Week 12: Introduction to Wireless Security with WEP and WPA2 PSK

The Cybersecurity and Infrastructure Security Agency (CISA) discharged its Cyber Essentials, a beginning stage for small businesses and government organizations to comprehend and address cybersecurity risk as other risks. Cyber Essentials expects to prepare smaller associations that have never been a part of the national dialogue on cybersecurity with fundamental steps and assets to improve their cybersecurity.

Each of the six Cyber Essentials includes a list of actionable items anyone can take to reduce cyber risks. These are:

• Drive cybersecurity strategy, investment and culture;
• Develop heightened level of security awareness and vigilance;
• Protect critical assets and applications;
• Ensure only those who belong on your digital workplace have access;
• Make backups and avoid loss of info critical to operations; and
• Limit damage and restore normal operations quickly.

https://www.cisa.gov/cisa/news/2019/11/06/cisa-releases-cyber-essentials-small-businesses-and-governments

There has been a lot of hype around Disney Plus since it launched. From their servers crashing to getting hacked they clearly had a very interesting week. The service got more than 20 million users in its first 24 hours which resulted in their website getting so much traffic that their servers crashed. A lot of users complained about not being able to access their accounts. Disney’s official statement said that there has been no breach but user accounts and information are popping up online for sale for as little as $3.

https://www.washingtonpost.com/business/2019/11/19/thousands-disney-accounts-were-hacked-sold-online-little/

The security research team at Checkmarx has made something of a habit of uncovering alarming vulnerabilities, with past disclosures covering Amazon’s Alexa and Tinder. However, a  discovery of vulnerabilities affecting Google and Samsung smartphones, with the potential to impact hundreds of millions of Android users, is the biggest to date. What did the researchers discover? Oh, only a way for an attacker to take control of smartphone camera apps and remotely take photos, record video, spy on your conversations by recording them as you lift the phone to your ear, identify your location, and more. All of this performed silently, in the background, with the user none the wiser.

https://www.forbes.com/sites/daveywinder/2019/11/19/google-confirms-android-camera-security-threat-hundreds-of-millions-of-users-affected/#753bfbe64f4e

IT provider InfoTrax Systems is being sued by the FTC for failing to detect 20 hacking intrusions over a 22-month period. 22 months!  Hackers went undetected and were able to access data for 1 million consumers including full names, SSNs, physical and email addresses, phone numbers, and credentials for InfoTrax accounts. The breach was only discovered by InfoTrax due to the hacker maxed out their cloud storage system.

The following article outlines the FTC complaint against InfoTrax. It lists InfoTrax’s unreasonable security practices (lack of controls and processes) https://www.ftc.gov/system/files/documents/cases/162_3130_infotrax_complaint_clean.pdf

• Not taking inventory and deleting personal data (data retention policy)
• Not conducting code review of its software and testing the security of its network
• Not detecting malicious file uploads
• Not adequately segmenting its network (protect critical business assets)
• Not implementing security safeguards (IPS/IDS)to detect suspicious activity on its network

https://www.zdnet.com/article/thousands-of-hacked-disney-accounts-are-already-for-sale-on-hacking-forums/

Intro-to-Ethical-Hacking-Week-12

https://capture.fox.temple.edu/Mediasite/Play/08985ba7c9594d48896c4fddecc46b8d1d

Instagram is testing a new option to hide the “like” counts from the public and only available to the post owner self. The user can decide whether they wanna receive public’s opinion of the post. Social Media’s new attempt to put humanity in front of technology? My questions would be, why not just having a “like” function without any amounts collecting?

 

techcrunch.com