Two things:
1) I am still unable to start a thread- my UI is as follows https://pasteboard.co/GK6RXoN.png
2) For the presentation / summary, are we supposed to be writing this as if presenting to the company? Should we be talking about what we found, or how we found it?
Andres – I found the last article you posted “https://imgur.com/gallery/rNlQJuT” very interesting. It provides a lot of additional google hacking methods that can be used in the future. It would be great if there was a site that has all the available search operators? It will be great, if anyone knows a site that contains all the available search operators and can share it with everyone.
Hacker group OurMine hacked Vevo and then leaked the data. They call themselves white hackers, which I would disagree. Releasing data is something a malicious hacker group would do.
Pretty weird that “The group… removed the stolen information from its website on Vevo’s request.” Especially once you consider the fact that once it’s downloaded once, pulling it off their website doesn’t really do anything to stop the flow of info.
One thing that I found very odd about the story as well is Vevo’s first response (or rather that of an employee) to OurMine’s initial contact informing them about the breach. It seems strange that someone who I would assume is in a position in the IT or security department would be so immediately dismissive of a message notifying them of a breach, Clearly, it was something worth looking into and should have been treated with more seriousness from the outset. This incident will definitely get them to reevaluate their IDS if nothing else.
CCleaner, a tool used by many too delete unnecessary filed on their Windows computer and keep it running smoothly, was infiltrated with malware. Piriform, the company that developed CCleaner says they noticed an unknown IP address receiving data from the software on September 12th. They have patched the issue so users need to update CCleaner as soon as possible. The paid version of CCleaner has automatic updates but the free version does not so free version users are most at risk currently. The do not know who perpetrated the attack or when they got in but do know the server the data was being sent to is in the US.
That is definitely unfortunate for users of the free version if they don’t follow this kind of news. They could potentially go weeks or months without realizing that there is compromised software on their device. Companies should consider implementing some sort of notification system to communicate with all users of their product in the event of incidents like these. to help ensure patches will be downloaded. I think that would be a good step towards mitigating the security risk posed by these kind of issues.
Amanda – Very interesting article. I read up some more on this article and found out that hackers were able to singe the malicious installation executable (v5.33) using a valid digital signature issued to Priform by Symantec. The hackers also used DGA (Domain Generation Algorithm) so if the server went down they could use DGA to generate new domain to receive and send stolen information. Also, even though the CCleanre company is claiming the new version will fix all the issue, it is recommended to perform a deep clean. Again, great article Amanda.
Thank you Amanda for sharing this article with us. It’s very important to understand this issue since a large of people use CCleaner and most of the versions that are used are free. The biggest question in my opinion would be: Why this is happing? Is it to hack the other people data or the company Piriform itself does hacking the software to make people buy the paid version which is the patched one?
In my opinion, the company can be responsible for this unknown IP address for two reasons:
1- Make people buy the paid version.
2- Make people aware of there is a risk of hacking data from their computers and the only safe way to use Ccleaner to clean them.
The free version of CCleaner is also patched, it just does not have auto-update enabled so the user has to manually update it to the patched version, while the paid one does have auto-update so the user doesn’t have to do anything to have the patched version. I do think it was Piriform’s responsibility to ensure that their product does not include malware, but to insinuate that they purposefully put the malware into the product is quite the mental leap. Could it have been a rogue employee doing it? I think that is a possibility. But was it a calculated business move? I think that is extremely unlikely.
This article talks about the following: Foreign countries manipulating citizens by pushing out fake news in social media, both the sides left and right are ignoring facts and instead pushing out fake as long as it benefits them, Facebook discovered a Russian connection where they spend 100k on the last election to push fake news out, and finally we are so focus on our argument dominating that we lose track of what the real problem is, foreign countries are using social media as a method to hack and manipulate our elections and benefit them without even needing to hack our systems.
It will be interesting to see how things unfold in the future. Will social media (fake news) be a bigger threat to U.S then the hacking of system? What will companies like Facebook do to prevent foreign countries from continued to spread fake news that benefits them? Will the government regulate the social media industry?
In my opinion, there is a brain hacking as well as computer hacking. In other words, for so many years Media including social media played a role to brain wash people and address certain ideas to the goal of making a party fail or help a politician to success.
Your article talks about Russia but I can guarantee you that so many governments of other countries do as well. There are articles talk how the biggest Media network “Aljazeera” for example played a big role to change the leaderships in many countries during the Spring Arab.
This article talks about the steps you need to take if you interested in following a career in cybersecurity.
– Why is there an increased demand for cybersecurity professionals?
Cybercrime has exploded in the past couple of years, with major ransomware attacks such as WannaCry and Petya putting enterprises’ data at risk. To protect their information and that of their clients, companies across all industries are seeking cyber professionals to secure their networks.
-What are some of the cybersecurity job roles?
A career in cybersecurity can take the form of various roles, including penetration tester, chief information security officer (CISO), security engineer, incident responder, security software developer, security auditor, or security consultant.
-What skills are required to work in cybersecurity?
The skills required to work in cybersecurity vary depending on the position and company, but generally may include penetration testing, risk analysis, and security assessment. Certifications, including Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP) are also in demand, and can net you a higher salary in the field.
Where are the hottest markets for cybersecurity jobs? Top companies including Apple, Lockheed Martin, General Motors, Capital One, and Cisco are all hiring cybersecurity professionals. Industries such as healthcare, education, and government are most likely to suffer a cyberattack, which will probably lead to an increase in the number of IT security jobs in these sectors.
-What is the average salary of a cybersecurity professional?
The average salary for a cybersecurity professional depends on the position. For example, information security analysts earn a median salary of $92,600 per year, according to the US Bureau of Labor Statistics. Meanwhile, CISOs earn a median salary of $212,462, according to Salary.com. Salaries are significantly higher in certain cities, such as San Francisco and New York.
-What are typical interview questions for a career in cybersecurity?
Questions can vary depending on the position and what the specific company is looking for, according to Forrester analyst Jeff Pollard. For entry and early career roles, more technical questions should be expected. As you move up the ranks, the questions may become more about leadership, running a program, conflict resolution, and budgeting.
-Where can I find resources for a career in cybersecurity?
ISACA, ISC(2), ISSA, and The SANS Institute are national and international organizations where you can seek out information about the profession as well as certification and training options. A number of universities and online courses also offer cybersecurity-related degrees, certifications, and prep programs
Apple has lunched recently the new IphoneX with a new future called FaceID to replace the Finger print ID future. Few issues concerning the new facial recognition system have been raised, It became such a debate whether it might make it easier for the authorities or thieves to force a user to unlock their handset and whether it will handle the hijab worn by some Muslim women, among other facewear.
This new Iphone X will be available in November. Journalists at the launch at the company’s Cupertino, California headquarters were shown Face ID working in controlled circumstances.
On Wednesday, Senator Al Franken published a letter he had sent to Apple seeking more information about this new future.
The biggest question at this time how Face ID will impact iPhone users’ privacy and security, and whether the technology will perform equally well on different groups of people,” he wrote.”To offer clarity to the millions of Americans who use your products, I ask that you provide more information on how the company has processed these issues internally, as well as any additional steps that it intends to take to protect its users.”
good article but i seem to think we have so much personal information on our devices. We should worry about securing them . Apple as a vendor has to continue to re-invent their products. Past apple iphones had finger recognition and now moving to facial. The more things you had to a device the more chances of security issues and compromising personal information.
Two things:
1) I am still unable to start a thread- my UI is as follows https://pasteboard.co/GK6RXoN.png
2) For the presentation / summary, are we supposed to be writing this as if presenting to the company? Should we be talking about what we found, or how we found it?
Same here with 1) and 2) What is that UI and thread, please?
For my hacking article of the week, I wanted to try a different approach. Below are some of my favorite news sources for security-related topics.
https://www.schneier.com/crypto-gram/
https://www.reddit.com/r/netsec/
https://isc.sans.edu/
Also, since we talked about Google hacking this week, I thought I’d share the below infographic.
https://imgur.com/gallery/rNlQJuT
Andres – I found the last article you posted “https://imgur.com/gallery/rNlQJuT” very interesting. It provides a lot of additional google hacking methods that can be used in the future. It would be great if there was a site that has all the available search operators? It will be great, if anyone knows a site that contains all the available search operators and can share it with everyone.
@Andres, thanks for sharing! I have a hard time following articles on reddit but it is a great source of information.
My article: http://thehackernews.com/2017/09/vevo-music-video-hacked.html
Hacker group OurMine hacked Vevo and then leaked the data. They call themselves white hackers, which I would disagree. Releasing data is something a malicious hacker group would do.
Pretty weird that “The group… removed the stolen information from its website on Vevo’s request.” Especially once you consider the fact that once it’s downloaded once, pulling it off their website doesn’t really do anything to stop the flow of info.
@Ian, good catch! And yeah very strange. You would think Vevo would know that..
One thing that I found very odd about the story as well is Vevo’s first response (or rather that of an employee) to OurMine’s initial contact informing them about the breach. It seems strange that someone who I would assume is in a position in the IT or security department would be so immediately dismissive of a message notifying them of a breach, Clearly, it was something worth looking into and should have been treated with more seriousness from the outset. This incident will definitely get them to reevaluate their IDS if nothing else.
http://time.com/4946576/ccleaner-malware-hack/
CCleaner, a tool used by many too delete unnecessary filed on their Windows computer and keep it running smoothly, was infiltrated with malware. Piriform, the company that developed CCleaner says they noticed an unknown IP address receiving data from the software on September 12th. They have patched the issue so users need to update CCleaner as soon as possible. The paid version of CCleaner has automatic updates but the free version does not so free version users are most at risk currently. The do not know who perpetrated the attack or when they got in but do know the server the data was being sent to is in the US.
That is definitely unfortunate for users of the free version if they don’t follow this kind of news. They could potentially go weeks or months without realizing that there is compromised software on their device. Companies should consider implementing some sort of notification system to communicate with all users of their product in the event of incidents like these. to help ensure patches will be downloaded. I think that would be a good step towards mitigating the security risk posed by these kind of issues.
Amanda – Very interesting article. I read up some more on this article and found out that hackers were able to singe the malicious installation executable (v5.33) using a valid digital signature issued to Priform by Symantec. The hackers also used DGA (Domain Generation Algorithm) so if the server went down they could use DGA to generate new domain to receive and send stolen information. Also, even though the CCleanre company is claiming the new version will fix all the issue, it is recommended to perform a deep clean. Again, great article Amanda.
Thank you Amanda for sharing this article with us. It’s very important to understand this issue since a large of people use CCleaner and most of the versions that are used are free. The biggest question in my opinion would be: Why this is happing? Is it to hack the other people data or the company Piriform itself does hacking the software to make people buy the paid version which is the patched one?
In my opinion, the company can be responsible for this unknown IP address for two reasons:
1- Make people buy the paid version.
2- Make people aware of there is a risk of hacking data from their computers and the only safe way to use Ccleaner to clean them.
The free version of CCleaner is also patched, it just does not have auto-update enabled so the user has to manually update it to the patched version, while the paid one does have auto-update so the user doesn’t have to do anything to have the patched version. I do think it was Piriform’s responsibility to ensure that their product does not include malware, but to insinuate that they purposefully put the malware into the product is quite the mental leap. Could it have been a rogue employee doing it? I think that is a possibility. But was it a calculated business move? I think that is extremely unlikely.
http://www.technewsworld.com/story/84798.html
Russia, Fake News and Facebook: 24/7 Manipulation
This article talks about the following: Foreign countries manipulating citizens by pushing out fake news in social media, both the sides left and right are ignoring facts and instead pushing out fake as long as it benefits them, Facebook discovered a Russian connection where they spend 100k on the last election to push fake news out, and finally we are so focus on our argument dominating that we lose track of what the real problem is, foreign countries are using social media as a method to hack and manipulate our elections and benefit them without even needing to hack our systems.
It will be interesting to see how things unfold in the future. Will social media (fake news) be a bigger threat to U.S then the hacking of system? What will companies like Facebook do to prevent foreign countries from continued to spread fake news that benefits them? Will the government regulate the social media industry?
Donald,
In my opinion, there is a brain hacking as well as computer hacking. In other words, for so many years Media including social media played a role to brain wash people and address certain ideas to the goal of making a party fail or help a politician to success.
Your article talks about Russia but I can guarantee you that so many governments of other countries do as well. There are articles talk how the biggest Media network “Aljazeera” for example played a big role to change the leaderships in many countries during the Spring Arab.
http://www.techrepublic.com/article/cheat-sheet-how-to-become-a-cybersecurity-pro/
Cheat sheet: How to become a cybersecurity pro
This article talks about the steps you need to take if you interested in following a career in cybersecurity.
– Why is there an increased demand for cybersecurity professionals?
Cybercrime has exploded in the past couple of years, with major ransomware attacks such as WannaCry and Petya putting enterprises’ data at risk. To protect their information and that of their clients, companies across all industries are seeking cyber professionals to secure their networks.
-What are some of the cybersecurity job roles?
A career in cybersecurity can take the form of various roles, including penetration tester, chief information security officer (CISO), security engineer, incident responder, security software developer, security auditor, or security consultant.
-What skills are required to work in cybersecurity?
The skills required to work in cybersecurity vary depending on the position and company, but generally may include penetration testing, risk analysis, and security assessment. Certifications, including Certified in Risk and Information Systems Control (CRISC), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP) are also in demand, and can net you a higher salary in the field.
Where are the hottest markets for cybersecurity jobs? Top companies including Apple, Lockheed Martin, General Motors, Capital One, and Cisco are all hiring cybersecurity professionals. Industries such as healthcare, education, and government are most likely to suffer a cyberattack, which will probably lead to an increase in the number of IT security jobs in these sectors.
-What is the average salary of a cybersecurity professional?
The average salary for a cybersecurity professional depends on the position. For example, information security analysts earn a median salary of $92,600 per year, according to the US Bureau of Labor Statistics. Meanwhile, CISOs earn a median salary of $212,462, according to Salary.com. Salaries are significantly higher in certain cities, such as San Francisco and New York.
-What are typical interview questions for a career in cybersecurity?
Questions can vary depending on the position and what the specific company is looking for, according to Forrester analyst Jeff Pollard. For entry and early career roles, more technical questions should be expected. As you move up the ranks, the questions may become more about leadership, running a program, conflict resolution, and budgeting.
-Where can I find resources for a career in cybersecurity?
ISACA, ISC(2), ISSA, and The SANS Institute are national and international organizations where you can seek out information about the profession as well as certification and training options. A number of universities and online courses also offer cybersecurity-related degrees, certifications, and prep programs
Apple explains Face ID on-stage failure
Apple has lunched recently the new IphoneX with a new future called FaceID to replace the Finger print ID future. Few issues concerning the new facial recognition system have been raised, It became such a debate whether it might make it easier for the authorities or thieves to force a user to unlock their handset and whether it will handle the hijab worn by some Muslim women, among other facewear.
This new Iphone X will be available in November. Journalists at the launch at the company’s Cupertino, California headquarters were shown Face ID working in controlled circumstances.
On Wednesday, Senator Al Franken published a letter he had sent to Apple seeking more information about this new future.
The biggest question at this time how Face ID will impact iPhone users’ privacy and security, and whether the technology will perform equally well on different groups of people,” he wrote.”To offer clarity to the millions of Americans who use your products, I ask that you provide more information on how the company has processed these issues internally, as well as any additional steps that it intends to take to protect its users.”
http://www.bbc.com/news/technology-41266216
good article but i seem to think we have so much personal information on our devices. We should worry about securing them . Apple as a vendor has to continue to re-invent their products. Past apple iphones had finger recognition and now moving to facial. The more things you had to a device the more chances of security issues and compromising personal information.