MIS 5212-Advanced Penetration Testing

MIS 5212 - Section 001 - Wade Mackey

Fox School of Business

Mengxue Ni

Philadelphia Ransomware Sets Sights on Healthcare

by Leave a Comment

The Philadelphia ransomware has begun targeting healthcare organizations, in a targeted campaign likely carried out by amateurs. According to Forcepoint researcher Roland Dela Paz, the attack involves using Philadelphia as the payload in a spear-phishing campaign. A shortened URL is used as a lure. Once a user clicks on the link, the site redirects to a personal storage site to download a malicious document that contains the targeted healthcare organization’s logo and a signature of a medical practitioner from the organization as bait.

One teenager was identified as a suspect for operating Philadelphia just last month. A public decrypted is available to those who have been infected by Philadelphia. The analyst Dela Paz pointed out that being inclined to paying ransom to recover patient data, the healthcare sector became a low-hanging fruit for seasoned ransomware operators looking to maximize profit, such as those behind the Locky ransomware.

 

Link: https://www.infosecurity-magazine.com/news/philadelphia-ransomware-sets/

Kali Linux “NetHunter”-Turn Your Android Device into Hacking Weapons

by 1 Comment

Kali Linux is an open source Debian-based operating system for penetration testing and forensics. It comes wrapped with a collection of penetration testing and network monitoring tools used for testing of software privacy and security.

After making its influence in hacker and security circles, Kali Linux has now been published with Kali Nethunter, a version of the security suite for Android devices. The tool is a mobile distribution designed to compromise systems via USB when installed and run on an Android phone.

The tools are designed for use by an attacker who has physical access to a device — an insider threat — or someone who gains access through social engineering, tailing etc.

http://thehackernews.com/2014/09/kali-linux-nethunter-turn-your-android.html

Russia Admits Major Info Warfare Mission

by Leave a Comment

Ruslan Stoyanov-head of Kaspersky Lab’s computer incidents investigation team and two Federal Service (FSB) officers Sergei Mikhailove and Dmitry Dokuchayev were arrested two months ago. The treason case had brought in December is the result of allegations made by an online payments firm seven years ago, it has emerged.

It was initially though that they may have been arrested in connection with an incendiary dossier compiled by a former MI6 man about US President Donald Trump, alleging the Kremlin has compromising material on him.

However, Pavel Vrublevsky, founder of online payments firm ChronoPay, told Reuters that the arrests were made in connection with allegations he made in 2010 that Stoyanov and Mikhailov had passed secrets to US firms which then made their way into the hands of intelligence officials.

Link: https://www.infosecurity-magazine.com/news/russian-cyber-treason-case-takes/

Only 3% of Orgs Can Address Top Threats like Ransomware

by 2 Comments

When it comes to how successful business will be at defending against the top attacks of the day, the results are sadly lackluster: research reveals that only 3% of organizations have the technology and only 10% have the skills in place to address them. Ransomware alone has the potential to inflict the most significant damage to organizations in 2017, yet not even half of those surveyed have the skills (44%) or the technology (43%) to effectively combat it.

The survey didn’t tell us that 3% organizations are all the organizations or only those which were attacked. If it is only those which were attacked, then I think this number is fair because I believe hackers will do researches before hacking, so they will choose organizations which didn’t have enough skills or technologies. I would like to think big companies most having the abilities to address top treats like ransomware, or they will do a great job on protecting themselves from these attacks.

Link: https://www.infosecurity-magazine.com/news/only-3-of-orgs-can-address-top/

 

Social Media Phishing Attacks Soar 500%

by 3 Comments

Social Media phishing attacks jumped by a massive 500% in Q4,2016. The report claimed fraudulent accounts across sites like Twitter and Facebook increased 100% from the third to fourth quarter. So-called “angel phishing” is a relatively new tactic in which the black hats register fake Twitter accounts that masquerade as customer support accounts. They monitor the real support accounts for irate customer messages and then quickly jump in to send messages back to those users loaded with malicious links.

I was phishing attacked by an email that told me I was hired by a company which I never applied. I did search the person who was trying to interview me, I found out the real-person said she didn’t hire people through google hangout or skype. Also, she said her identity was stolen on LinkedIn. For students who is desecrating to get a job after graduation, I think this kind of phishing is very attractive. The only thing I didn’t get is how did them get my school email.

 

Link: https://www.youtube.com/watch?v=qE3lce3XGXw

Microsoft asks for an exception to the US Immigration Ban

by Leave a Comment

Microsoft has asked President Donald Trump’s administration for an exception to the executive order (EO) on immigration that bans travel from seven majority-Muslim Countries.

The computing behemoth is seeking a program that would allow people from those countries to enter and leave the United States on business or family emergency travel if they hold valid work or student visas and have not committed any crimes.

It’s not just Microsoft that is concerned with the immigration stance of the new president: Google, Apple and Amazon.com, all big employers of foreign-born tech talent, have expressed opposition to the administration’s policies.

I think people who already have green-card and valid work-visa in America should not be sent back to their own countries. It is unfair for people who work hard to stay in America. In addition, America is an immigration country, if president Trump wants to only keep citizens here, there won’t be enough populations to support the country.

link: https://www.infosecurity-magazine.com/news/microsoft-asks-for-exception-1/

Mozilla: HTTPS Traffic Now Over 50%

by 1 Comment

Finally, some good news is posted. The white hats emerged this week after Mozilla revealed that more web pages are now loaded by Firefox using the secure HTTPS protocol than not.

As of 30 January, the figure stood at 50.1%, but it’s been on a steady rise since November 2015 when the figure was under 40%.

The uptake is being helped by initiatives such as the Mozilla and Chrome-backed Let’s Encrypt, which act as an automated certificate authority to provide HTTPS certs to sites for free, and HTTPS Everywhere – a Firefox, Chrome and Opera extension designed to encrypt communications with major websites.

HTTPS is slowly gaining more and more acceptance in the marketplace, with the UK government last year enabled it on sites to protect against Man in the Middle and other attacks. Also, Google switched it on for all BlogSpot domains last year.      Although, HTTPS is not a silver bullet, it is still a good sign for cyber security.

 

Link of article: https://www.infosecurity-magazine.com/news/mozilla-https-traffic-now-over-50/