Mozilla Firefox Considers Blocking Cyber security Company Darkmatter; Reports Arise of Its Link to a Cyber Espionage Program




Firefox 'browser-maker' Mozilla is under talks about considering whether to block the cyber security organization DarkMatter from serving in as one of its internet security gatekeeper after a Reuters report connected the UAE-based firm to a cyber-espionage program.

The international news organization announced in January that the cyber-security company gave the staff the secret to a hacking operation with the codename Project Raven, on behalf of an Emirati intelligence agency. The unit there included previous U.S. intelligence officials who led hostile cyber operations for the UAE government.

The shrouded program, which operated from a converted Abu Dhabi house far from DarkMatter's headquarters, included hacking into the internet accounts of human rights activists, journalists and officials from rival governments.

Mozilla said the company is under talks to arrive at a decision on whether to deny the authority possessed by DarkMatter, however expects to decide within weeks. While two Mozilla officials said in a meeting a week ago that Reuters' report raised their worries about whether DarkMatter would abuse their position to certify sites as safe or not.

Selena Deckelmann, a senior director of engineering for Mozilla, said "We don't currently have technical evidence of misuse (by DarkMatter) but the reporting is strong evidence that misuse is likely to occur in the future if it hasn't already."

Likewise informing that Mozilla was thinking about stripping a few or the majority of the 400 certifications that DarkMatter has granted to sites under a limited authority since 2017.

In any case DarkMatter CEO Karim Sabbagh denied the Reuters report connecting his company in any way to Project Raven."We have never, nor will we ever, operate or manage non-defensive cyber activities against any nationality," he said in a letter to Mozilla on February 25th, posted online by the cyber security company.

While in the past Mozilla has depended heavily on technical issues when choosing whether to trust a company with certification authority or not, the Reuters investigation has driven it to re-evaluate its arrangement for affirming candidates.


The Dark Side of Kremlin- The Catalogue of Russian Data Leaks: All You Need To Know




Thousands of Russian emails and documents were leaked online in the late January in a catalogue named “The Dark Side of Kremlin”.


The catalogue was published by a “transparency collective” which goes by the name of “Distributed Denial of Secrets”.

DDoS encompasses an anonymous group of journalists, researchers, tech-experts and activists.

The documents contained private information regarding all the major hot-shots of Russia including the politicians, religious figures and the military.

The DDoS say, that their only job is to provide information to those who need it. If the information strengthens suspicions it hardly matters.

They also mentioned that their collection of data including emails, chat logs and attachments were hacked a few years ago by several hacking groups in Russia and Ukraine.

The Cyber Junta, Russian hackers Shaltai-Boltai, Ukrainian Cyber Alliance and other international parties were among the few accused.

The information leaked includes private documents and emails from the Ministry of Defense, the Russian Presidential Administration and other high-level political operatives.

Russia’s Prime Minister Dimitry Medvedev’s phone was hacked and his holiday pictures were uploaded online.

Russian President’s chef who controls companies that cater fancy banquets in Kremlin also lost his private notes to the leak.

The leak also includes the elaborate personal notes made by the chef on conversations between Putin and European leaders from Italy and Britain.

The most revealing hacks were the ones that came from the Russian Presidential Administration, which fairly let the Russian government, be a little more “transparent”.

The leak had details on how the government controls the Russian media and the way it transmits messages etc.

The most concerning part is that no one knows for sure how much and what kinds of information have been laid out bare in the open.

The leaks also provide an insight about the relations between Ukraine and Russia.

The inner-doings of Russia’s proxies and other insidious groups have also been brought into the light.

The DDoS had experienced a wipe on their servers making it imperative for them to upload it soon, in order to prevent the data from being censored.

Reportedly, this leak can’t be considered as a revenge for anything that has happened before, it was just an attempt at transparency.

A lot of the information present in the leaks was already available on the web but a lot of new investigations have been given birth due to this massive leakage.

This Russian document leak has created a paradigm shift in the way countries take their cyber-security seriously.

Analyzing these leaks could possibly lead Russia to adopting a new way of securing the web and its Presidential administration.

The government has already started taking care of its cyber-security vigilantly and all the loop holes will soon be filled up.

617 Million Account Details Put On Sale on the Dark Web


Account Details of approximately 617 million accounts including information details, like names of account holders, their passwords and their email address have been put on sale by hackers on the dark web. 16 websites including some well-known ones, like Dubsmash, MyFitnessPal and ShareThis have been a target.

Although there have been no reports of any financial data like the credit card details or banking passwords being undermined however there is a threat of the location data, the social authentication keys and the personal data of the users of being on sale.

A report by The Register, a British technology news and opinion website, states that "The above mentioned information is available for less than $20,000 in Bitcoin.”

Now, while some of the previously mentioned sites, as Animoto, MyHeritage and MyFitnessPal, knew about the security ruptures on their platforms and had already informed their users already about the issue, however the breaches reported on some other sites were new thus they haven't been accounted for beforehand.

Both 500px and EyeEm have taken appropriate measures and informed their users about the break all the while requesting them to change their passwords, as a prudent step.

The list of websites affected by the hack include: Dubsmash (162 million accounts), MyFitnessPal (151 million accounts), ShareThis (41 million accounts), Animoto (25 million accounts), MyHeritage (92 million accounts), 500px (15 million accounts), Artsy (1 million accounts), Armor Games (11 million accounts), BookMate (8 million accounts), Whitepages (18 million accounts), EyeEm (22 million accounts), 8fit (20 million accounts), HauteLook (28 million accounts) and Fotolog (16 million accounts).


Hackers Now Utilizing SS7 Attacks to Steal Money from Bank Accounts


As indicated by yet another research cyber hackers have now shifted their attention towards taping the phone network by means of the misuse of the SS7 protocol in order to steal money from the bank accounts directly by intercepting the messages.

Since the protocol is utilized by Internet service providers and telecom company to control the telephone calls and instant text messages across the world, the SS7 attacks performed by the said cyber criminals uses a current 'structure blemish' i.e. a flaw in it and exploits it accordingly so as to perform different perilous attacks, that are very much similar to the acts of data theft, eavesdropping, text interception and location tracking.

UK's Metro Bank has already fallen victim to this attack. In view of the affirmation given by the National Cyber Security Center (NCSC), the 'defensive' arm of the UK's signals intelligence agency GCHQ, SS7 attacks are consistently utilized by cybercriminals to intercept the messages in order to steal the code that is additionally utilized for bank transactions.

NCSC said that “We are aware of a known telecommunications vulnerability being exploited to target bank accounts by intercepting SMS text messages used as 2-Factor Authentication (2FA).”

Due to this two factor authentication, by having a SS7 network access the cybercriminals can intercept the messages even after they gain access to the internet banking login credentials by the means of phishing attacks and then initiate the verification code through text message. Later they can without much of a stretch block it through SS7 attack and use it to finish their transaction procedure.

 “Something that members of the general public don’t necessarily have to worry about. An SS7 attack is unlikely to be effective if the bank uses a form of 2FA that doesn’t rely on text messages, such as an authenticator app.”

When approached some of the notable Telecom Service Providers to get to know their thoughts regarding this matter of concern, Vodafone says “We have specific security measures in place to protect our customers against SS7 vulnerabilities that have been deployed over the last few years, and we have no evidence to suggest that Vodafone customers have been affected.”

Likewise they express that, they are working with GSMA, banks and security specialists so as to alleviate and further protect their clients.


Trezor Wallet: Not So Hack-Safe After All!









The hackers have found another way to penetrate the safety walls of the seemingly “quite safe” Trezor Wallet.


One of the inquisitive crypto-mining fans took to twitter, to shout out that the device which goes by the name of Trezor wallet has a vulnerability which lays bare  "un-password-protected" users.


This is not the first time such an attack has been possible on devices of the aforementioned kind and the researchers deem it as inevitable, given the poor fabrication of the devices.


At the Chaos Communication Congress, the theme was solidly elucidated and discussed upon, by specialists who talked about the hack-ability of crypt0-wallets.


The Congress spread across the different kinds of vulnerabilities, hardware, software and firmware could be affected by.


The gathered specialists expounded about recurring and systematic problems in wallets.


The team also worked upon creating a library of malicious attacks related with harvesting of funds from the hardware wallet.


The vulnerabilities these wallets possess, the ways to move around them and the available courses of action were discussed at the congress at length.


The team demonstrated how breaking the boot-loader protection and breaking web interfaces which are used to communicate with the wallets, is done.


Some physical attacks such as “Glitching”(an attempt at bypassing security of the micro-controllers of the wallet) were also a part of the CCC team’s drill.


The vulnerabilities uncovered by the team, have detailed implications which could only be solved via a firmware update or even a new hardware revision.


There is hope as to companies deliberating on the severity of the situation and that they will put forth some improvements.


With an extreme rise in the trend if hardware wallets, there has also been an extreme rise in the users, given these devices hoard a consequent number of crypto-currency.


There exist crypto-traders who work essentially and daily over and on these famous wallets.


Thousands and Millions of dollars’ worth crypto-currency is stored within the “walls” of these hardware wallets, rendering the reason behind all these attacks on them, apparent.


As to what the recently found attack did? It majorly concerned and focused upon breaking the interfaces that aid the communication with the wallet.

  
The Trezor wallet was attached to various devices which included a socket with an FPGA. Then supposedly a code was run to give the hackers access to the seed and pin.
But the hack would only go through if the wallet wasn’t password protected.


The engineer who is in charge of Trezor, Pavol Rusnak, took to twitter to let the public know that they weren’t previously privy to the situation.


But, now that they are, by the end of January a new firmware update will see its way through to the wallet.


He also cited that the issue is currently being investigated and that it soon is expected to be patched.


NASA On Hack Alert: Personal Data And Servers Compromised!




NASA’s recently been victimized by a data breach on its server that laid bare Personally Identifiable Information (PII) of its former and present employees alike.



The breach surfaced as a result of an internal security audit conducted by NASA. It was realized that the social security numbers and other PII was available on the compromised server.


 It was only after a couple of months that the NASA employees were notified about the unfortunate issue, given that the security experts had gotten wise about it in the month of October.


When the employees came up with the concern regarding their stolen data, that’s when they were alerted about it all.


The matter will take a lot of looking into and is a concern of top agency priority. The examining of the servers is going on at full speed.


Needless to say, NASA and federal cyber-security are keenly trying to settle on the severity of the exfiltration and the identity theft of the possibly affected.


According to what NASA has cited, none of its missions or secret data was compromised and everything is under control. Identity protection has also been offered to those who were supposedly affected by the compromised data.


NASA has also alluded that the civil service employees of NASA who were detached from the actual agency may have been subject to this hacking attack.


Reportedly, Instantaneous efforts were made to safeguard the servers and it was affirmed that individuals’ security is being taken very sincerely; also for NASA, as its spokespersons have mentioned, data security is paramount.


21-Year-Old Arrested For SIM Swapping Hack; Allegedly Steals $1 Million


U.S. broadsheet the New York Post announced Nov. 20 regarding some authorities in the United State, state of California who have arrested a 21-year old New Yorker for the supposed burglary of $1 million in crypto utilizing "SIM-swapping,"

SIM-swapping otherwise called a "port-out scam" includes the burglary of a mobile phone number with the end goal to capture online financial and social media accounts, empowered by the way that numerous organizations utilize computerized messages or telephone calls to deal with client validation.

The captured suspect, Nicholas Truglia, is accused for having focused on well off Silicon Valley officials in the Bay Area, and of effectively convincing telecoms support staff to port six exploited people's numbers to his an affirmed "crew" of accomplice attackers. Deputy DA Erin West, of Santa Clara Superior Court, told the Post that the ploy was "a new way of doing an old crime.”

“You’re sitting in your home, your phone is in front of you, and you suddenly become aware there is no service because the bad guy has taken control of your phone number,” West said.

With his capture on November 14, authorities were able to recover $300,000 in stolen reserves while the remaining assets remain untraced.

Trugila is currently being held at pending for extradition to Santa Clara, where he faces 21 felony counts related with an aggregate of six exploited people, authorities said. One of Truglia's supposed SIM-swapping victims, San Francisco-based Robert Ross, was purportedly robbed of $500,000 worth of crypto possessions on his Coinbase wallet "in a flash" on Oct. 26, and in the meantime a further $500,000 was taken from his Gemini account. West said the $1,000,000 was Ross' "life savings" and his two girls' college fund.

This rising predominance of SIM swap-related occurrences has therefore provoked a California-based law enforcement group to make it their "most noteworthy need." in excess of one prominent occasion, exploited people have acted to sue telecoms firms, for example, AT&T and T-Mobile for their help of the wrongdoing.

Truglia is since being held Manhattan Detaintion Complex pending extradition to Santa Clara in California. Formal charges identify with a seven-day "hacking spree" starting Oct. 8, particularly involving "grand theft, altering or damaging computer data with the intent to defraud and using personal information without authorization.”


Microsoft Shuts down Websites in Association with the Russian Military Intelligence Service GRU


On the twentieth of August, Microsoft made public that it effectively terminated 6 websites in affiliation with the Russian Military Intelligence Service GRU.

The hacker group that has come to light is the well-known Fancy Bear also referred to here, as APT28 which likewise has been formerly connected to cyber-espionage campaigns directed towards various governments around the globe, including to the hack of the Democratic National Committee before the 2016 US Presidential Election.

The gathering last targeted the conservative think tanks namely the Hudson Institute and the International Republican Institute, three which were intended to mirror the U.S. Senate sites and one of the fake ones even ridiculed Microsoft's online products.

Microsoft's Digital Crimes Unit (DCU) effectively executed a court order to transfer the control of six internet domains made by the group. The six domains are:

my-iri.org
hudsonorg-my-sharepoint.com
senate.group
adfs-senate.services
adfs-senate.email
office365-onedrive.com

Microsoft’s president and chief legal officer Brad Smith wrote, “We have now used this approach 12 times in two years to shut down 84 fake websites associated with this group. Attackers want their attacks to look as realistic as possible and they therefore create websites and URLs that look like sites their targeted victims would expect to receive email from or visit.”

What's more, in spite of last week's steps, Microsoft is anxious by the continuous activity that is focusing on these and other sites that are for the most part centered towards elected officials, politicians, political groups and additionally think tanks over the political range in the United States.

Since Russian cyber-attacks directed towards the elections are recurring and likely to expand , Microsoft is intending to protract the Microsoft's Defending Democracy Program with yet another initiative called the Microsoft AccountGuard , which will provide the best in class cyber security protection at no additional cost to all the candidates and campaign workplaces at the federal, state and local level as well as think tanks and political organizations that are presently thought to be under attack.


Flaw In the Amazon Echo; Allows Hackers to Listen In To Users’ Conversations





Security researchers from the Chinese tech giant Tencent as of late discovered a rather serious vulnerability in Amazon Echo. The vulnerability is termed serious on the grounds that it enables programmers to furtively tune in to users' conversations without their knowledge.

The researchers in a presentation which was given at the DEF CON security conference, named ' Breaking Smart Speakers: We are Listening to you,' and precisely explained as to how they could assemble a doctored Echo speaker and utilize that to gain access to other Echo devices.

'After several months of research, we successfully break the Amazon Echo by using multiple vulnerabilities in the Amazon Echo system, and [achieve] remote eavesdropping. When the attack [succeeds], we can control Amazon Echo for eavesdropping and send the voice data through network to the attacker.'

Researchers utilized Amazon's Home Audio Daemon, which the device uses to communicate with other Echo devices on a similar Wireless connection, to ultimately control the users' speakers. Through which they could quietly record conversations or even play random sounds.

The attack though, is the first one that the researchers have distinguished a noteworthy security defect in a well-known smart speaker such as the Amazon Echo. The researchers have since informed Amazon of this security imperfection and the firm said it issued a software patch to the users' in July. They likewise note that it requires access to a physical Echo device.


In any case, Amazon and the researchers both warn that the technique distinguished is extremely modern and in all probability is easy for any average hacker to carry out. 'Customers do not need to take any action as their devices have been automatically updated with security fixes,' says an Amazon spokesperson.

Yet, some have brought up that the attack could also be carried out in regions where there are multiple Echo devices being utilized on the same network, the simplest example of it are the Hotels or Restaurants.

Nonetheless prior this year, researchers from University of California, Berkeley too recognized a defect where hackers could not only control prominent voice assistants such as, Alexa, Siri and Google Assistant but could also slip indiscernible voice commands into audio recordings which could further direct a voice assistant to do a wide range of things, that range from taking pictures to launching websites and making phone calls.


Threatening Frailty in the Indian Mobile Security



Compromising your phones has become quite an easy task for the hackers these days as it is convenient for them to do so without much hard work .There are numerous ways already available like the hackers can change passwords and get access to confidential corporate and private data on your phone or better yet they can either install malicious code on your phone that allows them to read your messages, access your photos or could even turn on your microphone.

In other words, once hackers access your device, they can easily use your microphone or camera to record you, and thanks to GPS, they’ll even get to know your location.

In case of companies that make operating systems (OS) for mobile phones, they are used to plugging known vulnerabilities and loopholes by periodically updating their operating systems and release newer versions of it by even issuing security patches.

But in the case of Android, there exists a unique problem. Android being a foundational OS releases an update or a security patch and it’s unclear who is responsible for updating the OS that’s actually running on the device.

There are hundreds of companies that are currently making Android based devices and selling more than 60,000 models worldwide. It’s a complex ecosystem, with no one quite tracking the updates and vulnerabilities.

A third of the Android phones in India are running a version of the OS released in March 2015 or before. This leaves now some 300 million smart phone users in India potentially vulnerable.
Nobody presently knows how they are utilizing the internet and what applications are being installed on these devices. They are additionally liable to be less attentive about imparting information to application developers. Most terms and conditions that users consent to have a tendency to be in English. And that in itself is reasonable enough for assuming that numerous Indian mobile users are consenting to things without quite understanding what they are consenting to.

Saket Modi, the CEO of Lucideus Tech as well as a well-known ethical hacker says,
“It is relatively harder to install malware on Apple’s iPhones as to install a hacking app on an iPhone, you need the unique device identifier — a sequence of 40 letters and numbers, which can only be accessed by connecting the phone to a computer via Apple’s iTunes software. It is far easier however to install an app from an unknown source on an Android phone than on an iPhone,”

According to data aggregated by Lucideus, Android (all versions combined) has 1,855 known vulnerabilities, compared with 1,495 for iOS.

The Outdated privacy laws in India add to the troubles of mobile phone users. Shiv Putcha, founder of telecom consultancy Mandala Insights says..

 “In India, the regulations are weak at best, you don’t have a privacy law, no regulations around data storage or access to private data. If they (mobile phone makers and service providers) aren’t storing data here, how can we be sure how secure our data is?”

Nevertheless the government though did respond to this issue by highlighting the need for a strong data protection law, along the lines of the General Data Protection Regulation (GDPR) in the EU, and has even set up a committee to look into it.


Although according to Google, in 2017, India still ranks third in the highest percentage of phones with potentially harmful applications (PHAs) among the major Android markets, with 1% of the total Android phones in the country affected, though the figure had dropped by a third from 2016 but Google still says that devices that install apps from outside the Google Play app store are nine times more likely to have PHAs.






The CBI Registers Case of Alleged Hacking AndUnauthorised Online Transactions Involving $1.41 Million.


The Central Bureau of Investigation (CBI) on Monday registered a case against an on-site resource of Yalamanchili Software operations team, which provides the prepaid card application.

The accused, Sandeep Kumar Poojary is culpable of hacking a foreign travel card database and 374 unauthorised online transactions involving $1.41 million through three prepaid cards issued by the State Bank of India (SBI).

There are as yet many suspected to be involved with this case registered under various provisions of the IPC and the IT Act.

“Manpower resources for handling the system operations were also provided by Yalamanchili Software...”said SBI, in its complaints.

The wakeup call actually came up a year ago in February, when Yalamanchili software's COO reported the incidence to the bank, expressing that the balance in the prepaid card system had been modified deceitfully for authorisation of three foreign travel cards having a place with a solitary client.

The authorisation was said to have occurred over online business sites (e-commerce websites) of four shippers predominantly: Neteller.com, Entropay, Swiftvoucher and Skrill.com and these exchanges were carried out from November 8, 2016 to February 12, 2017.

The bank's NRI Seawoods branch in Navi Mumbai issued the primary card on November 7, 2016. Two more add-ons were issued to the user on November 29 and December 7, 2016, by the same branch.

As indicated by the FIR, the merchant transactions came by the means of VISA with the nation code as Great Britain, and the transaction and billing currency as U.S. dollars.

While the exchanges occurred on the prepaid card system, the balance seemed to have been modified manually by means of the Oracle Database access; the Yalamanchili Software Exports told the bank. Post authorisation the settlement transactions and authorisation alongside the general ledger entry was deleted.

The balance sheet generated on the prepaid card system therefore, did not display any difference.
 Additionally the bank added that after the swindling was identified, SBI managed successfully to block the three cards, banish the users from transacting on the four merchant sites, and abrogated the privilege of application user for executing database package.


Prevalent Cyber threat group targets UK

As of late a well-known hacking group attempted is as yet trying to focus on the UK with an updated version of malware intended to install itself into the compromised systems and stealthily conduct surveillance. Within the most recent year, the group seems to have been especially centered on diplomatic targets, including consulates and embassies. 

Both the Neuron and Nautilus malware variations have already been credited to the Turla advanced persistent threat group, which is known to routinely carry out cyber-espionage against a range of targets, including government, military, technology, energy, and other business associations and commercial organisations. 

It basically targets Windows mail servers and web servers; the Turla group conveys uniquely made phishing emails to trade off targets in attacks that deploy Neuron and Nautilus in conjunction with the Snake rootkit. By utilizing a combination of these tools, Turla can increase diligent system access on compromised systems, giving secretive access to sensitive data or the capacity to utilize the system as an entryway for carrying out further attacks. 

However the UK's National Cyber Security Centre (NCSC) - the cyber security arm of GCHQ - has issued a notice that Turla is conveying another variant of Neuron which has been altered to sidestep disclosure. 

Alterations to the dropper and loading mechanisms of Neuron have been composed in such a way so as to avoid the malware being detected, enabling its pernicious activities to proceed without being intruded. 

While the creators of Neuron have additionally attempted to change the encryption of the new version, now configuring various hardcoded keys as opposed to simply utilizing one. In the same way as other of alternate changes, it's probably that these have been carried out to make detection and decryption by network safeguards more troublesome. 

At all might be the situation it is believed that the National Cyber Security Centre doesn't point to work by Turla being related with a specific danger on-screen character - rather alluding to it as:
                                 "A predominant digital danger group focusing on the UK".


Security breach encountered in Perth international airport

A Vietnamese hacker infiltrated Perth international airport's computer system and swiped away sensitive security details. Le Duc Hoang Hai, 31 , utilized credentials of a third party contractor to unlawfully get to the airport's system in March a year ago.

Prime Minister Malcolm Turnbell's cyber security adviser Alastair Macgibbon told the West Australian that the Vietnamese figured out how to steal "a significant amount of data". He added the hack to be "a close miss" that could have been a considerable measure more terrible. The programmer could get the data on the Airport's building security yet luckily not radars. The authorities at the Airport detected a security breach and informed the federal cyber security authorities in Canberra who at that point tipped-off Vietnam.

 The 31-year-old was then arrested in Vietnam after the authorities got the information about the tip-off from the Australian federal police. He has been convicted in a Vietnamese military court and condemned to 4 years behind the bars. Aside from this, the travellers were not placed in threat as he was not able access radars, computer data related with air traffic or even the personal details of said travellers.

 Kevin Brown,Perth Airport CEO,later assured that no personal data of members of the public,such as details of credit card numbers, was accessed but other Perth Airport documents were taken. Brown said the airport has completed a full risk assessment of the data stolen and concluded that there was no threat or risk to the travelling public.The Perth international airport was in any case, the main Australian focus of the hacker, who had prior succeeded in compromising the website of the Vietnamese banks and telecommunications also including an online military newspaper.

 Macgibbon further added saying that right now there is no confirmation whether Hai, was working with a bigger hacking group or whether the data stolen in the breach was sold off or leaked online. In any case, he commented on the incident saying that it is indeed a warning sign that crisis like these are going to be encountered a lot in the coming future.