JR. SECURITY EVANGELIST

This week we’ve posted an article on the methods used by cybercriminals to hack your password. And that’s just in time, since apparently 17% of Internet users use “123456” as their default password.

Security articles of the week (January 15-20, 2016)

Technology is improving at a very rapid pace, a testimony to that is how facial recognition has advanced to the point where it can recognize the same face 18 years apart. We also can’t forget to mention the genuine conversation that exists concerning the potential threat posed by AI.

So without further ado, here are this week’s top 10 security articles.

1.          Weak passwords are still the root cause of data breaches

“Looking at the list of 2016’s most common passwords, we couldn’t stop shaking our heads. Nearly 17 percent of users are safeguarding their accounts with “123456.” What really perplexed us is that so many website operators are not enforcing password security best practices.” states the report published by Keeper Security. “We scoured 10 million passwords that became public through data breaches that happened in 2016.

2.          Anonymous launches a new operation — to stop seagull genocide!

After a Middle East Airlines flight encountered a sizeable flock of seagulls as it landed at the Rafik Hariri International Airport in Beirut, Lebanese government officials reportedly called for hunters to shoot any birds in the area.

Outraged by what it refers to as “Seagull genocide”, Anonymous is calling on all environmentalists and animal rights activists to spread the word before it’s too late.

3.          Locky Ransomware Hackers Are On Extended Vacation For Some Reason

For the past year, the malware known as “Locky,” which infects victims’ computers and encrypts their files before demanding a ransom in order to release them, has been one of the most effective and dreaded threats on the internet.

But in the last three weeks, a period that coincided with the holidays, Locky attacks have pretty much stopped, according to security researchers.

4.          The top mobile threats of 2016

If we learned anything in 2016, it’s that mobile threats are not going away – if anything, they’re growing, multiplying and becoming increasingly sophisticated. While there’s no perfect crystal ball, I do expect to see some new trends and patterns emerge in 2017 that CISOs need to be ready for. Here is a look at some of major threats discovered in 2016, and what these threats will look like in 2017.

5.          How—and why—you should use a VPN any time you hop on the internet

One of the most important skills any computer user should have is the ability to use a virtual private network (VPN) to protect their privacy. A VPN is typically a paid service that keeps your web browsing secure and private over public Wi-Fi hotspots. VPNs can also get past regional restrictions for video- and music-streaming sites and help you evade government censorship restrictions—though that last one is especially tricky.

6.          Alexa, Are You Keeping My Information Private?

Let’s get an understanding of how Alexa works. When the wake word is spoken, it actually takes a few seconds of recorded data before the wake word and about 60 seconds in recorded data in total. This data is stored locally and sent up to the cloud for analysis and to assist with Alexa’s logic. These recordings are also used to better understand speech by Amazon, helping to teach its A.I. about accents and speech recognition.

7.          You Can Crash Anyone’s iPhone Or iPad With a Simple Emoji Text Message

A newly discovered bug in Apple’s iOS mobile operating system is being exploited in a prank that lets anyone crash your iPhone or iPad by just sending an emoji-filled iMessage, according to several reports.

8.          Anti-virus software is getting worse at detecting both known and new threats

Average detection rates for known malware went down a couple of percentage points slightly from 2015 to 2016, he said, while detection rates for zero-days dropped in a big way – from an average of 80 percent down to 70 percent or lower.

9.          Elite Scientists Have Told the Pentagon That AI Won’t Threaten Humanity

A new report authored by a group of independent US scientists advising the US Dept. of Defense (DoD) on artificial intelligence (AI) claims that perceived existential threats to humanity posed by the technology, such as drones seen by the public as killer robots, are at best “uninformed”.

10.  Alleged child molester caught after 18 years thanks to facial recognition

In a pretty awesome demonstration of how far facial recognition technology has advanced, a child molester has been arrested after being recognized by such specialized software.

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

Trump’s inauguration is just around the corner, and at this point both the Obama administration and the incoming one have revealed their final moves in the cybersecurity field before the transition takes place.

Also, this week’s news has been dominated by The Shadow Broker’s offering of a database of NSA-grade hacking tools, and we were the first to break the news about it.

As for our own blog, we’ve published our latest article on browser hijackings, and why they are such a big cybersecurity threat.

Security articles of the week (January 8-13, 2017)

The saga about Russian interference in the US election is quickly drawing to a close, as some of his top selected officials at the CIA, Department of Defense and Secretary of State admit that Russia intervened in the US election process. President-elect Trump himself admitted that, even if begrudgingly.

Here are some of the other top important news of the week:

1.      How Cyber Propaganda Influenced Politics in 2016

Recent events in 2016 have demonstrated how important security is for political organizations. In 2016, we saw at least eight different high-profile attack campaigns against political organizations in countries like the United States, Germany, Ukraine, Turkey, and Montenegro. These campaigns were not meant for espionage alone, but for active interference with political processes and to influence public opinion.

2.      LA School Pays $28,000 Ransomware Bill

A Los Angeles school has paid a whopping $28,000 to regain access to key systems after being hit by a ransomware attack, as reports resurface that $1 billion may have been generated from such scams in 2016.

3.      Trump’s cyber-guru Giuliani runs ancient ‘easily hackable website’

US president-elect Donald Trump’s freshly minted cyber-tsar Rudy Giuliani runs a website with a content management system years out of date and potentially utterly hackable.

4.      Thanks, Obama: NSA to stream raw intelligence into FBI, DEA and pals

A last-minute rule change signed off by the outgoing Obama administration has made it much easier for the NSA to share raw surveillance data with more than a dozen government agencies.

5.      This Is How Russian Spies Could ‘Crack’ Telegram

Telegram was founded by Russian entrepreneur Pavel Durov, and has become a popular alternative to other apps like WhatsApp or Signal, especially in countries like Russia or Iran. The app markets itself as a secure, encrypted app, but end-to-end encryption is not enabled by default (users have to open a “Secret Chat” to turn it on) and security researchers and cryptography experts have repeatedly questioned the app’s security.

6.      Hackers Hacked Phone Hacking Company

This time, however, Cellebrite is making the headlines because of the different reason: it got hacked, and attackers managed to steal no less than 900 gigabytes of data.

7.    How to find out if your PC is vulnerable to ransomware

Ransomware is the nastiest form of malware there is. It encrypts your files and demands a ransom to release them. While you can remove the threat, doing so will often leave your files locked, with no way to recover them.

8.      Trump Confirms Russian Hacking Campaign, Aide Says

President-elect Donald Trump reportedly now accepts the U.S. intelligence community’s assessment that Russia attempted to meddle in U.S. elections, and may take action in response once he takes power, an aide says.

9.      Here’s a video recording of a complete Locky ransomware infection

CSO wanted to demonstrate the speed and devastation that comes with a ransomware attack, and the only way to do that was to infect one of our own systems. So just before the Thanksgiving holiday in the U.S., that’s exactly what we did.

10.  Adobe Sneaks a Google Chrome Extension in Latest Security Update to Collect Data

SwiftOnSecurity revealed on Twitter that the latest Adobe Reader update also deploys a Google Chrome extension that includes telemetry features to collect data from users’ computers.

The extension is simply called “Adobe Acrobat” and is automatically added to Google Chrome when installing the security update, but it does require users to enable it when launching the browser.

Conclusion

That’s it for this week, thank you for staying with us and tune in for our next update! Stay safe!

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

A tumultuous and memorable 2016 is now firmly behind us, but fear not, for 2017 is shaping up to be even more “interesting”.

The past year’s hard data has shown us a worrisome trend: spending on cybersecurity is going up and up, but not enough to contain rising cybercrime levels. New technologies such as Bitcoin and the Internet of Things have opened up new opportunities for criminal activity which malicious hackers have fully exploited.

Security articles of the week (January 2-6, 2017)

The conflict (if we can name it that) around alleged Russian involvement in the US presidential election has kept on escalating, with President Obama expelling 35 Russian diplomats.

In a further development reminiscent of both fake news and the threat of Russian hacking, the Washington Post published and then retracted an article about a supposed Russian attack on Vermont’s power grid. Turns out, there was no such attack after all.

We won’t dwell more on the matter since plenty of other events warrant our attention:

1.     Florida Man sues Verizon for $72m – for letting him commit identity theft

James Leslie Kelly, who is serving a prison term in the US state for grand theft and criminal use of personal information, is seeking $72m in damages from the telecom giant. He claims a Verizon shop in Highlands County was negligent when it allowed him to steal another man’s identity.

2.     Ukraine Suffered 6,500 Cyberattacks In Two Months, President Says

Ukraine President Petro Poroshenko said the country suffered 6,500 cyberattacks in the last two months and investigations have shown Russia was behind them, according to a Reuters report.

3.     Android tops 2016 vuln list, with 523 bugs

Of any single product, CVE Details reckons, Android had the most reported vulnerabilities in 2016 – but as a vendor, Adobe still tops the list. Even so, with 523 vulnerabilities carrying a CVE number in 2016, Android carried nearly double the patch-load of Adobe Flash (which had 266 and was number four on the list).

4.     Staying Anonymous Online: Lessons learned from Silk Road Founder’s Mistakes

Is using a web anonymizer like Tor or one of its alternatives, enough to keep you truly anonymous online? Does a VPN make you anonymous? Is there any one program or service that will keep you completely anonymous on the internet?

Regrettably, the answer to all of the above questions is the same two letter word: No.

You also need to be aware of the common mistakes that people make online that lead to anonymity being broken.

5.     Ransomware took in $1 billion in 2016

According to a security expert who requested anonymity, ransomware cybercriminals took in about $1 billion last year, based on money coming into ransomware-related Bitcoin wallets.

6.     Deleted Data Is Still There, On Your Disk

This article will make you rethink how you clear and delete data from devices you have stopped using. “Delete” and “Clear Recycle Bin” isn’t enough, since a large part of the data is secretly stored by the device, and will only be removed after it has been overwritten by new data.

7.     Be Prepared: The Top ‘Social Engineering’ Scams Of 2017

Most blackhat hackers don’t rely purely on exception technical skills to do the evil deed. Usually, the hacker is someone tricking the target themselves or a helpful customer service agent or an employee into opening the way for them — a strategy called social engineering, and this tactic is used in more than two-thirds of hacking attacks.

8.     Malicious hackers can now transform your smart meter into a bomb

Smart meters are “dangerously insecure,” according to researcher Netanel Rubin – who claimed the gear uses weak encryption, relies on easily pwned protocols, and can be programmed to explode. The software vulnerability hunter derided global efforts to roll out the meters as reckless, saying the “dangerous” devices are a risk to all connected smart home devices.

9.     How to tell if your Snapchat has been hacked, and how to get it back

A mega breach on the scale of what affected LinkedIn, Tumblr, and Yahoo has yet to strike the messaging app.

But that’s not to say criminals aren’t trying to find a way into people’s accounts. Attackers clearly have Snapchat in their sights, which is why users need to learn how to spot the warning signs of a hack and how they can recover their accounts if someone compromises them.

10. The power grid hack that wasn’t – Vermont’s Burlington Electric

The Washington Post reported that Russian hackers had penetrated the U.S. power grid by compromising a utility in Vermont. The story was altered, and the initial claims were eventually retracted, but by the time this happened, the news had spread to other media outlets.

Conclusion

The year 2017 has started with a bang, and it seems the major trends of 2016 such as nation sponsored hacks, growth of ransomware and the security problems of the Internet of Things will come back to haunt us once again.

Fortunately, this time we know what we’re up against.

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

Russian hackers have deservedly taken center stage this week, with suspected hacks against Kiev’s power grid, the discovery of a huge crime organization that earns around 5 million dollars per day in ad fraud, and even a banking Trojan that’s doing the rounds in the country.

This week we’ve written a new cybersecurity alert about a malware cocktail that first infects your PC and then downloads a ransomware to encrypt your files, as well as an article on 17 underused shopping tips that can help keep you safe and secure.

Security articles of the week (December 18 – 23, 2016)

2016 is shaping up to be one of the most eventful one in years. From Brexit, to the refugee crisis, to Trump’s victory and allegations of Russian election hackings, it is quickly becoming clear that this year will have profound repercussions. What we don’t know is which direction it will take us.

So now, let’s see what this week’s most important cybersecurity news has in store for us:

1.      Ukraine’s capital, Kiev, had its power grid taken down by a hacking attack

Ukraine is investigating a suspected cyber attack on Kiev’s power grid at the weekend, the latest in a series of strikes on its energy and financial infrastructure.

2.      Tumblr Goes Down After Hacker Attack

Tumblr first went down at 3:15 PM ET (10:15 GMT + 2), when many users reported slowdowns and latency. Soon after that, Tumblr became available before going down once again a few minutes later, as the attack continued.

3.      The Most Dangerous People on the Internet in 2016

Not so long ago, the internet represented a force for subversion, and WIRED’s list of the most dangerous people on the internet mostly consisted of rebellious individuals using the online world’s disruptive potential to take on the world’s power structures. But as the internet has entered every facet of our lives, and governments and political figures have learned to exploit it, the most dangerous people on the internet today often are the most powerful people.

4.      Russian ‘Methbot’ scammers steal $3 to $5 mil a day by exploiting ad networks

A group of Russian cybercriminals is stealing between $3 and $5 million a day by diverting legitimate advertising revenues from over 6,000 brand-name websites such as ESPN, Vogue, Fortune, Fox News and CBS Sports.

5.      10 biggest hacks of user data in 2016

Several sites had their databases of user accounts not only breached but stolen this year, which include the necessary information for logins (i.e. username, password). The following sites are ranked starting at the fewest number of user accounts with passwords that were taken.

6.      Tordow Banking Trojan – A Grave Threat for Android Users

Comodo Threat Research Labs have identified a new malware Tordow v2.0 which is the first mobile banking Trojan created specifically for Android devices affecting users in Russia.

7.      How Metadata Can Reveal What Your Job Is

In November, a federal court ruling revealed that CSIS, Canada’s CIA analog, operated a secret metadata collection program for a decade; metadata being all of the information—time stamps, locations, names and numbers—wrapped around our digital communications.

8.      Congressional group says encryption backdoors are a bad idea.

The bipartisan congressional panel recommended that the U.S. support strong encryption and that “Congress should foster cooperation between the law enforcement community and technology companies.”

9.      Ransomware gets into the Christmas spirit with a festive discount

Victims paying ransom demands for CryptXXX can now unlock their files for only 0.5 Bitcoin. The 0.5 Bitcoin rate — around $395 at the current exchange rate — is only being offered until December 31st. The discount is offered via a pop-up window which appears before victims are taken to a Tor-based payments page.

Fortunately, there are some decryptor tools for this type of malware. Here’s a link to a decryptor tool for v1, v2, v3 and another tool for v4 and v5.

10.  Netflix US Twitter account hacked

Netflix’s US Twitter account was briefly hijacked on Wednesday. The feed was taken over by a hacking group, OurMine, who used the hijack to promote its website and invite Netflix to get in touch. The social media team running the Netflix US Twitter account, which has 2.5 million followers, got off easily.

Conclusion

Christmas is just around the corner,  we, the Heimdal Security team,  would like to take the time to wish you Happy Holidays and a Merry Christmas!

Stay safe,

Heimdal Security

 

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

Remember that huge Yahoo! email hack when the internet giant lost 500 million emails? Well, as it turns out, that’s not even the half of it (pun intended). In what is surely the biggest news of the week, Yahoo! announced that they leaked another 1 billion emails in an attack dating back to 2013. To make matters worse, they don’t know how to it was all done.

If you are a Yahoo! user and want to take some precautionary measures, we recommend you check out this article of ours covering this exact situation.

On another subject, we’re proud to announce that we’ve gathered the opinion of 32 leading cybersecurity industry experts, who answered the question: “Is Internet security a losing battle?”.

Security articles of the week (December 11-15, 2016)

Besides that small Yahoo! hack (where 1 billion emails were oh-so-graciously LEAKED), this week has been a pretty eventful, one on all fronts. Without further ado, here’s our weekly security roundup:

1.      Sneaky hackers are infecting home routers to serve users with endless malicious ads

Cybercriminal gangs have found a new way to serve malicious ads in such a way so it is hard to get rid of them – infect your internet router rather than your web browser by silently making requests to your computer without your knowledge.

2.      How one video game developer hunted down and blackmailed a troll

A video game industry insider has revealed how he helped track down a “troll” who had threatened to leak his company’s secrets.

Sam van Tilburgh said his team had managed to identify the teenager and obtain some of his schoolwork, which it then published online as a warning.

3.      Pentagon hit by Russian hackers in crippling attack that forced full systems overhaul – report

Russian blackhat hackers reportedly launched a targeted cyberattack on Pentagon in August 2015, which saw the unclassified email system used by the Joint Chiefs of Staff hijacked, leaving data of nearly 3,500 military personnel and civilians vulnerable to exposure. The attack’s aim is believed to have been to cripple the Pentagon’s systems, instead of a cyber espionage campaign, according to a report.

4.      France Creates Cyber Army to Fight Against Foreign Hackers

France is the latest country that forms a cyber-army whose purpose is to fight against foreign hackers, with Defence Minister Jean-Yves Le Drian explaining that operations of this new unit would begin as soon as next month.

5.      Amazon customers are warned of a scam email that aims to get their bank card details

Fake emails purporting to be from Amazon have been sent to thousands of Christmas shoppers around the world.

The mass email scam targets Christmas shoppers in an attempt to steal their bank card details.

6.      Nearly Half Of The Top 1 Million Websites Deemed Risky

Forty-six percent of the top million websites, as ranked by Alexa, pose potential malware risks to businesses.

Nearly half (46%) of the Alexa top one million websites were found to be risky, putting businesses at risk as their users visits these sites.

7.      Evernote Ditches Privacy Policy Allowing Note Access, Says Sorry To Furious Customers

After many of its customers promised to quit Evernote over an update to its privacy policy that allowed its employees to access user notes, the cloud software provider has decided to backtrack.

8.      Our planes are now ‘big flying mobile devices’ and top hacking targets

A rapid increase in the power and scale of cyberattacks has affected industries worldwide and the aviation sector is no exception. We’ve begun to skim the top of what a successful cyberattack against a player in the aviation industry can achieve.

In 2015, for example, LOT was forced to cancel 10 flights and delay over a dozen after a successful cyberattack was launched against the Polish airline’s ground systems.

9.  Yahoo Says 1 Billion User Accounts Were Hacked

Yahoo, already reeling from its September disclosure that 500 million user accounts had been hacked in 2014, disclosed Wednesday that a different attack in 2013 compromised more than 1 billion accounts.

10.      What can you do with a billion Yahoo passwords? Lots of bad things

Here’s how cybercriminals can use those 1 billion leaked Yahoo! emails to cause a world of damage.

Conclusion

Christmas is fast approaching, and with it the holiday spending spree.

The fourth quarter of a year is usually the most profitable quarter for all companies, and even malicious hackers.

That’s why we’d like to recommend you one of our articles that can help you stay safe during this intense shopping spree. We’ve also updated two of our article on password security and 14 awesome tips that can help keep cloud files safe.

Stay safe!

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

As 2016 draws to a close, some clear trends have emerged, and the cluster of events that we’ve had this week have highlighted them in an unusual fashion: the threat of disinformation through fake news, huge malware proliferation and massive botnets built on Internet of things vulnerabilities.

Using this as a starting point, we asked 30+ experts the following question: Is Internet security a losing battle?  The answers we got were smarter and more in-depth than we could have hoped.

Security articles of the week (4- 9 December, 2016)

This week’s stories are a great reminder of how the cybersecurity landscape has evolved during this past year. Every new trend was represented by it’s own story.
So, let’s get into this week’s cybersecurity round-up :

1)    Over 400,000 phishing sites have been observed each month during 2016

Around 84 percent of phishing sites observed in 2016 existed for less than 24 hours, with an average life cycle of under 15 hours. The data collected by Webroot shows that today’s phishing attacks have become increasingly sophisticated and carefully crafted in order to obtain sensitive information from specific organizations and people.

2)    ‘Pizzagate’ Conspiracy Meme Reaches Its Natural Conclusion—With Shots Fired

On December 5th, a North Carolina man was detained outside of a restaurant in Washington DC. The man entered the restaurant armed with an assault rifle and wanted to “self-investigate” rumors started by fake news sites according to which Hillary Clinton was somehow involved in a pedophilia ring. The pizza restaurant was the supposed headquarters of the whole operation.
The gunman ended up firing several shots, but fortunately no one got hurt.

3)    Guessing valid credit card numbers in six seconds? Priceless

Fraudsters can guess credit card numbers in as little as six seconds per attempt thanks to security gaps in Visa’s network, academics say.

4)    Malicious online ads expose millions to possible hack

Since October, millions of internet users have been exposed to malicious code served from the pixels in tainted banner ads meant to install Trojans and spyware, according to security firm ESET.

5)    Millions Of Passwords, Emails And Usernames Stolen From Dailymotion In Hack Attack

Hackers have exposed millions of accounts linked to video sharing website Dailymotion, swiping over 85 million unique usernames and email addressed according to data breach notification site LeakedSource.

6)    Ransomware forced hospitals to cancel 2,800 operations

At the end of October, three British hospitals suffered a “major incident” as a malware attack infected the Northern Lincolnshire and Goole NHS Foundation Trust (NLAG), forcing the almost complete shutdown of IT systems and the cancellation of routine patient operations for several days.

7)    Facebook, Microsoft, Twitter and YouTube team to ID terror content

Facebook, Microsoft, Twitter and YouTube have teamed up to share their expertise spotting terrorism-related content, in order to crimp its spread. The four put their name to a joint statement in which they declare “There is no place for content that promotes terrorism on our hosted consumer services.”

8)    The smart city security nightmare: How cities can stay awake

As more and more public infrastructure—from nuclear plants to bridges to electrical grids—get connected, weak security will create new dangers to public safety and even national security.

9)    We Went Looking for Russian Hackers and Met a Bunch of Sketchy People

On the internet, Russian hackers have reached an almost a mythical aura. They seem to have unfathomable hacking powers, and they appear untouchable.
But a journalism team from Vice’s Motherboard explored this shadowy world. The end result is a documentary on the subject, chronicling how Russian hackers reached their current level of fame.

10)  Five new malware programs are discovered every second

The numbers are in, and they don’t look too good.
According to AV-Test.org, it has 578,702,687 malware samples in its testing database – with over 115 million discovered so far during 2016 alone.
That translates to 4-5 new malware samples every second of every day.

Conclusion

Around 400,000 phishing sites have been discovered per month, 5 new malware programs are released every second, fake news is the root cause of a shoot-out that could have a lot of victims.

And yet, there’s reason to hope. Companies and regulators in the cybersec space are moving to create new ways of preventing malware attacks, either through strengthening infrastructure or by encouraging education. And there’s also a growing trend to fight back against fake news, and prevent it from spreading lies and untruths.

Without a doubt though, we live in interesting times. But ask a historian and he might say “may you live in interesting times” is more of a curse than a blessing.

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

Your online privacy is caught between corporate pressures and encroaching surveillance powers for national security agencies.

So we’ve compiled a list of 11 steps that can help you stay safe and anonymous on the web. Best of all, it only takes an hour to do all these steps!

We’ve also updated our guide on how to find the best antivirus, complete with review sites, detailing of important antivirus features and more.

Security articles of the week (28th November – 2th of December, 2016)

As far as cybersecurity goes, this was a fairly uneventful week. There wasn’t one dominant headline, and the news that did make it on the list are mostly evolutions of past events.
So without further ado, here are the biggest security news of the week:

1)      Japan’s Ministry of Defense may or may not have been hacked

Most indications point to a hacking of the Japanese MoD, although this is denied by the government. The perpetrator is most likely a nation-state actor, looking to acquire sensitive information relating to Japanese defenses and military installations.

2)      Deutsche Telekom hack affects 900,000 customers

German telecommunications giant and T-Mobile parent company Deutsche Telekom was the victim of a strong DDoS attack over the weekend, which left some 900,000 users affected, the company confirms in a blog post.

3)      Hackers crack Liechtenstein banks, demand ransoms

Hackers have days ago breached a Liechtenstein bank and are allegedly blackmailing customers by threatening to release their account data if ransoms are not paid.

4)      You Can Now Rent a Mirai Botnet of 400,000 Bots

Two hackers are renting access to a massive Mirai botnet, which they claim has more than 400,000 infected bots, ready to carry out DDoS attacks at anyone’s behest.

5)      Cold War 2.0: Russia is borrowing the Great Firewall of China to implement greater state censorship and control

The Great Firewall of China is a famous tool of censorship and state control of the internet — and Russia wants to throw up its own version of the web filtering system. Russia already operates the so-called ‘red web’ which is used to not only monitor what Russian citizens are up to online, but also implementing blocks and filters such as the recent ban on LinkedIn.

6)      At least 10 million Android users imperiled by popular AirDroid app

For at least the past six months, a popular remote management app available in the official Google Play Store has opened tens of millions of Android users to code-execution and data-theft attacks when they use unsecured networks, researchers said Thursday.

7)      Authorities Just Shut Down One of the World’s Largest Malware Networks | Motherboard

One of the largest botnet infrastructures in the world was finally annihilated in a joint effort by law-enforcement authorities and cybersecurity researchers in 30 countries. Over 800,000 domains have been seized, sinkholed or blocked, in “Operation Avalanche,” as the law-enforcement sting was known.

8)      How much money do cybercriminals earn?

Ever wanted to know just how much money malicious hackers make per month? Well, wonder no more. This report sheds light on the economics of cybercrime and how much a criminal can expect to make.

9)      Gooligan hooligans have compromised at least one million Google accounts

Attackers are using an Android malware campaign known as Gooligan to target Android users and breach the security of their Google accounts.

10)  FBI granted the right to hack the computers of any suspect running Tor, VPNs or anonymizing software

Starting with the 1st of December, the FBI will now have a much easier time hacking just about any computer it wants to. The use of VPNs and other anonymizing software such as Tor meant that it was previously difficult for the Feds to apply for the necessary warrant within the relevant jurisdiction.

Conclusion

A hack affecting 10 million Androd users, FBI was granted sweeping powers surveillance powers, Russia will now tighten its censorship laws even more.

It tells you all you need to know about the state of cybersecurity if this week is an “uneventful” one.

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

This week we found out about the latest method employed by cybercriminals to spread the Locky ransomware. They do this through a “spray and pray” campaign that sends out mass spam emails. Learn how to protect yourself by reading our cybersecurity alert.

What’s more, malicious hackers want more than just a ransom, and are fast developing new ways to extort money from the victims of a ransomware attack.

Security articles of the week (21-27 November, 2016)

The biggest story of the week is Facebook’s decision to develop a censorship tool in order to get access to China’s vast amounts of internet users. Now that the free-speech censorship taboo was broken, where will it stop?

And now it’s time for our weekly security roundup.

1)      Malicious images on Facebook lead to Locky Ransomware

Researchers have discovered an attack that uses Facebook Messenger to spread Locky, a family of malware that has quickly become a favorite among criminals.

The ransomware is delivered via a downloader, which is able to bypass whitelisting on Facebook by pretending to be an image file.

2)      FBI’s Dark Web Child Porn Investigation Stretched to Norway

Sometimes, it’s the good guys that do the hacking. Read on if you want to see how the FBI managed to take down a child pornography site.

3)      What Hotels Teach Us About Data And Prioritizing User Experience Over Security

While this story isn’t exactly news, it highlights how companies often times sacrifice your personal security so you can be more comfortable.

4)      Encryption key standard getting a makeover and EMC endorsement

An industry standard for managing encryption keys, which commenced in fall 2010, is about to get a makeover and a big new supporter.

5)      Facebook is ready to censor posts in China — should users around the world be worried?

The social network is currently banned in China, and this clearly takes a huge chunk out of Facebook’s ad revenue. In a bid to keep Chinese authorities happy, Mark Zuckerberg has been involved in the creation of software that can be used to monitor and censor posts made by users.

6)      Madison Square Garden admits hackers spent a year harvesting visitor credit-card data

Millions of sports fans and entertainment goers in New York may be affected by the latest payment-card breach.

7)      Visa cries foul over Euro regulator’s stronger authentication demands

The EU banking regulator’s plans to reduce fraud by obliging the use of passwords, codes or a card reader to authenticate electronic payments above 10 euros have drawn fire from the payments industry.

8)      A quarter of the world’s Wi-Fi’s are insecure and not passworded

This research on Wi-Fi security shows just how many vulnerable wireless connections are spread out across the world, and as it so happens, the USA has a disproportionate share of these.

9)      Election Results: Academics Seek Audit in Key States

A group composed of computer scientists and activists has proposed that U.S. election results be audited in three key states in which President-elect Donald Trump won by a razor-thin margin. The group’s goal is to definitively disprove that cybercriminals may have influenced the contentious election.

10)  Forget Net Neutrality, Trump FCC Advisor Wants to Kill the FCC Itself

Under President Donald Trump, the US government’s policy protecting net neutrality, the principle that all internet content should be equally accessible to consumers, is likely to be rolled back, according to tech policy experts.

Conclusion

Between Trump’s policy ideas on cybersecurity and net neutrality, ever tightening control of the Internet across both the developed and developing world and culminating with Facebook’s decision to censor itself to appease Chinese officials, we find ourselves in a world where freedom of speech and privacy seem to be on the retreat across all fronts.

Hopefully, proposed measures will be toned down upon implementation and current censorship efforts will be rolled back in the future.

By the way: if you want to see what we’re reading and dive straight into the most important security news from the industry and beyond, we’ve set up a Flipboard magazine just for that. You can browse through it right now.

Quite a lot of major hacks took place this week, but Black Friday promises to be the main event. For those of you who want to let loose your inner shopper, stay safe by reading this article.

But until then, let’s delve into our weekly security roundup!

Security articles of the week (14-19 November, 2016)

1)   Mozilla patches 29 vulnerabilities in Firefox 50.

Mozilla addressed 29 vulnerabilities, three rated critical, when it released the latest iteration of its flagship browser, Firefox 50 and Firefox ESR 45.5, on Tuesday.

2)      Pre-installed Backdoor On 700 Million Android Phones Sending Users’ Data to China

Do you own an Android smartphone? You could be one of those 700 Million users whose phone is secretly sending text messages to China every 72 hours.

3)      Alleged Adult Website Breach May Affect 412 Million Accounts

A group that collects stolen data claims to have obtained 412 million accounts belonging to FriendFinder Networks, the California-based company that runs thousands of adult-themed sites in what it described as a “thriving sex community.”

4)      The Internet Of Things, DNS Weaknesses, Or Trump: Which Will Sink The Internet?

Either one or all three combined can inflict some serious damage to Internet infrastructure and change how we use the web.

5)      Russia is going to ban LinkedIn after court ruling. What’s next?

The reasons behind this drastic measure exist for other companies as well, so this may be just the first in a long-line of high profile bans of tech companies.

6)      Facebook’s Mark Zuckerberg hacked again

Hacking group OurMine claims credit for defacing the Facebook CEO’s Pinterest account. It also hacked Zuckerberg back in June.

7)      TrickBot banking Trojan is the next big threat

After months of testing, a new banking Trojan called TrickBot is being aggressively slung at owners of personal and business bank accounts in UK and Australia.

8)      International computer fraud, forgery and money laundering ring dismantled.

This criminal organization was so sophisticated that it’s organization resembled that of an established company. And it was just as efficient.

9)      Christmas clash: The retailer vs the cybercriminal

“Follow the money” is a well-known saying if you want to get rich. This is what malicious hackers are doing as they target Black Friday shoppers.

10)   Telecom operator gets hacked, information of 6 million people may have leaked.

Three, one of UK’s biggest mobile operators, has become the latest victim of a massive data breach that reportedly left the personal information and contact details of 6 Million of its customers exposed.

Conclusion

As an endnote, try to shop only with online retailers you trust, and be more suspicious than usual when dealing with costumer support or emails from retailers.

And don’t miss our latest article, which focuses on netiquette, meaning the basic rules of how to use the internet safely and avoid getting hacked.

If email is your thing, you can sign up for the newsletter below and get the weekly roundup in your inbox. Whatever works best for your digital habits.

In one of this week’s articles you’ll find a story about a researcher hacking the Wi-Fi of an entire city. If he had been a cybercriminal he could have been able to hijack the traffic, and intercept passwords, emails and even credit card details.

Threats against Wi-Fi routers are real, so we’ve written a guide on how to secure your own Wi-Fi connection in order to keep the bad guys out.

Without a doubt, the dominant headline of the week was the election of Donald Trump as President of the United States. While not a cybersecurity news in itself, Mr. Trump’s stance and policies on online security will surely impact the field for years to come.

And now for that time of the week, here are some of the most important articles we’ve had this period.

Security articles of the week (7-13 November, 2016)

1. Cerber ransomware now targets databases

Security company McAfee warns that the cybercriminals behind the Cerber ransomware have begun to target businesses as well as individuals by encrypting their databases until payment is received.

2. El Paso city bungs $3.2m to email crooks pretending to be bosses

After keeping quiet for days, the city of El Paso, Texas, has finally admitted that it has fallen prey to “CEO fraud” emails that saw scammers funnel $3.2m from the authorities using bogus invoices.

3.‘Sign in with Facebook’ Threatens Millions of Devices

Signing into secure websites with Facebook or Google is awfully convenient—especially when using a mobile device. But widespread, incorrect usages of a foundational technology by third-party mobile app developers gives hackers almost-effortless access to more than one billion apps and millions of devices.

4. Warning: Beware of Post-Election Phishing Emails Targeting NGOs and Think Tanks

Just a few hours after Donald Trump won the 2016 US Presidential Election, a hacking group launched a wave of cyber attacks targeting U.S.-based policy think-tanks with a new spear phishing campaign designed to fool victims into installing malware.

5. Over 300,000 Android Devices Hacked Using Chrome Browser Vulnerability

A vulnerability in Chrome for Android is actively being exploited in the wild that allows hackers to quietly download banking trojan apps (.apk) onto victim’s’ device without their confirmation.

6. Hacker shows how easy it is to take over a city’s public Wi-Fi network

In a perfect example of how public wireless networks can be dangerous for privacy and security, an Israeli hacker showed that he could have taken over the free Wi-Fi network of an entire city.

7. Antivirus Fails to Stop Ransomware 100% of the Time

And antivirus wasn’t the only security solution that came up short. Victims reported that 95% of the attacks bypassed the victim’s firewall(s); 77% of the attacks bypassed email filtering; 52% of the attacks bypassed anti-malware; and 33% of the attacks were successful even though the victim had conducted security awareness training.

8. Facebook suspends plans to collect WhatsApp user data in the UK

Facebook has put the brakes on its plans to collect WhatsApp user data in the UK, after the Information Commissioner’s Office (ICO) told it to back off.

9. File-Encrypting Ransomware “Telecrypt” Abuses Telegram

A new file-encrypting ransomware dubbed by researchers “Telecrypt” abuses the instant messaging service Telegram for command and control (C&C) communications and to allow victims to send messages to the attackers.

10. Open Database Exposes Millions of Job Seekers’ Personal Information

An outsourcing company named Capgemini left a database containing sensitive information on the open internet, exposing the names, contact details, resumes, and other personal information of potentially millions of people who used a global recruiting firm.

Conclusion

Given the explosion of cybercrime and nation-sponsored cyberattacks in recent years, combined with the election of Donald Trump as President of the United States, we are bound to see a dynamic period in the field of cybersecurity, with an unpredictable set of consequences.

Cybersecurity talks a lot about malware, hackers, exploits, DDoS etc. But this time, we want to bring you the true stories of 15 people who each experienced a different type of hacking, and what they learned after that.

Don’t miss this security alert about a LinkedIn phishing campaign doing the rounds!

Security articles of the week [October 31st – November 6th, 2016]

A relatively uneventful week compared to the previous two, the most important headline being Google’s disclosure of an actively used vulnerability in Windows.

1)      Google disclosed an actively exploited Windows vulnerability, and Microsoft isn’t happy.

The exploit Google found was already actively used, but Microsoft still wasn’t happy to have a Windows vulnerability being publicly exposed.

2)      Google’s AI has learned to create its own encryption method

The way Google’s AI learned to do this is the really fascinating story.

3)      Microsoft’s Edge is more secure than both Firefox and Chrome.

So Microsoft’s most recent browser has managed to surpass its two biggest competitors in terms of security.
Check this link if you want to know more about what Edge can do.

4)      This is how criminals use Bitcoin, and also how prosecutors catch them.

Cryptocurrencies have become the payment method of choice for hackers, because of their stealthy features and ease of use. Despite that, there are ways to catch them.

5)      This is how you don’t hack a bank. Also, give this man a Darwin Award!

This appears to be one of the most inept pieces of computer crime in recent history.

6)      7 Reasons Consumers Don’t Take Action on Cybersecurity.

Security awareness is high but it’s hard to turn personal knowledge into effective practices.

7)      This country’s internet was almost taken down by a DDoS attack.

The Mirai malware keeps inflicting damage, and this time the hackers targeted the African country of Liberia.

8)      Atom Bombing, a new threat to your Windows.

This new vulnerability in Windows has many cybersecurity specialists concerned, especially since it can’t actually be patched because it uses a legitimate Windows feature.

9)      State of Corporate Data Security 2015-2016.

A data-driven research on the state of cybersecurity over the past year, a must read for anyone with strong interests in the field.

10)   The Locky ransomware is now the most used malware email attachment.

With spam numbers surging to record levels, it seems malicious hackers have found their new weapon of choice in Locky.

Conclusion

As we’ve said, a fairly uneventful week, with many headlines still focusing on the implications of the Mirai DDoS attack two weeks ago. For this writer however, the most intriguing development of the week was the self-taught encryption method of Google’s AI. This just goes to show how rapidly we are moving into the future, and offers us a glimpse of what’s in it.

Security Tips and Tricks from Top Experts
2016.06.27 SLOW READ

50+ Internet Security Tips & Tricks from Top Experts

Expert Roundup Software Patching
2016.04.06 SLOW READ

15+ Experts Explain Why Software Patching is Key for Your Online Security

27 Cyber Security Experts
2015.08.25 SLOW READ

The Most Common Mistakes These 27 Cyber Security Experts Wish You’d Stop Doing

Comments

Howdy, I do think your blog could possibly be having internet browser compatibility problems. When I look at your web site in Safari, it looks fine but when opening in IE, it’s got some overlapping issues. I just wanted to provide you with a quick heads up! Aside from that, fantastic site!

Thanks for letting us know. Are you sure your browser resolution is set to the standard for your desktop resolution? We’ve found that other readers experienced this and, when they set their browser resolution to normal, the issue was gone. The fastest way to do this is to hold CTRL and press 0.

And thanks for the awesome feedback!

[…] You can also follow our blog’s weekly roundup or our social profiles (especially Twitter), where we share the latest cybersecurity […]

Leave a Reply

Your email address will not be published. Required fields are marked *

GO TO TOP