Ethical Hacking

A review of the Phishing attacks for the Year 2020 has been summarized below:
A report by Interisle Consulting Group and Illumintel states some major facts about the phishing landscape in 2020.
First off, the exact size of the phishing problem remains unknown. However, the problem is bigger than it seems.
Most phishing is focused on a small number of domain registrars and registries and hosting providers.
Of all the maliciously registered domains, 65% is used within 5 days of registration.
Around 9% of phishing attacks are conducted on a small number of subdomain service providers.

The amount of phishing attacks discovered every year continues to increase. It takes advantage of our cognitive biases and fools us into giving away our details. When these biases are combined with clever tactics used by cybercriminals, the attacks become even more effective.

Reference: https://cyware.com/news/how-much-phishing-is-too-much-phishing-6de63298

This week’s reading article introduced us to the world of malware. The article provided a fundamental definition of malware as well as provided brief definitions of the types of malware.
It was interesting to read how the malware propagates through systems once they are infected. The article also provided history of malware in computer systems and concluded with a methodology of six basic steps which constitute a malware response plan.

Question:
What skills are needed for writing malware?

Malware

• Described as malicious software intentionally designed to cause damage to a computer, server, client, or computer network. (ex.  computer viruses, worms, Trojan horses, ransomware, spyware, adware, rogue software, and scareware)
• Detect/remove malware: windows defender/Malwarebytes
• The term was coined by Yisrael Radai in 1990
  • first-known malware is Creeper: moved around different mainframes with a message that said “‘I’m the creeper: Catch me if you can.”
• PUP(Potentially unwanted software): tricks users into installing into their systems through browser toolbars
  • can contain spyware functionality…not normally considered malware unless executes malicious features.

Questions:

1. Have you ever encounter a malware attack? How and why?
2. What can be used to defend against a malware attack?

Many Apple Users also use the navigation software app called Waze. Security engineer Peter Gasper found out when he was using the app’s web interface that it doesn’t just display his coordinates, it also displays the coordinates of the driver’s nearby. Each driver/account is assigned a unique ID and it doesn’t change over time. This means that if someone with malicious intent were to track a driver, they can also track the driver’s complete journey, what cities they go through, and their stops. This is incredibly dangerous because if there were any human trafficking/kidnappings to occur, the trafficker could’ve used Waze’s vulnerability to locate their target. This vulnerability has been patched since then but it’s interesting to think how as much as technology helps us, it can also make the world a more dangerous place.

https://www.infosecurity-magazine.com/news/waze-vulnerability-identifies-users/