Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Transaction and acco ...

 Tips

eBay is one of the most popular marketplaces in the world, and one of the reasons is that it’s generally safe and reliable. But when you engage in monetary transactions, you always assume the risk of losing money as a result of fraud or negligence, to name just two causes. What can you do to protect yourself as   show more ...  

much as possible from fraud and deception when using eBay? eBay’s increasing number of measures to ensure its users’ security is representative of a general trend. The site has programs to protect both buyers and sellers. The programs recommend some clear risk-minimizing practices. Nevertheless, it does not hurt to once again list these as well as other recommendations in a single place and to comment on them a little. General security rules for all eBay users Make your account password long, difficult to guess, and unique. That means not using passwords shorter than 8 characters (which are easy to brute-force), passwords that are simply your date of birth (or those of relatives), or passwords you’ve already used for other services (data leaks occur every day, and in the likely event that your password was part of one, then no matter how complicated it is, an attacker can simply try it on another site). If you are having trouble thinking up and remembering dozens of passwords, use a password manager, which can perform both of these functions for you. Activate two-factor authentication. eBay offers two options: You can receive a code by text message or push notifications from eBay’s mobile app. Any attempt to log in to your account from a new device will trigger the generation of a code, so simply having your login name and password won’t be enough for an outsider to access your account. Choose from one to three security questions to further verify your identity. eBay’s verification questions are mostly not very reliable, so be cunning and provide made-up answers that cannot easily be found on the Internet or your social network profiles. So as not to forget the tricky answers, save them in an encrypted note in your password manager. Learn the tricks of averting phishing attacks, and be suspicious of any e-mails and messages that claim to come from eBay. Sending such messages has long been a primary way for scammers to dupe their victims. Moreover, distinguishing fake messages from real ones can be difficult. The most reliable way to send and receive payments on eBay is through PayPal. First, doing so prevents you from exposing your financial data to potential fraud, and second, the service’s money-back guarantee program protects you. If a seller proposes that you pay by card, money transfer, or cash, then be careful: If you go for it, you’ll lose eBay’s protection, and should the seller turn out to be a scammer, you’ll be on your own. Related to the previous tip: Don’t communicate with the other party outside of the platform. eBay’s built-in communication tools are perfectly sufficient for most transactions, and if someone asks for your e-mail address or phone number, chances are they are a scammer. Check your transaction history from time to time, and if you notice anything suspicious, contact support immediately. Keep your operating system, browser, and antivirus software up to date to reduce your risk of being hacked. If you use eBay on your phone, keep the mobile app updated as well. In case of any dispute or disagreement, use the platform’s Resolution Center, which provides step-by-step directions for all common conflict situations. If you follow the rules, issues should be resolved in your favor. Sign out of your account before you leave eBay. This is especially important if you visit the site from a public or work computer. eBay security guidelines for buyers If the price seems unbelievably low, it’s suspicious. eBay is a well-established platform, and you are very unlikely to find a genuine item for sale here that is much cheaper than average. Read product descriptions carefully. If you receive a damaged (scratched, broken, or torn) item, you can return it for a refund, but only if the defect was not indicated in the description. The same applies to any discrepancies between what you expected and what you actually got. When you buy a product, you are agreeing that everything in the description is acceptable. Pay attention to the seller’s rating. Everyone’s threshold is different. If you aren’t comfortable with a seller’s rating, but the deal still seems attractive, go ahead and read other users’ reviews, including in particular the negative ones. Perhaps the seller made a couple of mistakes at the start of their selling career, but their record has been perfect for a long time. Don’t buy illegal goods. It may sound obvious, but remember that what is legal in one country may be illegal in another. eBay security guidelines for sellers If you are a seller, keeping meticulous records of your transactions is a must. Keep all receipts documenting the sending and delivery of goods to avoid situations in which a buyer can claim they did not receive anything and requests a refund. In the same vein, use a reputable delivery service that can issue receipts for shipped goods. Write accurate descriptions. Carefully describe all of the important characteristics of the product, including any defects. If an item has a flaw you didn’t mention, you may have to accept its return and issue a refund. Never ship an item before receiving payment from the customer. That’s where the eBay-plus-PayPal combination shines, allowing both parties to use an escrow account, which means PayPal withdraws the payable amount from the buyer’s account, holds it until buyer and seller are mutually satisfied, and then transfers it to the seller’s account.

image for Microsoft Uses Trade ...

 Ransomware

Microsoft Corp. has executed a coordinated legal sneak attack in a bid to disrupt the malware-as-a-service botnet Trickbot, a global menace that has infected millions of computers and is used to spread ransomware. A court in Virginia granted Microsoft control over many Internet servers Trickbot uses to plunder   show more ...  

infected systems, based on novel claims that the crime machine abused the software giant’s trademarks. However, it appears the operation has not completely disabled the botnet. A spam email containing a Trickbot-infected attachment that was sent earlier this year. Image: Microsoft. “We disrupted Trickbot through a court order we obtained as well as technical action we executed in partnership with telecommunications providers around the world,” wrote Tom Burt, corporate vice president of customer security and trust at Microsoft, in a blog post this morning about the legal maneuver. “We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems.” Microsoft’s action comes just days after the U.S. military’s Cyber Command carried out its own attack that sent all infected Trickbot systems a command telling them to disconnect themselves from the Internet servers the Trickbot overlords used to control them. The roughly 10-day operation by Cyber Command also stuffed millions of bogus records about new victims into the Trickbot database in a bid to confuse the botnet’s operators. In legal filings, Microsoft argued that Trickbot irreparably harms the company “by damaging its reputation, brands, and customer goodwill. Defendants physically alter and corrupt Microsoft products such as the Microsoft Windows products. Once infected, altered and controlled by Trickbot, the Windows operating system ceases to operate normally and becomes tools for Defendants to conduct their theft.” From the civil complaint Microsoft filed on October 6 with the U.S. District Court for the Eastern District of Virginia: “However, they still bear the Microsoft and Windows trademarks. This is obviously meant to and does mislead Microsoft’s customers, and it causes extreme damage to Microsoft’s brands and trademarks.” “Users subject to the negative effects of these malicious applications incorrectly believe that Microsoft and Windows are the source of their computing device problems. There is great risk that users may attribute this problem to Microsoft and associate these problems with Microsoft’s Windows products, thereby diluting and tarnishing the value of the Microsoft and Windows trademarks and brands.” Microsoft said it will leverage the seized Trickbot servers to identify and assist Windows users impacted by the Trickbot malware in cleaning the malware off of their systems. Trickbot has been used to steal passwords from millions of infected computers, and reportedly to hijack access to well more than 250 million email accounts from which new copies of the malware are sent to the victim’s contacts. Trickbot’s malware-as-a-service feature has made it a reliable vehicle for deploying various strains of ransomware, locking up infected systems on a corporate network unless and until the company agrees to make an extortion payment. A particularly destructive ransomware strain that is closely associated with Trickbot — known as “Ryuk” or “Conti” — has been responsible for costly attacks on countless organizations over the past year, including healthcare providers, medical research centers and hospitals. One recent Ryuk victim is Universal Health Services (UHS), a Fortune 500 hospital and healthcare services provider that operates more than 400 facilities in the U.S. and U.K. On Sunday, Sept. 27, UHS shut down its computer systems at healthcare facilities across the United States in a bid to stop the spread of the malware. The disruption caused some of the affected hospitals to redirect ambulances and relocate patients in need of surgery to other nearby hospitals. Microsoft said it did not expect its action to permanently disrupt Trickbot, noting that the crooks behind the botnet will likely make efforts to revive their operations. But so far it’s not clear whether Microsoft succeeded in commandeering all of Trickbot’s control servers, or when exactly the coordinated seizure of those servers occurred. As the company noted in its legal filings, the set of Internet address used as Trickbot controllers is dynamic, making attempts to disable the botnet more challenging. Indeed, according to real-time information posted by Feodo Tracker, a Swiss security site that tracks Internet servers used as controllers for Trickbot and other botnets, nearly two dozen Trickbot control servers — some of which first went active at beginning of this month — are still live and responding to requests at the time of this publication. Trickbot control servers that are currently online. Source: Feodotracker.abuse.ch Cyber intelligence firm Intel 471 says fully taking down Trickbot would require an unprecedented level of collaboration among parties and countries that most likely would not cooperate anyway. That’s partly because Trickbot’s primary command and control mechanism supports communication over The Onion Router (TOR) — a distributed anonymity service that is wholly separate from the regular Internet. “As a result, it is highly likely a takedown of the Trickbot infrastructure would have little medium- to long-term impact on the operation of Trickbot,” Intel 471 wrote in an analysis of Microsoft’s action. What’s more, Trickbot has a fallback communications method that uses a decentralized domain name system called EmerDNS, which allows people to create and use domains that cannot be altered, revoked or suspended by any authority. The highly popular cybercrime store Joker’s Stash — which sells millions of stolen credit cards — also uses this setup. From the Intel 471 report [malicious links and IP address defanged with brackets]: “In the event all Trickbot infrastructure is taken down, the cybercriminals behind Trickbot will need to rebuild their servers and change their EmerDNS domain to point at their new servers. Compromised systems then should be able to connect to the new Trickbot infrastructure. Trickbot’s EmerDNS fall-back domain safetrust[.]bazar recently resolved to the IP address 195.123.237[.]156. Not coincidentally, this network neighborhood also hosts Bazar malware control servers.” “Researchers previously attributed the development of the Bazar malware family to the same group behind Trickbot, due to code similarities with the Anchor malware family and its methods of operation, such as shared infrastructure between Anchor and Bazar. On Oct. 12, 2020 the fall-back domain resolved to the IP address 23.92.93[.]233, which was confirmed by Intel 471 Malware Intelligence systems to be a Trickbot controller URL in May 2019. This suggests the fall-back domain is still controlled by the Trickbot operators at the time of this report.” Update, 9:51 a.m. ET: Feodo Tracker now lists just six Trickbot controllers as responding. All six were first seen online in the past 48 hours. Also added perspective from Intel 471.

 Trends, Reports, Analysis

Cyberattacks are becoming increasingly sophisticated as tools and services on the dark web – and even the surface web – enable low-skill threat actors to create highly evasive threats.

 Malware and Vulnerabilities

Stored cross-site scripting (XSS) vulnerabilities unearthed in several Confluence plugins allow attackers to inject malicious JavaScript code into pages used within the collaboration platform.

 Threat Actors

In recent times, several threat actors have leveraged malware specifically designed to target Mac, Linux systems, such as TeamTNT's Black-T malware, IPStorm botnet, FinSpy backdoor, and others.

 Companies to Watch

The round was led by Goldman Sachs with participation from existing investor ABS Capital Partners. As part of the deal, Holger Staude, a Managing Director of Goldman Sachs Growth, will join the Board.

 Security Culture

A bug bounty program is an initiative through which an organization sanctions security researchers to search for vulnerabilities and other weaknesses on its public-facing digital systems.

 Expert Blogs and Opinion

Manufacturing medical devices with cybersecurity firmly in mind is an endeavor that, according to Christopher Gates, an increasing number of manufacturers is trying to get right.

 Trends, Reports, Analysis

The vicious HEH botnet has become the latest peer-to-peer botnet that is capable of wiping every piece of data from a variety of IoT devices with weakly protected or exposed telnet services.

 Feed

Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports   show more ...  

Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS Identification by TCP/IP Fingerprinting, and Reverse-ident scanning. Nmap also supports a number of performance and reliability features such as dynamic delay time calculations, packet timeout and retransmission, parallel port scanning, detection of down hosts via parallel pings.

 Feed

Microsoft has warned about a new strain of mobile ransomware that takes advantage of incoming call notifications and Android's Home button to lock the device behind a ransom note. The findings concern a variant of a known Android ransomware family dubbed "MalLocker.B" which has now resurfaced with new techniques, including a novel means to deliver the ransom demand on infected devices as well as

 Feed

Since the beginning of this year, organizations' IT staff have faced numerous challenges and an increased workload as a result of the global pandemic and shift to a mainly remote workforce. Supporting end-users that are now working from home has introduced new challenges in troubleshooting since it isn’t as simple as visiting an end user’s desk to resolve issues as they arise. One support issue

2020-10
Aggregator history
Monday, October 12
THU
FRI
SAT
SUN
MON
TUE
WED
OctoberNovemberDecember