Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Transatlantic Cable ...

 News

In an odd turn of events, the 174th episode of the Kaspersky Transatlantic Cable podcast takes Dave and me back to a slew of topics that were hot in 2018: ransomware, Bitcoin prices, and more. We start with a story about the skyrocketing price of Bitcoin. Dave and I share some of our theories on the rise. Keep in mind   show more ...  

that we are not financial analysts, and we’re absolutely not giving investment advice. From there, we move to some new patents Microsoft has filed that may leave you scratching your head, especially if you use Teams. Our third story takes a bit of a sad turn. Facebook’s crackdown on “political” ads seems to have negatively affected small business owners — a group Facebook claimed it wants to help in this pandemic. Moving on from there, it’s the 2020 version of snow days for school students, with ransomware shutting down the twenty-fifth largest system in the USA. To close out the podcast, we look at the twisting tale of Phantom Secure that is just a TV movie waiting to happen — thank you for writing this Joseph Cox. If you liked the podcast, please consider subscribing or sharing with your friends. For more information on the stories that we covered, please visit the links below: Bitcoin price hits all-time high of almost $20,000 Microsoft files patent to record and score meetings on body language Facebook’s AI mistakenly bans ads for struggling businesses Ransomware halts classes for 115,000 Baltimore pupils Baltimore County schools will reopen Wednesday after being closed due to cyberattack The Network: How a Secretive Phone Company Helped the Crime World Go Dark

image for How cyberprosthetic ...

 Special Projects

CYBATHLON 2020, in which people with disabilities complete once-impossible everyday tasks using state-of-the-art technologies, is more than just an international competition. The organizers at ETH Zurich (the Swiss Federal Institute of Technology in Zurich) conceived it as a platform for the development of assistive   show more ...  

technologies that support fuller lives for people with disabilities. This year’s event took place in mid-November, and Kaspersky was there as a partner of Team Russia. What is CYBATHLON? CYBATHLON includes races in six disciplines: Powered Arm Prosthesis (ARM), Powered Leg Prosthesis (LEG), Powered Exoskeleton (EXO), Powered Wheelchair (WHL), Functional Electrical Stimulation (FES) bike, and Brain–Computer Interface (BCI). Participants not only compete for gold, but also demonstrate the capabilities of the latest assistive devices. For example, using state-of-the-art arm prostheses, wearers were able to screw in light bulbs or feel what was inside a box; and in the latest wheelchairs, users can climb stairs. What’s more, the event motivates developers to enhance their products, because it is at once a competition for athletes and a showcase for the teams that create the technologies. In this post, we will talk about the technologies: past, present, and future. From a bronze leg to a cyberlimb with a neurointerface The use of prostheses goes back a long way. The first known reference to an artificial limb is in the Rigveda, an ancient Indian collection of Sanskrit hymns dating back to the second millennium BCE, in which the gods give legendary warrior Vishpala a leg of iron after she loses one in battle. Archaeological prostheses date back about that far: For example, a roughly 3,000-year-old wooden toe was discovered in Egypt, and a bronze leg found in the Italian city of Capua is about 2,300 years old. Following their ancient origins, artificial limbs remained pretty much unchanged for millennia. Then, in the sixteenth century, scientists created the first mechanical prosthesis, with hinged joints that wearers could control by using another limb or by contracting nearby muscles. The period after World War II saw the appearance of another type of prosthesis: bioelectric (also called myoelectric or bionic). Bioelectric prostheses convert muscle activity in the residual limb into electrical signals, which in turn cause the device to move. Now, in the twenty-first century, scientists are poised to take the next big step, developing neurobionic prostheses that enable wearers not only to perform certain movements, but also to recognize objects by touch. The technology is still young and has a long way to go before it fully recreates the sense of touch, but it is on the path toward that accomplishment. Prosthetics today New technologies are not replacing but supplementing existing ones; a variety of prosthetic devices are already in use, including some that exist for purely cosmetic purposes. Each type has its own field of application. Mechanical prostheses are cheaper, easier to master, and more durable than bionic ones. They are more suitable, for example, for weightlifting and water-based activities — and when there is no power supply. For their part, bionic and neurobionic prosthetics are more comfortable to wear and provide a wider range of movement (for example, cyberlegs help wearers maintain balance, ascend and descend stairs, walk backward, and even run). Specialization in prosthetics Highly specialized prostheses also exist now, for use in certain conditions or for a specific job. For example, you can now find commercially available artificial limbs for water activities, basketball, jogging, and other sports. The availability of 3D printing has also contributed to the development of artificial limbs by making them cheaper and more customizable than ever before. In some cases, people can download a model online and tailor it to their needs before printing it. Prosthetic gadgets Another modern trend combines cybernetic limbs with digital technologies. For example, Russian manufacturer Motorica embedded a Galaxy Watch in a prosthetic arm this year. With it, the user can monitor their activity and control the arm’s settings — for example, the level of hand or finger grip. All-terrain wheelchairs Wheelchairs have helped people for more than a millennium, with first mentions dating back to the sixth century CE. Until the mid-seventeenth century, they were literally chairs on wheels, requiring a servant or assistant to maneuver. The first manual wheelchair appeared in 1655, and the first folding model was developed in the US in the early twentieth century. In our time, and in addition to the traditional kind, wheelchairs come with electric motors, caterpillar tracks for climbing and descending stairs, and even neurointerfaces for people also unable to move their arms. Electrostimulation and exoskeletons Scientists are also developing devices that enable paralyzed people to stand on their feet. (Incidentally, ancient Egyptians practiced electrostimulation as a therapeutic tool! Back then, they harnessed power from electric rays. Later, they replaced the electricity-generating marine creatures with electrostimulating devices.) In the aforementioned Functional Electrical Stimulation bike race, currents applied to competitors’ muscles make them contract and cause a pedaling movement. The first prototype of another rehabilitative technology — the exoskeleton — appeared in 1890. It still required effort on the part of the wearer, but the suit made walking, running, and jumping much easier with the aid of compressed gas. In 1917, a steam exoskeleton was patented, and we began seeing electric, pneumatic, and hydraulic models in the latter half of the twentieth century. Modern exoskeletons weigh less than their predecessors, are far easier to use, and offer greater scope for restoring independent movement. Some can connect to the cloud to store and process data about rehab treatment, and some of the latest can be manipulated by brain impulses. Neurointerfaces The futuristic technology behind thought-controlled devices is called a brain–computer interface (BCI). Such systems first appeared in the 1970s and are now making great strides. BCI sensors are implantable directly into the cerebral cortex, or they can be placed inside the skull or attached externally. The first method provides the best signal quality initially, but it can decrease if the body rejects the implant. Today, the most common BCIs are noninvasive and do not require surgery. Electroencephalography is the most common technology for reading brain activity. However, other “mind-reading” methods exist as well. For example, in the 1980s, researchers experimented with using eye movements to control a robot. Then, in 2016, scientists unveiled a BCI capable of reading pupil size. The scope of application for neurointerfaces is quite wide. At the dawn of BCI, for example, scientists used brain implants to treat acquired vision loss. And as we mention above, some newer wheelchairs and exoskeletons use neurointerface controls. As for CYBATHLON 2020 competitors, they took part in the Brain–Computer Interface race — a kind of computer game in which the power of thought moves game avatars. On the horizon Today, assistive technologies are advancing in leaps and bounds. What miracles lie around the corner, one can only speculate. Those at the cutting edge have some idea already. For example, employees at neurointerface specialist Neurobotics note that current developments aim primarily to help people with disabilities manage everyday tasks through BCI-controlled wheelchairs and smart homes. The technology has a long way to go before it’s commercially viable, however. As Neurobotics admits, “mind-reading” is still far less accurate than getting input from keyboard, mouse, or joystick commands. The company suggests 100–200 years is the soonest the general public can expect to use BCI as an effective replacement for the most familiar interfaces. Elon Musk, who is working on his own BCI implant project called Neuralink, envisages a shorter time to market. That said, it is not clear when that may happen or whether the device will be a success; implantation is a major step, and not one everyone is willing to take. Musk is not the only bold visionary. If you want some more sci-fi predictions, check out our Earth 2050 project, which lets users share their ideas, from fundamentally new sensory organs to a “body shop” where you can completely renew yourself. Bringing on the future Whatever the future holds, it’s important to remember that we are all creating that future, right here and right now. Therefore, we at Kaspersky wholly support the developers of assistive technologies and other ventures that aim to make this world a better place. They, like the organizers of CYBATHLON, are trying to build a brighter future for everyone.

image for Account Hijacking Si ...

 Data Breaches

For at least the third time in its existence, OGUsers — a forum overrun with people looking to buy, sell and trade access to compromised social media accounts — has been hacked. An offer by the apparent hackers of OGUsers, offering to remove account information from the eventual database leak in exchange   show more ...  

for payment. Roughly a week ago, the OGUsers homepage was defaced with a message stating the forum’s user database had been compromised. The hack was acknowledged by the forum’s current administrator, who assured members that their passwords were protected with a password obfuscation technology that was extremely difficult to crack. But unlike in previous breaches at OGUsers, the perpetrators of this latest incident have not yet released the forum database. In the meantime, someone has been taunting forum members, saying they can have their profiles and private messages removed from an impending database leak by paying between $50 and $100. OGUsers was hacked at least twice previously, in May 2019 and again in March 2020. In the wake of both incidents, the compromised OGUsers databases were made available for public download. The leaked databases have been useful in reconstructing who’s behind several high-profile incidents involving compromised social media accounts and virtual currency heists that leveraged SIM swapping, a crime that centers around convincing mobile phone company employees to transfer ownership of the target’s phone number to a device the attackers control. For example, when several high-profile Twitter accounts were hacked in July 2020 and used to promote bitcoin scams, the profile and private message data from previous OGUser forum compromises proved invaluable in piecing together the “who” behind that scam. The hacker handles featured in the defacement message left on OGUsers — “Chinese” and “Disco” — correspond to two nicknames used by banned OGUser members who have been trying to generate interest for their own forum that seeks to emulate OGUsers. Disco, a.k.a “Discoli” a.k.a. “Disco Dog,” is a young man from the United Kingdom who has marketed an automated bot program and service advertised as a way for customers to “cash out” illicit access to OneVanilla Visa prepaid card accounts using PayPal. The same individual also earlier this year founded a corporation in the U.K. called Disco Payments. Reached via Twitter, Discoli said he and his friends hacked OGUsers via an outdated plugin used by the site. But he claims they have no plans to sell the stolen user data, and said the company was registered as a joke. “I had a sort of feud with the administrator in the past but this one was more for fun,” Discoli said. “Not too interested in doing damage by releasing database or anything like that.” As I noted the first time OGUsers got hacked, it’s difficult not to admit feeling a bit of schadenfreude in the continued exposure of a community that has largely specialized in hacking others. Or perhaps in the case of OGUsers, the sentiment may more aptly be described as “schadenfraud.”

 Companies to Watch

W Investments Group, based in Montreal, led this Series E growth round of $35 million, with guidance from Yaletown Partners, leaders of the initial Series E round in June 2020.

 Threat Actors

The Dark Caracal APT group is believed to be linked to a Lebanese intelligence agency. It was discovered leveraging a new strain of the 13-year-old Bandook trojan in its latest attacks.

 Trends, Reports, Analysis

According to a CDNetworks report, brute force is the most common type of web application violation, followed by SQL injection, custom rules, dynamic IP blacklist, and IP blacklist.

 Malware and Vulnerabilities

The main payload is a variant of the XMRig Monero miner that is protected with a shared object developed to hide the presence of the miner's process from various tools for process enumeration.

 Feed

I2P is an anonymizing network, offering a simple layer that identity-sensitive applications can use to securely communicate. All data is wrapped with several layers of encryption, and the network is both distributed and dynamic, with no trusted parties. This is the source code release version.

 Feed

Red Hat Security Advisory 2020-5325-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services.

 Feed

Ubuntu Security Notice 4659-1 - It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Daniele Antonioli, Nils Ole Tippenhauer, and   show more ...  

Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. Various other issues were also addressed.

 Feed

Ubuntu Security Notice 4658-1 - It was discovered that a race condition existed in the binder IPC implementation in the Linux kernel, leading to a use-after-free vulnerability. A local attacker could use this to cause a denial of service or possibly execute arbitrary code. Daniele Antonioli, Nils Ole Tippenhauer, and   show more ...  

Kasper Rasmussen discovered that legacy pairing and secure-connections pairing authentication in the Bluetooth protocol could allow an unauthenticated user to complete authentication without pairing credentials via adjacent access. A physically proximate attacker could use this to impersonate a previously paired Bluetooth device. Various other issues were also addressed.

 Feed

CISOs with small security teams hold an intensive juggling act. They're responsible for sustaining the company's security resilience, ensuring compliance is adhered to and implementing privacy controls. In between these tasks, they need to follow up on board updates, lead cross-team communications and collaboration, and fight fires that may or may not be related to cybersecurity. All the while,

 Feed

Google Project Zero whitehat hacker Ian Beer on Tuesday disclosed details of a now-patched critical "wormable" iOS bug that could have made it possible for a remote attacker to gain complete control of any device in the vicinity over Wi-Fi. The exploit makes it possible to "view all the photos, read all the email, copy all the private messages and monitor everything which happens on [the device]

 Feed

Multiple botnets are targeting thousands of publicly exposed and still unpatched Oracle WebLogic servers to deploy crypto miners and steal sensitive information from infected systems. The attacks are taking aim at a recently patched WebLogic Server vulnerability, which was released by Oracle as part of its October 2020 Critical Patch Update and subsequently again in November (CVE-2020-14750) in

 Feed

Cybersecurity researchers today took the wraps off a previously undocumented backdoor and document stealer that has been deployed against specific targets from 2015 to early 2020. Codenamed "Crutch" by ESET researchers, the malware has been attributed to Turla (aka Venomous Bear or Snake), a Russia-based advanced hacker group known for its extensive attacks against governments, embassies, and

2020-12
Aggregator history
Wednesday, December 02
TUE
WED
THU
FRI
SAT
SUN
MON
DecemberJanuaryFebruary