CySecurity News - Latest Information Security and Hacking Incidents: HTTP

Chrome Security Cyber Security Cyberattack DNS Google Chrome HTTPS warning HTTP HTTP Attacks https

Chrome Blocks Unauthorized Certificates After Three ccTLD Hijacks

Chrome has taken steps to protect users after attackers compromised three country-code top-level domains and exploited the incidents to acquire unauthorized HTTPS certificates for multiple organizations. The affected namespaces are .gh for Ghana, .sl for Sierra Leone and .as for American Samoa. Attackers targeted the third-party registries which own the ccTLDs rather than Google directly.

In addition to the country-code top-level domain takeovers, the adversaries also modified the authoritative DNS records to compromise several Google domains and domains of other companies. Chrome reported that it is not evident that Certification Authorities (CAs) that issued the certificates acted in bad faith but instead concluded that the problem stemmed from attackers’ tampering with DNS infrastructure of the country-code domains.

Chrome’s Secure Web and Networking Team responded to the incidents by utilizing CRLSets to block the unauthorized certificates associated with Google properties and coordinated with the CAs to revoke the certificates, protecting the users of the browsers and other clients. The list of impacted entities grew as Chrome analyzed Certificate Transparency (CT) logs and identified a number of large publicly traded companies and popular internet services.

The team blocked certificates it suspected to be related to the attacks and reached out to the impacted businesses. Users of Chrome do not need to take any action as the protections are designed to be transparent and work in the background. However, Google warned that organizations should not rely on the browser to protect them against the attacks and that Chrome did not identify all the affected domains. Similarly, protections worked on Google Chrome and may have not triggered in other browsers and clients.

Organizations are advised to ensure that they monitor the CT logs for all the domains and that they are notified if an unauthorized certificate is issued. This is critical because every certificate that is trusted by the public must be reported to CT logs. For domains that are impacted by the ongoing attacks, it is recommended to look over the most recent certificates to ensure that they have not been issued without authorization. Google recommended the use of restricted Certification Authority Authorization (CAA) records and the use of ACME account bindings when available.

CAA records dictate which CAs can issue certificates and, while they do not prevent an attacker from using a hijacked domain to issue a certificate, they can help in ensuring that unknown CAs are not utilized. Additionally, the CAA records can prevent attackers from using domain-control validation for certificate issuance through misdirection. Using issuing restrictions and validation method restrictions can prevent attackers from using certificates’ domain validation through cached entries. These protections are only effective after the control of the domain is re-established.

Chrome announced its intent to keep working on long-term projects to improve security and reduce the risks associated with the use of certificates. The proposed changes include shortening the lifespan of certificates and limiting the re-use of domain validation. They will continue to work to improve the Chrome Root Program with the Chrome Quantum-resistant Root Program as the Chrome ecosystem seeks to mitigate the risks posed by DNS and routing compromises.

Google’s Incognito Mode Does Not Make Users Invisible. Here’s What It Actually Protects



 

Privacy

Browser Browser VPN Security Chrome Data Cookies DNS Google HTTP Incognito mode ISP Privacy

Google’s Incognito Mode Does Not Make Users Invisible. Here’s What It Actually Protects

Google’s Chrome Incognito mode can keep browsing history off a device, but it was never designed to make users anonymous online. A class-action lawsuit over the feature exposed how far that distinction could be misunderstood, with Google agreeing to delete or remediate billions of private-browsing records and change how it explains Incognito to users.

The lawsuit, Brown v. Google, was filed in 2020 and alleged that Google continued collecting information about users while they browsed through Chrome’s Incognito mode and other browsers’ private-browsing modes.

The plaintiffs initially sought billions of dollars in damages, with their claims eventually putting at least $5 billion at stake. However, Google did not ultimately agree to pay $5 billion. Under the settlement, there was no class-wide monetary payout. Instead, Google agreed to data deletion and remediation measures, changes to its privacy disclosures, and additional restrictions on data collection. Plaintiffs’ lawyers valued the settlement’s non-monetary relief at more than $5 billion, with estimates reaching $7.8 billion.

The case nevertheless exposed a fundamental problem with private browsing: preventing a browser from retaining a user's history is not the same thing as preventing websites, network operators or online services from observing that user's activity.

Google employees raised concerns about Incognito

The legal dispute became particularly notable after internal Google communications surfaced during litigation.

In one email, Google Chief Marketing Officer Lorraine Twohill told CEO Sundar Pichai that the company should make Incognito "truly private." She also warned that Google could not market the feature too strongly because it was "not truly private," requiring what she described as "fuzzy, hedging language."

Other internal communications were even more critical of the feature. According to material cited in the litigation, Google employees described Incognito as "misleading" and "effectively a lie," while another employee argued that Google should stop using the Incognito name and its spy-themed icon because users could misunderstand the protection it provided. Another recommendation suggested replacing the messaging with a warning that users were not protected from Google.

These discussions mattered because the lawsuit was not simply about whether Incognito stored browsing history locally. It questioned whether users were being given a sufficiently accurate understanding of what happened to their data after it left the browser.

Google disputed the allegations and maintained that the limitations of Incognito had been communicated to users. A Google spokesperson said the company believed the lawsuit was without merit and argued that Incognito was intended to provide a private browsing experience, rather than prevent websites and services from collecting information.

What Incognito actually does

Chrome's Incognito mode does provide a real privacy function, but that function is primarily local.

When a user opens an Incognito window, Chrome starts a separate browsing session. Once all Incognito windows are closed, Chrome does not retain the browsing history, cookies and site data, or information entered into forms from that session in the normal browser profile. Third-party cookies are also blocked by default in current versions of Chrome, although users can temporarily allow them for particular sites.

This makes Incognito useful in situations where the concern is another person accessing the same device.

Someone using a shared computer, for example, can browse for a gift without leaving the visited pages in Chrome's ordinary history. It can also provide a separate browsing session when a user does not want existing cookies and account sessions to carry over.

But there is an important limitation.

Incognito does not erase everything created during a session. Downloads remain on the device, and bookmarks saved during the session remain available after Incognito is closed. Signing into a website can also allow that service to associate activity with the account being used.

The key distinction is therefore simple: Incognito primarily limits what Chrome stores locally. It does not turn the internet connection into a private tunnel.

Your ISP and network administrator can still see activity

Opening an Incognito window does not prevent an internet service provider from observing network activity.

Google's own documentation states that organizations managing a network, including schools, employers and internet service providers, may be able to observe activity while a user is browsing in Incognito. Incognito also does not hide activity or location from the websites being visited.

This is an important distinction from encryption.

Chrome's HTTPS protections can encrypt traffic between a browser and an HTTPS-enabled website, helping prevent someone monitoring the connection from reading the contents of that traffic. Chrome also warns users when they are about to load sites without HTTPS, while Secure DNS can encrypt DNS lookups in supported configurations.

But HTTPS does not make the user anonymous.

The network still has visibility into connection metadata, while the destination website receives the request and can process information available to it.

In other words, Incognito and HTTPS solve different problems. Incognito reduces local traces. HTTPS protects communications in transit. Neither one, by itself, is an anonymity system.

Websites can still identify and track users

The privacy boundary becomes even clearer once a user reaches a website.

Google's current Chrome documentation explicitly states that Incognito does not change how websites collect data or how the services those websites use collect information. Sites can continue gathering information even when a user is not signed in.

Websites can also use first-party technologies and other mechanisms to understand activity within a session. Third-party cookies are only one part of the tracking ecosystem. Google itself notes that websites can use different mechanisms to personalize content and advertising and learn about activity across sites.

This is also where the distinction between an IP address and browser history matters.

Incognito can prevent a local Chrome profile from retaining the list of pages a user visited. It does not automatically conceal the network address from the websites receiving the connections.

And if a person voluntarily signs into a service while using Incognito, the service has an obvious account-level identifier with which to associate the activity. Google's own documentation warns that signing into a Google service or another website during an Incognito session can allow that site to remember the activity.

The lawsuit forced changes to Incognito

The settlement went further than simply changing a warning message.

According to the court filing, Google agreed to delete or remediate billions of records reflecting class members' private browsing activities. The company also agreed to continue blocking third-party cookies in Incognito for five years.

The filing provides an unusually detailed picture of why the cookie change mattered.

Google had historically collected its own third-party cookies when users visited non-Google websites. After the lawsuit was filed, Google implemented third-party-cookie blocking for Incognito users. Under the settlement, that protection had to remain in place for five years. The plaintiffs' filing said blocking data associated with Google's third-party cookies in Incognito could reduce Google's global annual revenue by nearly $500 million.

Google also agreed to remove four identified private-browsing detection signals. According to the plaintiffs' filing, those signals could reveal that a user had chosen private browsing and were then used to label the resulting data as private. The settlement required Google to delete those signals and agree not to use such detection mechanisms to identify or track private browsing.

The class covered an estimated 136 million users, according to court-related filings.

Google eventually changed the warning

The dispute also changed the language presented to Chrome users.

Chrome's current Incognito documentation now makes the limitation explicit. It says that Incognito does not change how data is collected by websites users visit and the services those websites use, including Google. Google also says that websites, network administrators and ISPs may still be able to observe activity during an Incognito session.

That clarification is arguably more important than the Incognito icon itself.

The familiar private-browsing interface can create an intuitive association between the words "Incognito" and anonymity. Technically, however, the feature is much narrower. Chromium describes Incognito as a window-level mode in which pages are not persisted to browsing history and a temporary cookie store is used for the session.

That is a local privacy mechanism, not an invisibility cloak.

So, is Incognito worth using?

Yes, if the objective is local privacy.

If you share a computer with other people, do not want a particular browsing session stored in your ordinary history, or want a temporary browser session separated from your normal cookies, Incognito remains useful.

It is also useful for testing how a website behaves without the cookies and account state associated with a normal session.

But users should not treat the Incognito icon as a guarantee that their online activity is hidden.

It does not prevent an ISP or network administrator from observing activity. It does not stop websites from collecting information. It does not automatically hide an IP address. It does not prevent a user from being identified after signing into an account. And it does not protect files downloaded to the device after the session ends.

Users seeking stronger privacy need to think in layers rather than relying on a single browser setting.

A privacy-focused browser can reduce tracking at the browser level. Tracker and content blockers can limit third-party collection. A properly configured VPN can conceal the user's IP address from the websites they visit and hide destination traffic from the ISP, although the VPN provider itself becomes part of the trust model. Keeping the browser, operating system and extensions updated remains essential because privacy controls cannot compensate for an unpatched security vulnerability.

Chrome itself should also not be treated as static. Google continues to modify its privacy and security architecture. Third-party-cookie protections in Incognito are already part of the browser's privacy model, while Google has also explored additional protections for IP addresses in Incognito.

The larger lesson from the Incognito lawsuit is therefore not that private browsing is useless.

It is that privacy has layers, and the word "private" can mean very different things depending on where the data is stored, who controls the network and which services receive the user's requests.

Incognito can hide your browsing history from someone checking the same device.

It cannot make you disappear from the internet.

Evooo1Bot Hijacks Linux Routers for Proxying, Credential Theft and DDoS Attacks



 

malware

Atlassian DDOS Attacks Evooo1Bot FortiGuard Lab HTTP Linux botnet malware

Evooo1Bot Hijacks Linux Routers for Proxying, Credential Theft and DDoS Attacks

A new Linux botnet named Evooo1Bot is turning internet-facing routers and other gateway devices into SOCKS5 traffic relay nodes, giving attackers a way to route malicious connections through compromised systems while retaining the ability to steal credentials, brute-force SSH accounts, exploit vulnerable devices and launch DDoS attacks.

FortiGuard Labs said it has been tracking the Mirai-based malware since at least July 2026, with activity observed against devices from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare and D-Link across multiple regions. Rather than relying on a single attack function, Evooo1Bot combines several capabilities within a modular Linux malware framework.

The malware retains the DDoS engine from the publicly leaked Mirai source code, but expands on the older botnet's approach with encrypted command-and-control communications, an SSH brute-force scanner, a SOCKS5 relay, a credential sniffer and an exploitation module targeting known vulnerabilities.

Mirai's original success was closely tied to internet-connected devices such as routers, cameras and DVRs, many of which were exposed with weak or default credentials. Fortinet previously documented how Mirai could scan for vulnerable systems, brute-force credentials and recruit them into a remotely controlled botnet.

Evooo1Bot takes that model further by adding more ways to use a compromised device after the initial infection.

Its exploit arsenal covers a wide range of internet-facing technologies. Newer builds have been found with modules targeting Hikvision cameras, Atlassian Confluence, Zyxel firewalls, TP-Link routers, D-Link NAS devices, WSO2 products, Kubernetes ingress-nginx and vulnerable PHP-CGI installations. FortiGuard noted, however, that some of the embedded exploits are incorrectly implemented and fail to compromise their intended targets.

When exploitation succeeds, the malware downloads a build suited to the victim's CPU architecture. FortiGuard identified 12 available builds, allowing the operators to target different Linux-based hardware rather than relying on a single binary.

The malware then attempts to make the compromise harder to trace. It clears Bash history and establishes persistence through mechanisms including systemd, SysV init, shell profiles and "rc.local". A cron job also attempts to download the payload again every five minutes, providing another way to restore the malware if it is removed.

Evooo1Bot also checks its surroundings before fully activating. It searches for debuggers, security software, sandboxes, virtual machines, containers and honeypots, indicating that the operators are attempting to distinguish ordinary victims from environments where the malware could be analyzed.

Its encrypted C2 communications operate over port 443, while an interactive shell gives operators direct control over infected systems. The malware also supports file uploads and downloads and uses a 28-command interface for remote operations.

The SOCKS5 component is where Evooo1Bot moves beyond the conventional DDoS-botnet model.

A SOCKS5 proxy can relay network connections through another system. In this case, the infected router becomes the intermediary, allowing attackers to send traffic through the victim's connection. Evooo1Bot supports both direct-listening and reverse-relay modes, which could help operators conceal the origin of malicious traffic, bypass geographic restrictions or reach networks accessible through compromised devices.

Multiple proxy sessions can operate independently, raising another possibility if the botnet expands: monetizing compromised residential connections as proxy infrastructure.

The malware also monitors "/proc/net/tcp" for network activity and attempts to capture HTTP Basic Authentication and Cookie headers. Alongside its shell and file-transfer functions, this gives operators additional opportunities to obtain information from systems positioned behind the compromised gateway.

SSH provides another route into vulnerable systems. Evooo1Bot uses 150 username and password combinations aimed at enterprise-oriented accounts and performs checks after successful authentication to identify possible honeypots.

DDoS remains part of the malware's toolkit, with 16 flood methods inherited from Mirai, including UDP, DNS, SYN, ACK, GRE, fragmented TCP and customizable HTTP floods.

The result is a botnet in which a compromised router can serve several purposes at once: it can participate in DDoS attacks, relay traffic, collect authentication material, provide remote shell access and help operators compromise additional vulnerable systems.

For users and organizations, securing these devices starts with applying firmware and security updates, replacing default administrator credentials and disabling unnecessary remote-access interfaces. Unsupported equipment that no longer receives security updates should also be replaced.

Network defenders should additionally watch for unexpected outbound connections, unusual proxy traffic and unauthorized changes to cron jobs, startup services or shell profiles.

Evooo1Bot shows why internet-facing routers and gateways cannot be treated simply as passive networking equipment. Once compromised, they can become operational infrastructure for an attacker, extending the intrusion far beyond the device itself.

Advanced Malware Campaigns Target Government and Academic Organizations



 

PDF

APT36 Avast avira cyber espionage HTTP Kaspersky malware PDF

Advanced Malware Campaigns Target Government and Academic Organizations

Cybersecurity researchers have identified ongoing cyber-espionage campaigns targeting government departments, academic institutions, and strategically important organizations across South Asia. The activity has been attributed to two established threat actors, Transparent Tribe and Patchwork, both known for maintaining long-term access to compromised systems.

Transparent Tribe, also tracked as APT36, has been active since at least 2013 and is associated with repeated intelligence-gathering operations against Indian organizations. In its latest campaign, the group used spear-phishing emails carrying ZIP archives that contained Windows shortcut files disguised as legitimate PDF documents. These shortcut files included real PDF content to appear harmless.

When opened, the shortcut launches a hidden process using the Windows utility mshta.exe, which runs an HTML Application script. This script decrypts and loads the final remote access trojan directly into system memory while simultaneously opening a decoy PDF to avoid alerting the victim. The script also interacts with Windows through ActiveX components, such as WScript.Shell, allowing it to analyze the environment and adjust execution behavior.

The malware adapts its persistence strategy based on the antivirus software installed. On systems with Kaspersky, it creates a working directory under C:\Users\Public\core and uses startup shortcuts to relaunch the malicious script. If Quick Heal is detected, it relies on batch files and startup entries. On machines running Avast, AVG, or Avira, the payload is copied directly into the Startup folder. If no recognized antivirus is found, the malware combines batch execution, registry-based persistence, and delayed payload deployment.

A second-stage component includes a malicious DLL named iinneldc.dll, which functions as a fully featured RAT. It allows attackers to remotely control the system, manage files, steal data, capture screenshots, monitor clipboard activity, and manipulate running processes.

Researchers also identified a separate APT36 campaign using a shortcut file disguised as a government advisory PDF. This file retrieves an installer from a remote server, extracts multiple malicious files, displays a legitimate advisory issued by Pakistan’s national CERT, and establishes persistence through registry modifications. One DLL communicates with a hard-coded command-and-control server using reversed strings to hide command endpoints and supports system registration, heartbeat signals, command execution, and anti-virtual-machine checks.

In a related disclosure, researchers linked Patchwork, also known as Maha Grass or Dropping Elephant, to espionage campaigns targeting Pakistan’s defense sector. These attacks used phishing emails with ZIP attachments containing MSBuild project files that abuse msbuild.exe to install a Python-based backdoor. The malware can communicate with command servers, execute Python modules, run commands, and transfer files.

Patchwork has also been associated with a previously undocumented trojan named StreamSpy. Delivered through ZIP archives hosting an executable named Annexure.exe, StreamSpy collects system information, establishes persistence through registry entries, scheduled tasks, or startup shortcuts, and communicates using both WebSocket and HTTP. WebSocket channels are used for command delivery and result transmission, while HTTP handles file transfers. Researchers observed technical similarities between StreamSpy, Spyder, and other malware families, indicating shared infrastructure and continued collaboration among related threat groups.

Here’s How Hackers Are Using QR Codes to Break Browser Security



 

QR code

browser isolation Cyber Security Hacking HTTP QR code

Here’s How Hackers Are Using QR Codes to Break Browser Security

Browser isolation is a widely used cybersecurity tool designed to protect users from online threats. However, a recent report by Mandiant reveals that attackers have discovered a novel method to bypass this measure by utilizing QR codes for command-and-control (C2) operations.

How Browser Isolation Works

Browser isolation is a security technique that separates a user's browsing activity from their local device. It streams only visual content from web pages into the user's browser, preventing direct interaction with potentially harmful sites or exploits. This can be implemented through cloud-based, on-premises, or local solutions.

Traditionally, attackers rely on HTTP requests to communicate with a C2 server and issue commands to compromised systems. However, browser isolation disrupts this process by streaming only webpage pixels, effectively blocking HTTP-based attack methods.

The QR Code Workaround

To bypass browser isolation, Mandiant researchers devised a technique that embeds command data within QR codes. The process works as follows:

The attacker’s server generates a web page containing a QR code embedded with command data.
A headless browser on the victim’s compromised system renders the page and takes a screenshot of the QR code.
The system decodes the QR code to extract and execute the command.

This approach exploits browser isolation’s reliance on transmitting visual data, allowing the QR code to be captured and decoded without triggering traditional security defenses.

Real-World Proof of Concept

Mandiant demonstrated the attack using tools like Puppeteer and Chrome in headless mode. They further integrated the technique with Cobalt Strike’s External C2 feature, showcasing its practicality. However, the technique has certain limitations:

Data Size: QR codes have a limited storage capacity, with a practical limit of about 2,189 bytes per code.
Latency: Each operation introduces a delay of approximately five seconds, making it unsuitable for high-bandwidth tasks such as proxying.

Mitigation Strategies

Despite this new attack vector, browser isolation remains a valid and essential security measure. Mandiant recommends a layered defense strategy to mitigate such threats:

Monitor Network Traffic: Detect abnormal low-bandwidth activity, such as iterative HTTP requests.
Identify Automation Tools: Watch for specific flags associated with headless mode in browser sessions.
Layered Security: Combine browser isolation with other cybersecurity measures to strengthen defenses.

Conclusion

This novel attack demonstrates the evolving nature of cybersecurity threats and the need for constant vigilance. Organizations should adopt a comprehensive approach, including education and robust protection strategies, to defend against emerging threats effectively. Browser isolation remains an important tool when integrated into a layered security framework.

The GuptiMiner Attack: Lessons Learned from a Five-Year Security Breach



 

Security Breach

Avast Cyber Attacks DLL hijacking eScan GuptiMiner malware Hackers HTTP Malware Attack North Korea Hackers Security Breach

The GuptiMiner Attack: Lessons Learned from a Five-Year Security Breach

In a startling revelation, security researchers from Avast have uncovered a sophisticated cyberattack that exploited vulnerabilities in the update mechanism of eScan, an antivirus service, for a staggering five years. The attack, orchestrated by unknown hackers potentially linked to the North Korean government, highlights critical flaws in cybersecurity infrastructure and serves as a cautionary tale for both consumers and industry professionals.

The modus operandi of the attackers involved leveraging the inherent insecurity of HTTP protocol, enabling them to execute man-in-the-middle (MitM) attacks. By intercepting the update packages sent by eScan's servers, the perpetrators clandestinely replaced genuine updates with corrupted ones containing a nefarious payload known as GuptiMiner. This insidious malware facilitated unauthorized access and control over infected systems, posing significant risks to end users' privacy and security.

What makes this breach particularly alarming is its longevity and the level of sophistication exhibited by the attackers. Despite efforts by Avast researchers to ascertain the precise method of interception, the exact mechanisms remain elusive. However, suspicions linger that compromised networks may have facilitated the redirection of traffic to malicious intermediaries, underscoring the need for heightened vigilance and robust cybersecurity measures.

Furthermore, the attackers employed a myriad of obfuscation techniques to evade detection, including DLL hijacking and manipulation of domain name system (DNS) servers. These tactics, coupled with the deployment of multiple backdoors and the inclusion of cryptocurrency mining software, demonstrate a calculated strategy to maximize the impact and stealth of their operations.

The implications of the GuptiMiner attack extend beyond the immediate scope of eScan's compromised infrastructure. It serves as a stark reminder of the pervasive threat posed by cyber adversaries and the imperative for proactive defense strategies. Moreover, it underscores the critical importance of adopting industry best practices such as delivering updates over secure HTTPS connections and enforcing digital signing to thwart tampering attempts.

For users of eScan and other potentially affected systems, vigilance is paramount. Avast's detailed post provides essential information for identifying and mitigating the threat, while reputable antivirus scanners are likely to detect the infection. Additionally, organizations must conduct thorough security assessments and implement robust cybersecurity protocols to safeguard against similar exploits in the future.

Ultimately, the GuptiMiner attack serves as a wake-up call for the cybersecurity community, highlighting the pressing need for continuous innovation and collaboration in the fight against evolving threats. By learning from this incident and implementing proactive measures, we can bolster our defenses and mitigate the risk of future breaches. Together, we can strive towards a safer and more resilient digital ecosystem.

Massive DDoS Attack was Thwarted by Cloudflare



 

IP Address

Botnet Cloud Computing Cloudfare Cyber Attacks DDOS Attacks FBI HTTP IP Address

Massive DDoS Attack was Thwarted by Cloudflare

Prioritized firms like gaming providers, hosting providers, cloud computing platforms, and cryptocurrency enterprises, according to Cloudflare, emanated from more than 30,000 IP addresses.

The greatest volumetric distributed denial-of-service (DDoS) attack that Cloudflare has seen to date was stopped.

The greatest attack, which is the largest documented HTTP DDoS attack, topped 71 million rps, per Cloudlare's analysis. The volume is 35% greater than the previous record, 45 million rps from June 2022, which had been recorded.

The FBI accused six suspects of their involvement in running 'Booter' or 'Stresser' platforms, which anybody can use to execute DDoS attacks, in response to this stream of continuously escalating attacks, and seized dozens of Internet domains. Operation PowerOFF, a larger, more coordinated worldwide law enforcement operation against DDoS-for-hire services, included the action.

Cloudflare has been collaborating with the victims to strike down the botnet and is providing service providers with a free botnet threat feed that will transmit threat intelligence from their IP and any ongoing attacks coming from their hosted autonomous system.

Researchers cautioned entities to take action immediately before the next campaign: protecting against DDoS attacks is crucial for organizations of all sizes, even while DDoS attacks on non-critical websites might not result in permanent harm or safety hazards. DDoS attacks against internet-facing equipment and patient-connect technology in the healthcare industry put patients' safety at risk.

What Exactly is DNS-over-HTTPS and Do you Need to Use it?



 

User Security

Cyber Security DNS DOH HTTP Internet Users User Privacy User Security

What Exactly is DNS-over-HTTPS and Do you Need to Use it?

Traditional Domain Name System (DNS) traffic, such as user requests to visit specific websites, has been largely unencrypted throughout the history of the internet. This means that every party involved in the DNS value chain that your request goes through has the ability to examine your queries and responses, and even change them, whenever you look up a web address in the "internet telephone book." This is altered by DNS encryption, such as DNS over HTTPS (DoH).

Many of the major internet service providers, including Apple, Mozilla, Microsoft, and Google, have integrated encrypted DNS through DoH into their offerings. While Apple implemented DoH with the iOS 14 and macOS 11 updates in the autumn of 2020, Mozilla was an early adopter, integrating it into its browser in the US as early as late 2018. DoH has also been made available on Chrome for Android by Google.

A global phone directory on the internet

The Domain Name System (DNS) essentially serves as the internet's version of the phone book. If you think of it a little like this, the operation of DNS will soon become clear. Therefore, the second-level domain (in the case of international.eco.de, this would be.eco.) is the corporate switchboard number, and the top-level domain (the far right part of a web address, like.com,.org, or.info) is the equivalent to the country code or area code. The third level (international) is the particular extension, meanwhile.

It's much simpler to gain a better understanding of how this directory is put together if you keep that in mind as you work. You can also learn how computers locate the websites they want to visit in order to connect you to the website of your choice.

A website or other internet resource that you have typed into your computer or phone will be located by DNS resolvers. The router at your house or place of business, or a public hotspot, is the first DNS resolver to which your device is locally connected.

Following a series of steps, this resolver looks for any preconfigured settings on the device or a history of previous visits to the specified website (called a cache). If this doesn't work, the resolver will pass the DNS request on to the resolver after it, which could be your current internet service provider (ISP). The same steps will be followed by this resolver, and if all else fails, it will look up the domain in the "internet phone book."

What dangers is DoH shielding users from?

By preventing DNS data manipulation and eavesdropping, one goal in the development of the DoH protocol was to increase user privacy and security. You are shielded from the possibility that a malicious actor could reroute your DNS traffic to another (malicious) location thanks to DNS traffic encryption. Instead of the actual bank website you wanted to visit, it might be a fake one or something similar.

Man-in-the-Middle (MITM) attacks are the term used to describe this type of cyberattack. The only practical solution at this time is DNS encryption via DoH (or the related DoT protocol). The monetization of DNS data, for example, when it is used for marketing purposes, is another issue that DoH has been able to address. This is a potential and real privacy concern that should be of interest to everyone.

User safety in public networks

An analysis of your behaviour and cross-network tracking may be done using the DNS query data from your mobile device when you use a public wireless (Wi-Fi) network in a hotel, coffee shop, or another location. These DNS services are frequently included in an all-inclusive, globally accessible Wi-Fi solution, but they may not be well-suited to abide by local privacy laws.

Additionally, it is possible that the privacy-protecting configurations are not turned on either. Free public Wi-Fi services are also frequently ineffectively managed in terms of security and performance, particularly when they are run or offered by smaller businesses. You could end up exposed to attacks coming from their own networks if this happens.

The good news is that DoH safeguards users on these open wireless networks because the Wi-Fi network's DNS resolver is avoided. As a result, user tracking and data manipulation at this level are prevented. That ultimately means that DoH provides a chance to safeguard communications in an unreliable setting. It's a fantastic and incredibly useful solution.

What alters due to DoH?

Only the transport mechanism by which your device and the resolver communicate changes with the DNS over HTTPS protocol. The well-known HTTPS protocol is used to encrypt both the requests and the responses. DNS requests using DoH currently avoid the local resolver because there aren't many DoH resolvers in use and technical work is still being done to make it possible for DoH resolvers to be "discovered." Instead, they are handled by a third-party DoH service provider that has been recommended by the relevant software maker or developer. The decision to offer their own DoH services is currently being considered by an increasing number of providers.

DoH in my company's network—do I want it?

DoH is unquestionably a helpful method of self-protection, particularly when using a public hotspot, but it might not be the best choice in environments with trusted network infrastructure. Corporate networks or using internet access services that you get from a reputable ISP are good examples of this.

For instance, your firm may have good cause to forbid an application that deviates from and overrides the system default. Given that the network administrator has no control over it inside the network, this might even be considered potentially harmful. If DoH is implemented at the system level as opposed to the application level, many of the issues with corporate networks vanish. At the system level, for instance, a corporate network administrator can configure the system and create a policy to ensure that the corporate resolver should be used for as long as the device is connected to the corporate network.

However, DoH should be used to increase security and privacy once the device is connected to a public network. These different configurations are, however, avoided if DoH is applied by default at the application level.

Concerning factors

Other issues with the use of external DNS resolution through DoH include potential slow response times, circumvention of parental controls, and legally required blocking, among others. However, depending on the situation, many of the DoH's potential drawbacks are balanced out by just as many benefits.

There is no question that DNS encryption enhances user security and privacy. DoH can offer a simple method for carrying this out. If you choose to activate DoH, you should make sure to research who will be handling the resolution, how they will handle your data, and whether you can easily turn it off when necessary.

To Keep you Secure, Google Chrome is Releasing a Critical Update



 

User Security

Chrome Update HTTP Mobile Security User Privacy User Security

To Keep you Secure, Google Chrome is Releasing a Critical Update

The popular web browser Google Chrome will now automatically block insecure downloads from HTTP sites thanks to a recent code change. Several HTTP sites have since been updated to use HTTPS encryption in an effort to protect the extensive data that we share about ourselves on the web, which was previously the norm.

Google, which is now the preferred option, has already implemented a series of changes that allow its users to retrieve and share data more securely. One of those updates is the recently added "Always use secure connections" checkbox, which instructs Chrome to switch all connections from HTTP to HTTPS. The address bar of older websites that solely use HTTP will also show a "Not Secure" warning.

According to the code change discovered by 9To5Google, the toggle will now warn users against downloading anything from an HTTP connection. Chrome users were previously notified when an HTTPS website downloaded a file in HTTP format, which is known as mixed content.

Given the nature of a toggle button, it will primarily act as a warning rather than a complete preventative measure, letting users use the web as they see fit, which in some situations may still include an insecure HTTP connection.

The update is unlikely to appear in Chrome 111, which is scheduled for release in March 2023, but it could be included in the company's next release later that year.

Google's dedication to its browser, whether through security enhancements or other features such as the recently announced memory and energy saver modes, has been lauded by web users, with the company now accounting for two-thirds (66%) of all desktop browsers installed, according to StatCounter.

SAP Security Patch for July: Six High Priority Notes



 

Vulnerability and Exploits.

API Bug Business Security CVE vulnerability HTTP Patch Fix SAP Vulnerabilities and Exploits Vulnerability and Exploits.

SAP Security Patch for July: Six High Priority Notes

The July 2022 patch release from SAP was released in addition to 27 new and updated SAP Security Notes. The most serious of these problems is information disclosure vulnerability CVE-2022-35228 (CVSS score of 8.3) in the BusinessObjects Business Intelligence Platform's central administration console.

Notes for SAP Business One

The three main areas that are impacted by the current SAP Security Notes are as follows, hence Onapsis Research Labs advises carefully reviewing all the information:

In integration cases involving SAP B1 and SAP HANA, with a CVSS score of 7.6(CVE-2022-32249), patches a significant information release vulnerability. The highly privileged hackers take advantage of the vulnerability to access confidential data that could be used to support further exploits.
With a CVSS rating of 7.5 (CVE-2022-28771), resolves a vulnerability with SAP B1's license service API. An unauthorized attacker can disrupt the app and make it inaccessible by sending bogus HTTP requests over the network if there is a missing authentication step.
A CVSS score of 7.4(CVE-2022-31593), is the third High Priority note. This notice patches SAP B1 client vulnerability that allowed code injection. An attacker with low privileges can use the vulnerability to manipulate the application's behavior.

On July 20, 2022, SAP announced 17 security notes to fix vulnerabilities of medium severity, the bulk of which affect the NetWeaver Enterprise Portal and Business Objects.

Cross-site scripting (XSS) vulnerabilities in the NetWeaver Enterprise Portal were addressed in six security notes that SAP published, each of which had a CVSS score of 6.1. Medium-severity problems in Business Objects are covered by five more security notes.

The SAP July Patch Day illustrates the value of examining all SAP Security Notes prior to applying patches.

Cybercriminals Impersonate Government Employees to Spread IRS Tax Frauds



 

Phishing Scams

Data Breach Fraud Email HTML HTTP IMAP IP Address IRS Phishing Scams

Cybercriminals Impersonate Government Employees to Spread IRS Tax Frauds

At end of the 2021 IRS income tax return deadline in the United States, cybercriminals were leveraging advanced tactics in their phishing kits, which in turn granted them a high delivery success rate of spoofed e-mails with malicious attachments.

On April 18th, 2022, a notable campaign was detected which invested phishing e-mails imitating the IRS, and in particular one of the industry vendors who provide services to government agencies which include e-mailing, Cybercriminals chose specific seasons when taxpayers are all busy with taxes and holiday preparations, which is why one should be extra cautious at these times.

The impersonated IT services vendor is widely employed by key federal agencies, including the Department of Homeland Security, as well as various state and local government websites in the United States. The detected phishing e-mail alerted victims about outstanding IRS payments, which should be paid via PayPal, and included an HTML attachment which looked like an electronic invoice. Notably, the e-mail has no URLs and was delivered to the victim's mailbox without being tagged as spam. The e-mail was delivered through many "hops" based on the inspected headers, predominantly using network hosts and domains registered in the United States.

It is worth mentioning that none of the affected hosts had previously been 'blacklisted,' nor had any evidence of bad IP or anomalous domain reputation at the time of identification. The bogus IRS invoice's HTML attachment contains JS-based obfuscation code. Further investigation revealed embedded scenarios which detected the victim's IP (using the GEO2IP module, which was placed on a third-party WEB-site), most likely to choose targets or filter by region.

After the user views the HTML link, the phishing script shall prompt the user to enter personal credentials, impersonating the Office 365 authentication process with an interactive form.

The phishing-kit checks access to the victim's e-mail account through IMAP protocol once the user enters personal credentials. The actors were utilizing the "supportmicrohere[.]com" domain relying on the de-obfuscated JS content.

Threat actors most likely tried to imitate Microsoft Technical Support and deceive users by utilizing a domain with similar spelling. The script intercepts the user's credentials and sends them to the server using a POST request. Login and password are sent to the jbdelmarket[.]com script through HTTP POST. A series of scripts to examine the IP address of the victim is hosted on the domain jbdelmarket[.]com. The phishing e-header emails include multiple domain names with SPF and DKIM records.

A Return-Path field in the phishing e-mail was set as another e-mail controlled by the attackers which gather data about e-mails that were not sent properly. The Return-Path specifies how and where rejected emails will be processed, and it is used to process bounces from emails.

Here's Why You Should Not Rely on a VPN Anymore



 

VPN

Cyber Security Cyberthreats Datathreats HTTP Technology VPN

Here's Why You Should Not Rely on a VPN Anymore

Virtual private networks (VPNs) are still used by millions of people to hide their activities on the internet by encrypting their location and web traffic. Over a period of time, advancement in technology brought changes in cybersecurity landscapes, thanks to the widespread use of encryption that has made public internet connections far less of a security threat, cybersecurity experts stated.

Cybercriminals are less interested in attacking people’s individual devices and instead focus on the login credential to their most important accounts, experts said. For years, cybercrimes experts urged people not to use Wi-Fi hotspots at public places like coffee shops and stations without taking steps to obscure their internet traffic. For example, if you are sharing a Wi-Fi network with a stranger it means you essentially sharing all your traffic with him who was using it. If someone decides to check their Bank balance, for instance, they give an opportunity to a nearby hacker to steal important data.

But VPNs provided net safety to this problem over the decades. VPN allows users to use the internet with enhanced security and privacy. It reroutes users’ internet traffic through their own servers and makes browsing more secure and private. It also helps users to stay secure when using public Wi-Fi connections. That can slow browsing speed, but hides the user’s Internet Protocol address and allows access to more internet sources.

However, now most browsers have implemented (HTTPS) an extra layer of security that automatically encrypts internet traffic. Hypertext transfer protocol secure (HTTPS) is a secure version of HTTP, it is a protocol that is used for sending data between a web browser and a website. HTTPS is encrypted in order to secure data transfer. It becomes important when a user transmits important data, such as by logging into a bank account, email service, etc.

More and more websites offer HTTPS connections such as Google, Brave, Chrome, Firefox, Safari, and Edge.

“Most commercial VPNs are snake oil from a security standpoint,” said Nicholas Weaver, a cybersecurity lecturer at the University of California, Berkeley. “They don’t improve your security at all...”

“…Remember, someone attacking you at the coffee shop needs to be basically AT the coffee shop. I don’t know of them ever being used outside of pranks. And those are all irrelevant now with most sites using HTTPS,” he added.

Search This Blog

Sections

Popular Posts

Blog Archive

Labels

Report Abuse

About Me

Footer About