Child Tweets Gibberish from U.S. Nuke Account

source: threatpost.com

 

Telecommuting social-media manager for the U.S. Strategic Command left the laptop open and unsecured while stepping away.

A nonsense tweet sent out from the official account of U.S. Strategic Command is no reason for alarm, according to the department. The social media manager’s kid found an open laptop, pounded on a few random keys and sent the tweet, which read, “;l;;gmlxzssaw” last Sunday.

The tweets were met with alarm since @USSTRATCOM controls the launch codes for the country’s nuclear arsenal. Mikael Thalen, a reporter with the Daily Dot, decided to file a Freedom of Information Act (FOIA) request to get answers.

“Filed a FOIA request with U.S. Strategic Command to see if I could learn anything about their gibberish tweet yesterday,” Thalen wrote. “Turns out their Twitter manager left his computer unattended, resulting in his ‘very young child’ commandeering the keyboard.”

USSTRATCOM stressed, according to Thalen, the post was not the result of a breach.

Continue reading “Child Tweets Gibberish from U.S. Nuke Account”

Young Adults, Seniors Over 75 Most Susceptible to Cyber Fraud: Report

source: technewsworld.com

The most vulnerable cybercrime victims are young adults and adults over 75, according to the latest research revealed in the LexisNexis Risk Solutions biannual Cybercrime Report.

Released Feb. 23, the report tracks global cybercrime activity from July 2020 through December 2020. The report reveals how unprecedented global change in 2020 created new opportunities for cybercriminals around the world, particularly as they targeted new users of online channels.

LexisNexis’ research found a 29 percent growth in global transaction volume compared to the second half of 2019. This growth came in the financial services (29 percent), e-commerce (38 percent) and media (9 percent) sectors. The number of human-initiated attacks dropped in 2020 by roughly 184 million, while the number of bot attacks grew by 100 million.

Continue reading “Young Adults, Seniors Over 75 Most Susceptible to Cyber Fraud: Report”

Netlab, the networking security division of Chinese security firm Qihoo 360, said it had discovered a new fledgling malware operation that is currently infecting Android devices for the purpose of assembling a DDoS botnet, according to a ZDNetreport. 

The botnet, Matryosh, is going after Android devices that have left their ADB debug interface exposed on the internet. Netlab says Matryosh is a ADB-targeting botnet, using the Tor network to hide its command and control servers. The encryption algorithm implemented in this botnet and the process of obtaining C2 are nested in layers, “like Russian nesting dolls,” why is why Netlabnamed it Matryosh. 

Commenting on the news, Burak Agca, Engineer at Lookout, a San Francisco, Calif.-based provider of mobile security solutions, says, “The key feature of this attack is the exploitation of ADB, a long standing Android feature that’s meant to provide developers a simple method to communicate with, and remotely control devices. ADB allows anyone to connect to a device, install apps and execute commands, without authentication.

Continue reading “New Matryosh Botnet Targeting Android Devices”

 

A Look Into the Pricing of Stolen Identities For Sale on Dark Web

source:  securitymagazine.com

 

After a data breach, much of that stolen personal and sometimes highly personally identifiable information (PII) is sold on markets residing within the dark web. But, how much does the sale of stolen information work, exactly, and how much money are criminals making from stolen data?

Comparitech researchers analyzedlistings across 40+ dark web marketplaces gathering data on how much stolen identities, credit cards and hacked PayPal accounts are worth to cybercriminals. 

Here are some key findings:

  1. Americans have the cheapest “fullz” (full credentials e.g. SSN, name, DOB etc), averaging $8 per record. Japan and the UAE have the most expensive identities at an average of $25. Not all fullz are the same. While SSN, name, and DOB are all fairly standard in fullz, other information can be included or excluded and thereby change the price. Fullz that come with a driver’s license number, bank account statement, or utility bill will be worth more than those without, for example. Some fullz even include photos or scans of identification cards, such as a passport or driver’s license.
  2. Prices for stolen credit cards range widely from $0.11 to $986. Hacked PayPal accounts range from $5 to $1,767.
  3. The median credit limit on a stolen credit card is 24 times the price of the card.
  4. The median account balance of a hacked PayPal account is 32 times the price on the dark web.

Credit cards, Paypal accounts, and fullz are the most popular types of stolen information traded on the dark web, but they’re far from the only data worth stealing, says Comparitech. Other types of stolen information usually for sale are: passports, driver’s licenses, frequent flyer miles, streaming accounts, dating profiles, social media accounts, bank accounts, and debit cards.

This data – most often stolen through phishing, credential stuffing, data breaches, and card skimmers – is bought and sold on dark web marketplaces. Here’s a few tips for avoiding those attacks, from Comparitech researchers: 

  • There’s not much an end user can do about data breaches except to register fewer accounts and minimize your digital footprint.
  • Keep an eye out for card skimmers at points of sale, particularly unmanned ones such as those at gas stations.
  • Learn how to spot and avoid phishing emails and other messages.
  • Credential stuffing can be avoided by using strong, unique passwords on all of your accounts.

For the full blog, please visit https://www.comparitech.com/blog/vpn-privacy/dark-web-prices/

Strong Passwords Aren’t As Easy As Adding 123. Here’s What Experts Say Really Helps


source:  cnet.com

Creating a good password isn’t as simple as putting an exclamation mark at the end.

You’ve seen all the familiar rules for strong passwords almost every time you create an online account. Use capital letters, numbers and special characters, and make it at least 8 characters long (or 10, or 12). These requirements are designed to make it harder for hackers to get into your accounts. However, they don’t really make your password stronger, say researchers at Carnegie Mellon University.

Lorrie Cranor, director of the CyLab Usable Security and Privacy Laboratory at CMU, says her team has a better way, a meter that websites can use to prompt you to create more-secure passwords. After you’ve created a password of at least 10 characters, the meter will start giving suggestions, such as breaking up common words with slashes or random letters, to make your password stronger. 

These tips set the password strength meter apart from other meters that provide an estimated password strength, often using colors. The suggestions don’t come from a checklist, but instead respond to common pitfalls Cranor’s team has seen people make when they set up passwords during experiments run by the lab over several years.

One of the problems with many passwords is that they tick all the security checks but are still easy to guess because most of us follow the same patterns, the lab found. Are numbers required? You’ll likely add a “1” at the end. Is it capital letters? You’ll probably make it the first one in the password. And special characters? Frequently exclamation marks.

CMU’s password meter will offer advice for strengthening a password like “ILoveYou2!” — which meets the standard requirements. The meter also offers other advice based on what you type in, such as reminding you not to use a name or suggesting you put special characters in the middle of your password. 

“It’s relevant to what you’re doing, rather than some random tip,” Cranor said. 

Continue reading “Strong Passwords Aren’t As Easy As Adding 123. Here’s What Experts Say Really Helps”

Data Leak Exposes Details of Two Million Chinese Communist Party Members

source: infosecurity-magazine.com

Sensitive data of around two million members of the Communist Party of China (CPC) have been leaked, highlighting their positions in major organizations, including government agencies, throughout the world.

According to reports from The Australian newspaper, featured in the Economic Times, the information includes official records such as party position, birthdate, national ID number and ethnicity. It revealed that members of China’s ruling party hold prominent positions in some of the world’s biggest companies, including in pharmaceutical giants involved in the development of COVID-19 vaccines like Pfizer and financial institutions such as HSBC.

The investigation by The Australian centred around the data leak, which was extracted from a Shanghai server in 2016 by Chinese dissidents.

It noted that CPC members are employed as senior political and government affairs specialists in at least 10 consulates, including the US, UK and Australia, in the eastern Chinese metropolis Shanghai. The paper added that many other members hold positions inside universities and government agencies.

The report emphasized there is no evidence that spying for the Chinese government or other forms of cyber-espionage have taken place.

image - china tech

 

 

Beulah Graves

Product Management

In her report, The Australian journalist and Sky News host Sharri Markson commented: “What’s amazing about this database is not just that it exposes people who are members of the Communist Party, and who are now living and working all over the world, from Australia to the US to the UK, but it’s amazing because it lifts the lid on how the party operates under President and Chairman Xi Jinping.

“It is also going to embarrass some global companies who appear to have no plan in place to protect their intellectual property from theft, from economic espionage.”

In September, the Cybersecurity and Infrastructure Security Agency (CISA) and the US Department of Justice issued a joint advisory warning US government agencies and private sector companies to be on high alert for cyber-attacks by threat actors affiliated with the Chinese Ministry of State Security (MSS).

Jane May

Photographer

 

DevSecOps:  Solving the Add-On Software Security Dilemma

military operations

source: technewsworld.com

 

The lack of standard practices in the DevOps communities is causing growing friction as security teams line up against developers. This internal friction leaves software they develop and organizations that use the apps vulnerable to attacks and breaches.

A report released Sept. 30 by open source security and license management company WhiteSource explores various factors contributing to the siloed software development culture and what steps are needed to achieve agile, mature, DevSecOps practices — which involves integrating IT security as a shared function among all DevOps teams.

The report shows feelings of increased pressure among software development teams to overlook security features to meet short development lifecycles.

That finding is especially significant in light of revelations that more than half of all developers polled in the report said they have either no secure coding training or only an annual event. Add to this lack of security training among software coders the finding that fewer than one-third of organizations have a defined, agreed-upon vulnerability prioritization process.

 

The DevSecOps Showdown

Perhaps an even more alarming dilemma is that on average just half of the organizations have an AppSec champion on their teams. More evidence of the security divide between teams is that even when security professionals say there is one, developers do not always agree, according to the report entitled “WhiteSource DevSecOps Insights, Security vs. Developers: The DevSecOps Showdown.”

“If developers feel they are neglecting security to stay on schedule, something in the DevSecOps process is broken,” warn the report writers.

WhiteSource surveyed over 560 application security professionals and software developers. Those results show that while most security professionals and developers believe that their organizations are in the process of adopting DevSecOps, most organizations still have a way to go, according to Rami Sass, CEO and co-founder of WhiteSource. The distance yet traveled is especially significant when it comes to breaking down the silos separating development at security teams, he noted.

“Full DevSecOps maturity requires organizations to implement DevSecOps across the board. Processes, tools, and culture need to evolve in order to break down the traditional silos and ensure that all teams share ownership of both security and agility,” Sass said.

Continue reading “DevSecOps: Solving the Add-On Software Security Dilemma”

Has Your Data Been Leaked to the Dark Web?

source:  cyberdefensemagazine.com

The part of the internet not indexed by search engines is referred to as the Dark Web. The Dark Web is however frequently misunderstood. The Dark Web is a network of forums, websites, and communication tools like email. What differentiates the Dark Web from the traditional internet is that users are required to run a suite of tools such as the Tor browser that assists in hiding web traffic. The Tor browser routes a web page request through a series of proxy servers operated by thousands of volunteers around the globe that renders an IP address untraceable.

The Dark Web is used for both illegal and respected activities. Criminals exploit the Dark Web’s anonymity to sell drugs and guns. Organizations like Facebook and the United Nations use the Dark Web to protect political and religious dissidents in oppressive nations. Legitimate actors like law enforcement organizations, cryptologists, and journalists also use the Dark Web to be anonymous or investigate illegal activities.

A 2019 study, Into the Web of Profit, conducted by Dr. Michael McGuires at the University of Surrey, shows that the number of Dark Web listings that could harm an enterprise has risen by 20% since 2016. Of all listings (excluding those selling drugs), 60% could potentially harm enterprises.

Continue reading “Has Your Data Been Leaked to the Dark Web?”

Upcoming S&T Guidance Will Improve Critical Infrastructure Resilience

source:  dhs.gov (contributed by Artemus FAN, Alicia Jones


It is easy to understand the importance of our “critical infrastructure,” such as telecommunications, energy, transportation, and emergency services, but what’s often overlooked are the underlying technologies that enable them. One such technology is Position, Navigation, and Timing (PNT) services, a national critical function powering many of the critical infrastructure sectors that enable modern society.

PNT is primarily provided through the Global Positioning System (GPS) and other Global Navigation Satellite Systems (GNSS). PNT is not just used for navigation, though. It also provides precision timing information that enables critical functions within telecommunication networks and the power grid. However, these PNT services are susceptible to interference such as GPS jamming and spoofing, which pose a risk to critical infrastructure. What was once an emerging risk is quickly becoming a pressing issue, with industry reporting a growing trend in the past two years of prominent PNT disruption events around the world. As the technological barriers to conducting these activities continue to fall, it becomes even more important to ensure our critical infrastructure is resilient to PNT disruptions.

Continue reading “Upcoming S&T Guidance Will Improve Critical Infrastructure Resilience”

Don’t give your information to marketers who might pelt you with spam or even expose you to a potential hack. Use Abine Blur instead.

source: fastcompany.com

Over the summer, I came across an online store that was promising big discounts on All-Clad cookware, but with a catch: You had to hand over an email address just to see what the deals were.

This would have given me pause if not for a secret weapon: I loaded up a service called Abine Blur and generated a free “masked email” address to use instead of my real one. While the masked email would still forward messages to my actual Gmail inbox, the store would never learn my real address, and I could cut off any future emails with one click.

I started using Abine Blur about five months ago, after hearing about it from one of my newsletter readers, and it’s since become one of my most cherished privacy services. With masked email addresses, I don’t have to worry about getting spammed just because I signed up for an app, made a donation, or subscribed to some retailer’s newsletter in exchange for a coupon. I just tell Abine Blur to stop forwarding their emails, and our link is severed.

Continue reading “This Free Service Is a Genius Way to Foil Spam…”