Oktacron - Cyber Security RSS Feeds History

Spies on wheels: how carmakers collect and then resell information | Kaspersky official blog

kaspersky Oct 18, 2023 Threats

Guess which of your possessions is the most active at collecting your personal information for analysis and resale? Your car. According to experts at the Mozilla Foundation, neither smart watches, smart speakers, surveillance cameras, nor any other gadgets analyzed by the Privacy Not Included project come close to the show more ...

data collection volumes of modern automobiles. This project involves experts examining user agreements and privacy policies to understand how devices use owners personal data. For the first time in the projects history, absolutely all (25 out of 25) reviewed car brands received a red card for unacceptably extensive collection of personal information, lack of transparency in its use, poorly documented data transmission and storage practices (for example, its not known whether encryption is used). Even worse, 19 out of 25 brands officially state that they can resell the information they collect. The icing on the cake of such privacy violations is that car owners have almost no ability to opt out of data collection and transmission: only two brands, Renault and Dacia, offer owners the right to delete collected personal data; however, its not so easy to even figure out if you should exercise this right. Buried deep within the license agreements that car buyers usually accept without even reading, there are utterly outrageous violations of privacy rights. For example, the owners consent to share their sexual preferences and genetic information (Nissan), disclosure of information upon informal requests from law enforcement agencies (Hyundai), and collection of data on stress levels — all in addition to 160 other data categories with deliberately vague names such as demographic information, images, payment information, geolocation, and so on. The worst brand of all in the ratings was Tesla, which earned, in addition to all the other possible penalty points, a special label: Untrustworthy AI. How cars collect information Modern cars are literally crammed with sensors — ranging from engine and chassis sensors that measure things like engine temperature, steering wheel angle, or tire pressure, to more interesting ones such as perimeter and interior cameras, microphones, and hand presence sensors on the steering wheel. All of them are connected on a single bus, so the cars main computer centrally receives all this information. In addition, all modern cars are equipped with GPS and cellular communication, Bluetooth, and Wi-Fi modules. The presence of cellular communications and GPS in many countries is dictated by the law (to automatically call for help in an accident), but manufacturers happily use this function for the convenience of both the driver – and themselves. You can plan routes on the cars screen, remotely diagnose malfunctions, start the car in advance And of course, the sensors and cameras -> car computer -> cellular network bridge creates a constant channel for information collection: where youre going, where and for how long you park, how sharply you turn the steering wheel and accelerate, whether you use seat belts, and so on. More information is collected from the drivers smartphone when its connected to the cars onboard system to make calls, listen to music, navigate, and so on. And if the smartphone is equipped with a mobile app from the car manufacturer for controlling car functions, data can be collected even when the driver is not in the car. In turn, information about passengers can be collected through cameras, microphones, Wi-Fi hotspots, and Bluetooth functions. With these, its easy to find out who regularly travels in the car with the driver, when and where they get in and out, what smartphone they use, and so on. Why do car manufacturers need this information? To earn more money. Apart from analysis for improving the quality of products and services, the data can be resold, and car features can be adapted for greater profit for the manufacturer. For example, insurance companies buy information about a particular drivers driving style to more accurately predict the likelihood of accidents and adjust insurance costs. As early as 2020, 62% of cars were equipped with this controversial function right at the factory, and this figure is expected to rise to 91% by 2025. Marketing companies are also eager to use such data to target advertising based on the owners income, marital status, and social status. But even without reselling personal data, there are many other unpleasant monetization scenarios, such as enabling or disabling additional car functions through subscriptions, as BMW tried unsuccessfully to do with heated seats, or selling expensive cars on credit with forced vehicle lockdown in case of payment default. What else is wrong with data collection and telematics? Even if you think theres nothing wrong with ads and theres nothing interesting they could learn about me, consider the additional risks you and your car are exposed to due to the technologies described above. Data leaks. Manufacturers actively collect your information and store it permanently — without sufficient protection. Just recently, Toyota admitted to leaking 10 years of data — all collected from millions of cloud-enabled vehicles. Audi had information on 3.3 million customers leaked. Other car manufacturers have also been victims of data breaches and cyberattacks. If this much personal data falls into the hands of real criminals and fraudsters, not just marketers, it could spell disaster. Theft. Back in 2014, we explored the possibility of stealing a vehicle via cloud functions. Since 2015, it has become clear that criminals remotely taking over a car is not some futuristic fantasy, but a harsh reality. Car thefts in recent years often exploit the remote relaying of signals from a legitimate key fob, but last years epidemic of KIA and Hyundai TikTok hijackings was based on the cars smart functions and only required the thief to insert a USB drive. Surveillance of relatives. When the car does not belong to you, but to a relative or employer, the owner can track the cars location, set geographical limits for its use, set speed limits and permitted driving times, and even control the volume of the audio system! Many car brands, such as Volkswagen and BMW, offer such features. As we know from our stalkerware research and the recent AirTag tracking scandals, such capabilities are simply crying out to be abused. How to reduce risks? Due to the scale of the problem, there are no simple solutions. Therefore, here are some mitigation options in descending order of radicality: Walk or ride a bicycle. Buy an old car model. Almost all cars manufactured before 2012 have very limited data collection and transmission capabilities. Buy a car with a minimal set of smart sensors and/or no communication module. Some manufacturers offer basic configurations with limited capabilities, but this requires carefully reading the user manual. The absence of a dedicated communication module (GSM/3G/4G) in the car is a reliable sign of its limited capabilities. Note that more and more cars come with smart features even in basic configurations (this path has already been paved by Smart TVs — they make money by collecting and selling data). Dont install the cars mobile app on your phone. Of course, starting the car from your smartphone or warming it up before you get in is often convenient, but is it necessary to pay for these features with deeply personal information — in addition to the money you spend? Very debatable. Dont activate Apples CarPlay or Android Auto pairing functions. When these functions are activated, the smartphone OS manufacturer gets all kinds of information from the car, and the car, in turn, retrieves information from the phone. Dont connect the car to your phone over Bluetooth or Wi-Fi. This way, again, you lose some functionality, but at least the car wont send information to the manufacturer through the phone, and nor will it download the phones address book and other personal data. You can compromise by establishing a Bluetooth connection only for headset and headphones protocols: youll be able to play music from your phone through the car speakers, but the transmission of other data types (such as the address book) wont be available. A bonus tip, which doesnt exclude the previous ones: Mozilla suggests signing a collective petition to car manufacturers, urging them to change their business model and stop making money by spying on customers. Power to the petitioning people!

The Fake Browser Update Scam Gets a Makeover

krebsonsecurity Oct 18, 2023 A Little Sunshine

One of the oldest malware tricks in the book — hacked websites claiming visitors need to update their Web browser before they can view any content — has roared back to life in the past few months. New research shows the attackers behind one such scheme have developed an ingenious way of keeping their show more ...

malware from being taken down by security experts or law enforcement: By hosting the malicious files on a decentralized, anonymous cryptocurrency blockchain. In August 2023, security researcher Randy McEoin blogged about a scam he dubbed ClearFake, which uses hacked WordPress sites to serve visitors with a page that claims you need to update your browser before you can view the content. The fake browser alerts are specific to the browser you’re using, so if you’re surfing the Web with Chrome, for example, you’ll get a Chrome update prompt. Those who are fooled into clicking the update button will have a malicious file dropped on their system that tries to install an information stealing trojan. Earlier this month, researchers at the Tel Aviv-based security firm Guardio said they tracked an updated version of the ClearFake scam that included an important evolution. Previously, the group had stored its malicious update files on Cloudflare, Guardio said. But when Cloudflare blocked those accounts the attackers began storing their malicious files as cryptocurrency transactions in the Binance Smart Chain (BSC), a technology designed to run decentralized apps and “smart contracts,” or coded agreements that execute actions automatically when certain conditions are met. Nati Tal, head of security at Guardio Labs, the research unit at Guardio, said the malicious scripts stitched into hacked WordPress sites will create a new smart contract on the BSC Blockchain, starting with a unique, attacker-controlled blockchain address and a set of instructions that defines the contract’s functions and structure. When that contract is queried by a compromised website, it will return an obfuscated and malicious payload. “These contracts offer innovative ways to build applications and processes,” Tal wrote along with his Guardio colleague Oleg Zaytsev. “Due to the publicly accessible and unchangeable nature of the blockchain, code can be hosted ‘on-chain’ without the ability for a takedown.” Tal said hosting malicious files on the Binance Smart Chain is ideal for attackers because retrieving the malicious contract is a cost-free operation that was originally designed for the purpose of debugging contract execution issues without any real-world impact. “So you get a free, untracked, and robust way to get your data (the malicious payload) without leaving traces,” Tal said. Attacker-controlled BSC addresses — from funding, contract creation, and ongoing code updates. Image: Guardio In response to questions from KrebsOnSecurity, the BNB Smart Chain (BSC) said its team is aware of the malware abusing its blockchain, and is actively addressing the issue. The company said all addresses associated with the spread of the malware have been blacklisted, and that its technicians had developed a model to detect future smart contracts that use similar methods to host malicious scripts. “This model is designed to proactively identify and mitigate potential threats before they can cause harm,” BNB Smart Chain wrote. “The team is committed to ongoing monitoring of addresses that are involved in spreading malware scripts on the BSC. To enhance their efforts, the tech team is working on linking identified addresses that spread malicious scripts to centralized KYC [Know Your Customer] information, when possible.” Guardio says the crooks behind the BSC malware scheme are using the same malicious code as the attackers that McEoin wrote about in August, and are likely the same group. But a report published today by email security firm Proofpoint says the company is currently tracking at least four distinct threat actor groups that use fake browser updates to distribute malware. Proofpoint notes that the core group behind the fake browser update scheme has been using this technique to spread malware for the past five years, primarily because the approach still works well. “Fake browser update lures are effective because threat actors are using an end-user’s security training against them,” Proofpoint’s Dusty Miller wrote. “In security awareness training, users are told to only accept updates or click on links from known and trusted sites, or individuals, and to verify sites are legitimate. The fake browser updates abuse this training because they compromise trusted sites and use JavaScript requests to quietly make checks in the background and overwrite the existing website with a browser update lure. To an end user, it still appears to be the same website they were intending to visit and is now asking them to update their browser.” More than a decade ago, this site published Krebs’s Three Rules for Online Safety, of which Rule #1 was, “If you didn’t go looking for it, don’t install it.” It’s nice to know that this technology-agnostic approach to online safety remains just as relevant today.

What CISOs Should Exclude From SEC Cybersecurity Filings

darkreading Oct 18, 2023 Feed

Should CISOs include only known information in the SEC filings for a material security incident, or is there room to include details that may change during the investigation?

Pro-Iranian Hacktivists Set Sights on Israeli Industrial Control Systems

darkreading Oct 18, 2023 Feed

The hacktivists known as SiegedSec identify ICS targets, but there's no evidence of attacks yet.

EPA Turns Off Taps on Water Utility Cyber Regulations

darkreading Oct 18, 2023 Feed

Facing a potential cascade of legal challenges from industry groups and state attorneys general, the EPA has rescinded its cyber-rules. But where does that leave local water safety?

Data Security and Collaboration in the Modern Enterprise

darkreading Oct 18, 2023 Feed

The CISO Survival Guide explores the complex and shifting challenges, perceptions, and innovations that will shape how organizations securely expand in the future.

Jupyter Notebook Ripe for Cloud Credential Theft, Researchers Warn

darkreading Oct 18, 2023 Feed

If not correctly locked down, Jupyter Notebook offers a novel initial access vector that hackers can use to compromise enterprise cloud environments, as seen in a recent hacking incident.

Critical Citrix Bug Exploited as a Zero-Day, 'Patching Is Not Enough'

darkreading Oct 18, 2023 Feed

The latest threat to Citrix NetScaler, CVE-2023-4966, was exploited as a zero-day bug for months before a patch was issued. Researchers expect exploitation efforts to surge.

Open Source Security Agents Promise Greater Simplicity, Flexibility

darkreading Oct 18, 2023 Feed

Endpoint management based on open source agents, such as osquery, could simplify IT management and security, while giving larger firms more customization options.

The Need for a Cybersecurity-Centric Business Culture

darkreading Oct 18, 2023 Feed

Building a culture of cybersecurity is achievable by acknowledging its importance and consistently reinforcing that message.

D-Link Confirms Breach, Rebuts Hacker's Claims About Scope

darkreading Oct 18, 2023 Feed

The router specialist says the attacker's claims to have heisted millions and millions of records are significantly overblown. But an incident did happen, stemming from a successful phish.

North Korea's Kimsuky Doubles Down on Remote Desktop Control

darkreading Oct 18, 2023 Feed

The sophisticated APT employs various tactics to abuse Windows and other built-in protocols with both custom and public malware to take over victim systems.

OCP Launches SAFE to Standardize Firmware Audits

darkreading Oct 18, 2023 Feed

Under the Security Appraisal Framework and Enablement (SAFE) program, device manufacturers would be able to work with approved auditors to verify firmware.

Israeli Cybersecurity Startups: Impact of a Growing Conflict

darkreading Oct 18, 2023 Feed

For Israeli startups and those closely linked to the country, the deepening crisis in the Middle East following the deadly Hamas attacks of Oct. 7 pose a fraught mix of complications.

FBI: Hackers Are Extorting Plastic Surgery Providers, Patients

darkreading Oct 18, 2023 Feed

The sensitive nature of medical records, combined with providers' focus on patient care, make small doctor's offices ideal targets for cyber extortion.

The Most Popular IT Admin Password Is Totally Depressing

darkreading Oct 18, 2023 Feed

Analysis of more than 1.8 million admin portals reveals IT leaders, with the highest privileges, are just as lazy about passwords as everyone else.

Prove Identity Nabs $40M to Expand in Mobile-Based Authentication Tech

cyware Oct 18, 2023 Companies to Watch

Prove Identity, the smartphone-based identity verification startup formerly known as Payfone, has raised $40 million in funding co-led by MassMutual Ventures and Capital One Ventures.

Update: IBM Says 631K Affected in Johnson & Johnson Database Breach

cyware Oct 18, 2023 Breaches and Incidents

Two federal class action lawsuits have been filed against IBM and Johnson & Johnson, alleging negligence in protecting sensitive health information and seeking financial damages and improved data security practices.

Malicious Version of RedAlert Rocket Alert App Used to Spy on Israel

cyware Oct 18, 2023 Breaches and Incidents

Hackers are targeting Israeli Android users by distributing a malicious version of the popular RedAlert – Rocket Alerts app, which acts as spyware and collects sensitive data from victims. To tackle the current threat, Android users are advised to avoid using internet URLs or third-party app stores to download the app.

New Admin Takeover Vulnerability Exposed in Synology's DiskStation Manager

cyware Oct 18, 2023 Malware and Vulnerabilities

The vulnerability stems from the use of the insecure randomness of the JavaScript Math.random() method, which can be exploited to predict and access restricted functionality.

FBI Warns of Extortion Groups Targeting Plastic Surgery Offices

cyware Oct 18, 2023 Threat Intel & Info Sharing

The FBI has issued a warning about cybercriminals targeting plastic surgery offices through phishing attacks. These attackers gain access to the networks and steal sensitive data, including personal information and medical records.

Report: Only a Third of Organizations Prepared to Comply with NIS2 Directive

cyware Oct 18, 2023 Trends, Reports, Analysis

Just 34% of organizations in the UK, France, and Germany are prepared for the EU's updated Network and Information Security Directive (NIS2), according to a survey by cybersecurity firm Sailpoint.

BLOODALCHEMY Provides Backdoor to Southeast Asian Nations' Secrets

cyware Oct 18, 2023 Malware and Vulnerabilities

Security researchers have discovered a backdoor called BLOODALCHEMY that is part of the REF5961 intrusion set, believed to be linked to a group with ties to China, targeting governments and organizations in the ASEAN region.

Federal Agencies are Falling Behind on Meeting Key Privacy Goal Set Five Years Ago

cyware Oct 18, 2023 Govt., Critical Infrastructure

The slow progress in implementing privacy requirements and the lack of resources and guidance for emerging technologies pose significant challenges for the government in addressing privacy risks.

Malvertising Campaign Uses Fake Notepad++ Ads on Google

cyware Oct 18, 2023 Malware and Vulnerabilities

The campaign involves malicious ads that redirect users to a fake Notepad++ website, where a system fingerprinting process takes place. If the user passes the checks, they are assigned a unique ID and given a time-sensitive download link.

Users of Telegram, AWS, and Alibaba Cloud Targeted in Latest Supply Chain Attack

cyware Oct 18, 2023 Breaches and Incidents

Attackers are using Starjacking and Typosquatting techniques to inject malicious code into open-source projects, compromising developers' systems and stealing sensitive data.

OpenSSF Launches Malicious Packages Repository

cyware Oct 18, 2023 Security Culture

The Malicious Packages Repository, which has already collected over 15,000 reports, provides a centralized database for shared intelligence, enabling early detection and prevention of malicious code in open-source projects.

AIDS Alabama Takes Swift Action After Massive Data Breach

cyware Oct 18, 2023 Breaches and Incidents

AIDS Alabama has confirmed a data breach that occurred between October 2021 and August 2022. Sensitive personal information such as names, addresses, Social Security numbers, medical diagnoses, and more were compromised.

Qubitstrike Targets Jupyter Notebooks with Cryptomining and Rootkit Campaign

cyware Oct 18, 2023 Breaches and Incidents

The threat actor behind Qubitstrike, likely from Tunisia, employs sophisticated techniques to evade detection and exploit cloud services, with the potential for carrying out various attacks on compromised systems.

Five Eyes Intelligence Chiefs Warn of ‘Sharp Rise’ in Commercial Espionage

cyware Oct 18, 2023 Trends, Reports, Analysis

The intelligence alliance emphasizes the importance of adopting security measures to protect staff and information in order to safeguard competitive advantage and shape the future of emerging technologies.

ELITEWOLF: NSA's Repository of Signatures and Analytics to Secure OT Environments

cyware Oct 18, 2023 Govt., Critical Infrastructure

The NSA has released a new tool called ELITEWOLF to help defend critical infrastructure against cyber threats. It is a repository of Intrusion Detection Signatures and Analytics that can detect potentially malicious activity in OT environments.

Amazon Adds Passkey Support as New Passwordless Login Option

cyware Oct 18, 2023 Security Products & Services

Amazon has added passkey support as a passwordless login option, offering better protection against malware and phishing attacks. Passkeys make it easier for users to log in without the need for password managers or memorizing passwords.

Chilean Government Warns of Black Basta Ransomware Attacks After Customs Incident

cyware Oct 18, 2023 Breaches and Incidents

The country's Computer Security Incident Response Team (CSIRT) confirmed the attack and urged all government agencies to take preventive measures, such as protecting backup copies of systems and limiting administrative permissions.

ClearFake Enters the Fake Browser Update Arena to Deliver Malware

cyware Oct 18, 2023 Breaches and Incidents

SEKOIA identified a threat called ClearFake that uses compromised WordPress sites to distribute malicious fake browser updates. This threat is likely operated by the same group behind SocGholish. It is to be noted that SocGholish operators had successfully leveraged this technique in 2022, which indicates that the show more ...

same threat group is likely behind the new ClearFake malware. The IOCs associated with the threat have been made available to understand attackers’ infrastructure, attack pattern, and their activities.

D-Link Confirms Data Breach: Employee Falls Victim to Phishing Attack

cyware Oct 18, 2023 Breaches and Incidents

The breach occurred through an old D-View 6 system that reached its end of life in 2015. The compromised data was used for registration purposes and does not contain user IDs or financial information.

Critical Citrix NetScaler Flaw Exploited to Target from Government, Tech Firms

cyware Oct 18, 2023 Malware and Vulnerabilities

A critical security flaw in Citrix NetScaler ADC and Gateway appliances (CVE-2023-4966) is being actively exploited, potentially allowing hijacking of authenticated sessions and bypassing multi-factor authentication.

Oracle Patches 185 Vulnerabilities With October 2023 CPU

cyware Oct 18, 2023 Malware and Vulnerabilities

Oracle has released 387 new security patches to address vulnerabilities in its own code and third-party components, with over 40 patches addressing critical severity flaws.

Fraud Prevention Firm Fingerprint Raises $33 Million

cyware Oct 18, 2023 Companies to Watch

The fraud prevention provider's $33 million Series C funding round brings the total raised by the company to $77 million. The new investment round was led by Nexus Venture Partners, with additional funding from Uncorrelated Ventures.

Report: Over 40,000 Admin Portal Accounts Use ‘admin’ as a Password

cyware Oct 18, 2023 Trends, Reports, Analysis

IT administrators are putting enterprise networks at risk by using weak passwords, including default passwords, leaving them vulnerable to cyberattacks, as per a new report by Outpost24.

Delete-Your-Data Laws Have a Perennial Problem: Data Brokers Who Fail to Register

cyware Oct 18, 2023 Expert Blogs and Opinion

The number of registered data brokers in states with operative registries does not accurately reflect the size and reach of the industry, raising concerns about non-compliance.

Getting RCE In Chrome With Incomplete Object Initialization In The Maglev Compiler

packetstormsecurity Oct 18, 2023 headline,hacker,flaw,google,chrome

NetScaler Vulnerability Exploited As Zero Day Since August

packetstormsecurity Oct 18, 2023 headline,hacker,flaw,zero day

FBI: Cybercriminals Targeting Plastic Surgery Offices And Patients

packetstormsecurity Oct 18, 2023 headline,hacker,government,privacy,usa,c

Twitter Glitch Allows CIA Informant Channel To Be Hijacked

packetstormsecurity Oct 18, 2023 headline,government,usa,flaw,spyware,twi

Former Navy IT Manager Sentenced To Prison For Hacking, Selling PII

packetstormsecurity Oct 18, 2023 headline,hacker,government,privacy,usa,d

D-Link Clears Up Exaggerations Around Data Breach

packetstormsecurity Oct 18, 2023 headline,hacker,privacy,data loss