Week 03

How to become a Professional Hacker? This is one of the most frequently asked queries we came across on a daily basis.

Do you also want to learn real-world hacking techniques but don’t know where to start? This week’s THN deal is for you.

Today THN Deal Store has announced a new Super-Sized Ethical Hacking Bundle that let you get started your career in hacking and penetration testing regardless of your experience level.

The goal of this online training course is to help you master an ethical hacking and penetration testing methodology.

This 76 hours of the Super-Sized Ethical Hacking Bundle usually cost $1,080, but you can exclusively get this 9-in-1 online training course for just $43 (after 96% discount) at the THN Deals Store.

https://thehackernews.com/2017/07/ethical-hacking-online-training.html

 

A new book argues that modern wars will be won with phones and laptops rather than tanks.

I was interested enough by the conversation surrounding this book on Hacker News that I sprung for the it. Information operations/warfare is fascinating to me, and I’ll give a recap of the book when I’ve finished it.

https://www.reuters.com/article/us-germany-cyber/german-government-hack-was-part-of-worldwide-campaign-sources-idUSKCN1GE2H5

According to sources, the attack on Germany was part of worldwide campaign reportedly run by Snake, a Russian hacker group. The investigations are going on according to which the attack was first reported in December but it actually began much earlier. Kremlin spokesman denied the allegations. German spokesperson said that they have averted major attack but did not reveal if the attack is still going on. According to some reports, attackers installed malicious software on 17 computers and copies some data including related to Russia.

Initially, German media reported that the attack was carried out by the Russian hacker group APT28 but now it is putting blame on Snake, another Russian hacker group. Recently wanna cry was reportedly done by Russia and target of the attack was Ukraine, ex-soviet republics, countries in South America, Baltic States and Scandinavia. These kinds of attacks are continuously increasing. Germany became the victim of the cyber-attack during 2016 presidential elections also.  The latest assault was targeted at German political institutions and individuals.

http://fox59.com/2018/03/30/new-iu-program-monitors-cybersecurity-threats-at-other-universities/

Indiana University launched a program called OmniSoc in a bid to prevent the universities from growing cyber-attacks. It will monitor the cyber problems of universities in real time. Technicians will act like security guards, the only difference will be that they will not guard any building but a regular online network. It will be 24 by 7 services present throughout the year. It is already monitoring the network of universities which are part of Big 10.

Executive director Tom Davis said that they want to identify the attacker at the earnest and want to create warnings for all the universities as soon as possible so that they can be prevented from future attacks. Soon this service will be taken over to the whole of the country. This step has been taken with regard to increasing cyber-attacks in the country. Recently Atlanta faced ransomware in which for the significant period of time, the police department was stalled and major information was stolen. Today everyone has laptop and mobile so there is need to prevent students from these cyber-attacks. OmniSoc will act as real-time monitoring station. It will give warning to all the universities in its ambit if any attack is planned by someone.

https://securityboulevard.com/2018/03/cyber-news-rundown-atlanta-ransomware-attack/

The city of Atlanta faced ransomware attack that led to detrimental effects on the police department. The city soon recovered from the incident but such cyber-attacks have been becoming very common.

Investigations have been going on Facebook regarding the collection of data of individuals. It has been estimated that due to lax API permissions, Facebook was able to collect the data from phone calls and SMS without user opt-ins. Recently, UK anti-doping agency has become the victim of cyber-attack. The attackers wanted to conceal the information of drug testing and medical records of athletes. Russia is alleged to be behind the attack as recently, Russian athletes were revealed to be using illegal substances to boost their performance. Fortunately, attackers were not able to conceal any data.

Due to the scandal in which misuse of data by third-party apps was revealed, Facebook is overhauling its Bounty Hunter program. The third party app found to be misusing the data from Facebook will be blocked permanently. Sanny malware has received multistep- delivery system. It has changed the delivery method of malware. Once the macro is launched, it downloads the file bypassing OS security checks.

https://www.newyorker.com/news/news-desk/the-seemingly-random-and-definitely-worrisome-cyberattack-on-atlanta

The city of Atlanta became a victim of ransomware on Thursday. According to the chair of the city’s finance committee, this is the biggest debacle he has seen in last 2 decades. All the information of last 16 years has been lost.  The group which has been identified behind the cyber-attack is identified as SamSam. Many more cities like Boeing have been affected by ransomware but the Atlanta is the largest city to be affected by ransomware so far. It is not yet clear if it is done for monetary incentives. Moreover, the city does not have the policy regarding the payment compensation of ransomware.

A federal criminal investigation is going on. Not many details have been revealed by the authorities so far.  The executive committee of the city held a meeting to discuss the attack but no major solution has been found so far. Chair of the finance committee said there are 9700 employees. So anyone can open an attachment related to the cyber-attack which comes in their mail for the purpose of malware or ransomware. He seemed helpless and he did not know how to prevent it in future.  The city administration has told the city to use more sophisticated methods to prevent such kind of attacks.

https://www.darkreading.com/endpoint/facebook-aims-to-make-security-more-social-/d/d-id/1331063

 

About time for facebook to make their stuff more secure.  Would have thought they would have thought about this from the beginning.

 

 

There are constant reports about new attacks, breaches, exploits and threats which make it difficult for stakeholders to understand the full impact of cybercrime. A report from McAfee in collaboration with the Center of Strategic and International Studies (CSIS), shows that cybercrime currently costs the global economy at a starting of $600 billion per year, or 0.8% of the global GDP. This is a 20% jump from cybercrime cost in 2014.

Additionally, a report from Cisco, which is based on interviews with over 3.000 CISOs, shows that almost half of all attacks end up costing the victim at least $500,000. 8% of companies in the report stated that cyber attacks have cost them over $5 million. For 11% of those companies, the cost ranges from $2.5 million to $4.9 million.

The $600 billion figure in the two reports represents total estimated losses due to theft of intellectual property and business confidential information, online fraud and financial crimes, personally identifiable information, financial fraud using stolen sensitive business information and other factors.

The reports have made it clear that there is an underreporting by victims and the scarcity of real data surrounding cybercrime incidents worldwide has made it difficult to get an accurate estimate of cybercrime costs. Typically, organizations only report minimum losses from cybercrime to avoid reputational damage and liability risks.

The cost of cybercrime has increased over the years as a result of ransomware, cybercrime-as-service, and the growing use of anonymity-enabling technologies (Tor and Bitcoin). Malicious activity on the Internet is at an all-time high. Vendors have reported over 80 billion malicious scans, 4,000 ransomware attacks, 300,000 new malware samples and 780,000 records lost due to daily hacking.

https://www.darkreading.com/attacks-breaches/global-cybercrime-costs-top-$600-billion-/d/d-id/1331106

https://www.darkreading.com/careers-and-people/best-practices-for-recruiting-and-retaining-women-in-security/d/d-id/1331114

The article introduces a few best practices, according to Forrester Research, to help reduce the gender gap in the cybersecurity field.

Women represent 15- 20% of the industry. However that includes risk management functions.

Recruit from academic institutions with a higher enrollment of women, Mentoring programs and Sponsor, recruit from diverse security events are a few examples.

“Hackers Can Now Steal Data Even From Faraday Cage Air-Gapped Computers”

In Wireless Network Security, given the nature of physics related to Wireless Signal propagation in the air, exposure of Wireless Radio Frequency waves beyond intended security perimeter such as building or room had always been an issue. When signal is bleeding outside of building and is reachable from a cafe shop across the street, it must be considered as a big problem because a a hacker can perform malicious activities while drinking coffee in a cafe shop across the street without even necessity to get into the building. While this is an issue, companies for many years have been accepting this fact “as-is” and protected wireless access by applying best industry practices (such as Changing Passcode every 3-6 months) and implementing appropriate wireless security to prevent from malicious eavesdropping.

While general wireless security solutions work for most organizations, some organizations may need to have workstation completely isolated from network communications. A “Faraday Cage” is what usually used to achieve complete isolation from network by containment of any signal transmission within the cage where critical workstation reside.

https://thehackernews.com/2018/02/airgap-computer-hacking.html