Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Cyberpunk 2020: The ...

 Technology

The Cyberpunk game series originated in the late 1980s, and it owes its existence largely to the popularity of books by William Gibson and Philip K. Dick as well as the film Blade Runner, which was based on one of the latter’s novels. Since then, the pen-and-paper games in this series have been refined and   show more ...  

updated several times, and they have reached their culmination in the epic computer game Cyberpunk 2077, which fans had been anticipating for some time before its actual release. But for today’s article we are interested in an earlier game in this series, Cyberpunk 2020. That is because it takes place in 2020 — our present day. By and large, it’s a run-of-the-mill pen-and-paper role-playing game: People gather at a table or in a chat room, generate characters with certain skills and characteristics, and then under the guidance of a master proceed through a certain story. It takes place in a rather gloomy but incredibly stylish world where corporations hold great power, street violence is rampant, and people have modified themselves using cybernetics. But we are interested in Cyberpunk 2020 primarily because one of the available character classes, Netrunner, is essentially a hacker who solves game problems using programs. That is, the character is a 2020 hacker as the authors of the late 80s and early 90s saw the role. Coming to the end of 2020, we wanted to compare the retrofuturistic hacker’s arsenal with real-world, present-day tools. A few words about the world of Cyberpunk 2020 Netrunners operate not in the physical world, but in virtual reality. Do you recall those jumbles of geometric shapes that the filmmakers of that period loved to use to portray digital universes? That’s what the creators of the game had in mind, too. The plot explains it as follows: Algorithms transform the topography of real information systems into a kind of futuristic landscape. When a hacker connects to the Net through a special “cyberdeck” device (or simply “deck”), their consciousness leaves the physical world and is embodied in the virtual one. Most professional Netrunners use an implanted interface to connect (it is possible to interact without such a device, using electrodes that stick to the head, but that doesn’t work as well). In this reality, the computer systems of governments, corporations, and other organizations are represented in the form of Data Fortresses (Dataforts for short), with code gates and appropriately thick “data walls.” Generally speaking, Netrunners try to penetrate the fortresses to learn their secrets, steal files, open computer-controlled doors in the real world, eavesdrop on conversations, and so on. Of course, the programs and experts defend the Dataforts. At the same time, extremely harsh laws — in effect practically all over the world — forbid illegal access to information and penetration of these information systems. Government organizations may use any means to take out the attackers. Corporate security services are not much nicer, and they have the right to arrest a hacker. He faces imprisonment in extremely harsh conditions at best, or at worst, memory erasure. Because the Netrunner is physically connected to the computer, defenders can even try to physically fry his brain. The Netrunner’s arsenal Depending on his hardware, a Netrunner can take a limited set of programs with him, so players who exercise forethought are rewarded. The available programs fall into several subcategories. We will cover the main sections described in the Cyberpunk 2020 rulebook, touching on the “Anti-Personnel” and “Demons” collections only lightly. Anti-Personnel tools can disable the Netrunner (give him a heart attack, destroy his brain, ignite his hardware). Fortunately, no real-world analogs to these — or to Demons, virtual entities that can be armed with additional programs — exist. But the other classes of programs from Cyberpunk 2020 resonate well with the real state of affairs in 2020. Intrusion programs The standard set of intrusion programs is small. Hammer and Jackhammer deal brutal attacks against data walls. You could make some rough comparisons with various classes of real tools and attack methods, ranging from brute-forcing to exploit packs, but strictly speaking, the very concept of data walls that need to be hammered to reduce their strength doesn’t really correspond to our actual 2020. There aren’t really any direct analogs to the game’s virtual hammers. There is also a Worm. It’s described as something that emulates a part of the code of the attacked infrastructure that can penetrate walls and provide access from the inside. Worms in the Cyberpunk universe have nothing in common with their modern-day namesakes. According to our classification, these would be closer to Trojans — except that real Trojans rarely pose as part of infrastructure, more commonly infiltrating under the guise of user applications and files, which is a much more effective strategy in practice. Decryption programs Codecracker is the simplest program for opening virtual code gates. Rather than deciphering a key, it gains access by disassembling the gate code. In general, this is an authentic tactic — hackers often do try to find vulnerabilities in authentication systems — but fortunately, in the real 2020, this process is not automated. The Wizard’s Book tries passwords and code words, entering billions in just a second. Perhaps this is the first program from the Netrunner arsenal with a real analog: Lots of tools exist for carrying out brute-force attacks. However, modern authentication systems have built-in security mechanisms to limit the number of allowed attempts. In other words, this kind of attack, though real, is no longer as effective as it once was. The Raffles decryption program is used to try to find a key to a file or gate by asking the system leading questions. Fortunately, real systems are not trained to answer extraneous questions; otherwise, this might be a real threat vector. Programs for detecting intruders Watchdog, Bloodhound, and Pit Bull are programs that protect the information system and warn the operator of any infiltrations. In general, we use such technologies in most of our security solutions. They are called IDS (intrusion detection systems). A few differences distinguish these ones: Bloodhound can also determine a hacker’s physical location, and Pit Bull can disconnect hackers from the Net. In reality, performing these tasks is not so trouble-free. SeeYa can identify invisible objects in virtual reality, and Hidden Virtue distinguishes real objects (a program, file, or attacker) from simulations. Our modern Internet works without the virtual interface, so we have no real-world need for such programs. Regarding Speedtrap, which detects the activity of programs that present a danger to the Netrunner, it’s difficult to nail down the real-world analog, but generally speaking, tools can enable you to detect the presence of software by its activity (for example, by scanning ports). Malware also often has mechanisms built in to detect security solutions. A Netrunner on the Net is, in fact, a kind of malware, so we can say that this program makes sense in modern terms. Tools for handling security systems and other Netrunners Flatline fries the interface chip that the cyberdeck uses to connect to the Net, and Poison Flatline disables the entire device. In reality, there is no such thing: remotely causing irreparable damage to hardware is extremely difficult. (Then again, don’t forget what happened to certain centrifuges for uranium enrichment, or other exotic stories such as the printer hacking that incapacitated nonvolatile memory. Krash and DecKRASH cause hardware errors and force system reboots. The first attacks the nearest processor in the attacked deck or system, and the second focuses just on cyberdecks. These are the real deal. A multitude of tools exists to conduct Denial of Service attacks. True, the real equivalents are more highly specialized and more likely to attack the operating system than the hardware, but their effects are comparable. Murphy forces the target to run all available programs at the same time. This one’s pure fiction. It is also not clear what the point of this action would be during a real attack. Virizz slows down the cyberdeck, and the only solution is a reboot. The real-world analog would be, again, a DoS attack. Viral 15 forces the cyberdeck to delete one random program or file per minute. It remains active until the system is restarted. That sounds like a kind of slow-motion wiper. Moreover, it stays in operation until reboot, meaning that it is probably fileless, running only from RAM. In reality, of course, it is much more profitable for attackers to delete data as quickly and stealthily as possible. Evasion/Stealth tools Invisibility masks the trail of the cybermodem, and Stealth mutes its signal to keep security systems from reacting to the presence of the stranger (while at the same time not blocking visibility by other Netrunners). Neither program would work in our reality. Replicator creates millions of copies of the cybermodem traces to throw defenders off the trail. Such a tactic is genuine — faced with millions of indicators of compromise, a security program probably can’t react to a real threat in time. Protection programs Shield, Force Shield, Reflector, and Armor all protect the Netrunner against bodily attacks. Just like the attacks, these protective tools are fictional. Flak creates a wall of static interference, blinding enemy programs. In reality, it probably corresponds to another type of DoS attack: one aimed specifically at cybersecurity tools. Antisoftware tools Killer (as well as several variants) is described as a virus that enters the logical structure of other programs, causing errors. This type of program may well exist: Viruses that embed themselves in executable files were once popular with virus writers, and they regularly caused infected programs to crash. However, that was not typically the intended behavior but rather the result of careless programming. In recent years, this type of threat has practically disappeared; it is not clear why it would be useful in practice. Manticore, Hydra, and Dragon are programs for hunting demons. They’re no more real than the demons are. Aardvark, however, is a real thing. The tool finds and destroys Worm programs (which you’ll remember are Trojans for our purposes here). In fact, Aardvark is nothing more than ordinary antivirus software. Judging by the description, it would be rather archaic by modern standards; it relies on signature analysis (current security solutions are much more complicated). Programs for remote management Viddy Master, Soundmachine, Open Sesame, Genie, Hotwire, Dee-2, and Crystal Ball are programs used to remotely manage various equipment (microphones, speakers, screens, cameras, doors, cars, and robots). They may well exist in reality, especially in devices from manufacturers that are not very concerned about security. News At 8 is a program for accessing information and news through the Net. Of course, such software exists. It includes Web browsers, for example. Phone Home allows the Netrunner to place and accept calls while on the Net. That’s just a standard client for IP telephony. Utilities Databaser creates files to store information. Nothing special about that. Alias changes the name of the file to conceal its true purpose. This type of function is built into practically any operating system, only here, it also includes a randomizer. Re-Rezz recompiles and restores damaged files and programs. In reality, it is impossible to recompile a damaged program without the source code (then again, if you have the source code, then there’s no problem). But the methods used for recovering damaged files are in fact more relevant in the second decade of the twenty-first century than ever before. For example, our rollback technology, which protects important data from ransomware, saves a copy of the file opened by a suspicious process and then replaces the damaged data with the copy. Instant Replay and NetMap: The first one records the path of the Netrunner on the Net, and the second shows a map of the nearby Net regions. Pure fantasy. GateMaster deletes Virizz and Viral 15 without needing to reboot the cyberdeck. This is like a very narrowly targeted antivirus program. It calls to mind early antivirus programs, which were written to counteract specific strains and not to protect the computer from malware in general. Padlock is a program that limits access to a deck. It is indeed possible to write software to restrict access to something. ElectroLock and Filelocker are programs for protecting information from unauthorized access. Basically, they are utilities for encrypting files. They differ in algorithm complexity. Such software actually exists (for example, our products call this technology File Level Encryption). File Packer and Backup are quite realistic archiving and backup programs, respectively. A view from the past The Cyberpunk 2020 rulebook makes for quite entertaining reading and contains many interesting predictions apart from the hacker’s toolkit. It will be fun to repeat this exercise 57 years from now and compare Cyberpunk 2077 with the real year 2077. As they say, stay tuned.

 Expert Blogs and Opinion

FireEye's revelation earlier this week that it had been infiltrated by a nation-state hacking crew that stole its red-team hacking tools served as a chilling reminder that no one is completely secure.

 Malware and Vulnerabilities

At the Black Hat Europe security conference, Forescout researchers will detail the bugs found in seven open-source TCP/IP stacks, the collection of network communication protocols that broker connections between devices and networks.

 Threat Intel & Info Sharing

The new code-injection technique essentially allows cybercriminals to inject code to launch dangerous XSS (cross-site scripting) attacks within the bounds of a PDF document.

 Companies to Watch

The deal values the company at $1.15 billion, which makes Venafi a cybersecurity “unicorn”, a popular term for companies valued over $1 billion. Previous investors, Foundation Capital and TCV, will remain shareholders.

 Malware and Vulnerabilities

Jabber is Cisco's widely-used enterprise chat and instant-messaging platform, which it acquired in 2008. The app allows developers to embed a natively sandboxed Chromium-based web browser in their applications.

 Companies to Watch

Data management and governance provider Skyflow this week announced a new $17.5 million Series A financing round, bringing the total raised by the company to date up to $25 million.

 Feed

Ubuntu Security Notice 4669-1 - It was discovered that a cross-site scripting vulnerability in SquirrelMail allows remote attackers to use malicious script content from HTML e-mail to execute code and/or provoke a denial of service.

 Feed

Aerospike Database versions before 5.1.0.3 permitted user-defined functions (UDF) to call the os.execute Lua function. This Metasploit module creates a UDF utilizing this function to execute arbitrary operating system commands with the privileges of the user running the Aerospike service. This module does not support   show more ...  

authentication; however Aerospike Database Community Edition does not enable authentication by default. This module has been tested successfully on Ubuntu with Aerospike Database Community Edition versions 4.9.0.5, 4.9.0.11 and 5.0.0.10.

 Feed

Ubuntu Security Notice 4666-2 - USN-4666-1 partially fixed a vulnerability in lxml, but an additional patch was needed. This update provides the corresponding additional patch in order to properly fix the vulnerability. It was discovered that lxml incorrectly handled certain HTML. An attacker could possibly use this issue to cross-site scripting attacks.

 Feed

The OpenAsset Digital Asset Management web application allowed for spoofing of IP addresses by using X-Forwarded-For header. By default, the web application would allow all traffic in for 127.0.0.1, in order to prevent users from accidentally blocking themselves. Vulnerable versions include 12.0.19 (Cloud) and 11.2.1 (On-premise).

 Feed

Cybersecurity researchers from Facebook today formally linked the activities of a Vietnamese threat actor to an IT company in the country after the group was caught abusing its platform to hack into people's accounts and distribute malware. Tracked as APT32 (or Bismuth, OceanLotus, and Cobalt Kitty), the state-aligned operatives affiliated with the Vietnam government have been known for

 Feed

Microsoft on Thursday took the wraps off an ongoing campaign impacting popular web browsers that stealthily injects malware-infested ads into search results to earn money via affiliate advertising. "Adrozek," as it's called by the Microsoft 365 Defender Research Team, employs an "expansive, dynamic attacker infrastructure" consisting of 159 unique domains, each of which hosts an average of

 Feed

With the continuing rise of IoT devices, mobile networks, and digital channels, companies face a lot of pressure to generate meaningful and actionable insights from the wealth of data they capture. Gartner Research lists data democratization as one of the top strategic technology trends to watch out for.  While empowering non-technical users to run ad-hoc reports gives enterprises the ability to

 Feed

A relatively new ransomware strain behind a series of breaches on corporate networks has developed new capabilities that allow it to broaden the scope of its targeting and evade security software—as well as with ability for its affiliates to launch double extortion attacks. The MountLocker ransomware, which only began making the rounds in July 2020, has already gained notoriety for stealing

 Feed only

Graham Cluley Security News is sponsored this week by the folks at Recorded Future. Thanks to the great team there for their support! There has never been a better time than 2020 to be a cybercriminal. From extortion ransomware to cyberespionage campaigns, malicious hackers are capitalizing on uncertainty, causing   show more ...  

chaos, and cashing in. The best … Continue reading "These free tools from Recorded Future can make you a security intelligence expert"

 Business + Partners

Hackers, never at a loss for creative deception, have engineered new tactics for exploiting the weakest links in the cybersecurity chain: ourselves! Social engineering and business email compromise (BEC) are two related cyberattack vectors that rely on human error to bypass the technology defenses businesses deploy   show more ...  

to deter malware. Social Engineering Social Engineering is when hackers impersonate trusted associates or acquaintances to manipulate people into giving up their passwords, banking information, date of birth or anything else that could be used for identity theft. As it turns out, it’s easier to hack our trust than our computers. Social engineering covers a range of tactics: Email from a friend or family member – A hacker gets access to the email password of someone you know. From there, they can send you a malicious link in an email that you’re more likely to click on because it came from someone you trust. Compelling story (pretexting) – This includes urgently asking for help. This can read like, “Your friend is in danger and they need your help immediately – please send me money right away so they can get treatment!” Standard phishing tactics – Phishing techniques include website spoofing emails appearing to come from an official source asking you to reset your password or confirm personal data. After clicking the link and entering the info, your security is compromised. “You’re a winner” notifications ­– Whether a lottery prize or a free trip to Cancun, this tactic catches many off guard. It’s known as “greed phishing” and it takes advantage our fondness for pleasure or weakness for the word “free.” Business Email Compromise Business email compromise is a targeted attack against corporate personnel, usually someone with the authority to request or fulfill a financial transaction. Victims execute seemingly routine wire transfers to criminals impersonating legitimate business associates or vendors. This form of fraud relies on a contrived pretext to request a payment or purchase be made on the attacker’s behalf. According to the FBI, BEC attacks resulted in more than $26 billion (you read that right) between June 2016 and July 2019. Here are a few tips for protecting users and businesses from BEC attacks: Slow down – BEC attacks combine context and familiarity (an email from your boss) with a sense of urgency (I need this done now!). This causes victims to lose their critical thinking capabilities. Don’t trust, verify – Never use the same channel, in this case email, to verify the identity of the requester. Pick up the phone and call, or use video chat. Prepare for the inevitable – Use all the technology at your disposal to ensure a BEC attack doesn’t succeed. Machine learning-enabled endpoint security solutions can help identify malicious sites. Address the weakest link – Train users to spot BEC attacks. Webroot testing shows that phishing simulations can improve users’ abilities to spot attacks. Perfecting Your Posture Webroot Security Intelligence Director, Grayson Milbourne, offers several suggestions that companies can do to increase their security posture. First, he says, “Whenever money is going to be sent somewhere, you should have a two-factor verification process to ensure you’re sending the money to the right person and the right accounts.” Milbourne is also a big advocate of security awareness training. “You can really understand the security topology of your business with respect to your users’ risk factors,” he says. “So, the engineering team might score one way and the IT department might score another way. This gives you better visibility into which groups within your company are more susceptible to clicking on links in emails that they shouldn’t be clicking.” With the increase in scams related to the global COVID-19 pandemic, timely and relevant user education is especially critical. “COVID obviously has been a hot topic so far this year, and in the last quarter we added close to 20 new templates from different COVID-related scams we see out in the wild,” Milbourne says. “When we look at first-time deployment of security awareness training, north of 40% of people are clicking on links,” Milbourne says. “Then, after going through security awareness training a couple of times, we see that number dip below 10%.” Where to learn more Our newest research on phishing attacks and user (over)confidence, “COVID-19 Clicks: How Phishing Capitalized on a Global Crisis” is out now, check it out! The post Staying a Step Ahead of the Hack appeared first on Webroot Blog.

 Industry Intel

Cybercrime surpasses $1Trillion in global costs A recent study has put the global cost of cybercrime at over $1 trillion for 2020. This figure is up significantly from 2018, which was calculated at around $600 billion. And while most effects are financial, roughly 92% of affected organizations cited by the study   show more ...  

reported additional issues stemming from cyberattacks. Over half took no measures to prevent or recover from common types of attack. Major hosting provider affected by cyberattack The worldwide hosting service provider Netgain was forced to take many of its servers and data centers offline following a recent ransomware incident. The attack occurred just before Thanksgiving and continues to cause intermittent outages for customers as the company works to restore their systems. Due to the volume of systems Netgain provides services for, they remain unsure how long customers will be inconvenienced by the fallout from this attack. Default passwords compromising radiology equipment Researchers have discovered that GE has implemented default passwords that can be easily found online across a wide range of medical equipment. These passwords, used by technicians to perform routine maintenance, could also be used illicitly to take control of the machines or cause them to malfunction. Users are unable to change these credentials on their own and require a certified GE tech to come to make on-site adjustments. While GE has stated it does not believe any unauthorized access has been identified, the critical nature of these machines makes this a high priority vulnerability. Educational technology still lacking proper security An alarming number of schools and educational institutions switching to remote learning have made no changes to their security policies or implemented any cybersecurity training for staff and/or students. Additionally, nearly 40 percent of the schools surveyed weren’t even able to provide devices for their employees or students to work remotely during the pandemic, though 70 percent had switched their regular communications to video conferencing services. Payment card skimmers hiding in CSS Camouflaging payment card skimmers into the CSS of compromised e-commerce site is the latest evasion tactic being used by cybercriminals. The skimmer is run by the Magecart group, which is known for successfully evading detection software and innovating to boost longevity on compromised systems. The embedded script launches during the checkout process by redirecting the customer to a new page where it begins stealing information entered into a form. The post Cyber News Rundown: Global Cybercrime Costs Surpass $1 Trillion appeared first on Webroot Blog.

2020-12
Aggregator history
Friday, December 11
TUE
WED
THU
FRI
SAT
SUN
MON
DecemberJanuaryFebruary