Security

This New Encryption Can Make Gmail Safer

 

There's a new way to keep your Gmail safe from prying eyes, and experts say it's well worth using. Google announced the addition of end-to-end encryption (E2EE) to Gmail on the web, which will allow enrolled Google Workspace users to send and receive encrypted emails within and outside their domain. 

In an email interview with Lifeire, end-to-end encryption is critical for any communications service because it restricts message content to the sender and receiver(s), according to Jeff Wilbur, senior director of online trust at the nonprofit Internet Society.

"This means that the message content can be seen by bad actors or rogue employees and is subject to access by law enforcement under warrant," Wilbur added. "With end-to-end encrypted email, only the sender and recipient(s) have the key to unscramble the data, so it is safe from prying eyes of any kind."

Users of Google Drive, Google Docs, Sheets, Slides, Google Meet, and Google Calendar already have access to client-side encryption, or what Google refers to as E2EE. The email header won't be encrypted if you enable the new encryption. Still, Google claims that data delivered as part of the email's body and attachments cannot be decrypted by Google servers.

"With Google Workspace Client-side encryption (CSE), content encryption is handled in the client's browser before any data is transmitted or stored in Drive's cloud-based storage," Google wrote on its support website. "That way, Google servers can't access your encryption keys and decrypt your data. After you set up CSE, you can choose which users can create client-side encrypted content and share it internally or externally."

The sender's and the receiver's devices—also referred to as device-to-device encryption—are these two ends in a true end-to-end encrypted messaging service, according to Anurag Lal, CEO of the cybersecurity firm NetSfere, in an email interview with Lifewire. He stated that this type of encryption is perfectly safe because it ensures that only the intended recipient can access the messages. Once messages are encrypted on the sender's device, they cannot be decrypted until they reach the receiver's device.

"While traversing the internet, a message may take several hops from server to server before reaching its final destination," he added. "True E2EE ensures that the message cannot be decrypted on any of these hops, thereby providing complete protection. It should be noted that in E2EE, the ends can refer to any two endpoints. Therefore it's essential to know what these endpoints are to understand if your messages are truly protected."

Private Data

Other email services that don't use Gmail provide end-to-end encryption. People can utilize PGP encryption to encrypt their own emails, but there are also email providers that focus on email encryption, like ProtonMail, according to Robert Andersen, CEO of data security firm Grape ID, in an email to Lifewire.

"Sadly, implementing PGP encryption typically requires significantly more effort than most people are willing to put forth (watch online training videos)," he added. "ProtonMail is a good solution for those who don't mind changing email providers and paying a subscription."

According to Kory Fong, vice president of engineering at Private AI, end-to-end encryption is "essential" for emails to maintain confidentiality. The only way to guarantee that only the sender and the recipient can view all the information in that email is to use this method.

"So even the email provider that controls the servers can't see what's in the messages," he added. "Generally, email services like Gmail will encrypt your email in transit, but Google itself can still access the content and even give access to third parties, but won't without explicit consent."

Fong said that ProtonMail is the most well-known provider that offers end-to-end email encryption, even in its free tier. "The company uses asymmetric, zero-access encryption, meaning even ProtonMail itself can't read what's in your emails," he added.

Another option for users who value their privacy above all else is to distribute a public key to others while automatically encrypting their mail with a private key. This is simple to use thanks to programs like GPG Suite and other GPG plugins, according to Fong. Whichever option you select, E2EE for email is crucial because, according to Andersen, email serves as the entry point to your entire online identity and data.

"Email provides centralized access to all of your online accounts, and your 26,000+ tracked digital profile attributes could easily get in the wrong hands leading to hundreds of types of fraud and scams," he added.
Read more »
Sharpext
email security Gmail Kimsuky Privacy Sharpext

Hackers Use Malware To Spy on Emails


Gmail users should keep a watch out for the recently found email spying software called SHARPEXT. The malware was found by Volexity, a cybersecurity firm. The spying malware targets AOL and Google account holders and can read/download their personal e-mails and attachments.

A hacking group that is believed to work from North Korea is loading harmful browser extensions for Edge and Chrome. It tries to steal email info from open AOL and Gmail sessions and interchange browser preference files. 

About SHARPEXT

Volexity experts found the malicious extension, known as SHARPEXT, it is active for almost a year by Kimsuky (aka SharpTongue). It uses the extension after the attack has been launched, for keeping its presence. 

"SharpTongue's toolset is well documented in public sources; the most recent English-language post covering this toolset was published by Huntress in 2021. The list of tools and techniques described in that post is consistent with what Volexity has commonly seen for years. However, in September 2021, Volexity began observing an interesting, undocumented malware family used by SharpTongue," reports Volexity.

Kimsuky's Attack

Unlike other harmful browser extensions, SHARPEXT isn't made for stealing user credentials. On the contrary, the extension steals information from the e-mail inboxes of the victims.

The hackers deploy the extension manually via a VBS script once the initial breach of the victim system has been done. 

How SHARPEXT is installed

To install SHARPEXT, the hackers replace the Preferences and Secure Preferences files, for the aimed Chromium-based browser, which is generally said to be a difficult task to execute. 

• To interchange the Secure Preferences file, the hackers obtain some details from the browser and make a new file running on browser start-up.

• After that, the attackers use a secondary script to conceal some of the extension's features and any other windows that can surface and alarm the users about suspicious activities. 

• Lastly, the extension uses a pair of listeners for a particular type of activity in the browser tabs. Installation is then modified for different respective targets. 

Volexity says "the purpose of the tabs listeners is to change the window title of the active tab in order to add the keyword used by dev.ps1, the PowerShell script described previously. The code appends the keyword to the existing title (“05101190” or “Tab+”, depending on the version). The keyword is removed when DevTools is enabled on the tab." 

Read more »
Zoho
fake domain Gmail Malicious Emails malware Ransom RAT Scam Zoho

Luna Moth: Hackers After the Subscription Scam 

Luna Moth is a brand-new data extortion group that has been breaking into businesses to spoof users' data. If the victims don't pay a ransom to prevent the information from being made public, hackers threaten to make the records publicly accessible. 

The hacker group adopted the alias Luna Moth and has been engaged in phishing efforts since at least March in which remote access tools (RAT) were distributed, enabling corporate data theft.

How does the scam work?

The Luna Moth ransomware gang has been analyzed by the incident response team at cybersecurity firm Sygnia, it was noted that the actor is attempting to establish a reputation under the name Silent Ransom Group (SRG).

In a report published, Sygnia claims that although the goal of Luna Moth, also known as TG2729, is to acquire key data, its method of operation is similar to that of a scammer.

The organization has been posing as Zoho MasterClass Inc. and Duolingo over the last three months, operating a widespread phishing scam.  The malicious emails are sent from Gmail accounts that were altered to look like official company email accounts, claiming to be from the Zoho Corporation or Duolingo.

Domains used

In April 2022, the first verified campaign-related domain was registered. Hostwinds, a service provider, hosts both the exfiltration and phishing domains, which are both listed under Namecheap.

The two primary sets of domains and IPs that make up Luna Moth infrastructure  can be tied to subscription fraud:

  • Domains with the XYZ TLD, such as maaays[.]xyz, are exfiltration domains. The organization uses these domains as the endpoint for the exfiltrated data when using the Rclone obfuscation method.
  • Phishing sites like masterzohoclass[.]com that pretend to be associated with Duolingo or Zoho. The majority of these domains only last for four hours or less.

Standard tools

Atera, Splashtop, Syncro, and AnyDesk are just a couple of good remote administration tools (RATs) that the hackers mainly employ to control compromised devices. These tools also give the hackers some flexibility and persistence: even if one of the RATs is taken out of the system, the others can still reinstall it. Furthermore, off-the-shelf tools like SharpShares, and SoftPerfect Network Scanner,  are being utilized by the group.

The tools are saved on spyware with fake names that make them appear to be legitimate These technologies enable threat actors to conduct basic reconnaissance tasks, acquire access to additional resources, and steal data from compromised networks in addition to RATs.



Read more »
Vulnerability and Exploits
Bug Bounty Bug Bounty Hunts Bug Bounty Programs Gmail iOS Macbook Vulnerability and Exploits

Apple Awards Bounty of $100,500 for Finding Flaws in MacBook

In 2021, Apple patched a set of MacOs vulnerabilities exposing the Safari browser to attack and letting threat actors hack users' online accounts, cameras, and mic. Cybersecurity expert Ryan Pickren, who found these vulnerabilities and reported back to company Apple, was given a $100,500 bug bounty, considering the critical scale of the vulnerabilities. These bugs exploit a set of security issues with iCloud sharing and Safari 15. 

It allows the hacker to control multimedia permissions and gain full access to all sites that the user has opened using the Safari browser. It also includes Gmail, iCloud, PayPal, and Facebook accounts. The problem is primarily concerned with ShareBear, it is an iCloud file-sharing platform that prompts users to open a shared document. Pickren noticed that the prompt doesn't ask the user to open a file after a user opened it once. 

Pickren concluded that this can allow a threat actor to play with the file's components if he has access to the files. "ShareBear will then download and update the file on the victim's machine without any user interaction or notification. 

In essence, the victim has given the attacker permission to plant a polymorphic file onto their machine and the permission to remotely launch it at any moment," explains Pickren in his writeup. In simpler terms, a .PNG format image file can have all its content and extension converted into an executable binary ("evil.dmg") once the user has opened the file. 

After this, one can launch the binary, which triggers exploit chain vulnerabilities that influence extra bugs found in Safari to control a system's mic and camera and steal local files stored in the device. It is not the first time Pickren disclosed bugs in iOS and macOS that allows a threat actor to gain access to a system and control its commands. 

The unauthorized access is gained when the victim opens a certain file type. He says "this project was an interesting exploration of how a design flaw in one application can enable a variety of other, unrelated, bugs to become more dangerous."
Read more »
Mobile Security
Email Email Hacking FBI Gmail Google Voice Mobile Security

You Might Be A Victim Of Google Voice Scam, Here's How To Protect Your Account

 

According to the FBI, Americans sharing their contact numbers online are attacked by Google Voice authentication scams. FBI explains that scammers are targeting users who have posted their phone numbers as a form of contact while trying to sell their products or services on online market platforms and social media. 

"Recently, we have also been getting reports of people who are getting targeted in other locations, including sites where you post about lost pets," reports FBI. 

Once successful, scammers set up a Google voice account in their victims' name or hack the target's Gmail accounts. Scammers use these hijacked emails later for other malicious campaigns or phishing attacks. 

The scammers contact their targets using text messages or emails that show their interest in items up for selling, the scammer then asks the seller to verify themselves by providing an authentication code from Google. FBI says "what he is really doing is setting up a Google Voice account in your name using your real phone number as verification."

After the Google Voice account is set up, scammers can easily launch other attacks, these attacks can't be retracted back to their origin. An attacker can also use these codes to penetrate and take control of a victim's Gmail account. 

How to protect yourself? 

If you have suffered a Google Voice authentication scam, the FBI suggests visiting Google's support website for assistance on how to get back your Google Voice account and retake your Voice number. 
  • You can also follow these tips suggested by the FBI:  ‌
  • Never share your Google verification code with anyone.  ‌
  • Only deal with buyers or customers in person. Use verified payment platforms for money transfer. ‌Avoid sharing your email Ids to buyers/sellers doing business on phone. 
  • Don't rush yourself into a sale. Your buyer may pressure you to respond, keep patience, don't get manipulated. 
If you suspect you have fallen victim to these online scams, you can report the incident to the FBI's Internet Crime Complaint Center, or call their local FBI office. 

"If your linked number gets claimed, that means you or someone else is using that number with another Voice account. If you still own the linked number, you can add it back to the Voice account where you want to use it," says the Google support website.
Read more »
Spam filter. Cyber Security.
Gmail Spam filter. Cyber Security.

Gmail spam filter breaks down, warning issued to millions of gmail users


Spam filters are something we rarely give a thought to, but nevertheless, they are quite important- working backstage and taking quite the load off. This was something many Gmail users realized after a glitch in Gmail's spam filter let dangerous, malicious, not safe for work messages to be sent to their inbox.

The problem was picked up by Android Police when a remarkable number of individuals posted the spam issue on Twitter and Reddit. They complained about spam messages being sent to their inbox, even promotional and updates alert.

"Did Gmail's spam filter and category function just completely shut down for everyone else? Everything's now going straight to the primary inbox.", tweeted Lachlan Markey, thedailybeast reporter and Viking Books author on July 1st.

“It is a strangely comforting thing that I can just search for "Gmail" and immediately Twitter provides me with evidence that yes, others are getting weirdly hit with spam right now”, tweeted Rev. Emmy Kegler the same day.

“It is a strangely comforting thing that I can just search for "Gmail" and immediately Twitter provides me with evidence that yes, others are getting weirdly hit with spam right now” posted Abid Patel on the micro-blogging site.

Even Reddit was in-fluxed with threads discussing Gmail filter issue, "Is anyone else noticing that Gmail spam filters are broken as of an hour or two ago?", posted a Reddit user. Though Google did acknowledge the problem saying a notable amount of users faced the problem but the issue is now fixed and accounted for but some of the users are still complaining of filter and category problems on social media.

A major problem which spam mails could contain is malicious malware files and phishing emails which users thinking as primary mail could open and trigger and attach, though Google reassured in their statement that none of the accounts were compromised or hacked.

A spokesperson from Google released a statement that the glitch is now fixed and dealt with "We have identified and since fixed the issue of a small number of promotional emails and spam being incorrectly sent to users' primary inboxes. During this time, scans to filter malware and the most egregious spam and harmful content remained fully operational. Additionally, Gmail users remained protected by the many other features such as link protections and download time security scans which apply for messages in the inbox. We have no reason to believe any accounts were compromised as a result. If you happen to notice a suspicious email, we encourage you to report it as spam. More information on how to report spam can be found by visiting our Help Center.”
Read more »
Scams
Coronavirus scams COVID-19 CyberCrime Gmail Google Microsoft Phishing emails Scams

Google Is All Set To Fight The Coronavirus Themed Phishing Attacks and Scams


These days of lock-down have left cyber-criminals feeling pretty antsy about “working from home”. Not that it has mattered because apparently, that is why the number of cyber-crime cases has only hiked especially the Phishing attacks.

This has gotten Google working on its machine-learning models to bolster the security of Gmail to create a stronger security front against cyber-criminals.

Given the current conditions, the attackers seem to have a morbid sense when it comes to the themes of the Phishing attacks, i.e. COVID-19. Reportedly, 18 Million such attacks were blocked in a single week. Which amount up to 2.5% of the 100 Million phishing attacks it allegedly dodges every day.

Google, per sources, is also occupied with jamming around 240 Million spam messages on a daily basis. These phishing attacks and spams at such a worrisome time have impelled Google and Microsoft to modify their products’ mechanisms for creating a better security structure.

Reportedly, the number of phishing attacks, in general, hasn’t risen but in the already existing number of attacks, the use of COVID-19 or Coronavirus seems to have been used a lot.

Malware and phishing attacks, especially the ones related to COVID-19 are being pre-emptively monitored. Because being resourceful as the cyber-criminals are the existing campaigns are now being employed with little upgradations to fit the current situation.


A few of the annoying phishing emails include, ones pretending to be from the World Health Organization (WHO) to fool victims into making donations for VICTIMS to a falsified account.

Per the intelligence teams of Microsoft, the Coronavirus themed phishing attacks and scams are just the remodeled versions of the previous attacks.

The attackers are extremely adaptive to the things and issues that their victims might easily get attracted to. Hence a wide variety of baits could be noticed from time to time.

During the lock-down period of the pandemic, health-related and humanitarian organizations have been extensively mentioned in the scams and phishing emails.

Per sources, the Advanced Protection Program (APP) lately acquired new malware protections by enabling Google Play Protect On Android devices to some specifically enrolled accounts.

Allegedly, users trying to join the program with default security keys were suspended, while the ones with physical security keys were still allowed to be enrolled.

All the bettered security provisions of Google shall be turned on by default so that the users can continue to live a safe and secure life amidst the pandemic.

Read more »
Stalkerware
Coronavirus Gmail India malware MonitorMinor Security Social Media Spyware Stalkerware

Beware of Stalkerware That Has Eyes On All of Your Social Media!


Dear social media mongers, amidst all the talk about the Coronavirus and keeping your body’s health in check, your digital safety needs kicking up a notch too.

Because, pretty recently, security researchers discovered, what is being called as a “Stalkerware”, which stalks your activities over various social platforms like WhatsApp, Instagram, Gmail, Facebook, and others.

‘MonitorMinor’, per the sources, is definitely the most formidable one in its line.

Stalkerware are “monitoring software” or ‘Spyware’ that are employed either by people with serious trust issues or officials who need to spy for legitimate reasons.

Via this extremely creepy spyware kind, gathering information like the target’s ‘Geographical location’ and Messaging and call data is a cakewalk. Geo-fencing is another spent feature of it.

This particular stalkerware is hitting the headlines this hard because, MonitorMinor has the competence to spy on ‘Communication channels’, like most of our beloved messaging applications.

The discoverers of this stalkerware issued a report in which they mentioned that in a “clean” Android system, direct communication between applications is blocked by the “Sandbox” to kill the possibilities of the likes of this spyware gaining access to any social media platform’s data. This is because of the model called “Discretionary Access Control” (DAC).

Per sources, the author of the stalkerware in question manipulates the “SuperUser-type app” (SU utility) (if present) allowing them root-access to the system.

The presence of the SU utility makes all the difference for the worse. Because owing to it and its manipulation, MonitorMinor gains root access to the system.

The applications on the radar are BOTIM, Facebook, Gmail, Hangouts, Hike News & Content, Instagram, JusTalk, Kik, LINE, Skype, Snapchat, Viber, and Zalo-Video Call.

From lock patterns to passwords, MonitorMinor has the power to dig out files that exist in the system as ‘data’. And it obviously can use them to unlock devices. This happens to be the first stalkerware to be able to do so, mention sources.

Per reports, the procedure is such that the “persistence mechanism” as a result of the malware manipulates the root access. The stalkerware then reverts the system section to read/write from the initial read-only mode, copies itself on it, deletes itself from the user section, and conveniently goes back to read-only mode again.

Reports mention that even without the root access, MonitorMinor can do a consequential amount of harm to targets. It can control events in apps by manipulating the “Accessibility Services”. A “keylogger” is also effected via the API to permit forwarding of contents.
Unfortunately, victims can’t do much to eradicate the stalkerware form their systems, yet.

Other functions of the stalkerware include:
• Access to real-time videos from the device’s camera
• Access to the system log, contact lists, internal storage contents, browsing history of on Chrome, usage stats of particular apps
• Access to sound recordings from the device’s microphone
• Control over the device’s SMS commands.

The security researchers released a report by the contents of which, it was clear that the installation rate of it was the maximum in India, closely followed by Mexico and then Germany, Saudi Arabia, and the UK.

The researchers also per reports have reasons to believe that possibly the MonitorMinor might have been developed by an Indian because they allegedly found a ‘Gmail account with an Indian name’ in the body of MonitorMinor.

Read more »
Microsoft Office
Gmail IP addresses Revealed Microsoft Office

Microsoft Office 365 Exposing User’s IP Address in Emails





Microsoft Office 365's webmail interface has been accused for exposing the user's IP address injected into the message as an extra mail header.

This news comes as a rather major warning to those who resorted to Office 365 webmail interface to hide their IP address, because in reality they are not concealing anything.

The service injects an extra mail header into the email called x-originating-IP that contains the IP address of the connecting client, which for this situation is the user's local IP address and this all happens when an email is sent via Office 365 (https://outlook.office365.com/).

BleepingComputer even came around to test the webmail interfaces for Gmail, Yippee, AOL, Outlook.com (https://outlook.live.com), and Office 365.

As for Microsoft, it has removed the x-originating-IP header field in 2013 from Hotmail to offer their users much better security and privacy.

"Please be informed that Microsoft has opted to mask the X-Originating IP address. This is a planned change on the part of Microsoft in order to secure the well-being and safety of our customers."

However for Office 365, who 'caters to the enterprise', this header was deliberately left in so that admins could scan for email that has been sent to their respective organization from a specific IP address. This was particularly helpful for finding the location of a sender in the event of an account getting hacked.

And for Office 365 admins who don't wish to keep utilizing this header, they are allowed to make another new rule in the Exchange admin center that easily removes the header.



In any case, for security and auditing purposes, it is most likely a more shrewd decision to keep it enabled.

Read more »
Information Security News
Email services Gmail Google Information Security News

Gmail's Confidential Mode for G-Suite to be Launched on June 25




In an attempt to mature its email services, Google rolled out a privacy-centric feature called as ‘confidential mode’ which according to the announcements made by the company will be available for all the G suite users in the month of June. Reportedly, in 2018, a beta version of the feature has been launched in the month of August.
The feature is well-built to serve the users and their sensitive information; once available, the mode is configured to “be set to default ON for all domains with Gmail enabled, unless you choose to disable this feature" as per the Google announcements.
With the newly added Confidential Mode turned on, users are aided with inbuilt information rights management controls which allow them to set a specific expiration date for emails that will delete them automatically after the set deadline and they can also, revoke sent emails.
This groundbreaking feature of Gmail will also allow users to send self-destructing emails that will restrict forwarding and block printing to other users. 
As the officials further explained, “Because a sender can require additional authentication via text message to view an email, it’s also possible to protect data even if a recipient’s email account has been hijacked while the message is active."

How to use confidential mode

First of all, ensure that you are using the new version of Gmail which can be activated from the gear icon at the top.
Now open Gmail and click on compose, at the bottom of the mailbox will appear a tiny clock icon, click on that icon to configure the settings of that mail.  
You will have to go through this procedure for each mail you wish to use the feature with as the mode is configured on a per-email basis.


Read more »
Security and Privacy
Cyber Security News Gmail Google Security and Privacy

Google Using Gmail to Track User Purchases




The privacy of Gmail took a severe hit after a Reddit user's take on the matter related to privacy, he shared how he found that his Google Account's Purchases page carried a record of all his purchases made from other online platforms like Amazon; notably, it included the purchases made without using Google Pay.

Prior to appearing into your Google account, your Gmail messages undergo scanning by Google for purchases which happen at the expense of the privacy that the platform was supposedly providing.

While briefing his experience, the Reddit user told that when he checked his Google Account Purchases page, he discovered that the Purchases page also consists a record of the purchases he made from Adidas, Dominos, Amazon, Steam and some other online stores. To put the things into perspective, he further told that he does not use Google Pay.

On being enquired on the matter, Google stated that the source of information was Gmail messages. They also confirmed that the company is not making use of purchases or any other data stored in user emails and that this was configured to aid users in finding and tracking their valuable data.

Referencing from the company's statements, “To help you easily view and keep track of your purchases, bookings, and subscriptions in one place, we’ve created a private destination that can only be seen by you. You can delete this information at, any, time. We don’t use any information from your Gmail messages to serve you ads, and that includes the email receipts and confirmations shown on the Purchase page. We're always working to help people understand and manage their data.”


Read more »
Subscribe to: Posts (Atom)