Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for What Is Malware, How ...

 What is

You receive an email promising a free vacation to your dream destination. All you have to do is click a link and enter your details. Sounds tempting, right? But what if that click released a digital monster onto your computer that could steal your identity, lock you out of your precious files, or even turn your webcam   show more ...  

into a live feed for prying eyes? This is the reality of malware, just waiting for an unsuspecting click. According to a recent study, 560,000 new pieces of malware are detected every day, and nearly 4,000 new cyber attacks occur every day. So, it’s very important to know what is malware, what are the types of malware, how it works, what it does, and how you can protect yourself! What Is Malware in Cyber Security? Malware, short for malicious software, is an umbrella term encompassing any software program intentionally designed to harm a computer system, network, or device. Cybercriminals, or hackers, develop malware to disrupt operations, steal sensitive information, or extort money from victims. What Are the Types of Malware? The world of malware is a diverse one, with each type having its unique way of wreaking havoc. Here's a breakdown of some of the most common types of malware: Viruses: These digital parasites attach themselves to legitimate programs or files. When the infected file is executed, the virus replicates itself and spreads to other files and systems. Viruses can corrupt data, steal information, or even render your system unusable. Worms: Similar to viruses, worms can self-replicate but exploit network vulnerabilities to spread rapidly. They don't require attaching themselves to other files and can quickly consume system resources, causing crashes and network congestion. Trojan Horses (Trojans): Deception is the name of the game for Trojans. Disguised as legitimate software (e.g., games, productivity tools), they trick users into installing them. Once inside, Trojans can have various malicious functions, including stealing data, downloading other malware, or giving attackers remote access to the infected system. Ransomware: This particularly destructive type of malware encrypts a victim's files, making them inaccessible. Hackers then demand a ransom payment, often in cryptocurrency, in exchange for a decryption key. Ransomware can target individuals, businesses, and even critical infrastructure, causing significant disruption and financial losses. Spyware: As the name suggests, spyware is designed to spy on your activities without your knowledge or consent. It can steal a wide range of sensitive information, including browsing history, login credentials, keystrokes (including passwords), and even webcam recordings. Spyware can be particularly intrusive and can be used for identity theft, financial fraud, or corporate espionage. Adware: While not as destructive as other forms of malware, adware bombards users with excessive and intrusive advertisements. These ads can be pop-ups, banners, or even redirect users to malicious websites. Adware can be bundled with free software downloads or installed through deceptive advertising practices. While primarily a nuisance, adware can also generate revenue for attackers and potentially lead to accidental clicks on malicious links. Rootkits: These stealthy malware programs burrow deep into a system's core, granting attackers privileged access and control. Rootkits are difficult to detect and remove, allowing attackers to steal data, install additional malware, or disrupt system operations. Keyloggers: These malicious programs record every keystroke you type, including passwords, credit card details, and other sensitive information. Keyloggers can be hardware-based (attached to your keyboard) or software-based and can be installed through various methods, including phishing emails or infected websites. Fileless Malware: This emerging threat leverages legitimate system functionalities to execute malicious code without relying on traditional files. Fileless malware is difficult to detect by traditional antivirus software as it doesn't leave a signature on the disk. Cryptojacking: This malware doesn't steal data directly; instead, it hijacks your system's resources (CPU, GPU) to mine cryptocurrency for the attacker's benefit. Cryptojacking can slow down your device's performance and increase energy consumption. Hybrid Malware: As the name suggests, hybrid malware combines functionalities of different types of malware. For example, a program might act as a Trojan horse, granting initial access, while also incorporating features of ransomware to encrypt files. Hybrid malware poses a complex threat due to its multifaceted nature. Why Do Cybercriminals Use Malware? The motivations behind malware attacks are as varied as the malware itself. Here are some of the most common reasons: Financial Gain: This is perhaps the most common reason. Cybercriminals leverage malware to steal sensitive financial information like credit card details, bank account numbers, and login credentials. This stolen data can be used to make unauthorized purchases, commit identity theft, or sell it on the black market. Espionage: Cybercriminals may target individuals, corporations, or government agencies with malware to steal confidential information. This stolen data could include trade secrets, intellectual property, classified documents, or personal information. This information can be used for competitive advantage, blackmail, or sold to other parties. Disruption: Some malware attacks aim to cause chaos and disrupt operations. This might be driven by hacktivists with a political agenda, disgruntled employees, or even rival companies. By launching malware attacks, they can cripple critical systems, damage reputations, and inflict financial losses. Denial-of-Service (DoS) Attacks: Malware can be used to overwhelm a system with traffic, rendering it inaccessible to legitimate users. This can disrupt online services, websites, or entire networks. DoS attacks can be used to extort money, silence critics, or simply cause havoc. Cryptojacking: A growing trend involves using malware to hijack a victim's computer resources for cryptocurrency mining. This essentially steals processing power from the infected device to generate cryptocurrency for the attacker. How Does Malware Work? Malware can infiltrate your system through various means, including: Phishing Emails: Deceptive emails disguised as legitimate sources (banks, social media platforms) trick users into clicking malicious links or downloading infected attachments. Malicious Websites: Unsecured websites or those compromised by hackers can host malware that automatically downloads onto your device when you visit them. Infected Downloads: Downloading software, music, or movies from untrusted sources can introduce malware onto your system. Vulnerable Software: Outdated software with unpatched security holes can provide an easy entry point for malware. Physical Media: In rare cases, malware can spread through infected USB drives or external hard drives. What Does Malware Do? Malware's effectiveness lies in its ability to infiltrate your system undetected and wreak havoc from within. Here's a breakdown of the typical lifecycle of malware: 1. Delivery The first step involves delivering the malware to your device. This can happen through various methods, some more sophisticated than others: Phishing Emails: Deceptive emails disguised as legitimate sources (banks, social media platforms) trick users into clicking on malicious links. These links can download malware directly onto your device when clicked. Alternatively, they might lead to download pages where malicious software is disguised as legitimate software. Malicious Websites: Unsecured websites or those compromised by hackers can host malware. When you visit such a website, malicious code can automatically download and install onto your device in the background, often without your knowledge. Infected Downloads: Downloading software, music, or movies from untrusted sources is a common way for malware to spread. Free software download websites or peer-to-peer (P2P) networks might unknowingly distribute malware disguised as legitimate files. Vulnerable Software: Outdated software with unpatched security holes creates vulnerabilities that malware can exploit. Hackers can scan for devices with outdated software and deliver malware by targeting these vulnerabilities. Physical Media: In rare cases, malware might spread through infected USB drives or external hard drives. Plugging such a drive into your computer can initiate the malware transfer. 2. Installation Once delivered, malware needs to find a way to install itself on your system. This can happen through various means depending on the type of malware: Automatic Installation: Some malware exploits vulnerabilities in your system to automatically install itself upon download. This can happen very quickly, leaving you with little to no chance of stopping it. User Deception: Trojan horse malware often relies on tricking users into installing it. They might be disguised as legitimate software or bundled with other programs you download. Clicking on "Next" through an installation wizard without carefully reviewing the process can lead to installing malware unknowingly. Exploiting User Permissions: Sometimes, malware might request seemingly harmless permissions during installation, like access to certain folders or files. Granting these permissions unknowingly can give malware the foothold it needs to operate on your system. 3. Execution After successful installation, the malware executes its malicious code. This code can vary greatly depending on the malware's purpose. Here are some common actions malware might take: Data Theft: Malware can steal sensitive information like login credentials, credit card details, browsing history, or even keystrokes you type. This stolen data can then be used for financial gain, identity theft, or other malicious purposes. File Corruption or Deletion: Destructive malware might corrupt or delete important files on your system, causing data loss and system disruptions. Downloading Additional Malware: Some malware acts as a gateway for downloading and installing additional malicious software onto your device, further expanding the infection and its potential damage. Spying on Your Activity: Keyloggers and other forms of spyware can monitor your online activity and steal your personal information. This can include capturing your browsing history, emails, or even chat conversations. Disrupting System Performance: Malware can consume system resources, slow down your device, crash programs, and interfere with normal operations. This can make your device unusable or significantly hinder your productivity. Holding Data Hostage: Ransomware encrypts your files, making them inaccessible. The malware then demands a ransom payment in exchange for a decryption key, essentially holding your data hostage until you pay. 4. Communication and Control Some malware variants establish communication channels with external servers controlled by the attackers. This allows them to: Send Stolen Data: The stolen data from your device can be uploaded to these servers for the attackers to exploit. Receive Instructions: The attackers can send instructions to the malware on your device, remotely controlling its behavior and potentially escalating the attack further. Update the Malware: The attackers can update the malware on your device with new functionalities or ways to evade detection by security software. 5. Persistence Many malware variants are designed to persist on your system, making it difficult to remove them. They might employ various techniques to achieve this, such as: Hiding Files: Malware can hide its files and processes within your system, making them difficult to detect by traditional security software. Disabling Security Measures: Some malware might try to disable your antivirus or firewall to operate freely without being hindered by security software. Creating Registry Entries: Malware can create entries in your system registry to ensure it automatically launches every time you start your computer. How Can I Tell If I Have a Malware Infection? While malware can operate silently in the background, some telltale signs might indicate an infection: Slow System Performance: A sluggish device with frequent crashes or freezes could be a sign of malware activity. Unfamiliar Software: The presence of programs you don't remember installing can be a red flag. Pop-Ups and Ads: A sudden surge in intrusive pop-up ads or unwanted changes to your browser settings could be caused by adware. Disabled Security Software: Malware might try to disable your antivirus or firewall to operate freely. Frequent Error Messages: Unexplained error messages can sometimes indicate system corruption caused by malware. Missing or Corrupted Files: Important files disappearing or becoming inaccessible could be a sign of malware tampering. Network Issues: Increased internet traffic or difficulty accessing websites can be caused by malware communicating with external servers. How to Protect Against Malware Attacks? Here are some crucial steps you can take to safeguard yourself from malware: Install a Reputable Antivirus Program: A robust antivirus with real-time scanning capabilities can detect and block malware before it infects your system. Keep Software Updated: Regularly update your operating system, applications, and web browsers to patch security vulnerabilities that malware can exploit. Be Wary of Phishing Emails: Don't click on suspicious links or attachments in emails, especially from unknown senders. Verify the legitimacy of emails before interacting with them. Download Wisely: Only download software, music, and movies from trusted sources. Avoid downloading files from peer-to-peer (P2P) networks or untrusted websites. Enable Firewalls: Firewalls act as a barrier between your device and the internet, filtering incoming and outgoing traffic to prevent unauthorized access. Use Strong Passwords: Utilize unique and complex passwords for all your online accounts. Consider using a password manager to generate and store strong passwords securely. Be Cautious with USB Drives: Avoid using USB drives from unknown sources. Scan any external drives before opening them on your computer. Backup Your Data: Regularly backup your important files to an external drive or cloud storage to minimize damage in case of a malware attack. Is It Possible to Get Rid of Malware? The good news is that in most cases, you can successfully remove malware from your system. Here are some steps you can take to fight back: Run a Malware Scan: Your first line of defense is your antivirus software. Initiate a comprehensive scan of your entire system to detect and eliminate any malicious programs. Most antivirus programs will quarantine or remove the detected threats. Anti-Malware Software: If your standard antivirus fails to catch everything, consider employing specialized anti-malware software. These programs are designed to target specific types of malware that might bypass traditional antivirus scanners. They can offer a deeper clean and remove more stubborn malware variants. Manual Removal (Advanced Users): For users comfortable with technical procedures, removing malware manually in Safe Mode is an option. This process involves identifying and deleting suspicious files, registry entries, and startup programs. However, it requires a good understanding of your system and the specific malware you're dealing with. Important Note: Manual removal is not recommended for beginners as it can be risky and lead to further system issues if done incorrectly. Professional Help: If you're unsure about tackling malware removal yourself, especially if you suspect a complex infection, don't hesitate to seek assistance from a computer technician or data recovery service. They have the expertise and tools to diagnose the problem, safely remove the malware, and potentially recover any lost data. Key Takeaways Malware is malicious software designed to harm your computer system, network, or device. There are many different types of malware, including viruses, worms, trojans, ransomware, spyware, and adware. Malware can steal your data, corrupt your files, disrupt your system performance, and even hold your data hostage. You can protect yourself from malware by installing a reputable antivirus program, keeping your software updated, being wary of phishing emails, and downloading files only from trusted sources. If you suspect you have a malware infection, you can run a malware scan with your antivirus software or seek help from a professional. FAQs What is malware in simple words? Malware is malicious software designed to harm your computer or steal your information. What are the 4 types of malware? The four main types of malware are viruses, worms, Trojans, and ransomware. Is malware a virus? While malware can include viruses, it's a broader term covering various malicious software. What causes malware? Malware is caused by cybercriminals seeking to damage or gain unauthorized access to systems. How harmful is malware? Malware can be highly harmful, leading to data loss, financial theft, or even system damage.

image for The Comeback of Warz ...

 Dark Web News

WarzoneRAT, the notorious Remote Administration Tool (RAT) malware, made a comeback despite the FBI's efforts to dismantle its operations earlier this year.  After seizing its infrastructure and arresting key individuals behind the cybercrime scheme, the FBI believed they had hindered the WarzoneRAT malware   show more ...  

operation. However, recent observations by Cyble Research and Intelligence Labs (CRIL) suggest otherwise, as new instances of the WarzoneRAT, also known as Avemaria, have been identified in the wild. WarzoneRAT Rejoins the Dark Web World  According to Cyble Research & Intelligence Labs (CRIL), the latest wave of WarzoneRAT activity appears to be tied to tax-themed spam emails, exploiting unsuspecting victims with cunningly disguised attachments.  [caption id="attachment_60590" align="alignnone" width="1255"] (Source: Cyble)[/caption] In one instance, the attack chain begins with a compressed attachment, concealing a malicious LNK file disguised as a PNG image. Once executed, this LNK file triggers a series of PowerShell commands, ultimately leading to the deployment of WarzoneRAT via a multi-stage process involving VBScript and Reflective loading techniques. [caption id="attachment_60592" align="alignnone" width="1207"] (Source: Cyble)[/caption] Another method observed in the campaign involves the use of a ZIP archive containing seemingly harmless files, including a legitimate EXE, a malicious DLL, and a PDF document. Upon execution of the legitimate EXE, the malware employs DLL sideloading to load the malicious DLL, thereby initiating the WarzoneRAT infection process. WarzoneRAT AKA Avemaria Leverage Stealth  The sophistication of these attacks lies in their multi-faceted approach, which includes obfuscation techniques, evasion tactics, and the utilization of reflective assembly loading to inject the malware into legitimate processes such as RegSvcs.exe. By dynamically loading payloads during runtime and evading detection mechanisms, the attackers behind WarzoneRAT demonstrate a keen understanding of cybersecurity vulnerabilities. [caption id="attachment_60593" align="alignnone" width="893"] (Source: Cyble)[/caption] Furthermore, the choice of tax-themed spam emails as a delivery mechanism highlights the attackers' efforts to exploit users' trust and anticipation. By leveraging familiar themes, such as tax-related documents, threat actors increase the likelihood of successful infections, thereby maximizing the impact of their malicious campaigns. Despite the FBI's previous intervention, WarzoneRAT has proven adamant, adapting its tactics and techniques to evade detection and continue its malicious activities. By employing a combination of obfuscation techniques, evasion tactics, and themed social engineering, threat actors aim to maximize the effectiveness of their attacks while complicating the efforts of defenders to detect and mitigate them. The Rise and Fall of WarzoneRAT  [caption id="attachment_60594" align="alignnone" width="1200"] Source: FBI[/caption] Warzone RAT first emerged as a formidable remote access trojan (RAT) in January 2019, quickly gaining notoriety as a top malware strain by 2020. Operating under the disguise of a legitimate commercial IT administration tool, it was sold as a malware-as-a-service (MaaS) by an online persona named Solmyr, offering affordable plans starting at $37.95 per month.  Warzone RAT harbors malicious intent, serving as a powerful information stealer with advanced stealth and anti-analysis capabilities. However, on February 9, 2024, a crucial operation targeted Warzone RAT and its operators as a part of an international effort led by the FBI, with support from Europol and the Joint Cybercrime Action Taskforce (J-CAT).  The operation resulted in the seizure of internet domains, including www.warzone.ws, known for selling the Warzone RAT malware. This move aimed to disrupt cybercriminal activities facilitated by the RAT, including unauthorized access to victims' systems, keystroke logging, screenshot capture, and unauthorized webcam access. The crackdown also led to the arrest of two suspects in Malta and Nigeria on February 7, 2024, accused of selling the malware and aiding cybercriminals in their malicious endeavors. Despite these interventions, cracked versions of Warzone RAT continue to circulate on darknet forums, supplemented by instructional videos facilitating its deployment and command-and-control (C2) administration. Warzone RAT has been implicated in numerous threat actors’ campaigns, targeting geopolitical entities such as India's National Informatics Centre (NIC) and being utilized by the Confucius APT group against governmental institutions in mainland China and South Asian countries.  Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for Vietnam’s Third-La ...

 Firewall Daily

Vietnam's financial sector faced turbulence as VNDirect, the nation's third-largest securities broker, continued its struggle to recover from a debilitating cyberattack over the weekend. Despite efforts to restore services, investors remained locked out of the platform, underscoring the severity of the   show more ...  

VNDirect cyberattack. In an official announcement on Wednesday, VNDirect acknowledged the partial restoration of services while affirming ongoing efforts to ensure system integrity and customer security. VNDirect Cyberattack: Progressive Recovery Plan The company outlined a phased approach to recovery from the VNDirect cyberattack, prioritizing the reinstatement of customer accounts and progressively reintegrating financial products. "We have currently restored the system and are conducting a review to ensure absolute safety for customers," VNDirect stated on its Facebook page. The restoration plan unfolds in four stages after a massive cyberattack on VNDirect: Phase 1: Preservation of client status and account information. Phase 2: Resumption of money trading, fundamental and reproductive stocks trading. Phase 3: Reinstatement of other financial products. Phase 4: Full restoration of all features. [caption id="attachment_60499" align="aligncenter" width="753"] Source: VNDirect's Facebook Page[/caption] Currently, VNDirect has completed Phase 1, urging customers to access their account information and promptly change passwords. However, the company anticipates potential technical glitches due to heavy traffic and requests patience from users. Meanwhile, VNDirect scheduled flow checks with stock trading departments on March 28, 2024, in collaboration with ANTT experts to ensure system security. The company emphasized the importance of cybersecurity awareness among investors, advising against downloading unknown files or sharing PC access. [caption id="attachment_60501" align="aligncenter" width="744"] Source: VNDirect's Facebook Page[/caption] Market Repercussions and Regulatory Response The fallout extended beyond VNDirect's operations, prompting the Hanoi Stock Exchange (HNX) to temporarily suspend remote trading and online transactions involving derivative securities and debt instruments through VNDirect. The move reflects the severity of the incident and its broader implications for the financial ecosystem. Market repercussions were evident as VNDirect's share price plummeted nearly 4% and transaction volumes on the Ho Chi Minh City Stock Exchange (HSX) dropped by 10% on Monday. Concerns loomed over the contagion effect, but Vietnam's State Securities Commission (SSC) assured that other financial institutions remained unaffected. Addressing the attack, VNDirect's CEO, Nguyen Vu Long, attributed it to a "group of professional hackers" who encrypted data. Despite the setback, Long affirmed the successful decryption of blocked data and initiation of the restoration process. The cyber onslaught extended to affiliated entities like investment firm IPA and stock investment fund IPAAM, compounding the disruption across Vietnam's financial landscape. Websites of these companies remain offline as they grapple with the aftermath of the assault. As Vietnam's financial sector navigates the aftermath of this cyber siege, stakeholders brace for continued turbulence while emphasizing vigilance against evolving digital threats. The incident underscores the imperative for robust cybersecurity measures to safeguard the integrity of financial systems and protect investor interests in an increasingly digitized world. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for How to Password Prot ...

 How to

Have you ever felt like your computer has become cluttered, overflowing with many files? Financial documents, cherished photos, confidential work files – all these treasures deserve a safe place, away from prying eyes and accidental deletion.  According to research, a whopping 64% of Americans have fallen victim to   show more ...  

a data breach at some point. So, what can be done to transform your computer from an open door to a secure vault? That’s what password protection is for. In this article, we’ll tell you how to password-protect a folder, how to hide a folder, and much more! What Is Password Protection? Password protection is a security mechanism that restricts access to a folder or file by requiring a valid password for entry. Once implemented, anyone attempting to access the folder will be prompted to enter the designated password. Only upon successful password verification will the contents be revealed. This creates a virtual barrier around your data, preventing unauthorized users from viewing, modifying, or deleting sensitive information. Types of Password Protection There are two primary methods for password-protecting folders: Encryption: This approach scrambles the data within the folder using a complex algorithm. A decryption key (usually your password) is required to access the information. Even if someone bypasses the password protection layer, they'll be confronted with indecipherable data. Software-based protection: Specific software applications offer password protection functionalities. These programs might create a virtual vault or encrypt the folder using their encryption methods. Understanding the distinction between these approaches is crucial. Encryption offers a more robust level of security, rendering the data unusable even if someone cracks the password protection layer. Software-based protection, while convenient, may be less secure depending on the specific program used. Why Should You Password Protect a Folder? There are numerous reasons why password protection should be considered for sensitive folders: Shield Confidential Information: Financial documents, tax records, and medical data are just some of confidential information requiring the utmost protection. Password protection is a first line of defense, preventing unauthorized access and safeguarding these crucial files from falling into the wrong hands. Maintain Personal Privacy: Do you have personal photos, videos, or documents you wish to keep private? Password-protecting these folders ensures they remain hidden from prying eyes, offering peace of mind and control over your personal information. Uphold Work Confidentiality: If you work with sensitive business documents on your computer, password protection helps ensure that only authorized individuals within your organization can access them. This is crucial for maintaining confidentiality and preventing leaks of proprietary information. Prevent Accidental Deletion: Sharing a computer with others can sometimes lead to accidentally deleting important files. Password-protecting critical folders adds a layer of security, preventing unintentional deletion by others who might be using the same computer. Peace of Mind and Control: Password protection offers peace of mind. Knowing your sensitive data is secured behind a password barrier allows you to work and store information more confidently. It empowers you to control who can access your data, minimizing the risk of unauthorized use or exposure. How to Password Protect a Folder Using Encryption? Both Windows and macOS offer built-in encryption functionalities to password-protect folders and files. Here's a look at the process for Windows: Navigate to the folder you wish to protect. Right-click the folder and select "Properties." Click on the "Advanced" tab. Check the box labeled "Encrypt contents to secure data." Click "OK" and then "Apply." Windows will prompt you regarding whether to encrypt only the folder or the entire contents (subfolders and files) within it. Choose the option that best suits your needs. Keep in mind: This method leverages your Windows login password for encryption. While convenient, it's not foolproof if someone already has access to your user account. How to Password Protect a Folder Using Password Protection Software? Third-party software applications offer a wider range of password protection features. These programs can: Create password-protected vaults: These virtual vaults function as secure containers for your sensitive data. Offer additional functionalities: Features such as self-destructing files after a certain period or multi-factor authentication can be available. Pros: User-friendly interface, additional security features. Cons: Software cost (may require a paid subscription), reliance on a third-party program for security. How to Password Protect a Folder Using Full Encryption Software? For a more robust level of security, consider full-disk or full-partition encryption software. These programs encrypt entire drives or partitions, offering an extra layer of protection for all your data. Two popular options include: 7Zip: This free and open-source software allows you to password-protect individual archives (compressed folders) with strong encryption algorithms. VeraCrypt: This free, open-source program enables you to create fully encrypted virtual drives that appear as regular drives on your computer. Pros: High level of security, encrypts entire drives or partitions. Cons: Requires technical understanding for setup, potential performance impact on your system. How to Hide a Folder? While password protection secures your data, it doesn't necessarily hide the folder itself. If someone knows a specific folder exists, they might still attempt to access it. Here are a few methods to achieve a degree of invisibility: Change folder icon: Most operating systems allow you to change the icon associated with a folder. This can make it appear less conspicuous and blend in with other folders. Rename the folder: Give the folder a nondescript name that doesn't reveal its contents. Important Note: These methods do not offer true security. A determined user can still discover the hidden folder through various means. For robust protection, rely on password protection or encryption methods. What Is the Difference Between Password Protection and Encryption? While both password protection and encryption serve the purpose of securing your data, they achieve this goal in fundamentally different ways. Here's a breakdown of the key distinctions: Password Protection: This is like putting a lock on a filing cabinet containing the document. Anyone with the key (password) can access the cabinet and read the document. However, a determined individual could break the lock, gaining access to the information. Function: Acts as a gatekeeper, controlling access to data through a password verification process. Data Security: Relies on the strength of the password. A weak password can be easily cracked, leaving your data vulnerable. Data Readability: Once the password is entered, the data remains in its original, unencrypted format. If someone bypasses the password protection, they can access and read the data clearly. Implementation: Often built-in to operating systems or software applications. Relatively easy to set up. Encryption: This is like taking the document and scrambling the words using a complex code. Even if someone breaks the lock on the cabinet (bypasses password protection), they'll find an unreadable mess of text without the decryption key. Function: Scrambles the data itself using a complex mathematical algorithm. Data Security: Provides a much higher level of security compared to password protection alone. Even if someone bypasses the password protection layer, the data will be completely unreadable without the decryption key. Data Readability: Encrypted data appears as gibberish unless decrypted with the correct key. This makes it virtually impossible for unauthorized users to access the information even if they gain access to the folder. Implementation: May require additional software or tools for full-disk encryption. Can be slightly more complex to set up compared to basic password protection. How to Change the Password of a Password Protected Folder? The method for changing a password depends on the specific approach you used for protection. Windows folder encryption: Right-click the folder, select "Properties" > "Advanced" > "Encrypt contents to secure data" > "Change password." Third-party software: Refer to the software's documentation for instructions on changing passwords for protected folders or vaults. Full-disk encryption: The process varies depending on the software used. Consult the program's documentation for specific steps. Always remember your new password! Losing it can render your data inaccessible. What to Do If I Forget the Password to a Folder? Forgetting the password to a password-protected folder is a frustrating situation. Unfortunately, recovering the data without the password can be challenging, and the success rate depends on the specific methods used for protection. Here's a breakdown of potential options and limitations: Try Password Recovery Techniques: Recall Strategies: Take some time to remember the password. Think about commonly used passwords, variations of personal details, or any mnemonics you might have employed while creating the password. Password Managers: If you utilize a password manager, it might have stored the password for the protected folder. Check your password manager's vault and search for entries related to the folder or the software used for protection. Explore Software-Specific Recovery Options: Third-Party Software: Some password protection software applications offer built-in password recovery features. Consult the software's documentation for specific instructions. These features might involve security questions you set up during initial setup or emergency recovery keys. Consider Professional Data Recovery: Data Recovery Services: If the data within the folder is critical and other methods fail, professional data recovery services might be an option. However, these services can be expensive and success is not guaranteed. The complexity of the encryption used and the condition of the storage media play a significant role in the recovery process. Prevention is Key: While recovery options exist, it's much easier and less stressful to prevent forgetting your password in the first place. Here are some best practices to keep in mind: Strong Passwords: Develop strong and unique passwords for each folder or application you protect. Consider using a password manager to generate and securely store these passwords. Password Recovery Options: If the software offers password recovery features like security questions or emergency keys, make sure to set them up during initial setup and keep them in a safe location separate from your computer. Password Documentation: Write down your passwords on a piece of paper and store them in a secure location (not on your computer!) as a last resort if you forget. Tips for Keeping Files and Passwords Safe Here are some additional tips to ensure the security of your files and passwords, going beyond the basics: Password Management: Use a password manager: Don't try to remember numerous complex passwords. Utilize a password manager to generate strong, unique passwords for each of your online accounts. Reputable password managers offer robust encryption and secure storage for your passwords. Implement a master password: Your password manager will require a master password for access. Make this password exceptionally strong and unique, and avoid using it anywhere else. Consider using a passphrase, a longer string of random words, for increased security. Enable multi-factor authentication (MFA) for your password manager: Adding an extra layer of security to your password manager with MFA protects your passwords even if someone discovers your master password. Securing Your Devices: Enable encryption on your devices: Laptops, tablets, and even smartphones offer built-in encryption options. Turn on these features to protect your data in case of device loss or theft. Use a strong screen lock: Don't rely on a simple swipe or PIN to unlock your devices. Opt for a strong password or fingerprint/facial recognition for added security. Beware of public Wi-Fi: Avoid accessing sensitive information or online accounts while connected to public Wi-Fi networks. Public Wi-Fi can be insecure, making your data vulnerable to interception. Consider using a virtual private network (VPN) for added security when on public Wi-Fi. Install security software: A reputable security suite with antivirus, anti-malware, and firewall protection can help safeguard your devices from malicious software that might steal your passwords or encrypt your files. Maintaining Safe Habits: Be cautious with phishing attempts: Phishing emails or websites aim to trick you into revealing your passwords or personal information. Be wary of unsolicited emails, links, or attachments, and verify the sender's legitimacy before clicking anything. Think before you share: Don't share your passwords or sensitive information with anyone online or over the phone unless you're absolutely certain of the recipient's identity. Beware of social engineering: Social engineering tactics attempt to manipulate you into giving away your password or other sensitive information. Be cautious of anyone pressuring you for personal details or urging you to take immediate action. Review permissions granted to apps and websites: Many apps and websites require permissions to access certain features on your device or data within your accounts. Regularly review the permissions granted and revoke access you no longer need. Key Takeaways Password protection and encryption are powerful tools to safeguard your sensitive data on folders and files. Encryption offers a higher level of security by scrambling the data itself, making it unreadable even if someone bypasses the password protection. Choose a method that suits your needs, from built-in Windows encryption to third-party software or full-disk encryption programs. Remember strong passwords, enable two-factor authentication, and maintain backups to ensure comprehensive data security. FAQs Can I put a password on a folder? Yes, you can put a password on a folder using built-in encryption features or third-party software. How to password protect a file? To password-protect a file, you can use built-in encryption tools like BitLocker (Windows) or FileVault (Mac). How can I lock my folder with a password without any software? You can lock a folder with a password in Windows 10 by using built-in features like BitLocker or third-party software like VeraCrypt. Why can't I password-protect a folder in Windows 10? If you're unable to password-protect a folder in Windows 10, ensure you have the necessary permissions and are using the correct method. Why can't I encrypt my folder? If you can't encrypt a folder, check if your device supports encryption and if the folder isn't already encrypted.

image for Millions of WordPres ...

 Firewall Daily

A new Essential Addons For Elementor vulnerability has been revealed, affecting over 2 million websites utilizing the popular WordPress plugin. Security researchers have flagged Stored Cross-Site Scripting (XSS) vulnerabilities within this plugin, which could potentially pave the way for attackers to inject malicious   show more ...  

scripts into WordPress websites. The vulnerability stems from flaws identified in two integral widgets incorporated within the Essential Addons plugin, namely the Countdown Widget and the Woo Product Carousel Widget.  These Elementor vulnerabilities have raised concerns among website owners and developers alike due to their widespread impact. The vulnerability was reported by security researcher Ngô Thiên An (ancorn_) and Wordfence gave it a rating of 6.4 on the vulnerability scale, affecting versions from 5.9.11 and below.  Decoding the Essential Addons for Elementor Vulnerability Essential Addons For Elementor serves as an extension to the Elementor WordPress page builder, empowering users to enhance their websites with a ton of features and widgets. However, the recent report of XSS vulnerabilities within this plugin puts millions of users at risk since the plugin has an active installation of 2+ million.  [caption id="attachment_60544" align="alignnone" width="545"] Source: Wordfence[/caption] According to a security advisory published by Wordfence, the vulnerability specifically targets the "Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders" plugin, up to version 5.9.11. The vulnerability, categorized as "Authenticated (Contributor+) Stored Cross-Site Scripting," highlights lapses in input sanitization and output escaping mechanisms within the affected widgets. This vulnerability, assigned a severity score of 6.4 on the Wordfence vulnerability scale, highlights the potential risks associated with improper input validation. Furthermore, the advisory outlines the possibility for authenticated attackers, with contributor-level access or higher, to exploit the vulnerability by injecting arbitrary web scripts into affected pages. Essential Addons for Elementor Responds to the Vulnerability  [caption id="attachment_60546" align="alignnone" width="585"] Source: Wordfence[/caption] The developers behind Essential Addons for Elementor have addressed the recent vulnerability by releasing a comprehensive security patch. This patch not only tackles the Stored Cross-Site Scripting (XSS) vulnerabilities but also addresses various other flaws within the WordPress plugin. In their latest patch version 5.9.13, several critical issues have been resolved, including fixes for the EA Table of Contents, ensuring it no longer throws PHP Fatal errors when the Display on option is set to Custom Post Types. Additionally, minor bug fixes and improvements have been implemented to enhance the overall stability and performance of the plugin. Previous versions, such as 5.9.12 and 5.9.11, also saw fixes to key functionalities. For instance, issues with the EA Pricing Table, EA Advanced Accordion, EA Advanced Tabs, and EA Login Register Form have been addressed, ensuring seamless operation across various features. Furthermore, compatibility with popular themes and plugins like Fluent Form and Gravity Forms has been improved, minimizing conflicts and enhancing user experience. Alongside security updates, improvements in accessibility support have been made, ensuring that the plugin remains inclusive and user-friendly for all website visitors. The Stored Cross-Site Scripting (XSS) Pandemic Stored Cross-Site Scripting (XSS) vulnerabilities pose a threat to website security, enabling attackers to execute malicious scripts within the browsers of unsuspecting visitors. Such attacks could potentially lead to the theft of session cookies, thereby granting unauthorized access to sensitive website functionalities. XSS vulnerabilities are prevalent in web applications and often result from inadequate input sanitization and output escaping mechanisms. These vulnerabilities have taken a toll on WordPress users recently with many plugins having inadequate security settings, allowing threat actors to exploit the vulnerability and initiate remote code execution.  According to Wordfence, the Essential Addons for Elementor vulnerability “makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.” [caption id="attachment_60551" align="alignnone" width="556"] Source: Wordfence[/caption] Previously, Wordfence reported the same vulnerability within the Rank Math plugin. Researcher Ngô Thiên An (ancorn_) uncovered the vulnerability within the Rank Math plugin, which impacts versions up to and including 1.0.214. The vulnerability is associated with the plugin's management of attributes within the HowTo block. This lapse in input sanitization and output escaping means that authenticated attackers with contributor-level access or higher can inject arbitrary web scripts. These scripts have the potential to execute whenever a user interacts with the compromised page, posing a risk to user sessions and sensitive data. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for How To Get a Job in ...

 How to

In the contemporary era reliance on technological devices and the internet is pervasive encompassing both professional and recreational aspects of life. Consequently, the field of cybersecurity has witnessed substantial growth. According to the Data Security Council of India (DSCI), the demand for cybersecurity   show more ...  

professionals in India is projected to reach 64,000. Furthermore, DSCI anticipates a monumental surge in the demand for cybersecurity products and services, estimating an increase from 1.10 lakh employees in 2019 to 10 lakh by 2025. With cyber attacks escalating every year and sensitive data amassing across corporate networks and personal devices, the demand for skilled security professionals has never been higher. In this blog post we will discuss how you can get job in cyber security field. Cybersecurity Job Requirements Entering the realm of cybersecurity demands a blend of technical prowess and soft skills, setting a high bar for entry-level positions. Let's delve into the crucial criteria that candidates should meet: 1) Education Requirements: A bachelor’s degree in computer science or related fields like mathematics and engineering is typically favored by employers. Some roles may even prefer candidates with a master's degree in cybersecurity. For those unable to pursue traditional degrees, immersive cybersecurity boot camps offer a viable alternative. These intensive programs equip learners with the practical skills required in the cybersecurity job market. Popular bootcamps include Fullstack Academy's cybersecurity analytics bootcamp, Ironhack's remote cybersecurity bootcamp, and Code Fellows' ops and cybersecurity bootcamp. 2) Certifications: Certifications play a vital role in establishing professional credibility. CompTIA Security+, GIAC Security Essentials, and Certified Ethical Hacker (CEH) are popular choices for entry-level cybersecurity roles. Cisco Certified CyberOps Professional certification is also valued, emphasizing the ability to detect and respond to cyber threats. 3) Hard Skills: Proficiency in programming languages such as Java, Python, and C++, along with knowledge of Linux, project management, information systems, intrusion detection, and risk assessment, is essential. Accounting skills may be necessary for roles like IT auditors, highlighting the importance of a diverse skill set. 4) Soft Skills: Effective communication, presentation, critical thinking, problem-solving, networking, teamwork, and time management are indispensable for success in the cybersecurity field. While hard skills may secure the job, soft skills play a crucial role in career advancement and professional growth. By meeting these requirements and continuously honing both technical and soft skills, aspiring cybersecurity professionals can position themselves for success in this dynamic and rapidly evolving field. How to Get a Job in Cyber Security for Beginners? Securing a job in cybersecurity as a beginner can seem daunting, but with the right approach and dedication, it's entirely achievable. Here's a comprehensive guide to help beginners kickstart their journey into the world of cybersecurity: 1. Understand the Basics: Familiarize yourself with the fundamental concepts of cybersecurity, including networking, operating systems, encryption, and common security threats. 2. Acquire Relevant Skills: Develop technical skills in areas such as network security, system administration, ethical hacking, incident response, and malware analysis. Hone your soft skills, including communication, problem-solving, critical thinking, and attention to detail. 3. Obtain Education or Training: Pursue formal education through degree programs in cybersecurity, computer science, or related fields. Alternatively, enroll in online courses, bootcamps, or self-study resources to gain foundational knowledge. Consider obtaining certifications such as CompTIA Security+, Certified Ethical Hacker (CEH), or Cisco Certified CyberOps Associate to validate your skills and enhance your credibility. 4. Gain Practical Experience: Seek internships, entry-level positions, or volunteer opportunities in IT support, helpdesk, or cybersecurity roles to gain hands-on experience. Participate in Capture The Flag (CTF) competitions, cybersecurity challenges, or open-source projects to sharpen your skills and showcase your abilities to potential employers. 5. Build a Professional Network: Connect with cybersecurity professionals through online forums, social media platforms, local meetups, and industry events. Seek mentorship from experienced professionals who can provide guidance, advice, and insights into the cybersecurity industry. 6. Customize Your Resume and Cover Letter: Tailor your resume to highlight relevant skills, experiences, certifications, and projects related to cybersecurity. Craft a compelling cover letter that demonstrates your passion for cybersecurity, showcases your skills, and explains why you're a suitable candidate for the position. 7. Prepare for Interviews: Research the company and the role to which you're applying, familiarizing yourself with their cybersecurity practices and industry trends. Practice common interview questions and be prepared to discuss your technical knowledge, problem-solving abilities, and past experiences related to cybersecurity. 8. Stay Updated and Continuously Learn: Stay abreast of the latest cybersecurity trends, technologies, and threats by reading industry publications, attending webinars, and pursuing ongoing education and training. Continuously expand your skill set and pursue advanced certifications or specialization areas to remain competitive in the evolving field of cybersecurity. By following these steps and remaining persistent in your efforts, beginners can position themselves for success and embark on a fulfilling career in cybersecurity. How to Transition into a Cybersecurity Specialist Role with a Non-Technical Background Transitioning into a cybersecurity specialist role from a non-technical background is indeed feasible, given the diverse array of roles available within the cybersecurity industry. Employers increasingly seek individuals with varied skills and backgrounds, even those lacking technical expertise. Here are several roles to consider: 1) Cyber Security Analyst: Security analysts identify, assess, and manage cybersecurity risks. Responsibilities may include developing and implementing security policies, conducting audits, and assessing security measures. 2) Information Security Officer (ISO): ISOs develop and execute an organization's cybersecurity strategy. They oversee security teams, budgets, and ensure security integration across all departments. 3) Cyber Security Risk Manager: Risk managers identify, assess, and manage cybersecurity risks. They develop risk management plans and procedures to mitigate potential threats. 4) Security Awareness and Training Specialist: Specialists design and deliver cybersecurity awareness and training programs for employees. They assist in risk mitigation and promote cybersecurity best practices. 5) Security Consultant: Consultants offer cybersecurity consulting services to organizations. They aid in policy development, conduct assessments, and train employees on security protocols. 6) Security Sales Engineer: Sales engineers sell cybersecurity products and services to organizations. They assess customer needs, recommend solutions, and facilitate product implementation. 7) Security Marketing Manager: Marketing managers develop and execute marketing campaigns for cybersecurity products and services. They raise awareness of cybersecurity issues and promote best practices. Transitioning into these roles may require additional training, certifications, or networking. Utilize online courses, certification programs, and industry events to enhance your knowledge and skills. Highlight transferable skills, such as analytical thinking, communication, and problem-solving, in your resume and interviews to demonstrate suitability for cybersecurity roles. With dedication and persistence, transitioning into a cybersecurity specialist role is achievable, even with a non-technical background. If you're passionate about a cybersecurity career but lack a technical background, here's how you can prepare for a non-technical role: 1) Pursue Cybersecurity Certifications: Obtain cybersecurity certifications like Certified Information Systems Security Professional (CISSP) or Certified Ethical Hacker (CEH) to demonstrate your expertise in cybersecurity. These certifications serve as a valuable entry point into the field and showcase your understanding of cybersecurity concepts. 2) Network in the Cybersecurity Community: Attend cybersecurity conferences, workshops, and networking events to connect with professionals in the industry. Engaging with peers on platforms like LinkedIn can provide insights into different cybersecurity roles and potential job opportunities. 3) Volunteer for Cybersecurity Organizations: Offer your time and skills to cybersecurity organizations or community initiatives. Volunteering provides hands-on experience in the field and opportunities to network with industry professionals. 4) Set Up Job Alerts and Apply for Entry-Level Positions: Create job alerts for entry-level cybersecurity positions or internships to stay updated on job opportunities. Apply for roles that align with your skills and interests to kickstart your cybersecurity career. 5) Consider a Cybersecurity Bootcamp: Enroll in a cybersecurity bootcamp to enhance your cybersecurity knowledge and gain practical skills. Many bootcamps offer connections within the industry and may assist in securing entry-level positions after completion. 6) Gain Hands-On Experience: Seek freelance cybersecurity projects or internships to gain practical experience. Hands-on work allows you to develop essential skills and understanding of complex systems, enhancing your employability in non-technical roles. With dedication and the right combination of skills and experience, you can successfully pursue a non-technical cybersecurity career and thrive in this rapidly growing field. Entry-level Cyber Security Jobs With No Experience Securing an entry-level cybersecurity job with no prior experience is challenging but not impossible. Here are several entry-level roles in cybersecurity suitable for individuals with no prior experience: 1) Cybersecurity Analyst (Junior/Entry-Level): Responsibilities may include monitoring security systems, analyzing security breaches, responding to incidents, and implementing security measures. Entry-level cybersecurity analysts often work under the guidance of more experienced professionals. 2) Security Operations Center (SOC) Analyst: SOC analysts monitor and analyze security alerts and incidents to identify potential threats. They may also assist in incident response activities and contribute to the development of security policies and procedures. 3) IT Support/Helpdesk Technician: While not exclusively a cybersecurity role, IT support or helpdesk positions provide valuable exposure to cybersecurity concepts and technologies. Responsibilities may include troubleshooting technical issues, assisting with software installations, and implementing basic security measures. 4) Cybersecurity Intern/Trainee: Internship or trainee positions offer hands-on experience in cybersecurity roles. Interns may assist with security assessments, vulnerability scanning, and security awareness initiatives under the guidance of experienced professionals. 5) Security Awareness and Training Assistant: Entry-level roles in security awareness and training involve assisting in the development and delivery of cybersecurity awareness programs. Responsibilities may include creating educational materials, organizing training sessions, and promoting security best practices among employees. 6) Junior Penetration Tester/Ethical Hacker: Entry-level penetration testers conduct security assessments and vulnerability scans to identify weaknesses in systems and networks. They may assist in conducting penetration tests, analyzing results, and reporting findings to senior team members. 7) Cybersecurity Sales/Marketing Assistant: Entry-level positions in cybersecurity sales or marketing involve supporting sales and marketing teams in promoting cybersecurity products and services. Responsibilities may include market research, lead generation, and assisting with marketing campaigns. While these roles may not require prior cybersecurity experience, employers often look for candidates with a strong foundation in IT, critical thinking skills, and a willingness to learn. Pursuing relevant certifications, participating in training programs, and gaining practical experience through internships or volunteer work can enhance your prospects of securing an entry-level cybersecurity job with no prior experience. The Bottom Line! Getting a job in cyber security requires dedication, continuous learning, and a well-rounded skill set. By following this step-by-step guide, you will have all the tools necessary to kickstart your career in this rapidly growing field. Remember that it's never too late to pursue your passion for protecting data and keeping people safe online. With determination and perseverance, you too can join the ranks of highly skilled cyber security professionals and contribute towards creating a more secure digital world. The future is bright for those who are willing to put in the effort - so take action now! Key Highlights To embark on a career in cybersecurity, aspiring professionals should follow a strategic step-by-step approach. Firstly, acquiring the necessary education and training forms the foundation. This typically involves pursuing a degree in cybersecurity, computer science, or a related field. Certifications play a pivotal role in validating one's skills and expertise in cybersecurity. Obtaining certifications such as CompTIA Security+, Certified Ethical Hacker (CEH), or Cisco Certified CyberOps Professional enhances credibility and increases employability. Gaining hands-on experience is crucial for entry into the cybersecurity field. This can be achieved through internships, volunteer work, or entry-level positions. Customizing resumes and cover letters to highlight relevant skills, certifications, and experiences is paramount. Tailoring application materials to each job application demonstrates a genuine interest in the role and enhances the chances of securing interviews. FAQ's What qualifications do I need to get a job in cyber security? While a degree in computer science or a related field is beneficial, it's not always mandatory. Employers often value relevant certifications, hands-on experience, and demonstrable skills in areas like networking, programming, and information security. What certifications are important for getting a job in cyber security? Certifications such as CompTIA Security+, Certified Ethical Hacker (CEH), and Certified Information Systems Security Professional (CISSP) are highly regarded in the cyber security industry. They demonstrate proficiency in key areas and can enhance job prospects. How can I gain practical experience in cyber security? Seek internships, volunteer opportunities, or entry-level positions in IT or cyber security roles. Participating in Capture The Flag (CTF) competitions, building personal projects, and networking with professionals in the field can also provide valuable experience. How important is networking in finding a job in cyber security? Networking is crucial in the cyber security industry. Connecting with professionals, attending industry events, and joining online communities can help you learn about job opportunities, gain insights into the industry, and build relationships with potential employers. What steps should I take to prepare for job interviews in cyber security? Research the company and the role, practice common interview questions, and be prepared to discuss your skills, experiences, and knowledge related to cyber security. Highlight any certifications, projects, or achievements that demonstrate your expertise in the field.

image for CISA Unveils Landmar ...

 Cyber Essentials

In a pivotal move towards fortifying the nation's cybersecurity resilience, the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) unveiled a Notice of Proposed Rulemaking (NPRM) on Wednesday, March 27, 2024. This milestone, published for public inspection in the Federal   show more ...  

Register, signifies a significant stride forward in safeguarding critical infrastructure from cyber threats. Mandated by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), the NPRM heralds a new era of enhanced cybersecurity protocols. Empowering CISA through CIRCIA Under CIRCIA, CISA is poised to leverage cyber incident and ransomware payment data reported to the agency to discern real-time patterns, bridge crucial information gaps, swiftly mobilize resources for entities besieged by cyber assaults, and forewarn potential targets. Rapid dissemination of cyber incident intelligence enable cybersecurity agency to extend timely aid and preempt similar attacks on other organizations, thus curbing the cascading impact of cyber threats on national security. Secretary of Homeland Security, Alejandro N. Mayorkas, emphasized the significance of CIRCIA in enhancing the nation's cybersecurity posture, stating, "Cyber incident reports submitted to us through CIRCIA will enable us to better protect our nation’s critical infrastructure." Mayorkas highlighted that collaboration with both public and private stakeholders has been integral in shaping the proposed rule, inviting further input during the public comment period to refine the Final Rule. “CIRCIA enhances our ability to spot trends, render assistance to victims of cyber incidents, and quickly share information with other potential victims, driving cyber risk reduction across all critical infrastructure sectors. The proposed rule is the result of collaboration with public and private stakeholders, and DHS welcomes feedback during the public comment period on the direction and substance of the final rule,” said Mayorkas. Echoing Mayorkas's sentiments, CISA Director Jen Easterly hailed CIRCIA as a game changer for the cybersecurity landscape, emphasizing its pivotal role in preempting adversary campaigns, fostering early threat detection, and facilitating synchronized responses with public and private sector partners. “It will allow us to better understand the threats we face, spot adversary campaigns earlier, and take more coordinated action with our public and private sector partners in response to cyber threats. We look forward to additional feedback from the critical infrastructure community as we move towards developing the Final Rule," said Easterly. Stakeholder Engagement and Collaborative Efforts Since September 2022, CISA has diligently solicited input from a diverse array of stakeholders, including the critical infrastructure community, in shaping the NPRM. The open comment period presents stakeholders with another opportunity to contribute insights on proposed regulations for cyber incident and ransom payment reporting, alongside other facets of the CIRCIA regulatory framework. By harnessing insights garnered from the Request for Information (RFI) and listening sessions conducted over the past year, the cybersecurity agency has tailored the NPRM to align with stakeholders' needs and priorities. Implementation of CIRCIA heralds a paradigm shift in national cybersecurity strategy, empowering CISA to gain comprehensive insights into the evolving cyber threat landscape. By furnishing early warnings to entities at risk of cyber targeting, CIRCIA forms the cornerstone of proactive cyber risk reduction initiatives, thereby fortifying the nation's critical infrastructure against emergent cyber threats. As the NPRM progresses towards formal publication in the Federal Register, the public is urged to actively participate in the 60-day comment period, contributing valuable perspectives to shape the Final Rule. Through collective efforts and collaborative engagement, CISA aims to fortify America's cyber defenses and ensure the resilience of its critical infrastructure in the face of evolving cyber threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for UnitedHealth Group D ...

 Data Breach News

In the aftermath of the Change Healthcare cyberattack, UnitedHealth Group (the parent organization of Change Healthcare) has disbursed over $3 billion to affected providers. The cyber intrusion, disclosed in February, caused widespread disruptions in healthcare operations, leaving providers struggling to fill   show more ...  

prescriptions and obtain reimbursements from insurers, thereby stalling revenue cycles. Since the disclosure of the cyberattack on Change Healthcare, UnitedHealth Group has been actively addressing the fallout. The company has paid out an additional $1 billion to impacted providers, bringing the total amount disbursed to more than $3.3 billion. This financial support aimed to alleviate the immediate strain on healthcare providers grappling with the cyberattack. Change Healthcare Cyberattack Update: Over $3 Billion Disbursed to Health Providers Change Healthcare, a vital component of UnitedHealth Group's operations, processes billions of billing transactions annually, highlighting the extensive impact of the breach. The company responded to the threat, isolating affected systems and initiating remediation efforts. However, the full extent and duration of the disruptions remained uncertain. The cyberattack not only disrupted healthcare operations but also posed financial challenges for providers. According to a survey by the American Hospital Association, 94% of hospitals reported experiencing financial disruptions due to the Change Healthcare cyberattack, highlighting the widespread repercussions. In response to the crisis, UnitedHealth implemented a temporary funding assistance program to support struggling providers. The $3.3 billion in advances offered to providers will not require repayment until normal claims processing resumes, offering a lifeline to financially strained healthcare entities. Disruptions Will Continue in April  Despite ongoing efforts to restore operations, UnitedHealth acknowledged that disruptions may persist into April. The company has been collaborating with cybersecurity experts and law enforcement agencies to investigate the attack and mitigate further risks. However, concerns remain about the potential exposure of sensitive data, prompting heightened vigilance and collaboration with relevant stakeholders. In an SEC filing, UnitedHealth Group' stated, “The Company is working diligently to restore those systems and resume normal operations as soon as possible, but cannot estimate the duration or extent of the disruption at this time. The Company has retained leading security experts, is working with law enforcement, and notified customers, clients, and certain government agencies." At this time, the organization believes the network interruption is specific to Change Healthcare systems, and all other systems across the Company are operational. Interested parties can visit the Optum page to get the latest update on the Change Healthcare cyberattack.  Moreover, the Department of State has offered a reward for information leading to the identification of individuals associated with Blackcat, highlighting the severity of the incident. Lawmakers, including Rep. Jamie Raskin, have called for transparency regarding the breach's scope and impact. The House Committee on Oversight and Accountability requested detailed information from UnitedHealth regarding the timeline of the breach, targeted infrastructure, and cybersecurity protocols. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

image for How to tell that wha ...

 Threats

Imagine getting a call or message from your immediate senior — or maybe even the head honcho of the whole company. They warn you about a nasty situation brewing. It spells fines or some other financial woes for the company, big trouble for your department, and possible dismissal for you personally! Cold sweat   show more ...  

trickles down your spine, but theres still a chance to save the day! Youll have to hustle and do a few things you dont usually do, but everything should be alright First – hold your horses and take a few deep breaths. Theres a 99% chance this whole emergency is completely made up and the person on the line is a scammer. But how do you recognize such an attack and protect yourself? Anatomy of the attack These schemes come in dozens of flavors. Scammers may describe various issues faced by your company depending on the particular country, cite involvement of regulators, police, or major business partners, and then suggest all manner of ways to solve the problem with your help. Yet there are a number of key points — crucial psychological footholds — without which the attack is next to impossible to carry out. These can be used to recognize the attack for what it is. The superiors authority, or simple trust in someone you know. Most people by now have developed a resistance to odd requests from strangers — be it a police officer whos decided to reach out through instant messaging, or a bank employee personally concerned about your wellbeing. This scheme is different: the person approaching the victim appears to be someone you know to some extent — and a fairly important person at that. Scammers often choose a C-level managers profile as bait. First, they have authority; second, chances are the victim knows the person, but not well enough to spot the inevitable differences in speech or writing style. However, there are variations on this scheme where the scammers impersonate a coworker from a relevant department (such as accounting or legal) whom you may not know personally. Redirection to an external party. In the most primitive cases, the coworker or manager who reaches out to you is also the person you get a request about money from. Most often though, after the initial contact, the boss suggests you discuss the details of the matter with an external contractor whos about to reach out. Depending on the schemes specifics, this assigned person may be introduced as a law enforcement or tax officer, bank employee, auditor or similar; i.e., not someone the victim knows. The boss will ask you to provide the designated person with all the assistance theyll need and without delay. That said, the most elaborate schemes, such as the one with $25 million stolen following a deepfake video conference, may have the scammers pose as company employees throughout. A request has to be urgent, so as not to give the victim time to stop and analyze the situation. The audit is tomorrow, the partners just arrived, the amount gets charged this afternoon… long story short, you have to act right now. Scammers will often conduct this part of the conversation by phone, telling the victim not to hang up until the money is transferred. Absolute secrecy. To prevent anyone from interfering with the fraud, the boss early on warns the victim that discussing the incident with anyone is strictly forbidden as disclosure would lead to disastrous consequences. The fraudster might say that theyve no one else to trust, or that some of the other employees are criminals or disloyal to the company. They will generally try to keep the victim from talking to anyone until their demands are met. Example of a scam email from a fake boss Objectives of the attack Depending on the victims position and level of income, an attack may pursue different goals. If the victim is authorized by the company to execute financial transactions, the scammers will try to talk them into making an urgent secret payment to a vendor such as a law firm for assistance in solving problems — or just transferring the companys money to a safe account. Employees who dont deal with the companys money can be targeted by attacks that seek to obtain company data such as passwords to internal systems, or their own funds. Scammers may come up with dozens of backstories, ranging from an accounting data leak that jeopardizes the victims account, to a need to keep the companys cash gap closed until an audit is done. In the latter case, the victim is asked to use their own money in some way: transfer it to another account, pay for gift cards or vouchers, or withdraw it and give it to a trusted person. For greater persuasiveness, the scammers may promise the victim generous compensation for their expenses and effort — only later. Convincing level of detail Social media posts and numerous data leaks have made it much easier for fraudsters to launch carefully prepared, personalized attacks. They can: find the full names of the victim, their immediate senior, the CEO, and employees in the relevant departments (such as accounting), along with the exact department names; and find pictures of these individuals to create convincing instant messaging profiles and, if needed, even voice samples to create audio deepfakes. If theres big money at stake, the scammers may invest significant time in making the charade as convincing as can be. In some previous cases, attackers even knew the locations of company departments inside buildings and the positions of individual employees desks. Technical side of the attack Sophisticated schemes like this nearly always include a phone call from the scammers; however, the initial call from the boss may also come in the form of an email or instant message. In simpler versions of the attack, the scammers just create a new instant messaging or email account with the managers name, while in more sophisticated cases they hack their corporate email or personal accounts. This is called a BEC (business email compromise) attack. As for phone calls, scammers often use number spoofing services or obtain an illegal copy of the SIM card — the victims caller ID then displays the companys general phone number or even their bosss own. Malicious actors may use deepfake voice generators, so a familiar voice on the other end of the line cant guarantee the callers authenticity. Schemes like these may even use video calling where the callers face is also a deepfake. Protecting yourself against scammers First and foremost, attentiveness and courage to verify the information despite the scammers threats are two things that can protect you against this kind of attack. Take it slow, and dont panic. The scammers aim to knock you off balance. Keep calm and double-check all the facts. Even if the other party insists you dont hang up the phone, you can always pretend that the call dropped. This will buy you some time to do more fact-checking. Pay attention to the senders address, phone, and user name. If youre used to corresponding with your boss by email, but then you suddenly get an instant message in their name from an unfamiliar number, its time to prick up your ears. If youve always talked on an instant messaging app and you get a new message but theres no history, this means someones using a newly created account, which is a major red flag. Unfortunately, cybercriminals sometimes use fake email addresses that are hard to tell from the real ones, or hacked email or instant messaging accounts. All of this makes detecting forgery much more difficult. Pay attention to small details. If a person you know approaches you with an odd request, is there anything about the situation that tells you that the person may be an impostor? Do their emails look slightly unusual? Are they using uncharacteristic figures of speech? Do you usually address each other by first names, but theyre using a formal form of address? Try asking them something only the real person could know. Raise a red flag if you get an unusual request. If your boss or coworker is urgently asking you to do something unusual — and to keep it a secret to boot — this is nearly always a sign of a scam. Therefore, its critical that you verify the information you get and confirm the other partys identity. The least you can do is contact that person using a different channel of communication. Talking in person is best, but if this isnt a possibility, call their office or home number that youve got down in your phone book, or punch in that number manually; dont just dial the last incoming number — to avoid circling back to the scammers. Use any other channels of communication available. The cell number that called you — even if its your boss or coworkers real number youve gotten saved in your phone book — might have been compromised through SIM swapping or simple phone theft. Check with your coworkers. Despite being asked to keep it all confidential, depending on the nature of the request, it doesnt hurt to verify the information with your coworkers. If you get what appears to be a message from someone in accounting, contact other people in the same department. Warn your coworkers and law enforcement. If you receive such a message, it means scammers are targeting your organization and coworkers. If their tricks dont work on you, theyll try the next department. Warn your coworkers, warn security, and report the attempted scam to the police.

image for Episode 257: Securin ...

 automobile

In this episode of The Security Ledger Podcast (#257) Paul speaks with Dennis Kengo Oka, a senior principal automotive security strategist at the firm Synopsys about the growing cyber risks to automobiles as connected vehicle features proliferate in the absence of strong cybersecurity protections. The post Episode   show more ...  

257: Securing Software on Wheels...Read the whole entry... » Click the icon below to listen. Related StoriesEpisode 257: Securing Software on Wheels withEpisode 254: Dennis Giese’s Revolutionary Robot Vacuum Liberation MovementEpisode 256: Recursive Pollution? Data Feudalism? Gary McGraw On LLM Insecurity

image for Episode 257: Securin ...

 automobile

In this episode of The Security Ledger Podcast (#257) Paul speaks with Dennis Kengo Oka, a senior principal automotive security strategist at the firm Synopsys about the growing cyber risks to automobiles as connected vehicle features proliferate in the absence of strong cybersecurity protections. The post Episode   show more ...  

257: Securing Software on Wheels...Read the whole entry... » Click the icon below to listen. Related StoriesEpisode 254: Dennis Giese’s Revolutionary Robot Vacuum Liberation MovementEpisode 256: Recursive Pollution? Data Feudalism? Gary McGraw On LLM InsecurityCiting Attacks On Small Utilities, Dragos Launches Community Defense Program

 Trends, Reports, Analysis

Cybercrooks are exploring ways to develop custom, malicious large language models after existing tools such as WormGPT failed to cater to their demands for advanced intrusion capabilities, security researchers said.

 Feed

Ubuntu Security Notice 6719-1 - Skyler Ferrante discovered that the util-linux wall command did not filter escape sequences from command line arguments. A local attacker could possibly use this issue to obtain sensitive information.

 Feed

Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers. This is the source code release.

 Feed

The util-linux wall command does not filter escape sequences from command line arguments. The vulnerable code was introduced in commit cdd3cc7fa4 (2013). Every version since has been vulnerable. This allows unprivileged users to put arbitrary text on other users terminals, if mesg is set to y and wall is setgid.   show more ...  

CentOS is not vulnerable since wall is not setgid. On Ubuntu 22.04 and Debian Bookworm, wall is both setgid and mesg is set to y by default.

 Feed

The 13th International Workshop on Cyber Crime, or IWCC, 2024 call for papers has been announced. It will take place July 30th through August 2nd, 2024 in Vienna, Austria.

 Feed

The server in Circontrol Raption versions through 5.11.2 has a pre-authentication stack-based buffer overflow that can be exploited to gain run-time control of the device as root. The pwrstudio web application of EV Charger (in the server in Circontrol Raption through 5.6.2) is vulnerable to OS command injection.

 Feed

Red Hat Security Advisory 2024-1549-03 - Updated images are now available for Red Hat Advanced Cluster Security. The updated image includes bug and security fixes. Issues addressed include a traversal vulnerability.

 Feed

Red Hat Security Advisory 2024-1538-03 - An update for cnf-tests-container, dpdk-base-container, performance-addon-operator-must-gather NUMA-aware secondary scheduler, numaresources-operator is now available for Red Hat OpenShift Container Platform 4.12.

 Feed

Ubuntu Security Notice 6686-5 - It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the Linux kernel did not properly handle certain error conditions during device registration. A local attacker could possibly use this to cause a denial of service. It was discovered that a race condition existed in   show more ...  

the Cypress touchscreen driver in the Linux kernel during device removal, leading to a use-after- free vulnerability. A physically proximate attacker could use this to cause a denial of service or possibly execute arbitrary code.

 Feed

In June 2017, a study of more than 3,000 Massachusetts Institute of Technology (MIT) students published by the National Bureau for Economic Research (NBER) found that 98% of them were willing to give away their friends' email addresses in exchange for free pizza. "Whereas people say they care about privacy, they are willing to relinquish private data quite easily when

 Feed

Cybersecurity researchers from ETH Zurich have developed a new variant of the RowHammer DRAM (dynamic random-access memory) attack that, for the first time, successfully works against AMD Zen 2 and Zen 3 systems despite mitigations such as Target Row Refresh (TRR). "This result proves that AMD systems are equally vulnerable to Rowhammer as Intel systems, which greatly increases the attack

 Feed

Considering the ever-changing state of cybersecurity, it's never too late to ask yourself, "am I doing what's necessary to keep my organization's web applications secure?" The continuous evolution of technology introduces new and increasingly sophisticated threats daily, posing challenges to organizations all over the world and across the broader spectrum of industries striving to maintain

 Feed

In the whirlwind of modern software development, teams race against time, constantly pushing the boundaries of innovation and efficiency. This relentless pace is fueled by an evolving tech landscape, where SaaS domination, the proliferation of microservices, and the ubiquity of CI/CD pipelines are not just trends but the new norm. Amidst this backdrop, a critical aspect subtly weaves into the

 Feed

A Linux version of a multi-platform backdoor called DinodasRAT has been detected in the wild targeting China, Taiwan, Turkey, and Uzbekistan, new findings from Kaspersky reveal. DinodasRAT, also known as XDealer, is a C++-based malware that offers the ability to harvest a wide range of sensitive data from compromised hosts. In October 2023, Slovak cybersecurity firm ESET 

 Feed

The Police of Finland (aka Poliisi) has formally accused a Chinese nation-state actor tracked as APT31 for orchestrating a cyber attack targeting the country's Parliament in 2020. The intrusion, per the authorities, is said to have occurred between fall 2020 and early 2021. The agency described the ongoing criminal probe as both demanding and time-consuming, involving extensive analysis of a "

 Feed

A sophisticated phishing-as-a-service (PhaaS) platform called Darcula has set its sights on organizations in over 100 countries by leveraging a massive network of more than 20,000 counterfeit domains to help cyber criminals launch attacks at scale. "Using iMessage and RCS rather than SMS to send text messages has the side effect of bypassing SMS firewalls, which is being used to great

 Google

Security researchers find a way to unlock millions of hotel rooms, the UK introduces cyberflashing laws, and Google's AI search pushes malware and scams. All this and much much more is discussed in the latest edition of the "Smashing Security" podcast by cybersecurity veterans Graham Cluley and Carole Theriault, joined this week by T-Minus's Maria Varmazis.

 BLEEPINGCOMPUTER

Source: www.bleepingcomputer.com – Author: Bill Toulas A new phishing-as-a-service (PhaaS) named ‘Darcula’ uses 20,000 domains to spoof brands and steal credentials from Android and iPhone users in more than 100 countries. Darcula has been used against various services and organizations, from postal,   show more ...  

financial, government, taxation departments, to telcos, airlines, utility, offering fraudsters over 200 templates to choose […] La entrada New Darcula phishing service targets iPhone users via iMessage – Source: www.bleepingcomputer.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team By Eric Sugar, President, ProServeIT In an era defined by the relentless advance of digitalization and the ever-expanding interconnectivity of industrial systems, the realm of cybersecurity has been thrust into the forefront of our collective   show more ...  

consciousness. The conventional paradigms of network security — once seen as impregnable — have demonstrated […] La entrada Implementing ZTA: Benefits and Best Practices – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

 Cyber Security News

Source: www.cyberdefensemagazine.com – Author: News team Cyberdefenders plug the holes, so attackers innovate to try to stay ahead. By Aaron Walton, Threat Intel Analyst, Expel Most cyberattackers don’t try to reinvent the wheel: as long as something works, they’ll keep doing it. Unfortunately for them,   show more ...  

cybersecurity teams are very good at diagnosing issues, fixing them, […] La entrada Attackers Keep Evolving: Lessons from Expel’s Q2 2023 Quarterly Threat Report – Source: www.cyberdefensemagazine.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

2024-03
Aggregator history
Thursday, March 28
FRI
SAT
SUN
MON
TUE
WED
THU
MarchAprilMay