Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for What is doxing? | Ka ...

 Privacy

Every time you like something on a social network, join a community of neighborhood residents, publish your CV, or get caught on a street camera, the information accumulates in databases. You may have no idea how vulnerable leaving all those traces of information — every action on the Internet and almost every   show more ...  

action in the real world — leaves you. The wrong biker, driver, father Doxing can happen to anyone, as these three anecdotes illustrate. When Maryland cyclist Peter Weinberg began receiving insulting messages and threats from strangers, he learned that his workout app was publishing his cycling routes and somebody had used them to deduce that Weinberg had recently passed not far from where somebody had attacked a child. The crowd quickly — and incorrectly — identified him as the suspect and found and published his address. In a very familiar pattern, the subsequent corrective tweets and other clarifications were shared far less widely than the original information was. On the other side of the world, an animal rights activist from Singapore published the name and address of a person whose car hit a dog, with a call to “give her hell.” According to the car’s owner, the public accusations harmed her career: After vigilantes figured out where she worked, hate posts hit the company’s Facebook page. As it happens, another person was driving the car at the time of the accident. A more famous iteration of the story involves former baseball pro Curt Schilling, who saw tweets about his daughter he considered inappropriate and offensive. Schilling tracked down their authors (which he said took less than an hour), collected a sizable dossier on each, and posted some of the information on his blog. The offenders who were connected with the baseball community were fired or removed from their athletic teams within a day. What happened? All three stories provide simple examples of doxing. The word describes the collection and online publication of identifying data without the owner’s consent. Apart from being unpleasant, it can also be damaging in real life, to the victim’s reputation, employment, and even physical safety. Doxers’ motives vary. Some believe they’re exposing criminals; some are trying to intimidate their online opponents; still others are in it to avenge personal slights. Doxing as a phenomenon emerged in the 1990s, but it has since become much more dangerous — and with the volume of private information now available to all, doxing really requires no special skills or privileges. We’re not here to analyze the legality or ethics of doxing. As security experts, our task is to outline doxers’ methods and suggest ways to protect yourself. Doxing: A look from the inside Because it requires neither special knowledge, nor many resources, doxing has become very common. The tools doxers use tend to be legitimate and public, too. Search engines Ordinary search engines can provide a lot of personal information, and using their advanced search functions (for example, searching among specific websites or file types) can help doxers find the right information faster. In addition to first and last name, a nickname can also betray a person’s online habits. For example, the common practice of using the same nickname on several websites makes things easier for online detectives, who can use it to aggregate comments and posts from any number of public resources. Social networks Social networks, including specialized ones such as LinkedIn, contain a wealth of personal data. A public profile with real data is basically a ready-made dossier. Even if a profile is private and open to friends alone, a dedicated investigator can collect bits of info by scanning a victim’s comments, communities, friends’ posts, and so forth. Add a friend request, perhaps from someone posing as a job recruiter, and you arrive at the next level, social engineering. Social engineering A hallmark of many attacks, social engineering takes advantage of human nature to help doxers gain information. Using publicly available information about a mark as a starting point a doxer can contact the victim and persuade them to give up their own information. For example, a doxer might appear in the guise of a medical admin or bank rep to try to wheedle information out of a victim — a ploy that works a lot better with a few bits of truth sprinkled in. Official sources People in the public sphere tend to have the hardest time maintaining network anonymity, but that doesn’t mean rock stars and pro athletes are the only ones who need to safeguard their personal information. A doxer may even use an employer to betray a potential doxing victim’s confidence, such as with a full name and photo on a corporate About Us page or full contact info on a departmental site. Sounds innocent, but general company info gets you close to the person geographically, and the photo may lead to their social network profile. Business activities, too, typically leave traces on the Internet; and, for example, quite a bit of information about company founders is publicly available in many countries. Black market More sophisticated methods include use of nonpublic sources, such as compromised databases belonging to government entities and businesses. As our studies have shown, darknet outlets sell all sorts of personal data, from passport scans ($6 and up) to banking app accounts ($50 or more). Professional data collectors Doxers outsource some of their work to data brokers, companies that sell personal data collected from various sources. Data brokerage is not a custom criminal enterprise; banks use data from brokers, as do advertising and recruitment agencies. Unfortunately, however, not all data brokers care who buys the data. What to do if your data has leaked In an interview with Wired, Eva Galperin, the Electronic Frontier Foundation’s director of cybersecurity, suggests that if you learn that your personal information has been misused, you should contact any social networks where doxers published your data. Start with customer service or tech support. Disclosure of private information without the owner’s consent normally constitutes a breach of user agreement. Although doing this will not solve the problem completely, it should reduce potential damage. Galperin also recommends blocking your social network accounts or finding someone to manage your accounts for some time after an attack. Like other available post-breach measures, it can’t undo the damage, but it might just save your nerves and perhaps help you avoid some difficult situations online. Protecting yourself from doxing You are certainly better off reducing the probability of a data leak than dealing with its consequences. Immunity doesn’t come easy, though. For example, you can hardly influence data dumps or leaks from governmental or social network databases. You can, however, make doxers’ jobs harder. Do not reveal secrets on the Internet Keep your personal data off the Internet — especially your address, phone number, and photos — to the extent possible. Make sure any photos you post contain no geotags, and likewise that documents hold no private information. Check your social network account settings We recommend choosing strict privacy settings on the social networks and services you use, leaving profiles open to friends only, and monitoring your list of friends regularly. You can use the step-by-step instructions on our Privacy Checker portal to set up social networks and other services. Protect your accounts against hackers Using a different password for every account may be a hassle (although it doesn’t have to be), but it’s an important safeguard. If you use the same password everywhere, and one of your services leaks it, then even the strictest privacy settings won’t help you. We recommend using a password manager. Our solution, Kaspersky Password Manager, saves not just passwords, but also the websites and services they access, leaving only one master key for you to remember. We also recommend using two-factor authentication wherever you can, to further strengthen your defense. Play it smart with third-party accounts If possible, avoid signing up for websites using social network or other accounts containing your real data. Associating one account with another makes your online activities easier to follow, for example, by linking your comments with your own name. To solve the problem, keep at least two e-mail accounts, reserving one for your real-name accounts and the other for websites where you prefer to stay anonymous. Use different nicknames for different resources as well, to make collecting info about your Internet presence harder. Try building a dossier on yourself One way to learn about the state of your privacy is to play the role of a doxer and search the Internet for information about yourself. That way, you can learn about any issues your social network accounts have and find out which bits of your personal data are roaming the Internet. What you find can help you track down the source of such data and possibly even learn how to have it deleted. To keep an eye out passively, you can set up Google to notify you about any new search results on queries containing your name. Delete info about yourself You can report any content infringing on your privacy and ask search engines and social networks to delete your data (for example, here are instructions for Google, Facebook, and Twitter). Social networks and other services typically disallow unauthorized publication of personal data through their use policy, but in reality, only law enforcement authorities can get a handle on certain dubious resources. Legal data brokers normally allow individuals to delete their personal info, but based on the sheer number of such companies, removing everything won’t be easy. At the same time, however, there are agencies and services that can help erase digital tracks. You’ll have to find the balance of ease, thoroughness, and cost that works for you. Quick tips One can get targeted by doxing at any time, with or without apparent cause. These tips will help you preserve your online privacy: Keep your personal data — real name, address, place of work, and so forth — off the Internet; Close your social network accounts to outsiders and use robust, unique passwords and two-factor authentication. To manage your passwords, install Kaspersky Password Manager; Avoid using account in one service to sign in to another — particularly if one of those accounts contains your real data; Be proactive: Try building a dossier on yourself and request data deletion from any services that know too much about you; Consider deleting accounts altogether. It’s a radical (if defeatist) method to thwart doxing, and we can help you do it right while preserving important data. Doxing represents just one incursion of online data ubiquity into real life, but it’s a big one that has the potential to ruin lives. We post regular news and practical information about doxing and how to stay safe.

image for Ransomware attacks o ...

 Business

A cyberattack on a clinic or hospital is literally a matter of life or death. In 2020, healthcare systems worldwide were already cracking under the strain of the COVID-19 pandemic, and the actions of cybercriminals only added to the load. One of the most significant threats of the past year for medical institutions   show more ...  

came from ransomware attacks — cyberattacks in which cybercriminals encrypt data or extort management with threats to publish stolen data. The consequences of such attacks are manifold. In addition to the obvious and dangerous disruption to medical services, healthcare companies can face longer-term repercussions ranging from regulatory fines to claims from patients whose personal data was violated. High-profile ransomware incidents One of the most talked-about cases of the past year, and a sign of the extent of the problem, was the Ryuk ransomware attack on Universal Health Services (UHS) last September. The group operates 400 medical facilities in the United States, the United Kingdom, and other countries. Fortunately, not all hospitals and clinics suffered, but the attack did hit UHS facilities in several US states. The incident occurred early on a Sunday morning: Company computers failed to boot, and some employees received a ransom demand. The telephone network was also affected. The IT department had to ask staff to work the old-fashioned way, that is, without IT. Naturally, that caused major interference in the usual flow of the clinic, affecting patient care, lab tests, and more. Some facilities had to refer patients to other hospitals. In its official statement, UHS said that there was “no evidence of unauthorized access, copying or misuse of any patient or employee data.” In March of this year, the company released a report stating that the attack had caused $67 million worth of damage, including data recovery costs, lost revenue due to downtime, reduced patient flow, and more. Meanwhile, an incident at Ascend Clinical, which specializes in testing services for kidney disease, led to a data breach affecting more than 77,000 patients. The cause of the infection is known: An employee clicked a link in a phishing e-mail. Having penetrated the system, the attackers got their hands on, among other things, patients’ personal data — names, dates of birth, social security numbers. An attack on Magellan Health in April 2020 compromised the personal data of both employees and patients (365,000 victims, according to media reports). The cybercriminals somehow managed, through social engineering, to impersonate a client, gain access to the internal network, use malware to intercept login credentials, and finally encrypt data on the server. Generally speaking, when attacking healthcare facilities, cybercriminals prefer to encrypt and steal data from servers rather than workstations. The same thing happened with the servers of the Florida Orthopedic Institute, when attackers encrypted the (previously stolen) data of 640,000 patients. That resulted in a rather unpleasant class action lawsuit. The above is just a sample of high-profile incidents from the news last year. In fact, we had dozens more to choose from. How healthcare institutions can secure themselves Malware can penetrate a system in a variety of ways: through e-mail attachments, phishing links, infected websites, and more. Attackers can steal remote-access credentials, coax them out through social engineering, or simply use brute force. The old medical adage that prevention is better than cure applies equally well to cybersecurity, and not least to protection against ransomware. Here are our preventive-care tips for all things cyber: Protect all devices — and not only computers. Company smartphones, tablets, terminals, information kiosks, medical equipment, and absolutely anything else with access to the corporate network and the Internet; Keep all devices up to date. Again, that’s not just computers. Cyberprotection for, say, a tomograph may not spring immediately to mind, but it too is essentially a computer with an operating system that might have vulnerabilities. Ideally, security should play a major role in the choice of equipment — at the very least, before buying, have the vendor confirm it releases updates for its software; Install security solutions to protect e-mail. Protecting electronic communications is vital; medical organizations receive a lot of e-mails, including spam, which can contain not only harmless trash, but also dangerous attachments; Train all employees — that means admins and doctors and anyone else who touches technology — in the basics of cybersecurity awareness. Ever more parts of medical care are going electronic, from the digitization of medical records to online video consultations. Cybersecurity awareness needs to be as routine as mask use during surgery. Many modern ransomware attacks are carried out in what we’d call a “manual” way. In other words, the cybercriminals behind modern ransomware attacks tend not to fire off malware scattershot, but rather to seek out ways to infect specific victims’ computers and servers, often using the art of social engineering. Sometimes, after infiltrating a network, they study the infrastructure at great length in search of the most valuable data. To detect such attacks, for which endpoint protection may not suffice, we recommend engaging a managed detection response service to monitor your infrastructure remotely.

image for Transatlantic Cable ...

 News

Dave and I start episode 199 of the Kaspersky Transatlantic Cable podcast with some good news in the infosec space: a researcher and his friend hunting bugs to help a family member pay for surgery. It’s not often we get a chance to talk about positive news, so this one is a bit of a breath of fresh air. From   show more ...  

there, we head back to the world of law enforcement and surveillance. In this story, a Florida law enforcement team was caught flying a surveillance drone over a protest/press conference reacting to a police shooting. Our third story is about the latest from the REvil ransomware gang and its attempted extortion of Apple. Staying on the topic of ransomware, we talk about how that malicious action affected the world in 2020, and a new report from Kaspersky. Closing out the podcast, we take a look at the news that an enterprise-level password manager has asked users to reset all passwords. If you liked what you heard, please consider subscribing and sharing with your friends. For more information on the stories we covered, see the links below: Researchers secure bug bounty payout to help raise funds for infant’s surgery Florida cops flew spy plane above press conference for Black teens killed by police REvil’s big Apple ransomware gambit looks to pay off Ransomware by the numbers: Reassessing the threat’s global impact Passwordstate users warned to “reset all passwords” after attackers plant malicious update

image for Task Force Seeks to ...

 Ransomware

Some of the world’s top tech firms are backing a new industry task force focused on disrupting cybercriminal ransomware gangs by limiting their ability to get paid, and targeting the individuals and finances of the organized thieves behind these crimes. In a 81-page report delivered to the Biden administration   show more ...  

this week, top executives from Amazon, Cisco, FireEye, McAfee, Microsoft and dozens of other firms joined the U.S. Department of Justice (DOJ), Europol and the U.K. National Crime Agency in calling for an international coalition to combat ransomware criminals, and for a global network of ransomware investigation hubs. The Ransomware Task Force urged the White House to make finding, frustrating and apprehending ransomware crooks a priority within the U.S. intelligence community, and to designate the current scourge of digital extortion as a national security threat. The Wall Street Journal recently broke the news that the DOJ was forming its own task force to deal with the “root causes” of ransomware. An internal DOJ memo reportedly “calls for developing a strategy that targets the entire criminal ecosystem around ransomware, including prosecutions, disruptions of ongoing attacks and curbs on services that support the attacks, such as online forums that advertise the sale of ransomware or hosting services that facilitate ransomware campaigns.” According to security firm Emsisoft, almost 2,400 U.S.-based governments, healthcare facilities and schools were victims of ransomware in 2020. “The costs of ransomware go far beyond the ransom payments themselves,” the task force report observes. “Cybercrime is typically seen as a white-collar crime, but while ransomware is profit-driven and ‘non-violent’ in the traditional sense, that has not stopped ransomware attackers from routinely imperiling lives.” A proposed framework for a public-private operational ransomware campaign. Image: IST. It is difficult to gauge the true cost and size of the ransomware problem because many victims never come forward to report the crimes. As such, a number of the task force’s recommendations focus on ways to encourage more victims to report the crimes to their national authorities, such as requiring victims and incident response firms who pay a ransomware demand to report the matter to law enforcement and possibly regulators at the U.S. Treasury Department. Last year, Treasury issued a controversial memo warning that ransomware victims who end up sending digital payments to people already being sanctioned by the U.S. government for money laundering and other illegal activities could result in hefty fines. Philip Reiner, CEO of the Institute for Security and Technology and executive director of the industry task force, said the reporting recommendations are one of several areas where federal agencies will likely need to dedicate more employees. For example, he said, expecting victims to clear ransomware payments with the Treasury Department first assumes the agency has the staff to respond in any kind of timeframe that might be useful for a victim undergoing a ransomware attack. “That’s why we were so dead set in putting forward comprehensive framework,” Reiner said. “That way, Department of Homeland Security can do what they need to do, the State Department, Treasury gets involved, and it all needs to be synchronized for going after the bad guys with the same alacrity.” Some have argued that making it illegal to pay a ransom is one way to decrease the number of victims who acquiesce to their tormentors’ demands. But the task force report says we’re nowhere near ready for that yet. “Ransomware attackers require little risk or effort to launch attacks, so a prohibition on ransom payments would not necessarily lead them to move into other areas,” the report observes. “Rather, they would likely continue to mount attacks and test the resolve of both victim organizations and their regulatory authorities. To apply additional pressure, they would target organizations considered more essential to society, such as healthcare providers, local governments, and other custodians of critical infrastructure.” “As such, any intent to prohibit payments must first consider how to build organizational cybersecurity maturity, and how to provide an appropriate backstop to enable organizations to weather the initial period of extreme testing,” the authors concluded in the report. “Ideally, such an approach would also be coordinated internationally to avoid giving ransomware attackers other avenues to pursue.” The task force’s report comes as federal agencies have been under increased pressure to respond to a series of ransomware attacks that were mass-deployed as attackers began exploiting four zero-day vulnerabilities in Microsoft Exchange Server email products to install malicious backdoors. Earlier this month, the DOJ announced the FBI had conducted a first-of-its-kind operation to remove those backdoors from hundreds of Exchange servers at state and local government facilities. Many of the recommendations in the Ransomware Task Force report are what you might expect, such as encouraging voluntary information sharing on ransomware attacks; launching public awareness campaigns on ransomware threats; exerting pressure on countries that operate as safe havens for ransomware operators; and incentivizing the adoption of security best practices through tax breaks. A few of the more interesting recommendations (at least to me) included: -Limit legal liability for ISPs that act in good faith trying to help clients secure their systems. -Create a federal “cyber response and recovery fund” to help state and local governments or critical infrastructure companies respond to ransomware attacks. -Require cryptocurrency exchanges to follow the same “know your customer” (KYC) and anti-money laundering rules as financial institutions, and aggressively targeting exchanges that do not. -Have insurance companies measure and assert their aggregated ransomware losses and establish a common “war chest” subrogation fund “to evaluate and pursue strategies aimed at restitution, recovery, or civil asset seizures, on behalf of victims and in conjunction with law enforcement efforts.” -Centralize expertise in cryptocurrency seizure, and scaling criminal seizure processes. -Create a standard format for reporting ransomware incidents. -Establish a ransomware incident response network.

 Malware and Vulnerabilities

Hackers are targeting Android phone users across the U.K via malicious text messages to steal banking information and credentials, and even lift passwords from devices.

 Malware and Vulnerabilities

Private messaging app Telegram is being exploited by cyberattackers who are delivering a ToxicEye RAT to take control over a hacker-operated Telegram account and leak critical data.

 Expert Blogs and Opinion

Several positive steps continue to be taken by organizations such as the European Union and the U.S. FTC to curb possible malicious uses and abuses of AI via new regulations.

 Feed

Graudit is a simple script and signature sets that allows you to find potential security flaws in source code using the GNU utility, grep. It's comparable to other static analysis applications like RATS, SWAAT, and flaw-finder while keeping the technical requirements to a minimum and being very flexible.

 Feed

Ubuntu Security Notice 4929-1 - Greg Kuechle discovered that Bind incorrectly handled certain incremental zone updates. A remote attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. Siva Kakarla discovered that Bind incorrectly handled certain DNAME records. A remote   show more ...  

attacker could possibly use this issue to cause Bind to crash, resulting in a denial of service. It was discovered that Bind incorrectly handled GSSAPI security policy negotiation. A remote attacker could use this issue to cause Bind to crash, resulting in a denial of service, or possibly execute arbitrary code. Various other issues were also addressed.

 Feed

Red Hat Security Advisory 2021-1468-01 - The Berkeley Internet Name Domain is an implementation of the Domain Name System protocols. BIND includes a DNS server ; a resolver library ; and tools for verifying that the DNS server is operating correctly.

 Feed

Ubuntu Security Notice 4928-1 - It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly use this issue to cause access sensitive information or cause a crash. It was discovered that GStreamer Good Plugins incorrectly handled certain files. An attacker could possibly   show more ...  

use this issue to execute arbitrary code or cause a crash. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 20.10. Various other issues were also addressed.

 Feed

Red Hat Security Advisory 2021-1452-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. The ceph-ansible package provides Ansible playbooks for   show more ...  

installing, maintaining, and upgrading Red Hat Ceph Storage. Perf Tools is a collection of performance analysis tools, including a high performance multi-threaded malloc() implementation that works particularly well with threads and STL, a thread-friendly heap-checker, a heap profiler, and a cpu-profiler.

 Feed

Red Hat Security Advisory 2021-1448-01 - Red Hat Advanced Cluster Management for Kubernetes 2.0.10 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private   show more ...  

cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which resolve some security issues and bugs. Issues addressed include a code execution vulnerability.

 Feed

A previously undocumented Linux malware with backdoor capabilities has managed to stay under the radar for about three years, allowing the threat actor behind to harvest and exfiltrate sensitive information from infected systems. Dubbed "RotaJakiro" by researchers from Qihoo 360 NETLAB, the backdoor targets Linux X64 machines, and is so named after the fact that "the family uses rotate

 Feed

Hackers are scanning the internet for weaknesses all the time, and if you don't want your organization to fall victim, you need to be the first to find these weak spots. In other words, you have to adopt a proactive approach to managing your vulnerabilities, and a crucial first step in achieving this is performing a vulnerability assessment. Read this guide to learn how to perform vulnerability

 Feed

Cybersecurity researchers on Wednesday exposed a new cyberespionage campaign targeting military organizations in Southeast Asia. Attributing the attacks to a threat actor dubbed "Naikon APT," cybersecurity firm Bitdefender laid out the ever-changing tactics, techniques, and procedures adopted by the group, including weaving new backdoors named "Nebulae" and "RainyDay" into their data-stealing

 Feed

The maintainers of Composer, a package manager for PHP, have shipped an update to address a critical vulnerability that could have allowed an attacker to execute arbitrary commands and "backdoor every PHP package," resulting in a supply-chain attack. Tracked as CVE-2021-29472, the security issue was discovered and reported on April 22 by researchers from SonarSource, following which a hotfix was

 Feed

An adversary known for its watering hole attacks against government entities has been linked to a slew of newly detected intrusions targeting various organizations in Central Asia and the Middle East. The malicious activity, collectively named "EmissarySoldier," has been attributed to a threat actor called LuckyMouse, and is said to have happened in 2020 with the goal of obtaining geopolitical

2021-04
Aggregator history
Thursday, April 29
THU
FRI
SAT
SUN
MON
TUE
WED
AprilMayJune