Ola leaks personal information of its customer, claims a girl

A girl from Chennai claimed that OlaCabs, famous as Ola, a mobile app for personal transportation in India, had sent personal information of more than 100 customers to her via SMS.

Swapnil Midha posted on Facebook that the Ola, which started as an online cab aggregator in Mumbai, now based out of Bangalore and is among the fastest growing businesses in India, leaked personal details such as mobile numbers, locations of users.

However, the company regarded it as a technical fault and confirmed that it has been fixed now.

“About three weeks ago, I booked an Ola cab for a long distance drive. After the ride I received a few garbled texts from "VM-OLACAB" that I didn't think much of and ignored. These messages were alpha-numeric with hashes and made no sense to me whatsoever. I assumed there was some system error and did not anticipate the sleep deprivation that followed,” she wrote on Facebook.

She added, “My phone beeped throughout the night. 1:06, 2:34, 2:37, 2:38, 4:05, 5:17. I couldn't get my head around why these were coming at these times. I then called their call centre the next day to explain that there was probably some sort of bug and my number had somehow gotten into their highly cryptic message transmission systems, whatever secrets they were trying to transmit.”

Although, the Ola assured her to fix the problem soon, she had been receiving SMS after SMS. She received text between 300 and 400.

“I received no further communication from them, no update, no email, just more garbled messages,” she explained. I reached out to them through every channel possible. I called their call centre at least 5 times, demanded to speak to the senior managers, and had to explain my problem each time in great detail, answering the same annoying questions.”

She said that the company shared personal details of their customers throughout the day and throughout the night.

“What scares me the most, is that THIS should be their number one priority. I questioned their lack of concern for privacy and data protection. I threatened to report them to the authorities and TRAI. Nothing seemed to work which makes you think - do they even care about protecting customer information? If they are sending all this to me, who are they sending MY booking details to? Whose number is receiving all of my data? Which creepy criminal knows my full name, my mobile number, my door number, my account details, when I'm home and when I'm out?” she added.

The girl has raised a serious question which the company concerned need to answer as soon as possible. If this, one of the most trusted companies like the Ola does such careless, what do we expect from others?  

Chinese Hackers targeting Indian institution to steal information

If we had to believe FireEye Inc, a US-based cyber security firm, hackers based in China are now targeting India to steal information about its border disputes and diplomatic intelligence.

The relationship between these two countries once broke in 1962 when both of them fought with each other over border issues. However, the situations between these countries have become a bit cool when Modi government came in power.

It is also said that the hackers were also active a month before the PM Modi visit to China.   
Now, it seems the cyber threat would make the thing worse as it was before.   

As per the company, an advanced campaign over the past four years has targeted more than 100 people, 70 percent of whom are in India. Earlier this year it identified a decade-long cyber espionage operation against businesses and governments in Southeast Asia.

“These attacks on India and its neighbouring countries reflect growing interest in its foreign affairs,” Bryce Boland, FireEye’s chief technology officer for Asia Pacific, said in the statement.

Along with the Indian institutions, the hackers also targeted Tibetan activists and others in Southeast Asia, in particular government, diplomatic, scientific and educational organizations, the security company said.

According to a news report published in The Financial Times, the hackers sent so-called spear phishing e-mails with Microsoft Word attachments appearing to relate to regional issues. Those messages contained a script which would create a “backdoor” in infected machines, allowing access to programs without detection by security measures.


Hackers leak more data from Ashley Madison, Biderman’s email along with millions users’ data exposed


Until now, hackers had revealed the personal details of Ashley Madison, a Canada-based online dating service and social networking service marketed to people who are married or in a committed relationship, users’. It seems they have a big plan as they recently hacked the emails of the site's founder and CEO of parent company Avid Life Media, Noel Biderman.

As Biderman tried to convince the reporter that the previous data breach was not true, this time the hacker posted a message for him which says, "Hey Noel, you can admit it's real now."

Along with the CEO, the millions of email addresses for customers of the dating site that facilitates extra-maritnal affairs were revealed, including those of US government officials, UK civil servants and executives at major corporations.

The hackers got accessed through emails sent and received by him. The file with Biderman's name on it has contained nearly 14 gigabytes of data.

According to a published in The Independent, the U.S. Defense Department and Postal Service is investigating the alleged use of military and other government email accounts on the site.

Executive Director of the Louisian Republican party Jason Doré told the Times-Piscuyune paper he was on a list of accounts because the site was used for "opposition research."

New Android Serialization vulnerability which can change a malicious app to a real one

A research team from IBM X-Force Research and Development, a famous commercial security research and development teams across the world, has found out that more than 55 percent of Android phones are at risk of a high-severity serialization vulnerability. Along with it, the researchers have also found several vulnerabilities in Android software development kits (SDKs), which can allow hackers to own apps.

The Serialization vulnerability could allow an attacker to give a malicious app with no privileges the ability to become a “super app” and help the cybercriminals own the device.

The researchers posted a video, in which shows how the malware works.

“Once our malware is executed, it replaces a real app with a fake one, allowing the attacker to exfiltrate sensitive data from the app and/or creates a perfect phishing attack. We replaced the real Facebook app with a fake one called Fakebook,” the team said.

Similarly, other vulnerabilities found in third-party Android SDKs and allow arbitrary code execution in the context of apps that use these SDKs. This executed code can, for example, steal sensitive information from the attacked app.

“The discovered vulnerabilities are a result of the attacker’s ability to control pointer values during object deserialization in arbitrary apps’ memory space, which is then used by native app code invoked by the runtime’s garbage collector (GC),” the researchers explained.

Although, the flaws have been fixed, the researchers feel that a general problem deserves a general mitigation, reducing the impact of such serialization attacks.


“Since bundles are very common in Android’s IPC, we suggest changing the bundle’s behavior from one that automatically instantiates all of its values to a lazy approach, such as retrieving only the values of keys it is asked for,” the researchers added.

ICANN hacked again, users need to reset their password


Internet Corporation for Assigned Names and Numbers (ICANN), has confirmed that an unauthorized person obtained its account holders’ usernames, email addresses and encrypted passwords for profile accounts created on its public website (ICANN.org) last week.

This is not the first time that the company's website got hacked.

According to a news report published in ZeeSome ten months ago, the company’s website had been hacked by hackers, who accessed its internal system following a spear phishing attack in November, 2014.

The company posted in its website on August 5 that these profile accounts contained user preferences for the website, public bios, interests, newsletter subscriptions, etc.

It is said that the encrypted passwords (hashes) are not easy to reverse however, for the users safety the company has urged all its users to reset their passwords.

“When you next visit our site, please go to the login page and click the forgot password link: https://www.icann.org/users/password/new to create your new password,” the company explained.

“There is no evidence that any profile accounts were accessed or that any internal ICANN systems were accessed without authorization,” the post read. While investigations are ongoing, the encrypted passwords appear to have been obtained as a result of unauthorized access to an external service provider.”

Bug allows Hackers to open locked Biometric Fingerprint Doors


Researcher has uncovered various flaws in a Taiwan-based Chiyu Technology's fingerprint access controller which could allow hackers to easily open the locked doors.

The researcher, Maxim Rupp has said that the vulnerabilities allow the attacker to view and modify the existing configuration of the device without authentication by directly accessing known paths. 


The path (CVE-2015-2871) varies slightly depending on model and services available.

According to an advisory published on July 31, the paths for accessing communications, fingerprint and other setup pages vary depending on the model and the services that are available, CERT/CC.

“It has identified models BF-660C, BF-630, BF-630W as being vulnerable; other models may also be vulnerable. The CERT/CC has been unable to verify this information with the vendor. The CVSS score below is based on CVE-2015-2871,” the advisory read.

According to a story published in SecurityWeek, the researcher said that by gaining access to the controller’s fingerprint setup page, an attacker could modify settings, such as “security level” and “sensitivity,” to make it easier to open the door protected by the device. An attacker can also change the device’s network settings and disconnect it from the targeted organization’s network.

“The researcher has also found that some of the vulnerable biometric devices are accessible via the Internet, which allows an attacker to exploit the weakness remotely. An attacker might be able to carry out other actions as well once he gains access to the controller’s configuration pages, but the expert says he hasn’t conducted further tests,” the report read.

The researcher said that there were several other companies that which sold the same devices under a different brand.

The flaws were reported by the researcher to Chiyu Technology via CERT/CC on May 29. CERT/CC. However, the company concerned has not managed to get in touch with the manufacturer.

It is still unclear that when the company will fix the flaws in the fingerprint access controller.

Antivirus software maker Bitdefender hacked, customers data leaked


It has been proved that no one is safe here from hackers. Even the security firms, which are supposed to protect us, get hacked.

Recently, an award-winning antivirus software maker and security software company has been hacked.

As per news reports, Bitdefender customers’ usernames and passwords leaked during the attack. It has confirmed that its system was breached following rumors that someone was holding the Romanian firm to ransom. The company has failed to encrypt its customers’ login details.

After getting into the company’s information, the crooks demanded $15,000 in order to keep its customers’ details safe.

They threatened the company that they would reveal the swiped customer records. However, it is said that they have put some information online.

The company has informed that the issue has been solved and additional security measures have been taken to prevent its customers from hacking.

A password reset notice was sent to all potentially affected customers, representing less than 1 per cent of our SMB customers.

“This does not affect our consumer or enterprise customers. Our investigation revealed no other server or services were impacted. Bitdefender takes security of its customers very seriously and any issue that might involve the security of our customers or the security of our servers is treated with the utmost urgency and seriousness,” the company explained.

Attackers can crash Your Android Device, says Trend Micro

 
Researchers from TrendLabs Security Intelligence have discovered a vulnerability in Android 4.3 (Jelly Bean) up to the current version, Android 5.1.1 (Lollipop) that could help an attacker to turn a phone “dead silent, unable to make calls, with a lifeless screen”.

Researchers have said that the flaw would cause phones to have no ring, text or notification sounds and be unable to make calls.

According to a post in its blog, “This vulnerability can be exploited in two ways: either via a malicious app installed on the device, or through a specially-crafted web site. The first technique can cause long-term effects to the device: an app with an embedded MKV file that registers itself to auto-start whenever the device boots would case the OS to crash every time it is turned on.”

The researchers said that the vulnerability was similar to the recently discovered Stagefright vulnerability. Both vulnerabilities were triggered when Android handles media files, although the way these files reached the user differs.

Researchers from Zimperium Mobile Security, a security firm, had discovered Stagefright in Android mobile operating system which they said to be the “worst Android vulnerabilities” to the date.

Though, the Google had patched the problem, millions of devices need to be updated. The flaw has affected nearly a billion devices.

 “The vulnerability lies in the mediaserver service, which is used by Android to index media files that are located on the Android device,” said the company. “The vulnerability is caused by an integer overflow when the mediaserver service parses an MKV file. It reads memory out of buffer or writes data to NULL address when parsing audio data,” the blog post read.

Although, the flaw was reported to the Google in May, the company concerned has been able to fix the issue.

Creepy Voice that you heard from Your Baby Monitor is not of a Ghost


Beware of the cameras connected to the Internet or the security cameras and monitoring as these systems can be easily hacked by the hackers. It camera hacking has become a serious issue now as of the potential for unauthorized people to make video recordings.

Ontario Provincial Police (OPP) issued a warning on Wednesday reminding people that these systems can be susceptible to hackers because many have an option to be used remotely enabled by default after a family from southwestern Ontario witnessed on July 7 a baby monitor watching their young child when it suddenly began playing music and a voice said they were being watched.

According to Liz Melvin, the OPP Const, the child was about to sleep in the nursery when the camera was remotely activated.  


“The camera played some eerie music and a voice could be heard indicating the parent and child were being watched,” Melvin told National Post. “Obviously it’s going to be disturbing.”

She said the family’s Internet service provider confirmed the router had been hacked and the source of the hack could be from anywhere in the world.

Although, such kid monitor hacking cases have been reported every month, Melvin said no other incidences have been reported and she wasn’t aware of any past investigations into this type of camera hacking in the area.

She said there are no suspects in the case and the investigation is ongoing.

In a bid to protect, people should use passwords to protect access to the Internet connection and access to monitoring systems. Similarly, buy cameras from trusted sources and cover them cameras when not in use.

Researchers find out New Linux Backdoor

Security researchers from Doctor Web, a Russian Anti-malware company, have detected a new backdoor dubbed Linux.BackDoor.Dklkt.1 that targets Linux operating systems.

However, the signature of the backdoor has been added to Dr.Web virus databases. So, its Linux users are under reliable protection.

“It clear that creators of this malicious program planned to equip it with wide variety of powerful features, but bringing all their intentions to life proved rather problematic at the moment, not all of the program's components work as they should,” the researchers wrote in a blog.

The researchers have claimed that backdoor is supposedly of Chinese origin. They have said that the virus makers tried to create a multi-component malicious program encompassing a large number of functional properties.

“For example, they wanted to equip it with functions typical of file managers, DDoS Trojans, proxy servers, and so on,” they added. “However, not all of these plans were destined to see the light. Moreover, virus makers attempted to make a cross-platform program out of their creation; so that the executable file could be assembled both for Linux and Windows architectures. However, due to carelessness of cybercriminals, the disassembled code contains some strange constructions that have absolutely nothing to do with Linux.”

According to the researchers, the backdoor checks the folder from which it is run for the configuration file containing all operating settings. The file has three addresses of command and control servers. One of them is used by the backdoor, while the other two are stored for backup purposes. The configuration file is encrypted with Base64.

Once the backdoor gets activated, it tries to register itself in the system as a domain (system service). If the attempt fails, the backdoor terminates its work.

“Once the malicious program is successfully run, it sends the server information on the infected system; at that, the transmitted data is compressed with LZO and encrypted with the Blowfish algorithm. In addition to that, every packet contains a checksum, so that the recipient could verify data integrity,” the researchers explained.

Researchers have said that then Linux.BackDoor.Dklkt.1 waits for incoming commands that can include launching a DDoS attack, starting SOCKS proxy server, running a specified application, rebooting the computer or turning it off.

Google protests against US government's new legislation "Wassenaar Arrangement"

 
Google has protested against the proposed legislation changes in the “Wassenaar Arrangement”  that would let the US government control the export of security research and technologies.

Google’s legal team member Neil Martin, and Tim Willis, Hacker Philanthropist, Chrome Security Team, opposed the proposed legislation by saying “it will hurt general web users” in a blog post.

Blog emphasized on how the proposed changes will directly affect the security research, “The time and effort it takes to uncover bugs is significant, and the marketplace for these vulnerabilities is competitive. That’s why we provide cash rewards for quality security research that identifies problems in our own products or proactive improvements to open-source products. We’ve paid more than $4 million to researchers from all around the world - our current Hall of Fame includes researchers from Germany, the U.S., Japan, Brazil, and more than 30 other countries.”

According to the blog post proposed legislation changes would apply Wassenaar Arrangement controls to software and tools, which will hamper the companies, who hire hackers to find vulnerabilities in their network and products.

If the proposed changes are approved then the companies operating in the US have to have a license to export their security technologies, or information on newly discovered vulnerabilities to anywhere other than Canada.

Google submitted their comments on the proposed rules to the United States Commerce Department’s Bureau of Industry and Security (BIS).

Do Organizations Fail to Care about your Medical data? UCLA Hacked



Hospital network of the University of California, Los Angeles was broke out by a team of hackers resulting in access of sensitive records of 4.5 million people.

According to the university, the data stolen includes names, Medical information, Medicare numbers, health plan IDs, Social Security numbers, birthdays and physical addresses.

This breach could have affected  people’s who has visited, or worked at the university's medical network, UCLA Health, that includes its four hospitals and 150 offices across Southern California.

The first attempt to hack the network was done in September 2014.  UCLA Health  announced on Friday - two months after it discovered the data breach. The university network alarm "detected suspicious activity," and UCLA Health called in the FBI for help.

"At that time, it did not appear that the attackers had gained access to the parts of the network that contain personal and medical information," UCLA Health said in a statement.

The hospital group is now notifying staff and patients, and offering them one year of identity theft recovery services.

Dr. James Atkinson, UCLA Hospital System's president, apologized to the public in a statement. And noted that hospital group is under constant attack from all over the world.

Organizations handling such kind of sensitive information should not only have physical security but also have a proper Cyber security protection. Organizations should understand importance of Cyber security before they fall victim to cyber attacks.

FBI takedown biggest malware marketplace 'Darkode'

Federal Bureau of Investigation  announced the takedown of ‘Darkode’, an international malware marketplace, on Wednesday.

Darkode was a secretive, password protected society of elite hackers, and this forum was used as a meeting place, and place to purchase and trade of hacking tools since 2008.

FBI arrested people from  20 countries and indictments for 70 individuals, including 12 in the U.S., from Wisconsin to Louisiana.

U.S. Attorney David J. Hickton said, “The FBI has effectively smashed the hornets' nest and we are in the process of rounding up and charging the hornets."

Adding to this Hickton explained how Darkode was one of the greatest threats to online security, mentioning one forum member who put up software (for a price of $65,000) that can take over cellphones. He said that how a user offered the ability to steal and sell lists of friends on Facebook.

According to the FBI’s Special Agent in Charge Scott S. Smith the arrests came after a two-year of undercover operation that infiltrated the forum.

The Pittsburgh Post-Gazette explains how the investigation started: "Following a lead generated in Pittsburgh around 18 months ago, the FBI cybersquad here launched Operation Shrouded Horizon. The bureau's local office assembled a coalition that started domestically with the bureau's offices in Washington, D.C., San Diego, New Orleans and San Francisco, and extended to online enforcement teams in 20 countries, including numerous European countries, Israel, Australia, Colombia, Brazil and Nigeria."

Federal officials say the investigation into Darkode is continuing.

Epic Games shut down its website after a hack



Epic Games,  an American video game development company based in Cary, North Carolina, now associate of Chinese Tencent Holdings, has taken down its website after they had discovered it's forums (forums.epicgames.com) were “compromised by a hacker”.

The company is now sending emails to its Epic Games Forum members informing them about that of their forums have been taken offline. 

“We are sorry to report that the incident may have resulted in unauthorized access to your username, email address, password, and the date of birth you provided at registration,” the email reads.

The company has said that there is a possibility of any information stored or sent by its users’ using the forums may have been accessed.

However, the company has not collected or maintained any financial information. It has advised its user to be alert for suspicious email such as phishing attempts.

It has said that when the site reopens, the forum member’s password will be reset.

“If you use the same password on this site which you use on other sites, we recommend immediately changing your password on those sites as well,” the email explained.

It is said that the affected forum site covers UDK, Infinity Blade, Gears of War, Bulletstorm, and prior Unreal Tournament games but the separate forum sites covering Unreal Engine 4, Fortnite, and the new Unreal Tournament were not affected.

“To further understand what’s happened and prevent it in the future, we’re working with a computer security firm to identify the nature of the compromise. We will report further information on the forums when they reopen,” the company explained in the mail.

Mozilla blocks vulnerable Adobe flash versions


A day after Facebook’s newly appointed Chief Security Officer Alex Stamos took to Twitter to call for more rapid moves to force Flash’s extinction as the plugin was reportedly being used to spread malware on users’ systems via security exploits, the head of Firefox Support has claimed to have blocked all the vulnerable versions of Adobe Flash in its Firefox browser.

On July 14, Mark Schmidt, head of Firefox Support posted on twitter, “BIG NEWS!! All versions of Flash are blocked by default in Firefox as of now.”

According to a news report published on TheNextWeb, three major Flash vulnerabilities were discovered during security firm Hacking Team’s leaked 400GB worth of documents, which allow malicious files to execute code and install malware on victims’ computers and product source code leaked online.

“Mozilla has noted that Flash will remain blocked until Adobe releases a version that isn’t being actively exploited by publicly known vulnerabilities,” the report read.

It is also said that Mozilla is trialing Shumway, an HTML5-based efficient renderer for the SWF format that’s used with Flash files.

Housing.com hacked within days of CEO's ouster

Within days of its CEO Rahul Yadav’s exit from the company, the website of Housing.com has been hacked.

The homepage of the website shows a cryptic message, which seems as a call for its co-founder.

The defaced Housing.com home page showed the message: “Yes! We will solve the real estate, but 10X better with The Chief Architect.” The Chief architect here, refers to Yadav who was sacked by the Board of Directors, blaming him for his unfavourable behaviour.

(pc- google images)


The page of the website was filled with the following messages.

Yadav has however denied that he by any means is behind the hacking incident. He denied his involvement on his facebook page by saying that, “I would have DESIGNED it better. ‪#‎NotInvolved ‪#‎LoveYouTechTeam".

J Prasanna, director, Cyber Security and Privacy Foundation, a non-profit organization in Bangalore said that, Housing should get a thorough technical assessment of the website. He added that in a live portal, there are more chances of compromising a lot of data of the consumers.

"In this case, the hackers decided to publish the hacking. What if the hackers don't publish this and the data is sold to competitors or rogue elements? These guys did for publicity, but not everyone would do it for fun.", Time of India quoted Prasanna as saying.

Housing.com’s board released announced Yadav’s release on the 1st of July. The board released a statement that day indicating his ouster from the online realty company.

The press release said, “The board believes his behaviour is not befitting of a CEO and is detrimental to the company, known for its innovative approach to product development, market expansion and brand building.” Yadav, the release said, would “no longer be an employee of Housing and be associated with the company in any manner, going forward”.

Selfies to use as a password for doing online payments


You know what? Selfies, which we click mostly for posting on social networking sites, are now being using as a password for doing payments. 

MasterCard, an American multinational financial services corporation headquartered in New York, United States, is trying new facial recognition technology that would let customers verify their identity online by taking a selfie.

Mastercard’ s customers, who still use a system called SecureCode to verify their identity while shopping online, requires them to enter a password at the point of sale.

In an interview with CNN Money MasterCard executive Ajay Bhalla said that they want to identify the people for who they are not what they remember.

"We have too many passwords to remember and this creates extra problems for consumers and businesses. The new generation, this is into selfies….  I think they'll find it cool. They'll embrace it," he added.

According to a news report published on The Telegraph, in order to avoid problems like forgetting passwords, stealing or intercepting, many financial organisations and technology companies are testing biometrics as an alternative form of identification.

Like a British technology firm recently launched the world’s first emoji-only passcode, which allows people to log into their banks using four emoji characters, instead of PINs or passwords.

According to the report, during the trial period, some of the Mastercard's users or customers will be prompted to snap a photograph of their face using the Mastercard app on their smartphone at the online checkout point instead of entering password.

It is said that the app then converts the photo into 1s and 0s using facial recognition technology, and transmits it over the internet to MasterCard, which compares it with a stored code representing the cardholder's face. If the two codes match up, then the purchase will be approved.

Bhalla said that MasterCard will not be able to reconstruct the user's face from the data, and that the information will be transmitted and stored securely.

The company is currently testing the technology with 500 customers, and is planning a broader trial for later this year.

Along with the selfies, the company is experimenting with other forms of identification such as fingerprint scanning and voice recognition.

BadOnions : Bad TOR exit nodes attempts to login with sniffed password


A security researcher spent a month to find bad TOR exit nodes by setting up a honeypot kind of website which has a fake login page - To find the nodes that sniffs the traffic and attempts to steal the password.

Tor protects its users by bouncing their communications around a distributed network of relays runs by volunteers all around the world.

Chloe wrote in a blog, “A few weeks ago I got the idea of testing how much sniffing is going on in the Tor network by setting up a phishing site where I login with unique password and then store them. I do this with every exit node there is and then see if a password has been used twice, if that's the case I know which node that was sniffing the traffic.”

According to the researcher, he bought a domain with a tempting name (such as bitcoinbuy) and then created a sub-domain(admin.) by using vhost and set up a simple login.

He used a simple login script that allowed any password ending wiht "sbtc".  He created a random password ending with "sbtc" (eg:d25799f05fsbtc) and used it via tor nodes.

The script also saves the login attempts and successful logins in a file with user agent, IP and time - This will help him to find the bad nodes.

“The results are not so surprising, but what is most surprising about this is that 2 nodes with the 'guard' flag had logged in twice. Also, none of these nodes has been flagged even though I reported them to Tor.” Researcher said in his blog.
He released the result of the test; He tested more than 130k Exit nodes within 32 days. He found that there were 12 failed-login attempts, 16 successful logins that had not come from the researcher.

Beware of CryptoWall Ransomware, victims reporting losses totaling over $18 million


FBI's Internet Crime Complaint Center's (IC3) data shows CryptoWall as the most current and significant Ransomware affecting millions of individuals and businesses in US.

CryptoWall and its variants have been targeting people since April 2014, between April 2014 and June 2015, the IC3 received 992 CryptoWall related complaints, with victims reporting losses totaling over $18 million.

The victims incurs ransom fees between $200 and $10,000, there are additional costs which includes network mitigation, network countermeasures, loss of productivity, legal fees, IT services, and/or the purchase of credit monitoring services for employees or customers.

The system becomes infected when the victim visits or clicks on the infected advertisement, email, attachment  or  infected websites- The malware encrypts the victim's file stored on the infected machine. Ransomware schemes demand payment in Bitcoin as  it is easy to use, fast, publicly available, decentralized, and provides a sense of heightened security/anonymity.

Victims can register the complaint to local FBI field office, or may also file a complaint with the IC3 at www.IC3.gov.

DDOS, APT attacks on Corporate and Banks


With spate of Distributed denial of service attacks and APT attacks on Banks and corporates, Anti DDOS mitigation vendors and ISP are joining together to fight the menace of DDOS attacks.

A few vendors work with ISP to mitigate the threat, working on putting up monitoring agents on every ISP(hardware box) which is connected to mitigation cloud.
A Bank official told on conditions of anonymity "ISP quickly responds to DDOS attack and mitigates for the customer. But comes to them with a Fat Proposal. Customers need to pay a standard amount ever year to get a protection.  In addition to this amount, they have to pay extra money every time they get hit.  The billing can run into lakhs for banks/corporate who take DDOS mitigation."
Another bank official confided that they have asked for a standard quote per year(ISPs are yet to respond).

Smaller vendors cannot tackle DDOS attacks. It has to be anti ddos companies with ISP which can handle this.

Some corporate and Banks are going in for a solution - They place their main websites and Mobile portal behind a Cloud Based WAF/Anti DDOS mitigation service. At the corporate end, they have a firewall and IPS making sure that no direct connection from the Internet is possible to their ISP Pipe. Does this solve the problem is yet to be seen.

"Advanced Persistent threat are followed by DDOS attacks, this is done to to erase any tracks of compromise on firewall, router, Intrusion Prevention Systems" says J Prasanna, Director, Cyber Security & Privacy Foundation Pte Ltd, a singapore based Cyber security certification organization.

The corporate/Banks are seeing only the DDOS and putting DDOS mitigation in place. It has to be checked to see if there is any compromise on data, criminal compromise from banks/corporate. The criminals could have gained access to the data or network and remain stealth for a long time", says Mr. Sreeram, Director, AVS Labs Pte Ltd, Singapore(organization which does consulting and services on cyber security).

The main problem for organizations is there are many vulnerabilities on systems which are undetected for a long period of time. The vulnerabilities could remain on the application software code written by software programmers or it could be in operating system, networks and other critical system level application. The black hat hackers(APT attackers) could exploits these vulnerabilities generally called 0-day vulnerability which could be used to enter into the systems.

Most of these organization need a "0-Day Vulnerability Assessment & Penetration Testing" and "APT Analysis" to find any Security breach". Normally not every one can do this because you need the best talents on board like "bounty hunters" who do vulnerability finding for fortune 500 companies. But that is no it - " Most bug bounty hunters cant find beyond web vulnerabilities", These auditors/assessors need the 0 day exploits and also knowledge of how APT attacks work. Most organization which perform regular Vulnerability Assessment and Penetration testing and even who do ISO 270001 certification implementation don't have capability to handle Zero-day or APT assessments.

Is a corporate with ISO 270001 standard implementation safe? A quite survey taken for 25 organizations show that almost all had standards implemented and they all experienced data theft. Some of corporate CISOs don't want to accept APT attacks, most of this information of compromise never reaches the management.

All the attacks happened at technical level, because of poor technical controls or products like antivirus/firewall/intrusion prevention not doing what they said they will do.

Do we still trust the ISO270001 implemented in corporate or the products they are using inside to save our data!