Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Identity theft in 19 ...

 Business

Cyberthreat researchers have of late been sounding the alarm about the rising danger of deepfakes. In particular, they advise to not trust your ears: in the digital age of artificial intelligence the voice at the other end of the line may not belong to whom you think. Speaking of which, any guesses what people were   show more ...  

afraid of more than a hundred years ago? In that mechanical age of scientific discovery, they were wary of, yes — trusting their ears. After all, the voice at the other end of the line — was it really whom they thought? Dont believe it? Then just take a look at a case of identity theft using then-sophisticated technology to steal money from a bank account depicted in a film shot back in 1915! Welcome to the world of the French silent movie series Les Vampires. Les Vampires A quick spoiler: anyone looking for supernatural blood-sucking monsters will be disappointed. The main character, journalist Philippe Guérande, confronts a daring criminal gang that calls itself the Vampires. Despite its venerable age, the film has a lot to offer in terms of information security. Take just the first scene, which illustrates why outsider access to work documents is a no-no. The Vampires themselves are of interest for their use of what were then hi-tech methods. A large chunk of episode three (The Red Codebook) is given over to cryptanalysis: Guérande looks for patterns in the villains encrypted notes. And episode 7 (Satanas) is built around an attempt to copy anothers identity. But how does anyone pull off identity theft armed only with early 20th-century tech? Identity theft in 1915 In a nutshell, the criminal scheme goes as follows. The Vampires learn that US tycoon George Baldwin is on a trip to Paris, where they decide to relieve him of some of his money. To do so, they devise a multistage attack. First, they arrange for the millionaire to be interviewed by one of their own, Lily Flower, posing as a journalist for Modern Woman magazine. She tells Baldwin that her magazine publishes a celebrity quote every month, and asks him to write a few words in a notebook, then date and sign them. Next, a saleswoman claiming to be from the Universal Phonograph Company visits the millionaire with a new piece of tech wizardry: an actual phonograph — the first device for recording and reproducing sound. She explains to Baldwin that its her companys policy to record the voices of famous people visiting Paris. Falling for the ruse, he dictates the only phrase he can pronounce in French: Parisian women are the most charming Ive ever seen, adding All right! in English at the end. The full nature of the scam is then revealed to the viewer. The purpose of the first stage was, of course, to steal the tycoons signature. Under the sheet on which Baldwin left his autograph was some sort of carbon paper, which duly captured the signature and date. Above this, the criminals write out a fake order obliging New American Bank to pay Lily (the journalist) the sum of US$100 000 (a princely sum today; imagine its value a century ago!). Next, they kidnap the telephone operator of Baldwins hotel, and send another accomplice in her place with a note: Im sick, sending my cousin as a replacement. The hotel management swallows this primitive trick and puts the total stranger in charge of the phone. Meanwhile, Lily goes to the bank with the fake payment order. The cashier decides to check the legitimacy of the transaction and calls the hotel where Baldwin is staying. There, the bogus telephone operator plays the recording of the millionaire uttering his catchphrase, which convinces the cashier to pay out. How feasible is this scheme? Most of it is utter twaddle, of course. How on earth would a Parisian cashier at a U.S. bank in 1915 know the signature, let alone the voice, of some American millionaire? Not to mention the fact that the phone lines back then would likely have distorted that voice beyond recognition. That said, the scheme itself is a classic implementation of a man-in-the-middle (MitM) attack — the cashier is sure the voice belonged to Baldwin, who in turn thinks that he, earlier, provided it to the phonograph company. Whats more, the movie features a 2FA bypass: signature theft and fake voice confirmation. Sure, all this is now done using digital technologies, but the core attack scenario remains the same. As such, the main countermeasures could have been formulated over a century ago: Dont give outsiders access to communication channels (bogus telephone operator). Do not share confidential personal data with anyone — ever (signature and voice biometrics). If in doubt, carefully double-check the legitimacy of the instruction (the phrase Parisian women are the most charming Ive ever seen is not the most cast-iron verification). Today, you can check out this wonderful movie series for yourself on Wikipedia. If, however, your employees arent ready to take cybersecurity tips from silent cinema, we recommend using our interactive Kaspersky Automated Security Awareness Platform instead.

 Trends, Reports, Analysis

Financial Conduct Authority (FCA) CEO, Nikhil Rathi, said in a speech delivered at the offices of The Economist this week, “We will remain super vigilant on how firms mitigate cyber-risks and fraud given the likelihood that these will rise.”

 Govt., Critical Infrastructure

The move follows urgent calls for the FCC to update its E-rate program to cover advanced firewalls and other network security measures. The pilot program is part of FCC Chairwoman Jessica Rosenworcel’s Learn Without Limits initiative.

 Trends, Reports, Analysis

Facebook and Microsoft’s collective dominance as the most spoofed brands continued into H1 2023, with the former accounting for 18% of all phishing URLs and the latter accounting for 15%, according to Vade.

 Computer, Internet Security

In what is shaping up to be a widespread privacy controversy, Spotify has come under scrutiny following allegations by users that the music streaming service made their private playlists public without their consent.

 Companies to Watch

Led by Lightspeed, the new round saw participation from existing investors Endiya Partners, Kalaari Capital, and MassMutual Ventures. Zluri helps organizations manage SaaS apps, mitigate security risks, and optimize costs, from a single dashboard.

 Malware and Vulnerabilities

A stealthy Linux malware, dubbed AVrecon, was found targeting more than 70,000 Linux-based SOHO routers at least since May 2021. It reportedly hijacked these devices to form a botnet that could steal bandwidth and provide a hidden residential proxy service. A total of 15 second-stage control servers were discovered by security researchers. It has marked its presence in more than 20 countries.

 Social Media Threats

Researchers with Veriti are warning about “over 700 domains related to Threads being registered daily” in recent weeks, offering an Android version of the app for download outside of Google’s official app store.

 Feed

Ubuntu Security Notice 6184-2 - USN-6184-1 fixed a vulnerability in CUPS. This update provides the corresponding updates for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. It was discovered that CUPS incorrectly handled certain memory operations. An attacker could possibly use this issue to cause CUPS to crash, resulting in a denial of service, or to possibly obtain sensitive information.

 Feed

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

 Feed

Debian Linux Security Advisory 5453-1 - Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks.

 Feed

Debian Linux Security Advisory 5452-1 - Multiple security issues were discovered in the GPAC multimedia framework which could result in denial of service or the execution of arbitrary code.

 Feed

The Russia-linked threat actor known as Gamaredon has been observed conducting data exfiltration activities within an hour of the initial compromise. "As a vector of primary compromise, for the most part, emails and messages in messengers (Telegram, WhatsApp, Signal) are used, in most cases, using previously compromised accounts," the Computer Emergency Response Team of Ukraine (CERT-UA) said in

 Feed

Microsoft Word documents exploiting known remote code execution flaws are being used as phishing lures to drop malware called LokiBot on compromised systems. "LokiBot, also known as Loki PWS, has been a well-known information-stealing Trojan active since 2015," Fortinet FortiGuard Labs researcher Cara Lin said. "It primarily targets Windows systems and aims to gather sensitive information from

 Feed

The hype around different security categories can make it difficult to discern features and capabilities from bias when researching new platforms. You want to advance your security measures, but what steps actually make sense for your business? For anyone ready to find an attack surface management (ASM) vendor, review these six questions before getting started to understand the key features to

 Feed

Cyber attacks using infected USB infection drives as an initial access vector have witnessed a three-fold increase in the first half of 2023,  That's according to new findings from Mandiant, which detailed two such campaigns – SOGU and SNOWYDRIVE – targeting both public and private sector entities across the world. SOGU is the "most prevalent USB-based cyber espionage attack using USB flash

 Feed

Threat actors are taking advantage of Android's WebAPK technology to trick unsuspecting users into installing malicious web apps on Android phones that are designed to capture sensitive personal information. "The attack began with victims receiving SMS messages suggesting the need to update a mobile banking application," researchers from CSIRT KNF said in an analysis released last week. "The

2023-07
Aggregator history
Monday, July 17
SAT
SUN
MON
TUE
WED
THU
FRI
JulyAugustSeptember