Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Russia
Austria cyber attack Cyber Attacks National Cyber Security Russia

Alexander Baranov says Russia has nothing to do with the cyberattack on the friendly Austrian Foreign Ministry


The hacker attack that the Austrian Ministry of Foreign Affairs underwent prompted European countries to take active measures to defend against such attacks. At the same time, the EU accuses Moscow of the attack, which makes no sense, given the friendly relations between Russia and Austria. Alexander Baranov, head of the Department of Information Security at the National Research University, commented on the situation.

According to the expert, anti-Russian accusations once again show the policy of Western "hawks" who regularly make groundless statements to undesirable countries.
"These accusations are completely groundless and are not supported by any arguments," Baranov said.

He stressed that Russia has absolutely no interest in attacking the Austrian Foreign Ministry. In addition, Austria supports the implementation of major projects, such as the Nord Stream 2 gas pipeline.

"This is one of the friendliest countries in the European Union, I think. Therefore, I do not see any sense to attack its foreign Ministry, especially since the country is small and it does not play a decisive role," the expert believes.

In his opinion, the provocation is obvious in order to worsen relations between the countries.
"One of the most famous methods of hackers is to carry out an attack from the territory of States that have nothing to do with it. Most often it is China or India," Baranov explained.

The expert reminded that it is now almost impossible to track the end user if he uses an anonymizer. It is possible that the European security forces were able to establish any facts, but they are not able to make them public because of the secrecy.

He added that European politicians enjoy their impunity by regularly making unfounded accusations.
"Representatives of Russia have repeatedly asked for facts, but there is nothing, there is only empty talk," the expert concluded.

A hacker attack on the Austrian Foreign Ministry occurred in early January. In Vienna, they believe that the incident has a Russian trace while recognizing the absence of any evidence.

Earlier, the Austrian newspaper DiePresse reported that a number of EU countries decided to form a group to protect themselves from cyber attacks from Russia. Vienna will work together with Germany, the Czech Republic, Belgium and Cyprus on this issue. These States consider themselves to be "victims of a Russian cyber-espionage".
Read more »
WhatsApp
Cyber Security Jeff Bezos UN WhatsApp

U.N Officials not using WhatsApp over Security Reasons


"The United Nations officials are not using WhatsApp for purposes of communication as it is unsafe and vulnerable to hacking," said a UN spokesperson last Thursday. The statement came out following the Jeff Bezos incident, where experts at the UN accused Saudi Arabia of hacking the WhatsApp account of Amazon's CEO Jeff Bezos. The experts at the UN last week said that they had information suspecting the association of Prince Mohammed bin Salman, Saudi Arabia's crown prince in the so-called cyberattack on Jeff Bezos that happened in 2018.


The officials have demanded an inquiry by American and other authorities as an immediate response, saying that the claims are based on a Forensic Report prepared by FTI, a consulting firm from Washington. The forensic report claims that Bezos' phone was hacked through an ill-disposed video file that was sent by the Saudi Prince via a WhatsApp account. Responding to the question "whether the United Nations Secretly General has used WhatsApp for communication purposes with Saudi Prince or any other world leaders?" Farhan Haq spokesperson of the U.N replied that "officials at the U.N are advised not to use WhatsApp application for messaging purposes as it is not a reliable social networking platform."

"Therefore, I believe that the U.N officials do not use the WhatsApp," Haq said later. According to him, the order to not use WhatsApp as a communication tool was given in June 2018, to the security officials. In response to this controversial action taken by the U.N, the company WhatsApp affirms that it offers one of the best safety to its more than 1.5 billion users.

"Each message sent via the app is protected through end-to-end encryption to maintain the confidentiality of the messages. No 3rd party, not even WhatsApp, can view the messages sent by users through WhatsApp. The encryption mechanism developed by WhatsApp is said to be one of the most secure technology according to the cybersecurity experts, and it is the most reliable platform out in the public," says Carl Woog, Director Communications at WhatsApp.

"Every app has a few flaws that can be exploited, but unlike WhatsApp, very few can resolve them immediately," said cybersecurity expert Oded Vanunu.
Read more »
Vulnerability and Exploits
Internet Explorer Microsoft North Korean Hackers Vulnerability and Exploits

Internet Explorer Targeted by North Korean Hackers: How to Stay Safe?



In a recent cybersecurity issue, some hackers from North Korea are attacking Internet Explorer by exploiting a vulnerability, which is said to be a zero-day flaw. The company Microsoft has not yet spoken on the issue and is still silent. 



Users should immediately stop using Internet Explorer for a while to stay safe from the hackers, suggest cybersecurity experts. If the users still prefer to use Microsoft software, they can download the latest Edge Browser by Microsoft. The Edge browser is safe from the attack as well as offers a better user experience while browsing than Internet Explorer. Other secured browsers include Google Chrome and Mozilla Firefox.

But if the users still want to use the traditional software, cybersecurity experts at Tom's Guide suggest downloading a limited time user account that is safe for any software modification.

Microsoft has scheduled to release its next security patch, not until the 11th of February, therefore, its a long wait before the latest update is issued.

Microsoft reveals the Flaw-

In an online advisory published on 17th January, Microsoft explained the vulnerability, saying the flaw allows the hacker to corrupt the memory and perform arbitrary coding. If achieved successfully, the hacker has full access to the system, the same as the genuine user.

"Let us imagine a scenario where the hacker hosts a website on the web, which is specially made to exploit the vulnerability via Internet Explorer, in this case, the hacker can lure the user to visit the website by sending him emails," says Microsoft.

Once the hacker has access to the admin user rights, the user system is hacked and the hacker has command over the system. He can modify the programs, install or delete any existing software or worse, delete important data.

The hackers are likely to be from North Korea-

One should not ignore this vulnerability because it has ties to hackers from North Korea. The attack on Internet Explorer seems to be similar to the one that affected the Mozilla firefox. Researchers at Qihoo 360 discovered the attack and accused Darkhotel, a group of hackers from North Korea, for carrying out this activity.
Read more »
Windows Defender
malware TrickBot trojan Windows Windows 10 Windows Defender

Modified TrickBot Trojan can now Steal Windows Active Directory Credentials


TrickBot trojan, a strain of malware that has been around affecting users since 2016 - is now evolved to steal Windows Active Directory credentials. Today, in the cybersecurity ecosystem it is considered as one of the top threats abusing businesses, experts estimate that TrickBot is responsible for compromising more than 250 million email accounts till date. Earlier, TrickBot went a step further while targeting Windows 10 users by disabling Windows defender onto their systems rather than just bypassing the protection. Fundamentally, TrickBot is a banking Trojan and is generally deployed through spearphishing emails like invoices mailed to the accounts department. Typically, it is attached as infected Microsoft Excel or Word documents. The malware can be spread across an organization in a number of ways, one of them is via exploiting vulnerabilities in a protocol called SMB which makes the process of sharing and accessing files on other systems easy for Windows computers.

First identified by Sandor Nemes, a security researcher from Virus Total, this new module of TrickBot dubbed as "ADII" further amplifies the threat it possesses for security, it steals Windows Active Directory information by executing a set of commands.

An Active Directory database is being created and stored into the default C:\Windows\NTDS folder on the domain controller, a server here is acting as the domain controller. Now, all the information including passwords, computers, users, and groups of Windows Active Directory are saved in a file by the name "ntds.dit" in the database. As all the aforementioned information is sensitive in nature, Windows resort to a BootKey that is located in the system component of the Registry and encrypts the information with the help of it. Admins who are responsible for database maintenance use a special tool known as "ntdsutil" to work with that database. Reportedly, standard file operations cannot access the BootKey.

How TrickBot Goes About Stealing Active Directory Credentials?


Administrators use the command "install from media", also known as "ifm", to create a dump of Active Directory. The command leads to the creation of an installation media for setting up new Domain Controllers. The new module "ADII" exploits the ifm command to produce a copy of the Windows Active Directory database; after the database is dumped into the %Temp% folder, the bot collects the information and transfers it to the admin. The collected data can be effective in infecting more systems in the same network and could also be employed by various other malware in search of similar vulnerabilities.
Read more »
Technology News
Bitcoin Cyrptocurrency Technology Technology News

UK to develop a system to track cryptocurrencies


HM Revenue and Customs (HMRC) of the UK Government has submitted a tender for the development of a system for monitoring financial transfers in digital money. The appearance of such a system in Russia could already have occurred.

Cryptocurrencies can be used not only for transferring funds or paying for services, but also for conducting criminal activities. This position was expressed by the UK tax service HMRC. The purpose of the introduction of this tool is the fight against criminal activity. It includes tax evasion and laundering of criminal proceeds.

Mikhail Mishustin, head of the Federal Tax Service of Russia and now Prime Minister, proposed the initiative to control income received through cryptocurrency for tax purposes in February last year.

"Money that a young person can freely move across the border using cryptocurrencies and other forms of payment, which the state does not notice and for which there is no regulatory framework, is dangerous," said Mishustin.

A similar system can already operate in Russia, suggested Dmitry Kirillov, a senior tax lawyer at Bryan Cave Leighton Paisner (Russia) LLP. He explained this by the fact that in 2018, the contract for the development of the Unified Information System was posted on the public procurement website. The 23rd page of the document states that "a tool should be created to analyze and identify illegal activities, including using cryptocurrencies."

"Apparently, the execution of the contract was completed. Therefore, I will not be surprised if the system already tracks cryptocurrency transactions of Russian users," said Kirillov.

Antonina Levashenko, the head of the Russian Center for Competencies and Analysis of Standards under the President of the Russian Federation, expressed a similar opinion. According to her, financial intelligence units of countries around the world are seeking to acquire effective tools for controlling cryptocurrency transactions, and Russia is no exception.

All experts agreed that a system for controlling transactions in cryptocurrency may appear in Russia. It is likely to focus on the fight against illegal income and the financing of terrorism.
Read more »
WhatsApp
Cyber Security Facebook WhatsApp

Simple Tips to Prevent your WhatsApp Account from Hackers


WhatsApp (now owned by Facebook), a popular social networking app, as we all know, is very easy to setup. But this simple process also opens your account to some vulnerabilities and threats, if you are not cautious while setting your WhatsApp account. Luckily, there exists an extra defense line to ensure the safety of your account, if your 6 digit activation code is hacked.


However, as noticed in the recent hacking incident against Amazon's CEO Jeff Bezos, it was observed that these security measures aren't enough to provide security. But it will somehow provide you an extra safety mechanism if, by any chance, the hacker gets your 6 digit security code. How to ensure the safety of your Whatsapp account? In normal circumstances, getting back to your hacked Whatsapp account is very simple: open the app, and while logging in, the app will send you another 6 digit code.

But the problem arises when the hacker, once having the hold of your account, intentionally puts up wrong verification codes to prevent further login into your account for up to 12 hours. The worst-case scenario arises when the user has not set up the 2 step authentication process, which permits the hacker to use a security pin of their own, restricting the user access to his Whatsapp account for a total duration of 7 days.

Therefore, it is always important to follow 2 basic rules:
  1. Don't disclose your 6 digit verification code- it doesn't matter if it's your parents, family, or friends. No one ever has a genuine intention to ask your Whatsapp code sent over the SMS, so never consider disclosing the details. 
  2. Set up a 2 step verification process- if in case, your account gets hacked by some reason, 2 step security pin ensures that only the user has the access to the Whatsapp account. 
How to set up the security pin-
  • Open Whatsapp and go to the settings option. 
  • Select account and hit 2 step verification. 
  • Setup your 6 digit security pin. 
  • You will be asked this every time you install your WhatsApp. You can also add your e-mail address as a backup if you ever lose your pin.
Read more »
DDOS Attacks
cyber attack Cyber Attacks DDOS Attacks

Experts predicted an increase in the number of DDoS attacks in 2020


In Russia, the number of DDoS attacks will increase due to the introduction of 5G technology, said Anton Fishman, head of the system solutions Department of the Group-IB.

He noted that the wider introduction of 5G will significantly increase the number of traditional attacks that providers have faced in recent years. "For example, the power and frequency of DDoS attacks will increase significantly due to many insecure devices."

According to him, a DDoS attack can be used as a distraction when stealing money from a Bank or disabling a service.

Earlier, Stanislav Kuznetsov, Deputy Chairman of the Board of Sberbank, said that the main areas that require attention when countering cybercrime are DDoS attacks, data leaks and fraud using social engineering methods. He explained that the number of DDoS attacks has increased, their quality has changed, in addition, it is quite difficult to detect them.

It is important to add that on the eve of the Deputy Chairman of the Board of Sberbank Stanislav Kuznetsov said that in January the bank underwent the most powerful DDoS attack in its history.

"On January 2, 2020, Sberbank faced an unprecedented DDoS attack that was 30 times more powerful than the most powerful attack in the history of Sberbank. The attack was carried out using IoT devices (Internet of Things)," said Kuznetsov, noting that the state Bank successfully repelled the cyberattack.

According to Kuznetsov, not every company in Russia or even in the world could reflect such attacks.
"This could become a trend in 2020 [increasing cyber attacks]," he added.

According to Kuznetsov, in 2019, the number of hacker attacks on Sberbank increased by 15-20%, and the Bank records 280-300 attempts to attack its systems per day.

"We identify all of them and block them. In addition, it is worth noting that mass malicious mailings are still popular — about 50% of the emails that our employees receive are spam, including phishing attempts," said the Deputy Chairman of Sberbank.
Read more »
Technology
Amazon Hacking Privacy Breach Technology

Amazon Chief’s Phone Hacked by the Saudi Arab Crown Prince



Referring to anonymous sources, a British daily newspaper came up with reports on details regarding Amazon Chief Jeff Bezos' cell phone being hacked in the wake of accepting a message from the Saudi Arabian crown.

Theft of information from Bezo's cell phone, however, is said to have been started in 2018 with a contaminated video file sent by means of WhatsApp from the personal account of Mohammed bin Salman, according to the previously mentioned British daily.

The report apparently comes about a year after the unexpected announcement that Bezos and his wife, MacKenzie, would separate following 25 years of marriage. The National Enquirer along these lines uncovered an extramarital affair between Bezos and Lauren Sanchez, a former TV anchor, in a progression of reports that depended, to some degree, on some intimate text messages sent by Bezos.

Bezos in this way distributed an extraordinary blog entry blaming the newspaper for taking steps to distribute all the more humiliating text messages and photographs except if he freely attested that there was no political motivation or outside force behind the newspaper's coverage.

Gavin de Becker, a security consultant for Bezos, later said he believed the Saudi Arabian government had gained access to Bezos' phone before the Enquirer uncovered the whole affair. He didn't give any immediate evidence to back up his claims, which he said originated from "our investigators and a few experts." De Becker referred to the Enquirer's business association with the Saudis, just as the intense coverage of the homicide of a critic of the Saudi regime by the Bezos-owned Washington Post, as reasons why bin Salman may look to harm the Amazon founder.

The newspaper reported a year ago that the Central Intelligence Agency connected the crown prince to the 2018 murder of Post Columnist Jamal Khashoggi. De Becker declined to remark past the rather lengthy statement a year ago, which was posted on the news site The Daily Beast.

The Saudi embassy didn't quickly react to a message looking for more inputs. In spite of the fact, it's still extremely unclear whether the supposed hack of Bezos' phone got to any sensitive Amazon corporate information.

While the company is yet to remark on the issue in the nine months since de Becker's allegation, the company representatives haven’t yet returned the messages seeking comment on the 21st of January.
Read more »
Russian Cyber Security
Bank Cyber Security Cyber Security Cyber Security awareness Cyber Security News Russian Cyber Security

Russian Bank reminds about the danger of transferring personal data to someone


Transferring personal data to someone (details of cards and accounts, passport data), you can become a victim of cyber fraud, so you can not do this in any case, recalled the Deputy Chairman of the Board of Sberbank Stanislav Kuznetsov.

"Even if you take a picture of your card and send it to someone — this is basically already a leak. You might as well throw your wallet with your salary in the trash," he said.

He also said that in the second half of 2019, Russian companies faced large-scale phishing. "Last year, several organized criminal groups working in this direction became more active. One of them has made a big step forward in expanding its criminal activities. This is the RTM hacking group, it is Russian-speaking and operates in Eastern Europe, including Russia".

According to him, using modern software, RTM sends phishing emails to tens of thousands of companies in the country 10-15 times a month. Mr. Kuznetsov added that many companies open emails infected with viruses. "In this way, criminals get access to the company's accounting documents — with the help of a virus, they send the company's funds to their Bank accounts and gradually withdraw them," he said.

According to Mr. Kuznetsov, Sberbank has already given law enforcement agencies materials about almost 20 criminals from the group. There are at least five such groups, he said.

"This is not a new type of crime, but in the second half of last year, Russia faced it for the first time on this scale. As a result, some institutions of the financial system, as well as small and medium-sized companies in various industries were affected," said Stanislav Kuznetsov.

Recall, according to a study by TAdviser and Microsoft, in 2019, 76% of Russian medium and small businesses faced cybersecurity incidents. The main source of threats, businessmen called e-mail and external Internet resources.
Read more »
SIM Swapping
cryptocurrency scam Cyber Fraud SIM jacking SIM Swapping

Canadian Teenager Charged and Arrested for $50 Million Cryptocurrency Theft


Samy Bensaci, an 18-year-old teenager from Montreal, Canada has been indicted for 4 criminal charges in relation to a theft of cryptocurrency worth $50 million in a SIM-swapping scam that targeted cryptocurrency holders, as per the reportings by Infosecurity Magazine, dated 17th of January.

The Canadian authorities have accused the teen hacker of being a part of a hacking group that was involved in the theft of millions of dollars from Canadians and Americans. The scam, of which Bensaci was allegedly a part of, stole, "$50 million from our neighbors to the south and $300,000 in Canada" told Lieutenant Hugo Fournier, a spokesperson for the Sûreté du Québec.

Bensaci was charged and consequently arrested in November and was later released on CA $200,000 bail, on orders of living with his parents in Northeast Montreal, as per the local media reports. As a result of the incident, prosecutors prohibited Bensaci's access to any device that can be connected to the internet including computers, mobile phones, tablets, games, and consoles. Specifically from accessing, “any computer, tablet, mobile phone, game console, including PS3, PS4, Xbox, Nintendo Switch, or any other device capable of accessing the Internet”. He has also been ordered to hand over his passport to local police to assure he does not flee away from the country.

One of the purported victims Don Tapscott confirmed, “We can confirm that last year a hacker attempted to steal crypto assets from our company and its employees. That attempt was unsuccessful. We cooperated with the police [and] have been impressed with their determination to bring those responsible to justice.”

SIM swapping attack, also known as SIM jacking or SIM splitting is a form of identity theft where an attacker targets a weakness in two-factor authentication to take over an account. The attacker exploits a cell phone carrier's ability to port a phone number to a new device with a new SIM to acquire access to the victim's credit card numbers, bank accounts, and other financial information. The feature is normally used when someone loses access to his phone (or gets it stolen) or is switching service to a new device. As the reliability of customers on mobile-based authentication is growing, SIM swap attacks have also been on a rise in recent times.
Read more »
Security
Crypto-jacking Cyber Crime Honeypot Industrial control system Security

Cyber Attack Alert! A Fake Factory Network Attacked With RAT, Ransomware, Malware and So On!



Researchers simulated a real-looking “Industrial prototyping” organization with fake employees, PLCs, and websites to study the types of cyber-attacks that commonly on such networks.

The elaborately fake organization’s website and the network worked on a highly advanced interactive “honeypot” network that worked extensively on attracting the attention of potential hackers.

The plan was to create such a legitimate-looking network that no one could even doubt it's being phony and to accumulate serious information related to cyber-threats and attacks to study and analyze them.

Behind researching these threats and attack mechanisms the motive was to dig out the threats that the “Industrial control system” (ICS) sector faces today.

Per sources, the sham company specifically let some ports of its network be susceptible to attack and Voila! It got hit with the most cliché of attacks that any IT network faces, including, Ransomware, Malware, Remote Access Trojans (RAT), Crypto-jacking, Online fraud and the “botnet-style” malware which hit the network’s robotic workstation.

A couple of the attackers went as far as shutting the factory via the HMI, locking the screen and opening the “log view of the robot’s optical eye”.
While one of the few attackers of the more mischievous inclinations worked on tactics like circumventing the robotics system to shut the HMI application and ultimately powering down the entire system, the others started the company network back and shut the bogus conveyor belt and then shut the network back again.

Per sources, the fake factory network was constructed of real ICS hardware and an amalgamation of physical hosts and virtual devices, mainly a Siemens S7-1200 PLC, an Omron CP1L PLC and two Allen-Bradley Micrologix 1100 PLCs.

The researchers as bait also used the common exposed passwords on the internet for the network’s administrative security, which happens to be a very basic mistake in the ICS sector.

The PLCs were used to imitate real processes like controlling the burner, the conveyor belt and palletizer for piling pallets using robotic arms. The plant network had three VMs including an engineering workstation for programming, a robotics workstation and HMI for controlling the factory.

Allegedly, per reports, later on, the fake network also opened up Remote Desktop Protocol, EtherNet/IP, and Virtual Network Connection ports to lure in more attackers.

Another attack that the researchers found out which deeply exhausted the server’s capacity, was for crypto-currency mining unlike what they thought it to be.

Per reports, the network was also attacked with ransomware called “Crysis”, which kept the network down for around four days while negotiating which led to HMI being locked down and loss of visibility into the plant operations.

If only the network were real, this ransomware would have wreaked major havoc owing it to 4 entire days of no production. This clearly reflects the kind of jeopardy the ICS sector could face.

One of the researchers pretending to be a worker at the fake company emailed the attackers to return their files and also mentioned that how they were working for a very important client and wanted to immediately run the production back.

The ransom stopped at $6,000 in email-exchange which didn’t need to be paid given that they already had backups and therefore were able to re-construct their systems. Following this little incident, another ransomware which goes by the name of “Phobos” tried to binge on the network.

And then came the attacker with quite a sense of humor. With a data destruction attack disguised as ransomware, the attacker renamed the network’s ABB Robotics folder. And when they didn’t agree to pay the ransom the attacker wrote a script that made browsers to porn sites appear whenever the network was started.

Hence, pretty evidently, in addition to never letting VNCs open without passcodes and reusing passwords across different systems, the researchers say, that this fake “Network” had everything that must NOT be done to keep the ICS sector safe and secure.

Read more »
Subscribe to: Comments (Atom)