Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for Cyberattack on Telem ...

 Cyber News

A recent cyberattack on the UK-based telematics provider, Microlise, has left British prison vans temporarily without essential tracking systems and panic alarms. While this disruption raised concerns about the safety and security of prisoner transportation, there is currently no indication that criminals have   show more ...  

attempted to exploit the situation. Authorities have assured the public that the cyberattack on Microlise has had no operational impact on British prisoner escort services. Microlise, a leading transport technology firm listed on the London Stock Exchange (AIM: SAAS), provides telematics services to fleet operators. Among its clients is Serco, a major contractor for the British Ministry of Justice responsible for transporting prisoners. Microlise Confirms Limited Data Breach Following the cyber incident, Microlise reported that the attack may have led to the exposure of some employee data but confirmed that no customer systems data was compromised. In an updated statement, Microlise stated, "We are making substantial progress in containing and clearing the threat from our network. Services are being brought back online and are expected to return to normal by the end of next week." The company has notified individuals potentially affected by the data breach, as per regulatory requirements, and is keeping the Information Commissioner’s Office (ICO) informed of developments. Details of Microlise Cyberattack and Progress in Restoration Microlise first disclosed the cyberattack to the London Stock Exchange on October 31, 2024, though details regarding the impact on customers, specifically the prison transport service managed by Serco, only recently emerged. According to Financial Times, Serco staff were notified that tracking, panic alarms, and navigation systems on prisoner escort vans were temporarily disabled due to the Microlise data breach. Despite these issues, officials view the incident as having no direct effect on the operations of British prisoner transport. The company has been progressively restoring services since the attack, and Microlise’s current assessment indicates that the incident will not significantly impact its financial forecasts or operational outlook. Microlise has also emphasized its commitment to transparently updating the market should any notable changes arise. Supply Chain Vulnerabilities in the Spotlight This incident brings attention to the vulnerability of third-party suppliers and the impact of supply chain attacks on critical services. There is no suggestion that the attackers targeted Microlise with knowledge of its connection to Serco’s prison transportation operations, but the breach highlights the potential for unintended consequences when cybersecurity incidents hit companies in key supply chains. The British government is aware of these risks and has been taking steps to improve supply chain security. A recent pilot project under the Cyber Essentials certification scheme aims to secure supply chains, starting with the largest UK banks implementing security standards for their suppliers. The Cyber Essentials scheme encourages basic cyber hygiene among businesses, helping to reduce vulnerabilities by establishing a minimum security baseline. Low Supply Chain Risk Management Among UK Businesses Despite increased awareness, many UK businesses have yet to prioritize cybersecurity within their supply chains. In the past year, only 6% of UK companies assessed cyber risks across their broader supply chain, partly due to limited resources, expertise, and cybersecurity tools. This low adoption rate of supply chain risk management has prompted government action, as unprotected businesses are increasingly targeted by cybercriminals exploiting supply chain weaknesses. As a response, the government plans to promote broader adoption of Cyber Essentials, viewing it as a valuable tool for supply chain risk assurance. The scheme offers a cost-effective way for businesses to strengthen their security posture and mitigate the risks posed by third-party vulnerabilities. Upcoming Cyber Security and Resilience Bill to Strengthen Defenses To further bolster UK cyber defenses, the government recently announced the forthcoming Cyber Security and Resilience Bill, introduced as part of the King’s Speech in July 2024. Set to be presented in Parliament in 2025, this legislation aims to expand the scope of existing cybersecurity regulations to cover a wider array of essential digital services, including critical infrastructure and public sector contractors. The Cyber Security and Resilience Bill will enhance existing UK cyber laws, which currently mirror regulations inherited from the European Union. With the EU’s recent updates to its own cybersecurity framework, the UK faces a pressing need to strengthen its regulations to ensure that the country’s infrastructure and economy remain protected against emerging threats. In line with the new legislation, regulators will be given increased authority, and businesses will face enhanced reporting obligations. These changes aim to provide the government with a clearer understanding of cyber threats and a more proactive response to protecting essential services from disruptive attacks. The bill represents a crucial step toward fortifying the nation’s cybersecurity stance and supporting businesses in managing their cybersecurity risks more effectively. Microlise’s Assurance and Commitment to Customers Microlise has expressed its gratitude to customers for their patience and understanding during the recovery period. “We would like to thank our customers for their patience and understanding while we continue to work to resolve this issue as quickly as possible,” the company stated. It remains focused on restoring normal operations swiftly and ensuring that all potential impacts are managed responsibly. With the British government’s anticipated Cyber Security and Resilience Bill, there is a renewed focus on ensuring the resilience of critical infrastructure and essential public services in an increasingly connected and vulnerable digital landscape.

image for Stealthier GodFather ...

 Cyber News

Cyble researchers have identified a new stealthier variant of the GodFather malware that uses native code and automated actions to target as many as 500 banking and cryptocurrency apps. “The latest version of the GodFather malware shows how dangerous and adaptable mobile threats have become,” the Cyble researchers   show more ...  

wrote. “By moving to native code and using fewer permissions, the attackers have made GodFather harder to analyze and better at stealing sensitive information from banking and cryptocurrency apps.” GodFather Malware Expands Targets to Include Japan, Singapore The Cyble Research and Intelligence Labs (CRIL) researchers noted that the infostealer has expanded its target countries from the UK, U.S., Turkey, Spain and Italy to add Japan, Singapore, Greece and Azerbaijan. The previous Java code implementation has moved to native code for its malicious activities, and the malware now relies on limited permissions, “relying heavily on Accessibility services to capture credentials from targeted applications,” the researchers said. Commands for USSD and SMS operations have been dropped from the latest version, and the malware lacks permission to collect or send SMS messages from infected devices. Instead, newly added commands focus primarily on automating actions on infected devices. The new GodFather malware commands “enable the malware to automate gestures on infected devices, mimicking user actions,” the CRIL blog said. “With its new automated actions and broader targeting of apps in more countries, this malware poses a growing risk to users worldwide,” Cyble said. Overlay Attack Replaced by Fake Login URL In one interesting twist, instead of a traditional overlay attack, the malware no longer loads the legitimate application and instead activates itself and loads a phishing page to steal banking credentials. “When the user tries to interact with the target application, the malware closes the genuine application,” the researchers said. “Instead, it loads a fake banking or crypto login URL into the WebView or displays a blank screen.” It constructs the injection URL using the command and control (C&C) server akozamora[.]top and appends the endpoint rx/f.php?f= along with the device name, package name and default language before loading the assembled URL in the WebView. [caption id="attachment_92605" align="aligncenter" width="550"] The new GodFather malware variant targets 500 banking and crypto apps (Cyble)[/caption] New GodFather Malware Variant Found on Phishing Site The researchers found the new malware variant after discovering a phishing site, mygov-au[.]app, that spoofed the official MyGov website of the Australian Government. “Upon further analysis, this site was found to be distributing a suspicious APK file linked to the GodFather Malware, known for its ability to steal banking application credentials,” the researchers said. That application, MyGov.apk, communicates with the URL az-inatv[.]com. That site hosts an open directory containing a file named counters.zip that tracked infected devices and included a list of IP addresses. The directory also included a page labeled “down” that hosted another APK file called lnat Tv Pro 2024.apk, which the researchers identified as the GodFather Malware. “While the MyGov application collected this data, we suspect the TA may leverage this visitor information to identify potential victim counts and later use the same website to distribute the GodFather malware,” Cyble said. The researchers recommended following good security practices, such as only installing apps from official app stores like the Google Play Store or the iOS App Store, keeping devices and apps updated, and using antivirus, strong passwords, biometrics and multi-factor authentication. The full blog also includes MITRE ATT&CK techniques and indicators of compromise (IoC).

image for Germany Drafts Law t ...

 Cyber News

The Federal Ministry of Justice in Germany has released a draft law aimed at providing legal protection for security researchers who identify and responsibly report security vulnerabilities. This legislation, part of an effort to modernize Germany's computer criminal law, aims to ensure that ethical security   show more ...  

research is shielded from criminal liability while setting tougher penalties for harmful cyber crimes. The proposed law outlines clear boundaries for legal security research activities, allowing researchers to identify and communicate IT vulnerabilities to vendors without fear of prosecution, provided their actions stay within the established guidelines. Currently, laws such as Section 202a of the Criminal Code (StGB) criminalize unauthorized access to data, even when intended for beneficial purposes, making it risky for ethical hackers to responsibly disclose security flaws. Under the new draft, the Ministry proposes adding a new paragraph to Section 202a, as well as to Sections 202b and 303a, specifying the conditions under which security research is deemed "authorized" and thus exempt from criminal penalties. Justice Minister: Recognize, Don’t Punish, Ethical Hacking Dr. Marco Buschmann, Germany’s Federal Minister of Justice, highlights the importance of fostering an environment where security researchers can contribute to public safety. "Anyone who wants to close IT security gaps deserves recognition – not a letter from the public prosecutor," Dr. Buschmann stated. He emphasized that unchecked security vulnerabilities pose serious threats to critical sectors like healthcare, transportation, and energy. Cyber criminals and foreign powers can exploit IT security gaps, which could paralyze hospitals, disrupt transportation, or jeopardize power plants. It is therefore in the public’s best interest that security flaws are identified and patched swiftly. With this draft law, we aim to remove the criminal liability risk for individuals who undertake this vital work," he added. The draft law does more than protect security researchers; it also enacts stricter punishments for severe cases of data espionage and interception. It introduces provisions for penalizing particularly serious instances of spying and data tampering. Under the proposed revisions, serious offenses related to unauthorized access (Section 202a) and data interception (Section 202b) could lead to stricter consequences if they meet certain criteria. These cases are considered “particularly serious” if the criminal act results in significant financial loss, is driven by greed or commercial gain, or is conducted by an organized group. Crimes compromising the functionality, integrity, or confidentiality of critical infrastructure—such as utilities or transportation networks—or the security of Germany, will also be subject to harsher penalties. Individuals involved in such activities could face prison sentences ranging from three months to five years. Protecting National Security through Tougher Cybercrime Laws The legislation highlights how critical infrastructure has become an increasingly attractive target for cybercriminals, as attacks on these systems can cause widespread disruption and substantial economic losses. By increasing penalties for these high-stakes crimes, the Ministry aims to create a strong deterrent against cybercriminals who pose risks to essential public services and national security. The Federal Ministry of Justice published the draft on its website and has circulated it to various states and associations for review. Stakeholders, including cybersecurity firms, legal experts, and public sector representatives, have until December 13, 2024, to submit their comments on the proposed changes. These statements will be made available to the public, allowing for transparent discourse on this significant regulatory update. The draft law aligns with Germany's broader efforts to strengthen national cybersecurity, as well as the European Union’s ongoing focus on harmonizing cyber defenses. The current German regulations governing computer-related crimes were largely inherited from EU laws but have since been revised by the EU to address new cyber risks. This legislative update is part of Germany's attempt to keep pace with the evolving cyber landscape, ensuring that its digital infrastructure remains resilient and its critical industries protected. Cybersecurity professionals and ethical hackers across Germany have long advocated for legal clarity around responsible disclosure practices, which have often fallen into a gray area. Under existing laws, even well-intentioned attempts to notify companies of vulnerabilities could result in criminal investigations, discouraging researchers from assisting in improving cybersecurity. The proposed draft law is expected to ease this concern by explicitly distinguishing between malicious hacking and authorized vulnerability research. Addressing Rising Cyber Threats to Critical Sectors Germany’s focus on cybersecurity has grown considerably in recent years, driven by a rise in cyberattacks on critical infrastructure and the private sector. The proposed law reflects an increasing awareness of cybersecurity as a collective responsibility, with the government supporting a legal framework that promotes collaboration between researchers and organizations. As technology continues to integrate into every aspect of society, from transportation to healthcare, ensuring the integrity and security of IT systems has become a top priority. The German government’s legislative efforts aim to secure this integration by not only safeguarding critical infrastructure but also supporting those who work to protect it. With this draft, the Ministry of Justice is taking steps to balance the need for strong cybersecurity with protections for those whose work helps uncover and fix vulnerabilities. The outcome of this proposal will have implications beyond Germany, likely setting a precedent for other countries that face similar challenges in promoting responsible cybersecurity practices. The final decision on the law is expected after the feedback period ends, with the Ministry reviewing all comments to consider adjustments. If passed, this law would signal a significant step forward in Germany’s approach to cybersecurity, potentially encouraging more security professionals to engage in vulnerability discovery, reporting, and ultimately enhancing the nation’s defenses against cyber threats.

image for Indian Online Stock ...

 Cyber News

Deepfakes are on the minds of many in India this week after a pair of Bengaluru residents lost 26 lakh Rupees (about US$31,000) in an Indian online stock trading scam. The two fell victim to deepfakes of Infosys co-founder NR Narayana Murthy and Reliance Industries chairman Mukesh Ambani, according to a Times of India   show more ...  

report. One of the two lost an additional 57.2 lakh Rupees (almost US$68,000) on a work-from-home job scam. Murthy had issued a public warning last December that there were deepfakes circulating that claimed to be him and that urged people to invest in an online trading app, and The Cyber Express has reported on deepfakes involving Ambani and other well-known figures. Indian Online Stock Trading Scam Detailed One of the victims, identified by the Times as Veena KG, 57, a resident of Banashankari, told south CEN crime police that she lost Rs 67.1 lakh (more than US$79,000) between Sept. 23 and Oct. 20. On Sept. 23, she saw a deepfake video of Murthy on Facebook promoting the “FX Road” stock trading platform. She contacted them and heard back from someone at info[at]fxroad[.]com who encouraged her to invest in the platform. She invested Rs 1.4 lakh from a credit card, saw returns of Rs 8,363, invested another Rs 6.7 lakh but never received the profits. She later fell victim to a work-from-home scam on Instagram. When she realized she was being cheated, she contacted cyber helpline 1930 and filed a complaint with police. The second victim, Asok Kumar TS, 63, of Rajapura of Anekal in Bengaluru Rural, fell for a deepfake video of Murthy and Ambani that also promoted FX Road. Police said the scam had been widely reported, and urged people to be wary of potential deepfakes from prominent people. Deepfakes Hit Companies Too It’s not just small investors who get hit by deepfake scams. A multinational company in Hong Kong fell victim to a US$25 million scam earlier this year, and deepfakes also targeted U.S. and Indian elections this year and have been wielded in other sensitive situations like the Russia-Ukraine war. The Delhi High Court recently ordered the Union government to look into the growing matter of deepfakes and report back later this month. To help companies and other organizations fight the growing menace of deepfakes, Cyble recently began offering its threat intelligence customers a real-time deepfake detection and takedown tool. The tool combines AI-powered monitoring and detection with real-time alerts so organizations can quickly identify and remove deepfake threats.

image for Critical Command Inj ...

 Vulnerability News

Cisco’s Unified Industrial Wireless Software for Ultra-Reliable Wireless Backhaul (URWB) Access Points contain a severe vulnerability that potentially allows attackers to execute commands with root privileges on affected systems. The flaw, identified as CVE-2024-20418, holds a CVSS score of 10, underscoring its   show more ...  

critical nature. Currently, there are no workarounds, although Cisco has released a software update to address this issue. The vulnerability exists due to insufficient validation within the URWB web-based management interface, making it possible for unauthenticated attackers to exploit the flaw by sending malicious HTTP requests to the interface. A successful exploit could grant attackers root access, putting networked devices at significant risk. Cisco urges users to upgrade to the latest firmware to mitigate potential impacts. Also read: State Spies Exploited Cisco Zero-Days to Intrude Government Networks Affected Cisco Devices and Identifying Vulnerable Systems The vulnerability affects Cisco Catalyst models operating in URWB mode, including the Catalyst IW9165D, IW9165E, and IW9167E series. Users can determine their device’s configuration by running the show mpls-config command in the CLI. Devices that respond positively to this command are in URWB mode and are at risk. Importantly, other Cisco wireless devices, including the 6300 Series and various Aironet models, remain unaffected. No Workarounds Available – Upgrade Required Cisco has not provided a workaround for the vulnerability, making an immediate upgrade essential. Fixed software versions are available, with Cisco recommending that users follow their usual update channels if they have active service contracts. Customers without a service contract should contact Cisco TAC for assistance. What is Cisco’s Ultra-Reliable Wireless Backhaul (URWB)? Cisco’s URWB technology provides the robust, low-latency wireless connectivity essential for critical, high-stakes applications across industrial and mobile environments. Designed to replace costly and complex wired infrastructure, URWB enables seamless, multigigabit performance with minimal packet loss, making it invaluable for sectors relying on autonomous systems, such as manufacturing, transportation, and energy. URWB extends beyond conventional wireless capabilities, using 802.11 technology over unlicensed spectrum to allow scalable, interference-resistant connectivity. It also features “make-before-break” handoffs and Multipath Operations (MPO) to ensure uninterrupted connections for fast-moving assets like automated guided vehicles (AGVs) and trains, even in high-speed or noise-prone environments. Industries such as ports, railways, and manufacturing leverage URWB for real-time applications, including video monitoring and remote machinery control, benefiting from reduced deployment costs and greater flexibility. The technology supports dual-mode capability, allowing devices to toggle between URWB and Wi-Fi 6/6E based on project needs, thereby optimizing infrastructure investments. Keeping Cisco Devices and Networks Secure Cisco recommends regularly consulting its Security Advisories page to stay updated on vulnerabilities and ensure timely software upgrades. The Cisco Product Security Incident Response Team (PSIRT) is committed to validating affected and fixed release details, helping organizations better manage risk. For industries relying on Cisco’s URWB for seamless, reliable wireless connectivity, this security update serves as a crucial step in maintaining robust and secure network operations. Also read: Cisco Patches Critical Vulnerability Affecting VPN Services

image for Australia’s Bold M ...

 Cyber News

Australia has unveiled plans to legislate a world-leading ban on social media access for children under the age of 16. Prime Minister Anthony Albanese made the announcement about Australia ban on social media on Thursday, revealing that the government is taking drastic steps to protect children from the harmful   show more ...  

effects of excessive social media use. This new initiative of Australia's ban on social media is expected to become law by late 2025. Australia Ban on Social Media: Stronger Safeguards for Online Youth The proposed measures aim to reduce the growing concerns over children’s exposure to social media and its detrimental impact on their mental and physical health. In particular, the government is addressing issues such as harmful body image depictions for young girls and misogynistic content targeted at boys. “Social media is doing harm to our kids, and I’m calling time on it,” said Albanese in a press conference. “I’ve spoken to thousands of parents, grandparents, aunties, and uncles. They, like me, are worried sick about the safety of our kids online, and I want Australian families to know that the Government has your back.” Albanese pointed to the negative effects of online content on children's well-being, including issues like body image distortion and inappropriate material being fed to impressionable young people. “What we are doing is listening and then acting,” he added. Age Verification Trials and Responsibility of Social Media Platforms Australia is already trialing an age-verification system that will assist in blocking children from accessing social media platforms. This includes cutting-edge methods like biometrics and government identification verification to ensure that only those who meet the minimum age requirement will have access. The onus for enforcing the age limit will rest solely on the shoulders of social media platforms. They will be required to demonstrate that they are taking reasonable steps to ensure children are blocked from accessing their services. Albanese emphasized that there will be no penalties for the users, and the responsibility will not lie with parents or children. The proposed age limit, set at 16, will be introduced into Parliament later this year, with a year-long grace period before enforcement begins. A review of the legislation will follow to ensure it remains effective and adaptable. “We want to make sure we get this right,” said Albanese. “The eSafety Commissioner will oversee the implementation, ensuring platforms take all reasonable steps to prevent underage access.” A Global First: No Exemptions and Strict Enforcement Australia’s new laws will set the highest age limit yet imposed globally, with no exemptions for parental consent. This approach is a significant shift from other countries, where parents can often consent to their children using social media services. In France, for instance, the government proposed a similar ban for children under 15, but with the option of parental consent. The government is also ensuring that platforms, such as Instagram, Facebook, TikTok, and YouTube, fall under the scope of this legislation. These platforms will be expected to adhere to new age verification protocols and demonstrate compliance to the Australian authorities. A Growing International Trend Other countries have made similar attempts to curb social media use among young people, but Australia’s approach is one of the strictest seen so far. The United States, for example, has long required parental consent for children under 13 to access certain digital platforms, while the European Union has discussed age restrictions but has not yet enforced a blanket ban. Minister for Communications Michelle Rowland, who championed the policy, highlighted the global impact of the new rules. “What we are announcing here and what we will legislate will be truly world-leading,” Rowland said. She went on to explain that the legislation would ensure platforms take proactive steps to protect vulnerable children and adolescents from harmful content. Industry Pushback While the government has emphasized the importance of safeguarding children’s mental health, some industry voices have raised concerns about the potential negative effects of such a ban. The Digital Industry Group, which represents major platforms such as Meta (Facebook, Instagram), TikTok, X (formerly Twitter), and Google, criticized the measure, warning that it could drive young people toward unregulated parts of the internet. “Keeping young people safe online is a top priority,” said Sunita Bose, Managing Director of the Digital Industry Group. “But the proposed ban for teenagers to access digital platforms is a 20th Century response to 21st Century challenges. Rather than blocking access through bans, we need to take a balanced approach to create age-appropriate spaces, build digital literacy, and protect young people from online harm.” Moving Forward Despite the criticism, the Australian government is pushing ahead with its plan. The legislation, once passed, will be implemented by 2025, with a review process to follow shortly after its commencement. The government aims to set a global standard for how children should be protected in the digital space, signaling its commitment to ensuring the safety of young Australians online. Albanese’s stance is clear: “These tech companies are incredibly powerful. They have algorithms that drive people toward certain behaviors. The fact is, young women see images of particular body shapes that have a real impact in the real world. And young men, through some of the misogynistic material they receive, face challenges that are difficult to navigate during a time of personal growth.” As the debate continues, Australia’s bold approach will undoubtedly be watched closely by other nations grappling with similar issues around child safety in the digital age.

image for Tor Browser and anon ...

 Privacy

The desire to remain anonymous online is as old as the internet itself. In the past, users believed hiding behind a nickname meant they could badmouth their neighbors on local forums with impunity. Now, such trolls can be identified in seconds. Since those early days, technology has taken a quantum leap: distributed   show more ...  

networks, anonymous browsers, and other privacy tools have emerged. One of these tools, which was heavily promoted a decade ago by former NSA contractor Edward Snowden, is the Tor Browser, where TOR is an acronym for The Onion Router. But in todays world, can Tor truly provide complete anonymity? And if it doesnt, should we just forget all about anonymity and rely on a regular browser like Google Chrome? How Tor users are deanonymized If Tor is new to you, check out our vintage article from way back when. There, we answered some common questions: how the browser ensures anonymity, who needs it, and what people usually do on the dark web. In brief, Tor anonymizes user traffic through a distributed network of servers, called nodes. All network traffic is repeatedly encrypted as it passes through a number of nodes between two communicating computers. No single node knows both the origin and destination addresses of a data packet, nor can it access the packets content. OK, short digression over — now lets turn to the real security threats facing anonymity enthusiasts. In September, German intelligence services identified a Tor user. How did they do it? The key to their success was data obtained through whats called timing analysis. How does this analysis work? Law enforcement agencies monitor Tor exit nodes (the final nodes in the chains that send traffic to its destination). The more Tor nodes the authorities monitor, the greater the chance a user hiding their connection will use one of those monitored nodes. Then, by timing individual data packets and correlating this information with ISP data, law enforcement can trace anonymous connections back to the end Tor user — even though all Tor traffic is encrypted multiple times. The operation described above, which led to the arrest of the administrator of a child sexual abuse platform, was possible partly because Germany hosts the highest number of Tor exit nodes — around 700. The Netherlands ranks second with about 400, and the US comes in third with around 350. Other countries have anywhere from a few to a few dozen. International cooperation among these top exit-node countries played a significant role in deanonymizing the child sexual abuse offender. Logically, the more nodes a country has, the more of them can be state-monitored, increasing the likelihood of catching criminals. Germany and the Netherlands are among the leaders on the number of Tor exit nodes — not only in Europe but worldwide. Source The Tor Project responded with a blog post discussing the safety of their browser. It concludes that its still safe: the de-anonymized individual was a criminal (why else would authorities be interested?), using an outdated version of Tor and the Ricochet messaging app. However, Tor noted it wasnt given access to the case files, so their interpretation regarding the security of their own browser might not be definitive. This kind of story isnt new; the problem of timing attacks has long been known to the Tor Project, intelligence agencies, and researchers. So although the attack method is well-known, it remains possible, and most likely, more criminals will be identified through timing analysis in the future. However, this method isnt the only one: in 2015, our experts conducted extensive research detailing other ways to attack Tor users. Even if some of these methods have become outdated in the forms presented in that study, the principles of these attacks remain unchanged. Generally it is impossible to have perfect anonymity, even with Tor. This phrase opens the Am I totally anonymous if I use Tor? section of the Tor Browser support page. Here, the developers provide tips, but these tips can at best only increase the chances of remaining anonymous: Control what information you provide through web forms. Users are advised against logging in to personal accounts on social networks, as well as posting their real names, email addresses, phone numbers, and other similar information on forums. Dont torrent over Tor. Torrent programs often bypass proxy settings and prefer direct connections, which can de-anonymize all traffic — including Tor. Dont enable or install browser plugins. This advice also applies to regular browsers, as there are many dangerous extensions out there. Use HTTPS versions of websites. This recommendation, incidentally, applies to all internet users. Dont open documents downloaded through Tor while online. Such documents, the Tor Project warns, may contain malicious exploits. With all these recommendations, the Tor Project is essentially issuing a disclaimer: Our browser is anonymous, but if you misuse it, you may still be exposed. And this actually makes sense — your level of anonymity online depends primarily on your actions as a user — not solely on the technical capabilities of the browser or any other tool. There is another interesting section on the Tor support page: What attacks remain against onion routing? It specifically mentions possible attacks using timing analysis with the note that Tor does not defend against such a threat model. However, in a post about the German users de-anonymization, the developers claim that an add-on called Vanguard, designed to protect against timing attacks, has been included in Tor Browser since 2018, and in Ricochet-Refresh since June 2022. This discrepancy suggests one of two things: either the Tor Project hasnt updated its documentation, or its being somewhat disingenuous. Both are problematic because they can mislead users. So what about anonymity? Its important to remember that Tor Browser cant guarantee 100% anonymity. At the same time, switching to other tools built on a similar distributed node network structure is pointless, as they are equally vulnerable to timing attacks. If youre a law-abiding individual using anonymous browsing simply to avoid intrusive contextual ads, secretly shop for gifts for loved ones, and for other similarly harmless purposes, the private browsing mode in any regular browser will probably suffice. This mode, of course, doesnt offer the same level of anonymity as Tor and its counterparts, but it can make surfing the net a bit more well, private. Just make sure you fully understand how this mode works in different browsers, and what it can and cant protect you from. In addition, all of our home security solutions include Private Browsing. By default, this feature detects attempts to collect data and logs them in a report but doesnt block them. To block data collection, you need to either enable Block data collection in the Kaspersky app or activate the Kaspersky Protection plugin directly in the browser. Besides this, our protection can also block ads, prevent the hidden installation of unwanted apps, detect and remove stalkerware and adware, and remove traces of your activity in the operating system. Meanwhile, the special component Safe Money provides maximum protection for all financial operations by conducting them in a protected browser in an isolated environment and preventing other apps from gaining unauthorized access to the clipboard or taking screenshots. Double VPN You can also stay anonymous on the internet using Kaspersky VPN Secure Connection that support Double VPN (also known as multi-hop). As the name suggests, this technology allows you to create a chain of two VPN servers in different parts of the world: your traffic first passes through an intermediary server, and then through another. Double VPN in Kaspersky VPN Secure Connection uses nested encryption — the encrypted tunnel between the client and the destination server runs inside a second encrypted tunnel between the client and the intermediary server. Encryption in both cases is only performed on the client side, and data is not decrypted on the intermediary server. This provides an additional layer of security and anonymity. Double VPN is available to users of Windows and Mac versions of Kaspersky VPN Secure Connection. Before enabling Double VPN, make sure that the Catapult Hydra protocol is selected in the application settings: Main -> Settings (gear icon) -> Protocol -> Select automatically, or Catapult Hydra. After that, you can enable Double VPN: Open the main application window. Click the Location drop-down to open the list of locations of VPN servers. Click the Double VPN Select two locations and click Connect. You can add your Double VPN server pair to Favorites by clicking the Add to Favorites button. How to enable Double VPN in Kaspersky VPN Secure Connection Congratulations! Now your traffic is encrypted more securely than usual — but remember that these traffic encryption methods are not intended for illegal activities. Double VPN will help you conceal personal information from data-gathering sites, avoid undesirable ads, and access resources unavailable in your current location.

image for Has the Cybersecurit ...

 Feed

While training and credentialing organizations continue to talk about a "gap" in skilled cybersecurity workers, demand — especially for entry-level workers — has plateaued, spurring criticism of the latest rosy stats that seem to support a hot market for qualified cyber pros.

 Feed

Red Hat Security Advisory 2024-8690-03 - Red Hat OpenShift Container Platform release 4.13.53 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and traversal vulnerabilities.

 Feed

Ubuntu Security Notice 7088-4 - Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could use this to cause a denial of service. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

Ubuntu Security Notice 7095-1 - Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

Ubuntu Security Notice 7089-3 - Chenyuan Yang discovered that the USB Gadget subsystem in the Linux kernel did not properly check for the device to be enabled before writing. A local attacker could possibly use this to cause a denial of service. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

 Feed

While parsing test result XML files with the TestRail CLI, the presence of certain TestRail-specific fields can cause untrusted data to flow into an eval() statement, leading to arbitrary code execution. In order to exploit this, an attacker would need to be able to cause the TestRail CLI to parse a malicious XML file.   show more ...  

Normally an attacker with this level of control would already have other avenues of gaining code execution.

 Feed

Red Hat Security Advisory 2024-8977-03 - An update for the python39:3.9 module is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions, and Red Hat Enterprise Linux 8.4 Telecommunications Update Service.

 Feed

Red Hat Security Advisory 2024-8694-03 - Red Hat OpenShift Container Platform release 4.12.68 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include denial of service and traversal vulnerabilities.

 Feed

A threat actor with ties to the Democratic People's Republic of Korea (DPRK) has been observed targeting cryptocurrency-related businesses with a multi-stage malware capable of infecting Apple macOS devices. Cybersecurity company SentinelOne, which dubbed the campaign Hidden Risk, attributed it with high confidence to BlueNoroff, which has been previously linked to malware families such as

 Feed

Defending your organization’s security is like fortifying a castle—you need to understand where attackers will strike and how they’ll try to breach your walls. And hackers are always searching for weaknesses, whether it’s a lax password policy or a forgotten backdoor. To build a stronger defense, you must think like a hacker and anticipate their moves. Read on to learn more about hackers'

 Feed

Tactics, techniques, and procedures (TTPs) form the foundation of modern defense strategies. Unlike indicators of compromise (IOCs), TTPs are more stable, making them a reliable way to identify specific cyber threats. Here are some of the most commonly used techniques, according to ANY.RUN's Q3 2024 report on malware trends, complete with real-world examples. Disabling of Windows Event Logging

 Feed

An ongoing phishing campaign is employing copyright infringement-related themes to trick victims into downloading a newer version of the Rhadamanthys information stealer since July 2024. Cybersecurity firm Check Point is tracking the large-scale campaign under the name CopyRh(ight)adamantys. Targeted regions include the United States, Europe, East Asia, and South America. "The campaign

 Feed

The China-aligned threat actor known as MirrorFace has been observed targeting a diplomatic organization in the European Union, marking the first time the hacking crew has targeted an entity in the region. "During this attack, the threat actor used as a lure the upcoming World Expo, which will be held in 2025 in Osaka, Japan," ESET said in its APT Activity Report for the period April to

 Feed

Cisco has released security updates to address a maximum severity security flaw impacting Ultra-Reliable Wireless Backhaul (URWB) Access Points that could permit unauthenticated, remote attackers to run commands with elevated privileges. Tracked as CVE-2024-20418 (CVS score: 10.0), the vulnerability has been described as stemming from a lack of input validation to the web-based management

 Feed

Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) that has racked up thousands of downloads for over three years while stealthily exfiltrating developers' Amazon Web Services (AWS) credentials. The package in question is "fabrice," which typosquats a popular Python library known as "fabric," which is designed to execute shell commands remotely over

 Feed

The Canadian government on Wednesday ordered ByteDance-owned TikTok to dissolve its operations in the country, citing national security risks, but stopped short of instituting a ban on the popular video-sharing platform. "The decision was based on the information and evidence collected over the course of the review and on the advice of Canada's security and intelligence community and other

2024-11
Aggregator history
Thursday, November 07
FRI
SAT
SUN
MON
TUE
WED
THU
NovemberDecemberJanuary