Search This Blog

Showing posts with label Cyber Security. Show all posts

Google Chrome under Threat of Cyberattack as Zero-Day Exploit surfaces


As if it wasn't spooky enough on Halloween night, the Google Chrome technicians were further frightened to announce a critical update notification regarding various browser platforms. Then, what gave Chrome the creeps? Two security vulnerabilities were discovered, out of which one is a Zero-Day exploit in the open!


So, what is the whole story? 

According to Google, "the current Chrome browser (desktop version) is being refreshed to 78.0.3904.87 (a new version) throughout various platforms like Mac, Linux, and Windows. The critical update will begin to work soon. The chrome users are highly suggested to add these updates for safety, unlike the Windows 10 security updates (in which the users were told not to)." In the present time, it is not simple to obtain out any particular information about the two exploits involved, except that the Zero-Day exploit is already out in the wild affecting the update.
"Access to flaws and links can be restrained until most of the users are renewed with a solution. The constraints are also said to be kept under hold until the bug that exists (only if) within other party's archives on which alike projects are depending," justifies Google for the actions taken.

About the Zero-Day Exploit- 

The vulnerability is known as CVE-2019-13720, according to Google. The threat was described on October 29 by Anton Ivanov and Alexey Kulaev, researchers at Kaspersky. "As far as we know, the Chrome update by Google directs loopholes that an intruder could misuse to hack an exploited computer if wanted," said Infrastructure Security Agency (CISA) and U.S. Department of Homeland Security Cybersecurity, in a statement.

Both the vulnerabilities misuse memory exploitation to intensify chances on the engaged computer. The CVE-2019-13721 vulnerability affects the PDFium library which is responsible for creating PDF files. But it is the latter, CVE-2019-13720, which is said to be misused in open which has an impact on audio components and Google Chrome. "Luckily, the threat is not very severe as Google has promptly recognized the flaws. The chances of any real damage in the' Zero-Day room' are least" says Mike Thomspon, applications security specialist.

The Ministry of Internal Affairs of Russia to create a Department to combat crimes in the IT-sphere


The Ministry of Internal Affairs will have units to combat crimes committed using IT-technologies. Units will be formed without increasing the staff.

This decision was made by Vladimir Kolokoltsev, the Minister of Internal Affairs of the Russian Federation, at a meeting of the Collegium of the Ministry of Internal Affairs of Russia, which was held as a video conference with all regions of the country. The meeting was attended by representatives of the Central Bank of the Russian Federation, the Ministry of Finance, Roskomnadzor, Rosfinmonitoring and a number of leading financial institutions.

The purpose of the creation of such units is to increase the efficiency of the prevention and suppression of crimes in the IT-sphere, as well as improving the skills and training of the most trained employees in identifying, revealing and investigating crimes committed using information and telecommunication technologies.

According to the Ministry of Internal Affairs, every seventh crime in Russia is committed in the field of IT-technologies. Law enforcement agencies in recent years have noted an increase in the number of crimes committed using the Internet, including fraud, drug distribution, theft of funds and other crimes.

At the moment, Vladimir Kolokoltsev instructed the heads of operational headquarters to prepare documents that will determine the structure, powers and functions of the new units to combat cybercrime.

Currently, the Office “K” of the Ministry of Internal Affairs is engaged in crimes in the field of information technology. In particular, the employees of this Department are engaged in the fight against illegal trafficking in electronic equipment and special technical equipment.

Earlier, E Hacking News reported that the Ministry of Internal Affairs will create a portal for complaints against hackers. The resource will be continuously and automatically collect data about the threats.

xHelper: A Non-Destructive Malware that has Affected 45,000 Android Devices


A new Android trojan tension has become a headliner after darting upon the detector of several cyber-security firms and disturbing the smartphone users, because of its re-installing peculiarity that has become a headache. The malware was located in March for the first time but it gradually developed to affect the android phones.


Hot as xHelper, it is a unique malware that has been detected by antivirus corporations. xHelper is quite dangerous as it has a self re-install origin, a process that makes it very difficult to eliminate from Android gadgets. The Trojan is said to have corrupted around 45,000 devices. "Every day, 131 different devices are corrupted, whereas, 2,400 devices are being affected every month," says Symantec, a cybersecurity company. Eliminating the xHelper assistance from your Android device is useless as the malware re-establishes itself despite the user completing a factory reset.

In the conclusion of a story, the Trojan provides for popup ads on devices simultaneously beside spams. These popup notices make profits for the bodies responsible for the deed. Also, the trojan-infected android devices are required to install various apps from the Google Play Store, once the damage has been done. The malware secures profit in the scheme of pay-per-download payments, once the application is installed on the android phone.

But it appears that the Trojan does not perform any lethal actions on the device. "xHelper is only confined to interfering popup ads and spams, it doesn't possess any severe threat to the device" claims the reports of Symantec and Malwarebytes. Besides, excluding the xHelper assistance from the Android OS devices won't do any relief as the malware re-fixes itself despite the user restoring the phone to factory reset settings. The matter of concern, though, is the point that android device users have been notified that while xHelper is momentarily only confined to popups, spams, and ads, it can, however, install different applications, which could extend a secondary degree trojan threat that can steal sensitive data such as personal information and banking credentials of the users.

The Central Bank will strengthen control over IT-security of credit institutions


In Russia, hackers may be involved in measures to strengthen control over the stability of credit institutions to cyber attacks. IT-auditors may be obliged in a test mode to crack the security systems of Russian banks with the involvement of white hackers.

Artem Sychev, Deputy head of the information security department of the Central Bank, said that the regulator, together with the FSB and the Federal Service for Technical and Export Control, is currently developing standards to assess the quality of work of independent companies that verify the reliability of bank infrastructure.

The representative of the Central Bank refused to clarify any details, however, sources say that one of the main standards for IT auditors will be a "full simulation of cyber attacks" with the participation of specialists with the same skills as potential hackers.

It is assumed that during such tests, specialists will reproduce the actions of real attackers, from penetration into the company's network to gain full control over its infrastructure or individual applications.

The head of the information security department of the Moscow Credit Bank Vyacheslav Kasimov agreed that the only way to qualitatively assess the security of the Bank's IT system can only be a complete simulation of a hacker attack.

Banks often make checks of their stability not for themselves, but for the regulator, so it has the right to set its own rules for conducting IT-audit, said Viktor Dostov, head of the Electronic Money Association.

According to Dostov, additional control will strengthen the protection of Russian money in the conditions of regular leakage of information from credit organizations.

Earlier E Hacking News reported that the Central Bank has a new punishment for banks for poor cyber defense. It will launch a new feature for credit institutions, it will be the risk profile on the level of information security. Depending on the risk profile on the level of cyber security, the Central Bank will give recommendations to banks. A financial institution that receives a low-risk profile will have consequences ranging from enhanced supervision to penalties.

IoT Devices Fall Prey to Attacks up to 10 Crore by Hackers


With more than 40 lakh attacks on IoT (Internet of Things) devices, India is among one of the Top 10 Victims Countries lists in the world. This can be a disappointment for Tech Freaks and companies that have just begun using IoT devices but don't consider protecting their IoT devices such as smart cameras. Hackers didn't even flinch while penetrating the systems. That's how simple the breakthrough was.


Simple methods like password guessing are used for getting the entry in IoT devices. Some sufferers of these attacks set passwords as naive as 'Admin.' And now, India has made it to the index of the top 10 countries that fell prey to IoT attacks in 2019. As shocking as the disturbance was, all of these hacks have happened in just the first half of the year. Nevertheless, it's ironical that India wasn't on this list at the same time last year. That is how distressing the circumstance has become.

In a study titled, 'IoT: A Malware Story,' Kaspersky, a cybersecurity company, says "There is an immense explosion in smart technologies like routers and smart cameras but people hardly care to guard them against cyber invasions, cyber safety solutions." This is due to a massive number of attacks happening in the first half of the year 2019. “Kasperky's honey pots (used as baits by the company to lure hackers) caught 10.5 crore invasions on IoT gadgets from 276,000 different IPs in contrast to 12 million invasions arising from 69,000 IPs in the very time previous year,” said its report.

The increase of IoT gadgets and lack of knowledge on cyber safety make this a sweet harvest for hackers. Invasions on IoT gadgets traversed 10-crore line in the first half of 2019, 9 times the number of attacks happened in the year 2018 at the same time. The Honey pots used as baits to catch the hackers have obtained fascinating knowledge about the manner of working of the hackers. Fortunately, the invasions on IoT gadgets are not complicated. However, lack of knowledge leads to attacks on IoT gadgets. Clicking on vulnerable links in IoT systems, hackers have sharpened their drives to ship into IoT devices and make a profit.

Mobile Malware: The next biggest security threat around the world


BlackBerry reveals Advance Persistence Threats and players targeting several enterprises. This entire time, the world had no clue about how widespread and common mobile malware is, and how it is being used for constant monitoring and reconnaissance. In truth, there are several hot actors and high-level safety threat that we didn't know until now. An advanced persistent threat (APT) is a long-time and pointed cyber invasion in which an invader gets entrance to a system and stays anonymous for a while.


The purpose of an APT intervention is usually to spy mobile actions and unlawfully take data instead of causing any harm to the company or the network. "It is Fertile, Prevalent and Multi-Platform," concludes Blackberry in a report titled 'Mobile Malware and APT Espionage.' The analysts recognized three superior harmful attacks, dawning essentially in countries like China, North Korea, Vietnam, and Iran, which further strengthens mobile malware, along with computer malware. The final aim is cyber spying and info retrieving, principally for business and administrative purposes. 

Opening up is a new harmful threat that Blackberry proclaims as BBCY-TA2. PWNDROID3, an earlier obscure android malware class, is being used for distributing a counterfeit bitcoin application. Following it is BBCY-TA3, a mobile malware that aims for westward and South Asian economic ventures in the telecommunications business. It also picks out almost all chemical production corporations across the globe, except for China. BlackBerry states it is yielding its relapse support with BBCY-TA2. Another Advance Persistence Threat is a class known as OCEANLOTUS, which uses a unique Android malware species PWNDROID1, via three spam mobile applications.

The whole show is that it makes BlackBerry Cylance CTO Eric Cornelius to the understanding that phone invasions are more conspicuous pervading of a danger than what people assumed. “This would come as a blow to the people when they discover how connected, and long-termed the attacks picking up mobile users are, as they have been simple prey for Advance Persistent Threat organizations. The reason being is the traditional lack of efficient safety resolutions for identifying and stopping mobile malware.”

NordVPN agrees to 'private' server infringement


NordVPN, a VPN provider has affirmed an intrusion on one of its servers in Finland, although the damage done was nothing serious. There were no dubious records on the server. “We don't trace, retrieve or distribute users' data. It is almost impossible for the attacker to obtain usernames and identifications and also, the hacker couldn't decipher the VPN traffic to different servers,” says the company.



"The only probable way to exploit website traffic was by doing an individual and complex MiTM breach to prevent a private connection that attempted to locate nordvpn.com," commented the company on its website. The attack happened in March 2018, when an unapproved user located the NordVPN server in Finland. They used an "unsafe remote administration system" that the data hub provider had forgotten.  The company didn't know of any such system. The server misused was attached to NordVPN's server record on January 31.

The service provider caught the violation and dismissed the account on 20th March without notifying the network provider NordVPN. The company discovered the attack several months back and immediately discontinued its engagement with the data center provider and cleansed all the details on the borrowed servers. It didn't reveal the infringement instantly because the company had to investigate the rest of its system to prevent the same incident from happening again. It also stimulated the decryption of our systems.

"This took a while because of the complex infrastructure and more than 3000 servers that our firm handles," says NordVPN. The problem didn't stir any of NordVPN's other servers. The company says that it would need engaged providers to reach more formidable safety measures. "We are also moving all of our data centers to RAM and this process would take another one year to complete," says NordVPN. While the break won't have any meaningful result on user secrecy, it will create a negative image of the company in the internet society. “NordVPN is multiplying measures on user privacy. We have supported an administration safety inspection and we are striving on a secondary no-records examination for the moment and are planning a fault munificence project." NordVPN will start autonomous surface scrutiny of its data systems to ensure it doesn't miss any loopholes.

Tehran has no data on alleged use of Iranian devices by Russian hackers


Iranian authorities do not have information about the alleged use of Iranian devices by Russian hackers to carry out cyberattacks on dozens of countries around the world, said an official representative of the Iranian government Ali Rabiya.

A report by the UK’s National Cybersecurity Center (NCSC) and the United States National Security Agency (NSA) reveals that the Turla hacking group, allegedly associated with “Russian entities", hacked software of Iranian hackers to cyber-spy and attack government and industry organizations in dozens of countries. The content of the document is published on the NCSC website.

It is claimed that, according to British intelligence services, the hacking campaign was most actively carried out in the Middle East. No evidence of cyberattacks is provided.

However, the Iranian government said they did not have information about Turla hackers.

According to political scientist Alexander Asafov, the assignment of the Turla hacker group to “Russian entities” is deliberately carried out by London and Washington, in order to “maintain an anti-Russian propaganda focus.”

"Even Western companies do not see any Russian connection in Turla's actions. But it’s not important for the propaganda of Britain and the USA,” the expert said.

Asafov added that by publishing such a report, London seeks to “support the image of bad Russia that he has already created” and wants to distract ordinary citizens from problems within the UK.

As noted by Asafov, reports of cybercrime for British and American politicians are a "universal tool."

A similar opinion is shared by the corresponding member of the Academy of Military Sciences Sergey Sudakov. According to him, it would now be beneficial for London to arrange a provocation.

At the same time, Iran, like Russia, is not the first time to be a central figure in Washington’s stories of "hacker attacks."

So, in early October, the American Corporation Microsoft said that allegedly Iranian hackers carried out an attack against the US political establishment and a number of other persons with the aim of "interfering" in the 2020 presidential election.

Sergei Sudakov believes that the next incident related to hacker attacks will also be attributed to Iranian and Russian hackers allegedly associated with the authorities of the Russian Federation and Iran.

Social Media Regulations: Need 3 Months To Frame Rules, Centre Informs SC



NEW DELHI: The Centre on Monday informed the Supreme Court that it would need 3 more months to finalize the process of updating and notifying the intermediary guidelines for social media in India, as per the reports by PTI. These new rules will be aimed at curbing the alleged exploitation of various social media platforms like Facebook and WhatsApp; major issues like fake news, hate speech, defamatory posts, and anti-national activities will be regulated by the updated guidelines which are expected by the last week of January.

After the top courts inquired about the steps taken on this subject, an affidavit had been filed, in which the government said that the country witnessed an exponential increase in the kind of posts and messages that incite hatred, disrupts social harmony and threatens country’s integrity, and therefore, a greater control over the internet is required to safeguard national security.

On the basis of the appeals filed by social media giants like WhatsApp, Facebook, and Twitter, who argued that the cases will probably have national security implications, the court assembled all the related cases and transferred them to the High Courts. After the government provides the court a draft of revised intermediaries guidelines, the next hearing will take its course, which is expected on January 15.

The Internet has become a powerful tool which can potentially cause “unimaginable disruption to the democratic polity”, The Ministry of Electronics and Information Technology told the court.

Although technology has facilitated economic growth and progress, it also heightened the concerns regarding social harmony and national security. “As the internet has emerged as a potent tool to cause unimaginable disruption to the democratic polity, it was felt that the extant rules be revised for effective regulation of intermediaries, keeping in view the ever-growing threats to individual rights and the nation’s integrity, sovereignty, and security,” remarked the ministry in the affidavit. “After collating and analyzing all the details from stakeholder participation and inter-ministerial consultation, the deponent has bonafide belief that a further period of three months would be required for finalizing and notifying the final revised rules in accordance with law.”

Prior to Tamil Nadu’s agreement on transferring the cases to the top courts, the Attorney Journal said, “WhatsApp and Facebook after coming to India can't say they can't decrypt information.”

The Russian Embassy in Prague denied the statement of a Russian spy network in the Czech Republic


The Russian Embassy in Prague denied the statement of the head of the Czech Security and Information Service, Mikhail Koudelka, who announced the disclosure of the activities of the Russian spy network allegedly operating in the country.

On Monday, the head of the Czech Security Information Service (BIS), Mikhail Koudelka, said that his agency and the Czech police had exposed the activities of a Russian spy network, which operates through the Russian Embassy in Prague.

"This network was completely defeated and beheaded," said Koudelka during a speech in the Czech Parliament.

According to the head of BIS, this network "was created by people associated with the Russian intelligence services, and funded from Russia and the Russian Embassy."

Koudelka claims that members of the network planned attacks against targets in the Czech Republic and other countries via the Internet. He also said that this network was part of a larger structure created by Russia in other European countries. However, he did not name these countries.

Koudelka said that he could not provide any specific information, as the investigation is not yet complete. However, information about this attempted intervention could be included in the BIS annual report, which will be considered by a parliamentary Commission this Thursday, October 24.

Recall that for the first time the Czech Security Forces disclosed the activities of the cyber attack center in early 2018. According to an investigation, the two companies were formally engaged in the sale of computer hardware and software, but in reality their employees were also preparing hacker attacks using their computers. Part of the equipment for companies in the Czech Republic was brought from Russia and also through the diplomatic mission.

The investigation said that the hacker group included both Czechs and Russians who received Czech citizenship.

Customers of Private Sector Banks Facing Problems in Net and Mobile Banking




Customers of several private sectors and well-known banks complained regarding encountering many issues in net and mobile banking in the course of the last few days, those of HDFC Bank, Kotak Mahindra Bank, and YES Bank are comprehended to have been most influenced by these 'outages'.

The issue, which made its appearance on the 1st of October, is by all accounts has been halfway settled, however numerous customers kept on facing certain issues while signing in to their accounts through the Internet and other apps.

While bank executives note that a mix of the festive season and the beginning of the month when salaries are credited just as some IT issue may have been the other reasons to have expanded the heap on servers. Following the restrictions at Punjab and Maharashtra Cooperative Bank, withdrawals had additionally increased after frenzy among certain depositors.

While the HDFC Bank, which is in the middle of a 'festive sale', appears to have briefly withdrawn an extra security feature for logging into net banking. Kotak Mahindra Bank's net banking page shows this message: “Due to high volume, you may experience some delay while accessing Net Banking. We will fix this soon. We regret any inconvenience caused.”

And at the same time, HDFC Bank spokesperson states that “Transactions through both net banking and mobile (app) banking have been very slow at times over the last couple of days, but they are going through. Though there isn’t nothing to be unduly worried about, we regret the inconvenience caused (to our customers)."

Nevertheless, the banks have guaranteed that they're making a decent attempt to resolve the issue and will ensure that the operations mentioned become, to a great extent, standardized at the earliest opportunity.

Russian experts created protection for ships and ports from cyber attacks


Russian company Engineering Technologies has developed a Poseidon system to protect ships and ports from cyberattacks. Domestic and foreign customers are already interested in this development.

Currently, 90% of the world's cargo is transported by sea. Objects of marine infrastructure due to their high automation and computerization are often victim of hackers. So, in 2017 and 2018, cyber attacks were carried out on the largest sea carriers Maersk (Denmark) and COSCO (China), as a result of which cargo terminal systems were blocked. In Russia in early 2018, hackers tried to disrupt the work of the Administration of the Sea Ports of Azov Sea.

"The Poseidon complex is being developed to protect ships and marine infrastructure facilities – ports, shipyards, drilling platforms from cyberattacks," said Artem Dolgikh, Poseidon Project Manager and Technical Director of Engineering Technologies.

Currently, most ships are protected using standard software, as well as security rules and policies on network equipment.

Poseidon uses the author's database of cyber vulnerability scenarios for the marine area and an automated threat detection algorithm implemented on the basis of neural networks and artificial intelligence.

According to Artem Dolgikh, the application of the program will reduce the costs of shipowners. So, a number of industry-specific marine companies, both in Russia and abroad, are already interested in it.

It became known that the software part of the system is planned to be developed in Russia, and the hardware part can be produced both on the territory of the Russian Federation and abroad.

Earlier, E Hacking News reported that now shipping companies are considering moving into the digital era and to work out a system which will integrate blockchain technology into one vast platform. A number of different shipping lines, such as A.P. Moeller- Maersk A/S have teamed up with technology companies, and they are about to revolutionize the shipping industry and upgrade the world’s most complex logistics network.

Putin's spokesman acknowledged the security of communications on Telegram


Communicate on Telegram is safer than on WhatsApp, said Dmitry Peskov, the special representative of the President of the Russian Federation on digital and technological development.

Recall that on September 16, Edward Snowden, a former employee of the US National Security Agency (NSA), who was granted asylum in Russia, said in an interview with a French radio station that senior officials should not use the WhatsApp messenger due to the low level of encryption. However, he added, both WhatsApp and Telegram are better than SMS or other unencrypted messages.

According to Peskov, Telegram messenger is superior to WhatsApp in terms of security, although there are no means of communication that guarantee absolute security.

"Absolutely safe means of communication does not exist. Until we made a quantum messenger, there are no safe means, " Peskov said.

Peskov also said that there is no ready-made solution for the domestic messenger for civil servants in Russia, however, there is a sense in such an application, and it will be useful.

"If we understand the physical possibility, then, of course, we will create messengers based on quantum technologies for civil servants in the Russian Federation. But for now, this is too long a story," Peskov added.

Peskov noted that at the present time Mail.ru and Sberbank are working on the creation of the Russian messenger. According to Peskov, "there are some serious developments of the domestic messengers: much work is being done in the company Mail.ru and there is a big project in Sberbank. I have not seen a solution that would be ready for implementation now."

"But, choosing between using the WhatsApp solution and using the Telegram solution, the choice of the Telegram solution from the point of view of communication security is completely obvious," said the special representative of the President of the Russian Federation.

He added that he uses both messengers.

Demand for teen hackers rises


Shivam Subudhi is 15 and lives in London. Three years ago, he was so inspired by the movies he was watching that featured hackers, he coded a simple port scanner revealing network doors that might let a hacker enter uninvited. "I decided to put my skills into practice for the first time," Subudhi says, "by pentesting my school network and website." Penetration testing is also known as ethical hacking and involves probing networks, systems, and sites looking for security vulnerabilities that could be exploited by an attacker. It was this activity that, unsurprisingly, brought Subudhi to the attention of the deputy headteacher. That teacher was also an IT enthusiast and introduced the budding hacker to the Cyber Discovery program; a £20 million ($24 million) U.K. government-backed scheme to teach kids how to be cybersecurity superheroes. Could your kid be next?

Teenage hackers sought by government Cyber Discovery program

Back in 2017, the U.K. government issued a tender to run a £20m Cyber Schools Programme as part of the National Cyber Security Strategy 2016-2021 created to reduce the cyber skills gap by encouraging young people to pursue a career in the profession. The SANS Institute bid for this contract was successful, having run similar programs in the U.S. and able to demonstrate the success of using a "gamified" learning model.

"SANS is by far the largest and most trusted provider of cybersecurity training in the world," James Lyne, CTO at the SANS Institute says, "so we have a wealth of experience, training content and expert instructors." In the first year the Cyber Discovery program saw some 23,000 youngsters from the U.K. aged between 14 and 18 taking part in the initial assessment phase, and around 12,000 qualifying to participate in the primary learning phases, "CyberStart Game" and "CyberStart Essentials." The following year, 29,000 took part and 14,000 qualified. Registration for the third year of Cyber Discovery is now open and Lyne anticipates a significant increase in participation, not least as the entry age has now dropped to 13.

Cyber Space Is Now A New Domain?


All the member countries of The North Atlantic Treaty Organization (NATO) are confident that all the member countries would retaliate if even a single member country is under cyber-attack.

The member countries include European countries, the US and Canada.

According to Article 5 of the founding treaty of NATO, “a collective defence commitment” could be made under the above circumstances. The article hasn’t been provoked since the 9/11 attack.

Per sources, “Cyber-space” has been designated as a domain which shall be defended and operated effectively like land, sea and air.

NATO hasn’t made such claims for the first time. The “Wannacry ransomware” attack which had wreaked havoc in the UK and NHS didn’t get the support of the Article 5.

There is no doubting the fact that considering an attack on one country as an attack on other countries too will be a herculean task when it comes to implementation.

The aspects and dimensions of an attack when it comes to cyber-crime and cyber-space are way different and abstract as compared to other forms of war.

Countries like Russia and Ukraine have been a part of such debates for quite some time now and there is no resolving and finding out the actual dimensions of an “attack”.

Resurgence in Ransomware Being Driven By a Surge of New Malware Families


A US based cyber security firm through its most recent threat report observed a 118% increase in new Ransomware strains basically in the first quarter of 2019 as compared with the last of 2018. It believes that the resurgence in ransomware is being driven by a flood of new malware families that are regularly more focused on.

The firm discovered that attackers were targeting the governments and organizations which were followed by companies in the financial, chemical, defence and education sectors. Their information corresponded with an ever expanding number of ransomware attacks standing out as truly newsworthy, especially US governments and urban communities, very much like the Texas Ransomware attack.

This new spate of ransomware attacks is said to have been a move away from 'spray and pray' ransomware strategies, in such targeted attacks, spear phishing – sending vindictive emails from an "apparently trusted person"  – is progressively being utilized to gain initial access 68% of the time.

Attackers are likewise said to have been utilizing unknown email services to oversee the ransomware crusades. The most widely recognized groups of ransomware during this period are known to be Dharma (otherwise called Crysis), GrandCrab and Ryuk.

In any case, McAfee, made some amazing disclosures also, first the cyber security firm found that culprits are turning to various attack approaches with regards to coin mining malware, like the CookieMiner malware focusing on Apple users.

Furthermore, also, it found an average of 504 'new threats per minute' in the first quarter of 2019 and noticed that more than 2.2 billion stolen account credentials were made accessible on the cybercriminal underground during the same period.

Its discoveries depend on the information accumulated from its Global Threat Intelligence cloud,, which comprises of over a billion sensors checking for different sorts of cyber dangers around the globe.

Raj Samani, McAfee fellow and chief scientist, stresses on the fact that the impact of these threats is very real and added further that “It’s important to recognise that the numbers, highlighting increases or decreases of certain types of attacks, only tell a fraction of the story. Every infection is another business dealing with outages, or a consumer-facing major fraud. And we must not forget that for every cyber-attack, there is a human cost.”

Hacking Attack Neutralized: France



A recent hacking attack was neutralized by the French government where 850,000 computers had been taken control of. The malware had been removed from the infected devices.

Retadup, a software worm was responsible for taking over of the devices in the Paris region according to sources.

The number of computers infected was massive which certainly indicates that it was a gigantic operation on the part of the hackers.

The police officials created a copy of the server which was responsible for the attack and allowed the hackers get into systems and take control.

All the infected computers were advised to uninstall Retadup malware which according to researchers had a part to play in the Monero Crypto-currency creation.

A few suggestions made by the researchers to ensure safety against malware attacks included:
·       Don’t open emails from unknown senders.
·       Don’t click attachments that pretend to offer anti-viruses for free.
·       Install and activate the anti-virus software immediately.

Windows Users Beware of the “Complete Control” Hack Attack; Update Imperative!





The hardware device drivers of Microsoft Windows due to a common design flaw left the entire systems of users compromised giving it to a recently resuscitated Remote Tojan Access (RAT).

The RAT brought about a hack attack tool with a modified format which as it turns out is absolutely free of cost.

The NanoCore RAT as it’s called, has been hovering around the dark web for quite some time now. It was sold initially for $25 which is a minimal amount for a hacking tool for Windows OS.

NanoCore’s cracked version, as soon as it appeared caused quite a commotion amongst researchers and hackers.

Initially the “premium plugins” were especially paid for privileges but the latest cracked version has it all for free.

The NanoCore coder had to be arrested given the rising familiarity of the product and the fact that he was a part cybercrime!
Despite that, NanoCore thrived and generated other tool variants RAT, Surprise Ransomware, LuminosityLink and of course the free “highly modified” latest version.

The NanoCore RAT, per researchers is controlled by way of easy security measures, no particular entry troubles and a really uncomplicated interface to aid even the novice hackers.

There was an outburst of campaigns using the very malware including:
·       Remote shutdown and restart of Windows systems
·       Remote file browsing on the infected system
·       Access and control of Task Manager, mouse and Registry editor
·       Disabling webcam lights to spy
·       Taking over open webpages
·       Recovering passwords and obtaining credentials
·       Remotely operated “locker” for encryption

Owing it to the long presence of NanoCore the techniques it uses are well known to the researchers. Scripting, registry keys and malicious attachments are the three main categories that the researchers found out.


The scripting threat’s basic solution is to check Microsoft office files for macro code and “anomalous execution” of legitimate scripting programs like PowerShell or Wscript.

The registry keys should be monitored for updates and patch cycles and rigorous security implementations should be made for behavioural detection.

Windows users should immediately go ahead and get their systems updated and make sure all their applications are running the way they actually should.

Additionally, Windows 10, 8.1 and 7 users should especially keep a keen check on regular updates and patching!

Phishing Attacks: Via Scraping Branded Microsoft Login Pages!


Phishing Attacks: Via Scraping Branded Microsoft Login Pages!



The latest phishing attack attacks using the targets’ company-branded Microsoft 365 tenant login pages just to make it look more believable.

Microsoft’s Azure Blob Storage and the Azure Web Sites cloud storage solutions are also under usage for finding solutions to host their phishing landing pages.

This helps the users think that they’re seeing a legitimate Microsoft page. This aids the cyber-con to target Microsoft users and get their services credentials.

This phishing campaign is mostly about scraping organizations’ branded Microsoft 365 tenant login pages just to fool the targets.

The above observations were made as a part of s research of the Rapid7’s Managed Detection and Response (MDR) service team, say sources.

The cyber-criminals actually go through the list of validated email addresses before they plan on redirecting the victims to the phony login pages.

They put up actual looking logos of the brands that they want to copy and that’s what helps them to scrape the tenant login page.

In case the target organization doesn’t have a custom branded tenant page, the phishing kit is designed to make use of the default office 365 background.

The same campaign’s been launched at various different companies and organizations including in financial, insurance, telecom, energy and medical sectors.


There are several points at hand that hint at the phishing campaign still being active. In fact someone may be updating it for that matter at different times.

The “phisher” behind the campaign could easily be exploiting the “Lithuanian infrastructure”.

Besides the using the phony Microsoft phony page and stealing credentials the campaign also is up for exploiting cloud storage services.

For landing page hostings also, the campaign works perfectly. Phishing kits were discovered in April this year.

IPFs gateways were also abused by phishing attempts by using TLS certificates issued by Cloudflare, last year in October.

Per sources, the following advises and measures should be taken at once by organizations using the Microsoft office 365:
·       Multi-factor authentication via Office 365 or a third party solution for all employees.
·       Enrolling staff in phishing awareness training programs.
·       Training to help the employees spot and report phishing attacks.

Hackers Can Intercept What’s Being Typed Just By The Sound Of It?




Hack Alert! Hackers could listen to the sound of typing on a person’s phone via a nearby smartphone and intercept what’s being typed.

Possibly, the acoustic signals or sound waves produced when a message is typed on a computer or a keyboard could be picked up by a smartphone.

The sound could later be processed leading an expert hacker to easily decode which keys were hit and ultimately what was it that was typed.
 
Allegedly, this trick could work in a busy hall filled with people chattering and typing as well, because researchers tried it out.

Sources mention that the researchers could intercept what’s being typed with a “41% word accuracy rate”. It might take only a couple of seconds to know what’s being typed.

The results of the research sure are disconcerting and privacy and security levels of the smartphones and their sensors have got to be taken to a higher level.

From detecting if a phone is still or in a pocket, to detecting if it’s on the move; with the enhanced technology, sensors too have come a long way.



Some sensors need permission whereas most of them are set to function as a default. Per sources, the researchers had in their analysis used the later.

All they did was develop an application that could intercept the sound of typing and detect which key exactly is hit.

According to researchers the material of the table at which the keyboard is placed, plays a crucial role in the entire process as the keys sound different on different materials.