Oktacron - Cyber Security RSS Feeds History

How Kaspersky Password Manager works | Kaspersky official blog

kaspersky Jan 31, 2023 Privacy

This past year we saw a flurry of news reports about leaks of personal data from various online services and even from popular password managers. If you use a digital vault, when you read about such a data leak, youll probably start imagining a nightmare scenario: attackers have accessed all your accounts whose show more ...

passwords are stored in your password manager. How justified are these fears? Using the example of Kaspersky Password Manager, well tell you how the multiple layers of defense of password managers work, and what you can do to make them stronger. General principles To start, lets review why password managers are a good idea. The number of internet services we use is constantly growing, and that means that were entering a lot of usernames and passwords. Its hard to remember them, but writing them down in random places is risky. The obvious solution is to save all your login credentials in one secure place, and then lock that vault with a single key. Then youll only need to remember one main password. When you first activate Kaspersky Password Manager, it prompts you to create a main password that youll use to open your digital vault. Then you can enter in this vault the data for each internet service you use: URL, username and password. You can do this manually, or you can set up a password manager browser extension and use a special command to transfer all the passwords saved in the browser to the vault. Besides passwords, you may add other personal documents to the vault, e.g., ID scan, insurance data, bank card data and important photos. When you need to visit a website, you open the vault, and then you can either manually copy the data you need into the login form, or allow the password manager to autofill the saved login credentials for the website. After that, all you need do is lock the vault. Digital vault and self-locking Now lets look at the protection mechanisms. The vault file is encrypted using a symmetric key algorithm based on the Advanced Encryption Standard (AES-256), which is commonly used around the world to protect confidential data. To access the vault, you use a key based on your main password. If the password is strong, attackers would need a lot of time to crack the cipher without the key. Also, our password manager automatically locks the vault after the user is inactive for a certain length of time. If an attacker happens to get hold of your device and manages to bypass the operating systems protection and reach the vault file, they wont be able to read whats in it if they dont have the main password. But its up to you to configure the self-locker. The default setting in the app might not lock the vault until after a rather long period of inactivity. But if youre in the habit of using a laptop or smartphone in a location that may not be completely safe, you can configure the self-locking to kick in after a minute. Theres another potential loophole though: if an attacker has planted a Trojan or used another method to install a remote-access protocol on your computer, they may try to extract passwords from the vault while youre logged in to it. In 2015, such a hacker tool was created for the KeePass Password manager. It decrypted and stored as a separate file an entire archive with passwords that was running on a computer with an open instance of KeePass. However, Kaspersky Password Manager is typically used along with the antivirus solutions by Kaspersky, and that makes it much less likely that a password manager will run on an infected computer. Zero knowledge The encrypted file with passwords can be saved not only on your device but also in Kasperskys cloud infrastructure — this allows you to use the vault from different devices, including home computers and mobile phones. A special option in the settings enables data syncing across all your devices with the installed Kaspersky Password Manager. You can also use the web version of the password manager from any device through the My Kaspersky website. How likely is a data leak if youre using cloud storage? First, its important to understand that were operating on the zero-knowledge principle. This means that your password vault is as encrypted for Kaspersky as it is for everyone else. Kaspersky developers wont be able to read the file — only someone who knows the main password can open it. Many — but not all — of todays services that store passwords and other secrets adhere to a similar principle. So, if you see a news report about a data leak from a cloud storage service, dont panic immediately: it doesnt necessarily mean that the attackers were able to decrypt the stolen data. This sort of breach is like stealing an armed safe from a bank without having the combination to the lock. In this case, the combination is your main password. Heres another important security principle: Kaspersky Password Manager doesnt save your main password on your devices or in the cloud. Even if a hacker accesses your computer or the cloud storage service, they wont be able to steal your main password from the product itself. Only you know this password. A strong main password However, a leak of an encrypted file with passwords can also create problems. Once attackers swipe a vault, they may try to hack it. There are two principal attack methods. The first is brute force. In general, this is very time consuming. If your password is made up of a dozen random characters and includes both lowercase and capital letters, numbers and special characters, brute forcing all the combinations takes more than a sextillion operations — thats… a whole number with 21 figures folks! But if you had decided to make your life easier and used a weak password — such as a single word or a simple combination of numbers like 123456 — the automatic scanner will pick it out in less than a second because in this case the brute forcing is based not on individual symbols but on a dictionary of popular combinations. Despite this, to this day many users pick dictionary passwords (combinations of symbols that have long been in the dictionaries of hackers scanners). Users of the password manager LastPass were warned about this potential problem in December 2022. When the account of a LastPass developer was hacked, the attackers gained access to the cloud-hosting the company uses. Among other data, the attackers got hold of backups of users vault passwords. The company told users that if they followed all the recommendations to create a strong and unique main password, they wouldnt have anything to worry about because it would take millions of years to brute force such a password. People who used weaker passwords were advised to change them immediately. Fortunately, many password managers, including Kaspersky Password Manager, now automatically check the strength of your main password. If its weak or only of medium strength, the password manager gives you a warning and you sure should heed it. Unique main password The second hacking method counts on the fact that people often use the same login credentials for different internet services. If one of the services is breached, attackers will automatically brute force the username and password combinations in other services in an attack known as credential stuffing. This kind of attack is often successful. Users of Norton Password Manager were warned about this kind of attack in the first weeks of this year. The company NortonLifeLock (formerly known as Symantec) announced that there were no breaches of its infrastructure. But in early December 2022, mass attempts to enter Norton Password Manager accounts using passwords that hackers had stolen because of a breach on another service were documented. Investigations by NortonLifeLock found that the hackers were able to use this attack to access the accounts of some of its customers. The obvious lesson from this story is that you shouldnt use the same password for different accounts. As for technical ways to protect yourself from these kinds of attacks, Kaspersky Password Manager can perform two important checks of your password database… First, it checks for uniqueness: the app warns you if one of your saved passwords is being used in multiple accounts. Second, our password manager checks whether your passwords are in a database of breaches. To perform this password-check securely, it uses the SHA-256 cryptographic hash algorithm. This means that the app doesnt send the passwords themselves to be checked; rather, it calculates a checksum for each password and compares these hashes to the checksums in the database of compromised passwords. If the checksums match, the app warns you that the password is compromised, and you should change it. But remember that these checks are done only with passwords you are saving in the vault. Its up to you to make sure that the main password is unique: youre the only one who knows it and it should be different from your other passwords. Memorable main password There are other ways to leak main passwords — and this is where the dreaded human factor comes into play. For example, some people note their main password in a place where it can be stolen, such as in an unencrypted file on their desktop or on a Post-It they stick on their office wall. Instead of writing it down, try to remember it. Its true that security rules say that a password should be long and complicated — sometimes were even prompted to generate a random combination of 12 to 16 characters. Its hard to remember a password like that. Thats why many people try to use simpler passwords, and then they become targets of hacks. So how do you make your main password both strong and memorable? A good strategy is to come up with a password based on three or four secret words. For example, you can take the name of the city where you had the best vacation of your life, tack on the name of the best bar you went to on that vacation, and then add the name and number of cocktails you drank. A password like that will be long and unique, as well as easy to remember — that is, of course, if you didnt have too many cocktails and still remember all those facts separately.

Phishers Trick Microsoft Into Granting Them 'Verified' Cloud Partner Status

darkreading Jan 31, 2023 Feed

Everyone on Twitter wants a blue check mark. But Microsoft Azure's blue badges are even more valuable to a threat actor stealing your data via malicious OAuth apps.

Critical VMware RCE Vulnerabilities Targeted by Public Exploit Code

darkreading Jan 31, 2023 Feed

Security vulnerabilities in VMware's vRealize Log Insight platform can be chained together to offer a cybercriminals a gaping hole to access corporate crown jewels.

Will Cybersecurity Remain Recession-Proof in 2023?

darkreading Jan 31, 2023 Feed

Demand for skilled professionals will remain high, but cyber budgets will be eaten away.

Firmware Flaws Could Spell 'Lights Out' for Servers

darkreading Jan 31, 2023 Feed

Five vulnerabilities in the baseboard management controller (BMC) software used by 15 major vendors could allow remote code execution if attackers gain network access.

Poser Hackers Impersonate LockBit in SMB Cyberattacks

darkreading Jan 31, 2023 Feed

Recent cyberattacks against SMBs across Europe have been traced back to copycat groups using leaked LockBit locker malware.

Predictions For Securing Today's Hybrid Workforce

darkreading Jan 31, 2023 Feed

Since requirements differ for users who work both from home and in the office, policies — and underlying technology — must adapt.

Are Your Employees Thinking Critically About Their Online Behaviors?

darkreading Jan 31, 2023 Feed

Three mindset shifts will help employees build a habit of vigilance and make better security decisions. Move past security theater to reframe thinking so employees understand data's value, act with intention, and follow data best practices.

Unleash the Full Potential of Zero-Trust Security

darkreading Jan 31, 2023 Feed

The demand is unmistakeable and the business case is readily justified — it's time to implement zero trust.

QNAP fixes critical bug letting hackers inject malicious code

cyware Jan 31, 2023 Malware and Vulnerabilities

The vulnerability is tracked as CVE-2022-27596 and rated by the company as 'Critical' (CVSS v3 score: 9.8), impacting QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system.

Budget constraints force cybersecurity teams to do more with less

cyware Jan 31, 2023 Trends, Reports, Analysis

About 49% of organizations have sufficient budget to fully meet their current cybersecurity needs, and 11% can, at best, protect only their most critical assets, according to a survey by the Neustar International Security Council.

Latvia confirms phishing attack on Ministry of Defense, linking it to Russian hacking group

cyware Jan 31, 2023 Breaches and Incidents

A spokesperson for Latvia’s Ministry of Defense confirmed that the latest attack was “most likely” linked to Russia's Gamaredon, although the investigation is still ongoing.

Cobalt Sapling Uses Multiple Personas for Pro-Iranian Missions

cyware Jan 31, 2023 Threat Actors

The threat actor known as Cobalt Sapling was spotted targeting Saudi Arabia by creating a new sub-group dubbed Abraham's Ax. Researchers also found a connection between Moses Staff and Abraham's Ax. Both rely on the same custom cryptographic wiper malware for encrypting the victim’s data. To stay protected, experts recommend organizations audit the access controls by leveraging the available IOCs.

How businesses can bolster their cybersecurity defenses with open source

cyware Jan 31, 2023 Expert Blogs and Opinion

Organizations are optimistic about the security of open-source software development, with an average of 77% believing the security of open-source development will improve by the end of 2023, according to a 2022 Linux Foundation report.

The Untold Story of a Crippling Ransomware Attack

cyware Jan 31, 2023 Incident Response, Learnings

More than two years later, Hackney Council is still dealing with the colossal aftermath of a ransomware attack. While its services are now back up and running, parts of the council are still not operating as they were prior to the attack.

Cyberattack confirmed as cause for phone and IT problems at British music school

cyware Jan 31, 2023 Breaches and Incidents

A specialist music academy in Guildford, southwest of London, has confirmed that a cyberattack is responsible for knocking out its phone lines and impacting the school’s IT systems.

Iranian and Russian Groups Target Organizations - Warns NCSC

cyware Jan 31, 2023 Threat Actors

The NCSC-U.K warned against ongoing spear-phishing campaigns against government entities, NGOs, think tanks, academia, and others, by Russia-based SEABORGIUM and Iran-based TA453 threat actors. SEABORGIUM and TA453 spend time researching their targets' interests and contacts to create a convincing approach. The NCSC-U.K recommends reporting activity consistent with the techniques described.

New Versions of Prilex PoS Malware Blocking Contactless NFC Transactions

cyware Jan 31, 2023 Malware and Vulnerabilities

Prilex is a highly advanced malware adopting a unique cryptographic scheme, doing real-time patching in target software, forcing protocol downgrades, manipulating cryptograms, doing GHOST transactions, and performing credit card fraud.

Schools don't pay, but ransomware attacks still increasing

cyware Jan 31, 2023 Trends, Reports, Analysis

The COVID-19 pandemic incentivized the use of virtual platforms for students to attend school remotely, which broadened the attack surface and presented a goldmine of sensitive information belonging to educators and students.

Cybercriminals Impersonate LockBit to Target SMBs in Northern Europe

cyware Jan 31, 2023 Malware and Vulnerabilities

In the wake of a significant rise in ransomware attacks, especially by the Lockbit locker group, a cybercriminals group was spotted targeting SMBs in Belgium and extorting by impersonating Lockbit. The incident highlights the threat of outdated software and systems, as extortion practices become increasingly popular even among less sophisticated criminals.

Hackers Use TrickGate Software to Deploy Emotet, REvil, Other Malware

cyware Jan 31, 2023 Malware and Vulnerabilities

A malicious live software service named TrickGate has been used by numerous threat actors to bypass endpoint detection and response (EDR) protection software for over six years.

How the Silk Road Affair Changed Law Enforcement

cyware Jan 31, 2023 Trends, Reports, Analysis

The Silk Road was the first modern dark web marketplace, an online place for anonymously buying and selling illegal products and services using Bitcoin. Ross Ulbricht created The Silk Road in 2011 and operated it until 2013 when the FBI shut it down.

Update: GitHub revokes code signing certificates stolen in repo hack

cyware Jan 31, 2023 Incident Response, Learnings

GitHub says unknown attackers have stolen encrypted code-signing certificates for its Desktop and Atom applications after gaining access to some of its development and release planning repositories.

Software's 'intangible' nature raises insurance concerns in court ruling

cyware Jan 31, 2023 Incident Response, Learnings

Seven Ohio justices unanimously ruled in the favor of Owners Insurance Company in a case filed against the insurer by EMOI, a medical billing software vendor in the healthcare space.

New PlugX Sample Uses Sneaky Methods, can Impact Air-gapped Systems

cyware Jan 31, 2023 Malware and Vulnerabilities

A new strain of the PlugX malware was found, which can hide malicious files on detachable USB drives and infect the Windows hosts they are connected to. The technique is stealthy and can impact air-gapped systems. Organizations are suggested to have in-depth and multi-layered security defense to protect all end-points.

New Report Reveals NikoWiper Malware That Targeted Ukraine Energy Sector

cyware Jan 31, 2023 Malware and Vulnerabilities

"The NikoWiper is based on SDelete, a command line utility from Microsoft that is used for securely deleting files," cybersecurity company ESET revealed in its latest APT Activity Report shared with The Hacker News.

Ukraine Targeted via New Waves of Data Wipers, Including SwiftSlicer

cyware Jan 31, 2023 Malware and Vulnerabilities

A lot has happened on the cyber front in Ukraine and Russia ever since the war began. Joining the bandwagon, on the behalf of Russian Sandworm APT, is a pack of five wiper malware, including the new Golang-based SwiftSlicer. The new wiper has been added to the VirusTotal database recently (submitted on January show more ...

26). Organizations are suggested to stay vigilant and implement an in-depth security strategy to keep their digital infrastructure protected.

Denial-of-Service Vulnerability Patched in Open5GS GTP Library

cyware Jan 31, 2023 Malware and Vulnerabilities

Due to insufficient length validation in the Open5GS GTP library when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol payload with any extension header length set to zero causes an infinite loop.

Ransomware Attack on Indianapolis Housing Agency Leaks Sensitive Info on 200,000 Residents

cyware Jan 31, 2023 Breaches and Incidents

Security experts were hired to investigate the incident and it was revealed that names, addresses, dates of birth, and Social Security numbers were leaked during the attack.

Pro-Palestine Hackers Threaten Israeli Chemical Companies

cyware Jan 31, 2023 Breaches and Incidents

A group, named Electronic Quds Force, is threatening companies’ engineers and workers and is inviting them to resign from their positions. The attacks are retaliation against the Israeli government and its policy against Palestinians.

Russia blocks access to US ‘Rewards for Justice,’ FBI and CIA websites

cyware Jan 31, 2023 Geopolitical, Terrorism

Russian telecommunications regulator Roskomnadzor blocked access to the U.S. State Department’s Rewards for Justice website on Friday, alongside the sites for the Central Intelligence Agency and the Federal Bureau of Investigation.

Cybercrime job ads on the dark web pay up to $20k per month

cyware Jan 31, 2023 Trends, Reports, Analysis

Cybercrime groups are increasingly running their operations as a business, promoting jobs on the dark web that offer developers and hackers competitive monthly salaries, paid time off, and paid sick leaves.

Guardz Emerges From Stealth Mode With $10 Million in Funding

cyware Jan 31, 2023 Companies to Watch

Guardz today emerged from stealth mode with $10 million raised in a seed funding round led by Hanaco Ventures, with additional investment from iAngels, Cyverse Capital, and GKFF Ventures.

New GOOTLOADER Variant Evolves Further with New Obfuscation Tricks

cyware Jan 31, 2023 Malware and Vulnerabilities

The UNC2565 hacker group appears to have restructured its GOOTLOADER (or Gootkit) malware by adding new components and implementing new obfuscation techniques. Gootkit is used by adversaries to drop additional malicious payloads, such as SunCrypt, REvil (Sodinokibi) ransomware, Kronos trojan, and Cobalt Strike, on compromised systems.

KeePass disputes vulnerability allowing stealthy password theft

cyware Jan 31, 2023 Malware and Vulnerabilities

The development team behind the open-source password management software KeePass is disputing what is described as a newly found vulnerability that allows attackers to stealthily export the entire database in plain text.

Saviynt Raises $205M; Founder Rejoins as CEO

cyware Jan 31, 2023 Companies to Watch

The latest funding brings the total raised by the California company to $375 million and provides a growth-mode runway for Saviynt to establish a foothold in a very competitive marketplace.

HHS, AHA Warn of Surge in Russian DDoS Attacks on US Healthcare Sector Entities

cyware Jan 31, 2023 Threat Intel & Info Sharing

U.S. government and industry authorities are warning the healthcare sector of a surge in distributed denial-of-service attacks in recent days against hospitals and other medical entities instigated by Russian nuisance hacking group KillNet.

GitHub Says Hackers Cloned Code-Signing Certificates In Breached Repository

packetstormsecurity Jan 31, 2023 headline,hacker,microsoft,data loss,cryp

U.S. Stops Granting Export Licenses For China's Huawei

packetstormsecurity Jan 31, 2023 headline,usa,china,cyberwar,backdoor,gov

Chromebook SH1MMER Exploit Promises Admin Jailbreak

packetstormsecurity Jan 31, 2023 headline,flaw,google,chrome

KeePass Disputes Report Of Flaw That Could Exfiltrate A Database

packetstormsecurity Jan 31, 2023 headline,database,flaw,password

South Korea Makes Crypto Crackdown A National Justice Priority

packetstormsecurity Jan 31, 2023 headline,government,korea,cryptography