Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Common social engine ...

 Business

In todays post, we discuss some social engineering tricks commonly employed by cybercriminals to attack companies. Coming up: several variants of a scam involving calls and emails from fake tech support; business email compromise attacks; requests for data from bogus law enforcement agencies… Hello, Im from tech   show more ...  

support A classic social engineering scheme is a call to a company employee from technical support. For example, hackers might call on a weekend and say something like: Hello, this is your companys technical support service. Weve detected strange activity on your work computer. You need to come to the office right away so we can figure out what it is. Of course, not many folks want to go to the office on a weekend, so the tech support guy reluctantly agrees, as a one-off, to break company protocol and sort out the issue remotely. But to do this theyll need the employees login credentials. You can guess the rest. Theres a variation on this scheme that became widespread during the mass migration over to remote working during the pandemic. The fake tech support notices suspicious activity on the victims laptop used for working from home, and suggests solving the problem using a remote connection, via a RAT. Again, the outcome is fairly predictable. Confirm, confirm, confirm Lets continue the topic of fake tech support. An interesting technique was spotted during the attack on Uber in the fall of 2022, when an 18-year-old hacker managed to compromise a number of the companys systems. The attack began with the criminal obtaining an Uber contractors personal login details from the dark web. However, to gain access to the companys internal systems, there was still the small matter of getting past multifactor authentication And this is where the social engineering came in. Through numerous login attempts, the hacker spammed the unfortunate contractor with authentication requests, then messaged the contractor on WhatsApp under the guise of technical support with a proposed solution to the problem: to stop the flow of spam, just confirm one. Thus, the final obstacle into Ubers network was removed. Its the CEO here. I need a money transfer this minute! Lets return to a classic again: next in line is a type of attack called an business email compromise (BEC) attack. The idea behind it is to somehow initiate correspondence with company employees, typically posing as a manager or an important business partner. Typically, the purpose of the correspondence is to get the victim to transfer money to an account specified by the scammers. Meanwhile, the attack scenarios can vary: if the criminals are more interested in infiltrating the companys internal network, they might send the victim a malicious attachment which absolutely needs to be opened. One way or another, all BEC attacks revolve around email compromise; but thats the technical aspect. A far greater role is played by the element of social engineering. Whereas most scam emails targeting regular users provoke nothing but mirth, BEC operations involve people with experience of large companies who are able to write plausible business emails and persuade the recipients to do what the criminals want. Where did we leave off? Its worth noting separately a specific BEC attack technique that has become very popular among cybercriminals in recent years. Known as conversation hijacking, the scheme allows attackers to insert themselves into existing business correspondence by impersonating one of the participants. Generally, neither account hacking nor technical tricks are used to disguise the sender — all the attackers need is to get hold of a real email and create a lookalike domain. This way they automatically gain the trust of all other participants, allowing them to gently steer the conversation in the direction they want. To perform this type of attack, cybercriminals often buy databases of stolen or leaked email correspondence on the dark web. The attack scenarios can vary. Use of phishing or malware isnt ruled out. But as per the classic scheme, hackers usually try to hijack conversations that relate directly to money, preferably large amounts, dropping their bank details in at the opportune moment, and then taking off with the loot to a tropical island. A prime example of conversation hijacking is what happened during the transfer of soccer player Leandro Paredes. Cybercriminals slipped into the email exchange under the guise of a representative of Paredes debut club, Boca Juniors, which was entitled to a small percentage of the transfer fee — amounting to €520 000, which the scammers pocketed for themselves. Hand over your data, this is the police A recent trend, which seems to have appeared in 2022, is for hackers to make official requests for data when harvesting information in preparation for attacks on users of online services. Such requests have been received by US-based ISPs, social networks and tech companies from hacked email accounts belonging to law enforcement agencies. A bit of context would be useful here. Under normal circumstances, to obtain data from service providers in the United States requires a writ signed by a judge. However, in situations where human life or health is endangered, an Emergency Data Request (EDR) can be issued. But whereas in the case of normal data requests there are simple and understandable verification procedures in place, for EDRs theres currently nothing of the sort. Therefore, its highly likely that such a request would be granted if it looks plausible and seemingly came from a law enforcement agency. In this way, hackers can get information about victims from a reliable source and use it for further attacks. How to guard against social engineering attacks The target in all the above attack methods is not a soulless lump of hardware, but a human being. So, to tighten corporate defenses against social engineering attacks, the focus must be on people. This means teaching employees the basics of cybersecurity to increase their security awareness, and explaining how to counteract various types of attacks. A great way to do this is through our interactive training solution Kaspersky Automated Security Awareness Platform.

image for Russian Cybersecurit ...

 Ne'er-Do-Well News

Nikita Kislitsin, formerly the head of network security for one of Russia’s top cybersecurity firms, was arrested last week in Kazakhstan in response to 10-year-old hacking charges from the U.S. Department of Justice. Experts say Kislitsin’s prosecution could soon put the Kazakhstan government in a sticky   show more ...  

diplomatic position, as the Kremlin is already signaling that it intends to block his extradition to the United States. Nikita Kislitsin, at a security conference in Russia. Kislitsin is accused of hacking into the now-defunct social networking site Formspring in 2012, and conspiring with another Russian man convicted of stealing tens of millions of usernames and passwords from LinkedIn and Dropbox that same year. In March 2020, the DOJ unsealed two criminal hacking indictments against Kislitsin, who was then head of security at Group-IB, a cybersecurity company that was founded in Russia in 2003 and operated there for more than a decade before relocating to Singapore. Prosecutors in Northern California indicted Kislitsin in 2014 for his alleged role in stealing account data from Formspring. Kislitsin also was indicted in Nevada in 2013, but the Nevada indictment does not name his alleged victim(s) in that case. However, documents unsealed in the California case indicate Kislitsin allegedly conspired with Yevgeniy Nikulin, a Russian man convicted in 2020 of stealing 117 million usernames and passwords from Dropbox, Formspring and LinkedIn in 2012. Nikulin is currently serving a seven-year sentence in the U.S. prison system. As first reported by Cyberscoop in 2020, a trial brief in the California investigation identified Nikulin, Kislitsin and two alleged cybercriminals — Oleg Tolstikh and Oleksandr Vitalyevich Ieremenko — as being present during a 2012 meeting at a Moscow hotel, where participants allegedly discussed starting an internet café business. A 2010 indictment out of New Jersey accuses Ieremenko and six others with siphoning nonpublic information from the U.S. Securities & Exchange Commission (SEC) and public relations firms, and making $30 million in illegal stock trades based on the proprietary information they stole. [The U.S. Secret Service has an outstanding $1 million reward for information leading to the arrest of Ieremenko (Александр Витальевич Еременко), who allegedly went by the hacker handles “Zl0m” and “Lamarez.”] Kislitsin was hired by Group-IB in January 2013, nearly six months after the Formspring hack. Group-IB has since moved its headquarters to Singapore, and in April 2023 the company announced it had fully exited the Russian market. In a statement provided to KrebsOnSecurity, Group-IB said Mr. Kislitsin is no longer an employee, and that he now works for a Russian organization called FACCT, which stands for “Fight Against Cybercrime Technologies.” “Dmitry Volkov, co-founder and CEO, sold his stake in Group-IB’s Russia-based business to the company’s local management,” the statement reads. “The stand-alone business in Russia has been operating under the new brand FACCT ever since and will continue to operate as a separate company with no connection to Group-IB.” FACCT says on its website that it is a “Russian developer of technologies for combating cybercrime,” and that it works with clients to fight targeted attacks, data leaks, fraud, phishing and brand abuse. In a statement published online, FACCT said Kislitsin is responsible for developing its network security business, and that he remains under temporary detention in Kazakhstan “to study the basis for extradition arrest at the request of the United States.” “According to the information we have, the claims against Kislitsin are not related to his work at FACCT, but are related to a case more than 10 years ago when Nikita worked as a journalist and independent researcher,” FACCT wrote. From 2006 to 2012, Kislitsin was editor-in-chief of “Hacker,” a popular Russian-language monthly magazine that includes articles on information and network security, programming, and frequently features interviews with and articles penned by notable or wanted Russian hackers. “We are convinced that there are no legal grounds for detention on the territory of Kazakhstan,” the FACCT statement continued. “The company has hired lawyers who have been providing Nikita with all the necessary assistance since last week, and we have also sent an appeal to the Consulate General of the Russian Federation in Kazakhstan to assist in protecting our employee.” FACCT indicated that the Kremlin has already intervened in the case, and the Russian government claims Kislitsin is wanted on criminal charges in Russia and must instead be repatriated to his homeland. “The FACCT emphasizes that the announcement of Nikita Kislitsin on the wanted list in the territory of the Russian Federation became known only today, June 28, 6 days after the arrest in Kazakhstan,” FACCT wrote. “The company is monitoring developments.” The Kremlin followed a similar playbook in the case of Aleksei Burkov, a cybercriminal who long operated two of Russia’s most exclusive underground hacking forums. Burkov was arrested in 2015 by Israeli authorities, and the Russian government fought Burkov’s extradition to the U.S. for four years — even arresting and jailing an Israeli woman on phony drug charges to force a prisoner swap. That effort ultimately failed: Burkov was sent to America, pleaded guilty, and was sentenced to nine years in prison. Alexei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Image: Andrei Shirokov / Tass via Getty Images. Arkady Bukh is a U.S. attorney who has represented dozens of accused hackers from Russia and Eastern Europe who were extradited to the United States over the years. Bukh said Moscow is likely to turn the Kislitsin case into a diplomatic time bomb for Kazakhstan, which shares an enormous border and a great deal of cultural ties with Russia. A 2009 census found that Russians make up about 24 percent of the population of Kazakhstan. “That would put Kazakhstan at a crossroads to choose between unity with Russia or going with the West,” Bukh said. “If that happens, Kazakhstan may have to make some very unpleasant decisions.” Group-IB’s exodus from Russia comes as its former founder and CEO Ilya Sachkov remains languishing in a Russian prison, awaiting a farcical trial and an inevitable conviction on charges of treason. In September 2021, the Kremlin issued treason charges against Sachkov, although it has so far refused to disclose any details about the allegations. Sachkov’s pending treason trial has been the subject of much speculation among denizens of Russian cybercrime forums, and the consensus seems to be that Sachkov and Group-IB were seen as a little too helpful to the DOJ in its various investigations involving top Russian hackers. Indeed, since its inception in 2003, Group-IB’s researchers have helped to identify, disrupt and even catch a number of high-profile Russian hackers, most of whom got busted after years of criminal hacking because they made the unforgivable mistake of stealing from their own citizens. When the indictments against Kislitsin were unsealed in 2020, Group-IB issued a lengthy statement attesting to his character and saying they would help him with his legal defense. As part of that statement, Group-IB noted that “representatives of the Group-IB company and, in particular, Kislitsin, in 2013, on their own initiative, met with employees of the US Department of Justice to inform them about the research work related to the underground, which was carried out by Kislitsin in 2012.”

image for Episode 251: Kry10 C ...

 application security

Host Paul Roberts speaks with Boyd Multerer, the CEO and founder of Kry10, which has made a secure OS for the Internet of Things. The post Episode 251: Kry10 CEO Boyd Multerer on building a secure OS for the IoT appeared first on The Security Ledger with Paul F. Roberts. Click the icon below to listen. Related   show more ...  

StoriesEpisode 250: Window Snyder of Thistle on Making IoT Security EasyForget the IoT. Meet the IoZ: our Internet of Zombie thingsSpotlight: Traceable CSO Richard Bird on Securing the API Economy

 Malware and Vulnerabilities

Security researchers have laid bare an ongoing attack campaign that specifically targets the npm ecosystem via a pair of malicious packages. Meanwhile, another researcher group reported seven malicious PyPI packages. Developers, package maintainers, and users must remain diligent in verifying the integrity and authenticity of packages before installation.

 Trends, Reports, Analysis

Submarine communication cables are a growing target for cyber-threat actors, with potential incidents capable of causing huge global internet disruption, a new report has found.

 Incident Response, Learnings

The Department of Health and Human Services on Wednesday said the HIPAA settlement with iHealth Solutions, which does business as Advantum Health, involved an investigation into the 2017 incident affecting 267 individuals.

 Govt., Critical Infrastructure

The Office of Management and Budget and the Office of the National Cyber Director released a memo outlining five cybersecurity budget priorities for federal departments and agencies for FY 2025 consistent with the National Cybersecurity Strategy.

 Incident Response, Learnings

A Russian network security specialist and former editor of Hacker magazine who is wanted by the US and Russia on cybercrime charges has been detained in Kazakhstan as the two governments seek his extradition.

 Govt., Critical Infrastructure

There are multiple discrepancies in how the European Commission allocates funds to the cyber agency, Juhan Lepassaar, the executive director of the EU Agency for Cybersecurity, said during a Tuesday parliamentary hearing evaluating allocated budgets.

 Trends, Reports, Analysis

According to the IIMD, the development of a National Cybersecurity Authority (NCA) and the planned development of a Global Cybersecurity Forum institute in the country have both affirmed Saudi Arabia's role in the field of cybersecurity.

 Malware and Vulnerabilities

Ransomware threat 8Base has been conducting double extortion attacks for over a year and its activities spiked suddenly in May and June 2023. 8Base has been connected to 67 attacks by Malwarebytes and NCC Group. Approximately 50% of the targeted victims belong to the business services, manufacturing, and construction sectors.

 Feed

A previously undocumented Windows-based information stealer called ThirdEye has been discovered in the wild with capabilities to harvest sensitive data from infected hosts. Fortinet FortiGuard Labs, which made the discovery, said it found the malware in an executable that masqueraded as a PDF file with a Russian   show more ...  

name "CMK Правила оформления больничных листов.pdf.exe," which translates to "CMK

 Feed

A critical security flaw has been disclosed in miniOrange's Social Login and Register plugin for WordPress that could enable a malicious actor to log in as any user-provided information about email address is already known. Tracked as CVE-2023-2982 (CVSS score: 9.8), the authentication bypass flaw impacts all versions of the plugin, including and prior to 7.6.4. It was addressed on June 14, 2023

 Feed

Cyber threat intelligence is an effective weapon in the ongoing battle to protect digital assets and infrastructure - especially when combined with AI. But AI is only as good as the data feeding it. Access to unique, underground sources is key. Threat Intelligence offers tremendous value to people and companies. At the same time, its ability to address organizations' cybersecurity needs and the

 Feed

The North Korea-aligned threat actor known as Andariel leveraged a previously undocumented malware called EarlyRat in attacks exploiting the Log4j Log4Shell vulnerability last year. "Andariel infects machines by executing a Log4j exploit, which, in turn, downloads further malware from the command-and-control (C2) server," Kaspersky said in a new report. Also called Silent Chollima and Stonefly,

 Feed

Android-based phone monitoring app LetMeSpy has disclosed a security breach that allowed an unauthorized third-party to steal sensitive data associated with thousands of Android users. "As a result of the attack, the criminals gained access to email addresses, telephone numbers and the content of messages collected on accounts," LetMeSpy said in an announcement on its website, noting the

 Feed

The Iranian state-sponsored group dubbed MuddyWater has been attributed to a previously unseen command-and-control (C2) framework called PhonyC2 that's been put to use by the actor since 2021. Evidence shows that the custom made, actively developed framework has been leveraged in the February 2023 attack on Technion, an Israeli research institute, cybersecurity firm Deep Instinct said in a

 Feed

Cybersecurity researchers have shared the inner workings of an Android malware family called Fluhorse. The malware "represents a significant shift as it incorporates the malicious components directly within the Flutter code," Fortinet FortiGuard Labs researcher Axelle Apvrille said in a report published last week. Fluhorse was first documented by Check Point in early May 2023, detailing its

 Data loss

UPS delivers some smishing advice (but have they kept something under wraps?), we ask ChatGPT to take a long hard look at itself, and we debate what the penalty should be for taking national secrets home with you. All this and much much more is discussed in the latest edition of the “Smashing Security” podcast by   show more ...  

cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by Host Unknown’s sole founder Thom Langford.

2023-06
Aggregator history
Thursday, June 29
THU
FRI
SAT
SUN
MON
TUE
WED
JuneJulyAugust