Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Supply Chain Attacks ...

 Security

Attacks against container infrastructure have grown in both frequency and complexity over time, and this trend is expected to continue. When using vulnerability scanning apps, unsafe containers may be identified online in as little as a few hours, according to Cyware.   Cyberattacks on companies' container   show more ...  

infrastructure, including Docker images, have risen over 600% in the past year, according to recent research by Aqua Security's Team Nautilus. The primary objective of almost all of these assaults is cryptomining, most of them as part of the Kinsing malware operation.Cryptocurrencies are more likely to be regarded as a minor nuisance than a significant security concern in most cases. After successfully breaching the container, crypt... (read more)

image for Russia Files Charges ...

 Security

Russia filed fresh accusations against Facebook, Google, Telegram, and Twitter, claiming that they failed to delete unlawful material. The Kremlin argues that by controlling and limiting the influence of social media and technology giants, it can prevent foreign interference in internal affairs, according to Republic   show more ...  

World.  In recent months, the Russian government has taken steps to restrict social media and technological companies. The data suggests that the administration intends to increase the number of fines it imposes to protect its interests. Russia has previously placed a punitive slowdown on Twitter in response to the US social network's unwillingness to delete banned information, as part of a broader campaign to constrain Western Internet corporations. Telegram is also... (read more)

image for What vishing is and ...

 Threats

Between tech support requesting access to your computer, concerned tax services specialists demanding payments, medical equipment suppliers “returning your call,” and many more — none legitimate — it’s a wonder anyone even answers their phone anymore. You’d be hard-pressed to find someone   show more ...  

who hasn’t experienced some form of phone scam, although the name for it isn’t as well-known: vishing. What is vishing? Vishing is short for voice plus phishing (as smishing is SMS + phishing), and, aided by the mass transition to remote work, it has turned the phone into a major weapon of fraud, to the extent that law-enforcement agencies now periodically release official announcements about the danger. According to 2019 data from the US Federal Trade Commission, only 6% of scam calls ended in financial loss. Nevertheless, when it happened, the damage was quite significant, with a median value of $960. Anyone can fall for a scammer’s bait, even experts who think they’ve seen it all. Many fraudsters are excellent at gaining the confidence of even the most vigilant target. On the one hand, vishing is more conservative than regular phishing, because the telephone itself is an older means of communication. On the other hand, massive data leaks in the digital age have lent voice scams new power: Never before have scammers been in possession of such volumes of information about almost everyone on the planet. The proliferation of Internet telephony (VoIP) further plays into the hands of cybercriminals, enabling them to manipulate phone numbers and cover their tracks. Types of scam calls Scammers can say just about anything on a call, but their attempts tend to fall into a few main categories. Telemarketing Telemarketing fraud tends to involve offers too good to be true and pressure too time-sensitive to end well. Some examples include winning the lottery (bonus points it you didn’t even buy a ticket), a reduced credit card interest rate, and other lucrative offers that are hard to refuse. They tend to have in common the need to make a decision on the spot, plus a small advance payment from you to them. If you have the time to think about the offer, it’s (usually) clearly fraudulent. If you make the payment, it’ll just go to the scammers, literally rewarding them for their crime and also reinforcing the value of using leaked databases of phone numbers to call and defraud thousands more people. Government agency One of the most common schemes involves allegedly unpaid or underpaid taxes. A “tax office” initiates the call and provides a choice: Pay the arrears or face a fine. The offer expires soon, after which the fine will increase. Again, adding time-sensitivity works. Given time to think about how tax agencies communicate with citizens, not to mention their deadline structures, the average citizen could probably figure out that such calls are fraudulent. Faced with a ticking clock and (apparently) a government agency known for strictness, however, adjusts the odds in scammers’ favor. Technical support For unsolicited tech-support calls, scammers choose large, well-known brands to increase the chances of connecting with an actual user of the product. The caller typically claims to have found an issue with the victim’s computer and asks for login credentials or remote access to their computer. A more sophisticated scheme involves some preparation, for example, infecting a computer with malware that invokes a pop-up window with a description of the alleged problem and a phone number to call to get it fixed. Bank The ultimate object of any scam is money, so of course some fraudsters pretend to call from banks. Generally, they claim to be reporting suspicious account activity, which in reality gives them cover to request details such as a CVC/CVV code or a one-time passcode from a text message. Armed with such details, the fake bank employee can easily clean out an account for real. How to recognize scam calls We can’t discount the notion that scammers, always on the lookout for more-convincing hooks, might someday learn from fraud’s rich history of tells, but most scams exhibit at least one of several red flags. If a call supposedly from a bank or government agency comes from a cell number, it’s almost certainly vishing. Double those odds if the phone number is from a different region. However, an official-looking number is no guarantee of a legitimate call; modern technologies allow caller ID spoofing. If a caller tries to extract confidential information, especially in a threatening manner, that too is a sign of vishing. In general, any attempt to find out private information is an indication of fraud: any information a real bank or tax office employee needs about you, they probably already have — remember, we’re talking about communication they initiated, not you. If someone urges you to make a monetary transaction and cites a deadline, it’s definitely a scam. If a caller tries to persuade you to install software on your computer to fix some problem they called to tell you about, it will probably end badly for you. Finally, an indirect but still reliable sign of vishing is if the caller gets confused, misspeaks, is hostile, or uses slang expressions. We have nothing against everyday speech, of course, but real operators are generally trained to use professional language. How to guard against scam calls If you spot at least one of the above red flags, the best option is simply to end the conversation. After that, call the company or organization that supposedly just called you and report the incident — the more information they collect, the more likely they are to catch, or at least hinder, the fraudsters. Look up the tech or customer support number separately, for example by going to the organization’s official website. In addition, resolutely avoid installing remote access programs on your computer, however convincing any caller may be, and use a reliable security solution that detects dangerous applications in good time and warns you about them.

image for We Infiltrated a Cou ...

 A Little Sunshine

Imagine waking up each morning knowing the identities of thousands of people who are about to be mugged for thousands of dollars each. You know exactly when and where each of those muggings will take place, and you’ve shared this information in advance with the authorities each day for a year with no outward   show more ...  

indication that they are doing anything about it. How frustrated would you be? A counterfeit check image [redacted] that was intended for a person helping this fraud gang print and mail phony checks tied to a raft of email-based scams. One fraud-fighting group is intercepting hundreds to thousands of these per day. Such is the curse of the fraud fighter known online by the handles “Brianna Ware” and “B. Ware” for short, a longtime member of a global group of volunteers who’ve infiltrated a cybercrime gang that disseminates counterfeit checks tied to a dizzying number of online scams. For the past year, B. Ware has maintained contact with an insider from the criminal group that’s been sending daily lists of would-be victims who are to receive counterfeit checks printed using the real bank account information of legitimate companies. “Some days we’re seeing thousands of counterfeit checks going out,” B. Ware said. The scams used in connection with the fraudulent checks vary widely, from fake employment and “mystery shopper” schemes to those involving people who have been told they can get paid to cover their cars in advertisements (a.k.a. the “car wrap” scam). A form letter mailed out with a counterfeit check urges the recipient to text a phone number after the check has been deposited. Most of the counterfeit checks being disseminated by this fraud group are in amounts ranging from $2,500 to $5,000. The crimes that the checks enable are known variously as “advanced fee” scams, in that they involve tricking people into making payments in anticipation of receiving something of greater value in return. But in each scheme the goal is the same: Convince the recipient to deposit the check and then wire a portion of the amount somewhere else. A few days after the check is deposited, it gets invariably canceled by the organization whose bank account information was on the check. And then person who deposited the phony check is on the hook for the entire amount. “Like the car wrap scam, where they send you a check for $5,000, and you agree to keep $1,000 for your first payment and send the rest back to them in exchange for the car wrap materials,” B. Ware said. “Usually the check includes a letter that says they want you to text a specific phone number to let them know you received the check. When you do that, they’ll start sending you instructions on how and where to send the money.” A typical confirmation letter that accompanies a counterfeit check for a car wrap scam. Traditionally, these groups have asked recipients to transit money via wire transfer. But these days, B. Ware said, the same crooks are now asking people to forward the money via mobile applications like CashApp and Venmo. B. Ware and other volunteer fraud fighters believe the fake checks gang is using people looped into phony employment schemes and wooed through online romance scams to print the counterfeit checks, and that other recruits are responsible for mailing them out each day. “More often than not, the scammers creating the shipping labels will provide those to an unwitting accomplice, or the accomplice is told to log in to an account and print the labels,” B. Ware explained. Often the counterfeit checks and labels forwarded by B. Ware’s informant come with notes attached indicating the type of scam with which they are associated. “Sometimes they’re mystery shopper scams, and other times it’s overpayment for an item sold on Craigslist,” B. Ware said. “We don’t know how the scammers are getting the account and routing numbers for these checks, but they are drawn on real companies and always scan fine through a bank’s systems initially. The recipients can deposit them at any bank, but we try to get the checks to the banks when we can so they have a heads up.” SHRINKING FROM THE FIREHOSE? Roughly a year ago, B. Ware’s group started sharing its intelligence with fraud investigators at FedEx and the U.S. Postal Service — the primary delivery mechanisms for these counterfeit checks. Both the USPS and FedEx have an interest in investigating because the fraudsters in this case are using stolen shipping labels paid for by companies who have no idea their FedEx or USPS accounts are being used for such purposes. “In most cases, the name of the sender will be completely unrelated to what’s being sent,” B. Ware said. “For example, you’ll see a label for a letter to go out with a counterfeit check for a car wrap scam, and the sender on the shipping label will be something like XYZ Biological Resources.” But B. Ware says a year later, there is little sign that anyone is interested in acting on the shared intelligence. “It’s so much information that they really don’t want it anymore and they’re not doing anything about it,” B. Ware said of FedEx and the USPS. “It’s almost like they’re turning a blind eye. There are so many of these checks going out each day that instead of trying to drink from the firehouse, they’re just turning their heads.” FedEx did not respond to requests for comment. The U.S. Postal Inspection Service responded with a statement saying it “does not comment publicly on its investigative procedures and operational protocols.” ANY METHOD THAT WORKS Ronnie Tokazowski is a threat researcher at Agari, a security firm that has closely tracked many of the groups behind these advanced fee schemes [KrebsOnSecurity interviewed Tokazowski in 2018 after he received a security industry award for his work in this area]. Tokazowski said it’s likely the group B. Ware has infiltrated is involved in a myriad other email fraud schemes, including so-called “business email compromise” (BEC) or “CEO scams,” in which the fraudsters impersonate executives at a company in the hopes of convincing someone at the firm to wire money for payment of a non-existent invoice. According to the FBI, BEC scams netted thieves nearly $2 billion in 2020 — far more than any other type of cybercrime. In a report released in 2019 (PDF), Agari profiled a group it dubbed “Scattered Canary” that is operating principally out of West Africa and dabbles in a dizzying array of schemes, including BEC and romance scams, FEMA and SBA loans, unemployment insurance fraud, counterfeit checks and of course money laundering. Image: Agari. Tokazowski said he doesn’t know if the group B. Ware is watching has any affiliation with Scattered Canary. But he said his experience with Scattered Canary shows these groups tend to make money via any and all methods that reliably produce results. “One of the things that came out of the Scattered Canary report was that the actors we saw doing BEC scams were the same actors doing the car wrap and various Craigslist scams involving fake checks,” he said. “The people doing this type of crime will have tutorials on how to run the scam, how to wire money out for unemployment fraud, how to target people on Craigslist, and so on. It’s very different from the way a Russian hacking group might go after one industry vertical or piece of software or focus on one or two types of fraud. They will follow any method they can that works.” Tokazowski said he’s taken his share of flack from people on social media who say his focus on West African nations as the primary source of these advanced fee and BEC scams is somehow racist [KrebsOnSecurity experienced a similar response to the 2013 stories, Spy Service Exposes Nigerian ‘Yahoo Boys’, and ‘Yahoo Boys’ Have 419 Facebook Friends]. But Tokazowski maintains he has been one of the more vocal proponents of the idea that trying to fight these problems by arresting those involved is something of a Sisyphean task, and that it makes way more sense to focus on changing the economic realities in places like Nigeria, which has been a hotbed of advanced fee activity for decades. Nigeria has the world’s second-highest unemployment rate — rising from 27.1 percent in 2019 to 33 percent in 2020, according to the National Bureau of Statistics. The nation also is among the world’s most corrupt, according to 2020 findings from Transparency International. “Education is definitely one piece, as raising awareness is hands down the best way to get ahead of this,” Tokazowski said. “But we also need to think about ways to create more business opportunities there so that people who are doing this to put food on the table have more legitimate opportunities. Unfortunately, thanks to the level of corruption of government officials, there are a lot of cultural reasons that fighting this type of crime at the source is going to be difficult.”

image for Episode 219: LGBTQ+C ...

 Companies

In this week’s episode of the podcast (#219) we speak with four cybersecurity professionals about what it means to be Queer in the industry: their various paths to the information security community, finding support among their peers and the work still left to do to make information security inclusive. All in honor   show more ...  

of Pride Month, 2021. The post ...Read the whole entry... » Related StoriesEpisode 216: Signed, Sealed and Delivered: The Future of Supply Chain SecurityEpisode 215-2: Leave the Gun, Take the McFlurryEpisode 214: Darkside Down: What The Colonial Attack Means For The Future of Ransomware

 Expert Blogs and Opinion

The whole of nation approach to national security requires the involvement of C-suite executives along with information sharing to promote best practices in ransomware response.

 Malware and Vulnerabilities

If left unpatched, the vulnerability allows attackers to bypass authentication and gain access to CRX Package Manager, leaving applications open to remote code execution (RCE) attacks.

 Breaches and Incidents

The builder for the Babuk Locker ransomware was leaked online. This could allow any cybercriminal group to create their custom ransomware variants. The leak of such advanced ransomware is a grave cause of concern for cybersecurity experts. Thus, it is best for organizations to proactively apply security measures to avoid such threats.

 Malware and Vulnerabilities

MalwareHunterTeam is alerting about the Linux version of the REvil ransomware that purportedly targets VMware ESXi servers. By targeting virtual machines, REvil can encrypt multiple servers with just a single command. Experts recommend installing VMware (ESXi) in high-security mode and implementing additional layers of security.

 Malware and Vulnerabilities

According to researchers, Epsilon Red operations are ongoing and more than 3,500 Microsoft Exchange servers are still vulnerable. Written in Go, the latest Epsilon Red strain launches mass server exploitation campaigns and tries to expose companies’ information for revenue. Therefore, for ample protection, adequate protection against ransomware attacks must include a defense-in-depth protection strategy. 

 Feed

Red Hat Security Advisory 2021-2575-01 - The lz4 packages provide support for LZ4, a very fast, lossless compression algorithm that provides compression speeds of 400 MB/s per core and scales with multicore CPUs. It also features an extremely fast decoder that reaches speeds of multiple GB/s per core and typically   show more ...  

reaches RAM speed limits on multicore systems. Issues addressed include an integer overflow vulnerability.

 Feed

Red Hat Security Advisory 2021-2566-01 - The fwupd packages provide a service that allows session software to update device firmware. Issues addressed include buffer overflow, out of bounds write, and use-after-free vulnerabilities.

 Feed

Global Socket is a tool for moving data from here to there, securely, fast, and through NAT and firewalls. It uses the Global Socket Relay Network to connect TCP pipes, has end-to-end encryption (using OpenSSL's SRP / RFC-5054), AES-256 and key exchange using 4096-bit Prime, requires no PKI, has Perfect Forward Secrecy, and TOR support.

 Feed

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

 Feed

Red Hat Security Advisory 2021-2569-01 - The libxml2 library is a development toolbox providing the implementation of various XML standards. Issues addressed include buffer overflow, bypass, null pointer, and use-after-free vulnerabilities.

 Feed

A KVM guest on AMD can launch a L2 guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nested_svm_vmrun. Executing vmrun from the L2 guest, will then trigger a second call to nested_svm_vmrun and corrupt svm->nested.hsave with data copied out of the L2 vmcb. For kernel versions that   show more ...  

include the commit "2fcf4876: KVM: nSVM: implement on demand allocation of the nested state" (>=5.10), the guest can free the MSR permission bit in svm->nested.msrpm, while it's still in use and gain unrestricted access to host MSRs.

 Feed

Red Hat Security Advisory 2021-2574-01 - The RPM Package Manager is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Issues addressed include a bypass vulnerability.

 Feed

Red Hat Security Advisory 2021-2595-01 - 389 Directory Server is an LDAP version 3 compliant server. The base packages include the Lightweight Directory Access Protocol server and command-line utilities for server administration. Issues addressed include a null pointer vulnerability.

 Feed

Red Hat Security Advisory 2021-2588-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include HTTP request smuggling, HTTP response splitting, denial of service, information leakage, and insecure permissions vulnerabilities.

 Feed

Red Hat Security Advisory 2021-2587-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include HTTP request smuggling, HTTP response splitting, denial of service, and information leakage vulnerabilities.

 Feed

Red Hat Security Advisory 2021-2591-01 - EDK is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Issues addressed include a heap corruption vulnerability.

 Feed

Red Hat Security Advisory 2021-2584-01 - Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Issues addressed include a HTTP request smuggling vulnerability.

 Feed

Red Hat Security Advisory 2021-2583-01 - Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

 Feed

GitHub on Tuesday launched a technical preview of a new AI-powered pair programming tool that aims to help software developers write better code across a variety of programming languages, including Python, JavaScript, TypeScript, Ruby, and Go. Copilot, as the code synthesizer is called, has been developed in collaboration with OpenAI, and leverages Codex, a new AI system that's trained on

 Feed

A coordinated international law enforcement operation resulted in the takedown of a VPN service called DoubleVPN for providing a safe haven for cybercriminals to cover their tracks. "On 29th of June 2021, law enforcement took down DoubleVPN," the agencies said in a seizure notice splashed on the now-defunct site. "Law enforcement gained access to the servers of DoubleVPN and seized personal

 Feed

Organizations today already have an overwhelming number of dangers and threats to look out for, from spam to phishing attempts to new infiltration and ransomware tactics. There is no chance to rest, since attack groups are constantly looking for more effective means of infiltrating and infecting systems. Today, there are hundreds of groups devoted to infiltrating almost every industry,

 Feed

A proof-of-concept (PoC) exploit related to a remote code execution vulnerability affecting Windows Print Spooler and patched by Microsoft earlier this month was briefly published online before being taken down. Identified as CVE-2021-1675, the security issue could grant remote attackers full control of vulnerable systems. Print Spooler manages the printing process in Windows, including loading

 Application Security

In 2020, cyber criminals used cloud applications, the cover of a pandemic, and a newly embraced work-from-home culture to serve up ransomware, steal data, and disrupt how companies do business. The year is over, but the challenges and risks remain.  How do we prevent these criminals from injecting chaos into our   show more ...  

hybrid work environments? As […] The post Preventing Criminals from Using Cloud Applications to Inject Chaos Into Work Environments appeared first on Security Weekly.

2021-06
Aggregator history
Wednesday, June 30
TUE
WED
THU
FRI
SAT
SUN
MON
JuneJulyAugust