Author: esimantiras

TikTok Engaging in Excessive Data Collection

Posted on by esimantiras

TikTok Engaging in Excessive Data Collection

source: infosecurity-magazine.com  |  image: pexels.com

 

TikTok has been engaging in excessive data collection and connecting to mainland China-based infrastructure, Internet 2.0 has claimed in a new white paper.

The latest report, overseen by Internet 2.0’s head security engineer Thomas Perkins, is an analysis of “the source code of TikTok mobile applications Android 25.1.3 as well as IOS 25.1.1”, with Internet 2.0 carrying out static and dynamic testing between 1 July to 12 July 2022 that focused on device and user data collection.

The report identified multiple instances of unwarranted data harvesting, including:

  • Device mapping
  • Hourly monitoring of device location
  • Persistent calendar access
  • Continuous requests for access to contacts
  • Device information

Continue reading “TikTok Engaging in Excessive Data Collection” →

Microsoft Disrupts Russian Cyber-Espionage Group Seaborgium

Posted on by esimantiras

Microsoft Disrupts Russian Cyber-Espionage Group Seaborgium

source: infosecurity-magazine.com  |  image: pexels.com

 

Microsoft claims to have disrupted a prolific Russian state-backed threat group known for conducting long-running cyber-espionage campaigns against mainly NATO countries.

In an update on August 15, the tech giant said it had disabled accounts used by the “Seaborgium” group for reconnaissance, phishing, and email collection, and updated detections against its phishing domains in Microsoft Defender SmartScreen.

Also known by threat researchers as Callisto Group, ColdRiver, TA446 and other monikers, Seaborgium is a “highly persistent threat actor” that focuses most of its time on the US and UK, and occasionally the countries of the Baltics, Nordics and Eastern Europe.

“Once successful, it slowly infiltrates targeted organizations’ social networks through constant impersonation, rapport building, and phishing to deepen their intrusion,” said Microsoft.

Continue reading “Microsoft Disrupts Russian Cyber-Espionage Group Seaborgium” →

Listy is a simple, free way to catalog your favorite stuff

Posted on by esimantiras

Listy is a simple, free way to catalog your favorite stuff

source: fastcompany.com  |  image: pexels.com

 

You can list your favorite albums, books, movies, TV shows, video games, sites, apps, wines, beers or social posts.

 

This article is republished with permission from Wonder Tools, a newsletter that helps you discover the most useful sites and apps. Subscribe here.

Listy is a free and simple app for making lists of your favorite things. It automatically includes related images, like book or album covers, and you can create shareable visual lists with the free app on Mac, iOS, or Android. It’s a handy way to quickly share recommendations with friends.

You can list your favorite albums, books, movies, TV shows, video games, sites, apps, wines, beers, or social posts. Your list shows up with the appropriate cover art: Any book, album, TV show, or movie you list will be paired with its representative image, just as whatever wines or beers you list will include images of their bottles.

MAKING LISTS IS SIMPLE

  • To make a list you first pick a category—like books, movies, video games. Then you add items one by one. Unlike many other apps, you don’t have to register or log in to start using it.
  • When you start typing the name of something, Listy searches a database to find it. That item, along with its image and other basic info, is added to your list.
  • You can sort lists by title, genre, rating, data added, or other info, depending on the category.
  • For films, the app automatically adds the movie’s release date, description, and fan score, drawn from the Movie Database, a free, community-built platform that’s now used by 400,000 developers and companies. It also notes where the movie is available to watch online.

EDIT AND SHARE YOUR LISTS

  • Once you’ve added items, you can edit your list to change its order or to delete or update items. You can also mark items as watched, read, played, or tasted.
  • You can share any of your lists as an image, making it easy to post lists to your social network of choice. You can also text or email a list as an image.
  • You can make as many lists as you’d like, each with as many items on it as you want.
  • Lists can be backed up to iCloud so they stay in sync between your iPhone, iPad, and Mac.

LIMITATIONS

  • You can export lists as images or in Listy’s own proprietary file format, but you can’t open or edit the app’s lists in other text apps.
  • You can’t send someone a link to a list. You have to attach the list as an image.
  • You can’t yet collaborate on a list with others, though that feature is in the works. The company has been careful about privacy: Its site uses no cookies.
  • You can use Listy for to-do lists or lists of ideas, but it’s not designed primarily for that. Better to use other simple free alternatives like Apple’s Reminders or Google Tasks, or dedicated to-do apps like Things.
  • Listy has a limited number of categories. If you want to make a list of your favorite snacks, animals, cartoon characters, or other categories the app hasn’t added yet, you’re out of luck, though new categories are added monthly.

ALTERNATIVES

 

Smishing vs. Phishing: Understanding the Differences

Posted on by esimantiras

 

Smishing vs. Phishing: Understanding the Differences

 

source: proofpoint.com  |  image: pexels.com

 
What have smishing offenders learned from their phishing email counterparts?

Email-based credential theft remains by far the most common threat we encounter in our data. But SMS-based phishing (commonly known as smishing and including SMS, MMS, RCS, and other mobile messaging types) is a fast-growing counterpart to email phishing. In December 2021, we published an article exploring the ubiquity of email-based phish kits. These toolkits make it straightforward for anyone to set up a phishing operation with little more than a laptop and a credit card. Since then, we’ve tracked their evolution as they gain new functions, including the ability to bypass multifactor authentication.

In this blog post we’re going to look at smishing vs. phishing and what smishing offenders have learned from their email counterparts, as well as some significant differences that remain between the two threats.

Setting the (crime) scene

A modern email phishing setup can be as simple as one person with a computer and access to common cloud-hosted services. But for a smishing operation, the picture is somewhat different. While software smishing kits are available to buy on the dark web, accessing and abusing mobile networks requires a little more investment.

Continue reading “Smishing vs. Phishing: Understanding the Differences” →

5 Ways to Make Your Passwords Instantly More Secure

Posted on by esimantiras

 

5 Ways to Make Your Passwords Instantly More Secure

 

source: cnet.com  |  image: pexels.com

 

If you think your passwords are uncrackable, think again.

Despite years of warnings, experts say most people are still using weak passwords to protect even their most sensitive information. Many people are reusing those insecure passwords to protect multiple accounts, putting more of their data at risk should any of the accounts be compromised.

“It’s the total account takeover scenario,” said John Buzzard, lead fraud and security analyst at Javelin Strategy & Research, referring to a cybercriminal cracking one password and then using it to access other accounts. “Consumers lose control over their entire digital lives.”

World Password Day, which takes place on Thursday, is a good time to review your digital security. Sure, it’s a totally made-up celebration that Intel created in 2013. But it’s still a good reminder to take a close look at your logins and make sure they check the required security boxes.

Continue reading “5 Ways to Make Your Passwords Instantly More Secure” →

What is IoT? Guide to the Internet of Things

Posted on by esimantiras

What is IoT? Guide to the Internet of Things

 

source: eweek.com  |  image: pexels.com

The Internet of Things introduces opportunities for organizations to achieve practical gains and transformative changes.

The Internet of Things (IoT) shifts human and computer interaction to a broad and widely distributed framework. By connecting various “things” and “objects”—smartphones, lights, industrial machines, wearables, remote sensors and physical objects that have been equipped with RFID tags—it’s possible to drive advances that would have seemed unimaginable only a couple of decades ago.

The IoT—which serves as a broad term for a vast network of connected devices—has moved into the mainstream of business and life. It now serves as a fabric for far more advanced human-machine interaction. It encompasses everything from home thermostats and wearables to tracking systems and smart systems for agriculture, buildings and even cities.

Today, virtually no technology lies outside the realm of the IoT. Self-driving vehicles, manufacturing robots, environmental monitoring, supply chain tracking, transportation systems, and remote medical devices are just a few of the areas undergoing radical change due to the IoT.

Mobile phone company Ericsson reports that there are currently about 29 billion IoT devices in use worldwide. Businesses are increasingly turning to the IoT to drive innovation, trim costs, improve safety and security, and promote greater sustainability.

Continue reading “What is IoT? Guide to the Internet of Things” →

FBI investigation:Huawei equipment could disrupt US nuclear comms

Posted on by esimantiras

FBI investigation determined Chinese-made Huawei equipment could disrupt US nuclear arsenal communications

 

source: cnn.com  |  image: pexels.com

 

Washington (CNN)On paper, it looked like a fantastic deal. In 2017, the Chinese government was offering to spend $100 million to build an ornate Chinese garden at the National Arboretum in Washington DC. Complete with temples, pavilions and a 70-foot white pagoda, the project thrilled local officials, who hoped it would attract thousands of tourists every year.

But when US counterintelligence officials began digging into the details, they found numerous red flags. The pagoda, they noted, would have been strategically placed on one of the highest points in Washington DC, just two miles from the US Capitol, a perfect spot for signals intelligence collection, multiple sources familiar with the episode told CNN.
Also alarming was that Chinese officials wanted to build the pagoda with materials shipped to the US in diplomatic pouches, which US Customs officials are barred from examining, the sources said.

Federal officials quietly killed the project before construction was underway.    The Wall Street Journal first

reported about the security concerns in 2018.      The canceled garden is part of a frenzy of counterintelligence activity by the FBI and other federal agencies focused on what career US security officials say has been a dramatic escalation of Chinese espionage on US soil over the past decade.        Since at least 2017, federal officials have investigated Chinese land purchases near critical infrastructure, shut down a high-profile regional consulate believed by the US government to be a hotbed of Chinese spies and stonewalled what they saw as clear efforts to plant listening devices near sensitive military and government facilities.

Continue reading “FBI investigation:Huawei equipment could disrupt US nuclear comms” →

Cyber Companies and Universities Are Building ‘Cyber Talent Hub’

Posted on by esimantiras

Cyber Companies and Universities Are Building ‘Cyber Talent Hub’

source: wsj.com  |  image: unsplash.com

 

Cyber firms will make practical training on their technology available to students in an attempt to address a skills shortage. The effort comes as fears mount that global competitors like China are outpacing the West on talent

Cybersecurity companies, investors and universities are collaborating to build a platform that would connect students with private-sector employers in hands-on training on the companies’ own technologies.

The effort is aimed at addressing a dearth of cyber professionals—around 600,000 positions in the U.S. alone are unfilled, according to industry surveys. Job seekers, however, are often stymied by excessive requirements for entry-level jobs, including demands for experience typically gained after years in the industry.

The Cyber Talent Hub, as the new platform will be called, will allow companies worldwide to post custom content allowing students to train on specific technologies they are likely to encounter in their careers. It will be launched at the end of this year.

Continue reading “Cyber Companies and Universities Are Building ‘Cyber Talent Hub’” →

New Air-Gap Attack Uses SATA Cable as an Antenna to Transfer Radio Signals

Posted on by esimantiras

New Air-Gap Attack Uses SATA Cable as an Antenna to Transfer Radio Signals

source: thehackernews.com  |  image:  pexels.com

 

A new method devised to leak information and jump over air-gaps takes advantage of Serial Advanced Technology Attachment (SATA) or Serial ATA cables as a communication medium, adding to a long list of electromagnetic, magnetic, electric, optical, and acoustic methods already demonstrated to plunder data.

“Although air-gap computers have no wireless connectivity, we show that attackers can use the SATA cable as a wireless antenna to transfer radio signals at the 6GHz frequency band,” Dr. Mordechai Guri, the head of R&D in the Cyber Security Research Center in the Ben Gurion University of the Negev in Israel, wrote in a paper published last week.

The technique, dubbed SATAn, takes advantage of the prevalence of the computer bus interface, making it “highly available to attackers in a wide range of computer systems and IT environments.”

Continue reading “New Air-Gap Attack Uses SATA Cable as an Antenna to Transfer Radio Signals” →

Text scams surge as robocalls decline, report finds

Posted on by esimantiras

Text scams surge as robocalls decline, report finds

source: usatoday.com  |  image: unsplash.com

 

You may have noticed receiving fewer robocalls over the past year, but a new report finds scammers are increasingly using a new way to reach consumers: text messages.

A report from the Consumer Watchdog office of the nonprofit U.S. PIRG is urging the Federal Communications Commission to pass new rules against robotexts, including requiring phone companies to block illegal text scams.

“Illegal robocalls and robotexts likely will never go away,” an excerpt from the report reads. “But they’ll continue to plague us as long as enforcement is lax, phone companies don’t try harder and enough consumers fall for scams to make it worthwhile for thieves.”

Spam texts have surged over the past year, jumping from 1 billion sent per month in July 2021, to more than 12 billion as of June, according to RoboKiller, a service specializing in blocking unwanted calls and texts.

Last year, acting FCC Chairwoman Jessica Rosenworcel proposed new rules requiring wireless carriers to block illegal texts.

In a statement released last October, the agency said complaints about unwanted text messages in 2020 more than doubled from the year before. 

“We’ve seen a rise in scammers trying to take advantage of our trust of text messages by sending bogus robotexts that try to trick consumers to share sensitive information or click on malicious links,” Rosenworcel said in last year’s statement.

The top scam texts of last year involved bogus delivery messages claiming to represent Amazon, the U.S. Postal Service or other companies. The messages say an order can’t be delivered or will arrive tomorrow, with a malicious link consumers click, the watchdog report said.

Others included fake messages from banks and texts related to the COVID-19 pandemic.

Meanwhile, the number of robocalls has declined over the past year, in part because of FCC rules requiring the use of technology to better identify robocalls and efforts by the agency and states to go after robocallers.