Search This Blog

Showing posts with label Cyber Security News. Show all posts

Tehran has no data on alleged use of Iranian devices by Russian hackers


Iranian authorities do not have information about the alleged use of Iranian devices by Russian hackers to carry out cyberattacks on dozens of countries around the world, said an official representative of the Iranian government Ali Rabiya.

A report by the UK’s National Cybersecurity Center (NCSC) and the United States National Security Agency (NSA) reveals that the Turla hacking group, allegedly associated with “Russian entities", hacked software of Iranian hackers to cyber-spy and attack government and industry organizations in dozens of countries. The content of the document is published on the NCSC website.

It is claimed that, according to British intelligence services, the hacking campaign was most actively carried out in the Middle East. No evidence of cyberattacks is provided.

However, the Iranian government said they did not have information about Turla hackers.

According to political scientist Alexander Asafov, the assignment of the Turla hacker group to “Russian entities” is deliberately carried out by London and Washington, in order to “maintain an anti-Russian propaganda focus.”

"Even Western companies do not see any Russian connection in Turla's actions. But it’s not important for the propaganda of Britain and the USA,” the expert said.

Asafov added that by publishing such a report, London seeks to “support the image of bad Russia that he has already created” and wants to distract ordinary citizens from problems within the UK.

As noted by Asafov, reports of cybercrime for British and American politicians are a "universal tool."

A similar opinion is shared by the corresponding member of the Academy of Military Sciences Sergey Sudakov. According to him, it would now be beneficial for London to arrange a provocation.

At the same time, Iran, like Russia, is not the first time to be a central figure in Washington’s stories of "hacker attacks."

So, in early October, the American Corporation Microsoft said that allegedly Iranian hackers carried out an attack against the US political establishment and a number of other persons with the aim of "interfering" in the 2020 presidential election.

Sergei Sudakov believes that the next incident related to hacker attacks will also be attributed to Iranian and Russian hackers allegedly associated with the authorities of the Russian Federation and Iran.

Social Media Regulations: Need 3 Months To Frame Rules, Centre Informs SC



NEW DELHI: The Centre on Monday informed the Supreme Court that it would need 3 more months to finalize the process of updating and notifying the intermediary guidelines for social media in India, as per the reports by PTI. These new rules will be aimed at curbing the alleged exploitation of various social media platforms like Facebook and WhatsApp; major issues like fake news, hate speech, defamatory posts, and anti-national activities will be regulated by the updated guidelines which are expected by the last week of January.

After the top courts inquired about the steps taken on this subject, an affidavit had been filed, in which the government said that the country witnessed an exponential increase in the kind of posts and messages that incite hatred, disrupts social harmony and threatens country’s integrity, and therefore, a greater control over the internet is required to safeguard national security.

On the basis of the appeals filed by social media giants like WhatsApp, Facebook, and Twitter, who argued that the cases will probably have national security implications, the court assembled all the related cases and transferred them to the High Courts. After the government provides the court a draft of revised intermediaries guidelines, the next hearing will take its course, which is expected on January 15.

The Internet has become a powerful tool which can potentially cause “unimaginable disruption to the democratic polity”, The Ministry of Electronics and Information Technology told the court.

Although technology has facilitated economic growth and progress, it also heightened the concerns regarding social harmony and national security. “As the internet has emerged as a potent tool to cause unimaginable disruption to the democratic polity, it was felt that the extant rules be revised for effective regulation of intermediaries, keeping in view the ever-growing threats to individual rights and the nation’s integrity, sovereignty, and security,” remarked the ministry in the affidavit. “After collating and analyzing all the details from stakeholder participation and inter-ministerial consultation, the deponent has bonafide belief that a further period of three months would be required for finalizing and notifying the final revised rules in accordance with law.”

Prior to Tamil Nadu’s agreement on transferring the cases to the top courts, the Attorney Journal said, “WhatsApp and Facebook after coming to India can't say they can't decrypt information.”

Hackers Now Allowed to Find Flaws in US Fighter Jets and Security System


The Trusted Aircraft Information Download Station could have been shut down entirely due to a host of flaws discovered by hackers who were challenged to detect vulnerabilities in a system of a U.S military fighter jet known as F-15.

It was unprecedented in the history of the tech world that outside researchers were given physical access to such critical machinery, and were asked to detect vulnerabilities. It was a matter of two days for a group of 7 hackers to come up with a number of exploits which included bugs that were identified by the Air Force itself but they couldn't fix it, according to the Washington Post.

Hackers put the system through numerous attacks which included subjecting it to malware and testing with objects like screwdrivers and pliers, reported the DEF CON 27.

In the context of the vulnerabilities exploited by the hackers, Roper Technologies attributed, “decades of neglect of cybersecurity as a key issue in developing its products, as the Air Force prioritized time, cost and efficiency.”

Usually, outsiders were not allowed such access to military equipment which is highly sensitive in nature and their operation; it came as a massive change in how the military and technological world works in synchronization, the gravity of which can be gauged by the fact that hackers physically approached the machine with tools.

As per Roper, American Air Force is of the belief that if it doesn't allow America's best hackers to find every single vulnerability present in their weapons, machinery and fighter jets, then they are at the risk of being exploited by other adversaries like Iran, Russia and North Korea.




Estonia started cooperation with India in the field of cybersecurity


The Estonian Information System Authority (RIA) signed a cyber security cooperation agreement with India last Wednesday.

In accordance with the new Agreement, the parties will provide security in the field of cyberspace with doubled efficiency.

The Ministry of Electronics and Information Technology of India agreed on the Agreement and Margus Noormaa, the Head of Estonian RIA (Information System Authority), endorsed it.

The contract involves the exchange of operational information, conducting special consultations, as well as providing extensive assistance to the parties and communication with experts and specialists in addressing the complex issues.

It is worth noting that on August 21, Vice-President of India Muppavarapu Venkaiah Naidu, who is visiting Estonia, met with the Head of the Estonian Government Juri Ratas.

"I am very pleased that the relations between Estonia and India have become closer in recent years. For example, interest in Estonia has been noticeably increased for both Indian students and start-up entrepreneurs," Juri Ratas said.

During a conversation with the Vice-President of India, the Estonian Prime Minister said that in recent decades Estonia has made a huge leap in economic development and has become a world leader in the field of e-state. Also, as Ratas noted, there are impressive achievements in the field of cybersecurity and blockchain technologies.

"We are happy to share our experience with India. Many local companies have already become excellent investment partners for us, and even wider cooperation in many areas of the economy can grow from this,” the Estonian Prime Minister said.

At the moment, Estonia is one of the most active countries in the field of IT-development.

So, this year the first summer school of cyber diplomacy begins in Tallinn for about 80 diplomats, scientists and experts from 26 countries of the world. The participants of the school will consider the law and norms in cyberspace, the role of cyber operations in modern conflicts and other relevant topics.

The total cost of creating the Cybersecurity Training Center exceeded 18 million Euros. NATO itself invested six million, and Estonia’s alliance partners donated two million.

However, the political scientist Vitaly Gaychonok said that this is crazy. According to the expert, it is extremely difficult to use the same laws in the cybersphere that are applied in real life.

Estonian authorities and the military are focusing on ensuring cybersecurity. In April this year, a Training Center on Cybersecurity was opened in Tallinn, where it is planned to train NATO specialists and conduct international cyber studies.

The scammers started to use fake video to steal money of the Russians



Fake videos appeared on the Internet with overlapping faces and voices of famous people with the help of which scammers steal funds. IT company JET warned Russians about this.

"A relatively new phenomenon deep fake has appeared on the network, it is fake videos with overlapping faces and voices of famous people on videos of various contents using Deep Learning technologies. This technology allows you to replace the movement of the lips and human speech on the video. It is difficult for an ordinary user to identify such fakes, and many take them for the truth," the company said.

Experts of the company found in the network fraudulent video using the image of the Russian showman and actor Dmitry Nagiyev, where he offers to visit a certain site and get a prize or cash reward. The company said that site visitors may lose money.

The company JET noted that the victims got to the portal with the generated domain name. Such sites only work for a couple of days, but criminals constantly open new ones.

According to Anna Oleinikova, an expert on neural networks in the company JET, deep fake is an extremely serious threat. "The range of malicious use of deep fake and similar technologies is very wide: blackmail, discrediting of media persons and politicians, unfair competition in business and politics," she said.

At the same time, the company notes that ordinary users can try to identify fakes, based on several signs. So, on fraudulent videos all the time eyes are open or half-closed, and around the head at sharp movements and change of lighting there are strange loops.

In turn, Stanislav Ashmanov, the head of the company "Neural networks of Ashmanov", said that it is very difficult to create believable deep fake. This requires a lot of different data and a complex algorithm. Now everything that appears on the Network suffers from a lack of quality and looks quite improbable.

“In my opinion, technology has not yet been completely improved to make video indistinguishable from reality, cheap and easy,” he added.

Cyber security Team Identified Ransomware Utilized to Compromise City Power



Residents of Johannesburg using pre-paid electricity meters were not able to load the electricity purchased from City Power and were also unable to purchase further electricity due to a ransomware attack which compromised City Power's database.

Earlier, City Power said while the variant of ransomware utilized to carry out the attack remains unknown, they have the encrypted network, applications, and database being restored and rebuilt by their ICT department.

Easing off the customers, Isaac Mangena, the utility's spokesperson, said, "We want to assure residents of Johannesburg that City Power systems were able to proactively intercept this and managed to deal with it quicker."

"Customers should also not panic, as none of their details were compromised," Mangena assured.

On Friday, City Power announced that their cybersecurity team identified the variant of malware which temporarily paralyzed the city's computer systems.

Reportedly, the email systems took the hardest hit by the ransomware and were taking a while to recover and be functional again.

While giving updates, Mangena said “The virus samples have been taken to the external labs for analysis and testing,”

“Our IT technicians have also recovered and, in [a] few instances, reconstructed most of the systems,, applications, and data that was threatened, using backup files.”

Victims of the cyber power attack along with the customers, have been raging since the incident happened and encrypted the computer databases, applications and network.

City Power turned to external cyber security experts who worked in association with their team to tackle the issue.


All data is in plastic: the usual passports of Russians will begin to change into digital


The Russian government has determined the basic parameters of the future electronic passport. Documents of the new type will be issued to Russians from 2020 in Moscow, and it is planned to fully switch to digital passports by 2022.

Paper passports will no longer be issued, but old documents will remain valid until their expiration date. People over 45 will continue to use paper documents indefinitely.

The e-passport will become a universal carrier of information about a person, necessary for his identification. The government is discussing the addition of other personal data to such a document, such as electronic signatures, fingerprints, insurance number.

However, the design of the electronic passport has not yet been approved. Prime Minister Dmitry Medvedev said that the main version is a plastic card with a chip, which will be complemented by the secure mobile application "My passport".

Such a document looks like a Bank card with a high degree of protection NFC-based chip will be integrated into the card and the card will also have a QR code and holographic protection. All components for the new document will be only "made in Russia".
Crypto-protection will increase the protection of a new passport against fakes. In addition, the mobile application "My passport" will give the opportunity to use a cloud digital signature, which is convenient for entrepreneurs. It is planned that the application will be available for all platforms — Android, iOS and even for the Russian operating system Aurora.

The government promised to pay maximum attention to the protection of electronic passports from hacking and manipulation.

It is interesting to note that Georgian citizens can already receive an electronic identity card, they can get it within three days for $ 10. A “smart” chip embedded in a plastic passport allows identifying the owner and getting all the information about his property, tax payments and even health.

"Now more than three million citizens of Georgia have electronic passports. Citizens from 14 years of age must obtain a passport", – said Givi Azarashvili, the Director of the House of Justice.


The e-voting system in Moscow has passed the first tests


On Thursday, July 11, the first stage of testing the e-voting system was completed, which will be used during the experiment in the elections of deputies of the Moscow City Duma on September 8.

According to Artem Kostyrko, the head of the Information Technologies Department of the capital of the Russian Federation, 178 attempts were made to replace the bulletins.

“Several attempts were recorded to find a link to a unique anonymized bulletin during the test voting. The attacks were professional,” Kostyrko said.

Kostyrko explained that it was not a system failure, but a data output failure. However, it happened 3 hours before the end of the voting. By this time, 75% of all participants voted.

He noted that the system was ready for attacks and they were fixed to be sent to the e-voting monitoring group for study.

Moreover, 1253 students took part in the testing and pointed out the shortcomings. "We conducted the first testing with students for a reason, because they are advanced users of gadgets, they can compare with applications and point out shortcomings," Kostyrko added.

Kostyrko noted that several more public tests are planned. "IT professionals will test e-voting system next week. We will ask hackers to try to hack the system, put a fake voice and so on."

In addition, a hacker who can hack the electronic voting system will be offered a cash prize of 1.5 million rubles (23 800 $). He added, “if hackers manage to hack the system, it doesn't mean it's bad. This means that our colleagues gave us an opportunity that we did not see. And we will say thank you to them!”

Recall that the idea of conducting an experiment with the blockchain elections to the Moscow City Duma at the end of February was proposed by a group of Russian State Duma deputies representing United Russia and the Liberal Democratic Parties. The Russian State Duma supported the proposed bill, and on May 29, Russian President Vladimir Putin signed the relevant law. On September 8, electronic voting will be held in three electoral districts, and voters will be able to decide in what form they will vote in traditional or online.

The Cyber Attack Response Center opened in Nizhny Novgorod


In the Russian city Nizhny Novgorod the largest Regional Cyber Attack Response Center was opened. The Center was established by Rostelecom-Solar, a subsidiary of Rostelecom, which is the operator of the systems supporting the operation of the public services portal and biometric identification in banks.
Solar JSOC Centers are already operating in other Russian cities such as Moscow, Samara and Khabarovsk. These subdivisions protect more than 110 largest Russian organizations from hacker attacks.  Federal agencies, regional administrations, financial organizations, energy companies apply to Rostelecom-Solar for information security.
The Center in Nizhny Novgorod has become the largest regional Center for monitoring and responding to cyber attacks.  The organization employs more than 70 information security professionals. The Center will be responsible for the security of all regional clients around the clock. The average response time to eliminate cyber attacks is 30 minutes.
This is a serious team of highly qualified experts in information security, able to provide customers with full protection against cyber threats, – said Igor Lyapunov, Vice President of Rostelecom for information security, General Director of Rostelecom-Solar.
All this work is impossible without qualified personnel.  This was one of the reasons why Nizhny Novgorod was chosen to create the Solar JSOC. The city has a number of universities that train IT specialists.
According to Igor Nosov, the Deputy Governor of the Nizhny Novgorod Region, today the Nizhny Novgorod Region ranks third in Russia in terms of the number of IT professionals. "We are proud of our IT companies. Today, about 700 such companies operate in the region, including the world's leading companies. And the fact that we are leaders in the IT sphere makes the problem of information security even more urgent for us.”
It is planned that the Regional Center will work closely with universities, implement internship and employment programs. Every year, more than 70 graduates and senior students participate in the Solar JSOC internship program, about 30 of them receive a job offer.

It is worth noting that now, cyber attacks are in the top 5 largest and most serious challenges facing Russia. Moreover, hacker targets are changing. Previously, the task was to seize cash, now hackers are going to gain control over the management of information systems. EhackingNews recently reported on a DDoS attack during the Presidential Straight Line.

Mozilla Fixes Actively Exploited Zero-Day Flaw with Firefox 67.0.3



Mozilla has fixed the Firefox and Firefox ESR zero-day vulnerabilities with the release of its latest versions, Firefox 67.0.3 and Firefox ESR 60.7.1. These flaws were rampantly exploited by the hackers to remotely execute arbitrary code onto the systems of the users who ran vulnerable versions of the Browser.
The zero-day flaw tracked as CVE-2019-11707 takes place when JavaScript objects are manipulated because of the issues in Array.pop; before Mozilla came up with the patch, hackers could set off the attack by misguiding users using vulnerable versions of the browser to visit a malicious web address which is designed to take control of the infected systems and consequently, execute arbitrary code onto the machines.
Referencing from the statements given by security advisory of Mozilla, the Browser developers are "aware of targeted attacks in the wild abusing this flaw" that could allow hackers who take advantage of this zero-day flaw to take over the affected machines.
As a security measure against the Firefox and Firefox ESR zero-day vulnerabilities which were reported to Mozilla by Coinbase Security team and Samuel Groß from Google Project Zero, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) put forth an advise suggesting users "to review the Mozilla Security Advisory for Firefox 67.0.3 and Firefox ESR 60.7.1 and apply the necessary updates."
Commenting on the matter, Groß tweeted, “The bug can be exploited for RCE [remote code execution] but would then need a separate sandbox escape,” 
“However, most likely it can also be exploited for UXSS [universal cross-site scripting] which might be enough depending on the attacker’s goals.” he added. 
Mozilla has released a similar emergency patch, Firefox 50.0.2 and 45.5.1 ESR, earlier in 2016 as well. Back in 2016, the flaw was exploited by cybercriminals to de-anonymize Tor Browser users and accumulate their private data such as MAC addresses, hostnames, and IP addresses.


The Russian State Duma will be engaged in the protection of personal data on the Internet



This week at a meeting of the State Duma deputies the State Duma Deputy Pyotr Tolstoy recalled the global leak of personal data, which became known in early May. In particular, passport data of the Vice-speaker of the lower chamber Alexander Zhukov appeared in the Network. In this regard, the parliamentarians decided to create a working group that will deal with data protection issues in the implementation of the national project Digital Economy.

According to Pyotr, just recently, personal data of 2 million Russian citizens including passport data of members of the Government were publicly available. “First, personal data of people is leaked, then their property, then money from Bank accounts. We need to take measures to protect personal data”, said Tolstoy.

It is worth noting that the experts called the cause of the leak in the errors in the legislation and illiteracy of website developers. The problem arose because of two requirements in the law – on the publication of decisions on the approval of large transactions, which often include passport details of the founders and on the use of electronic signature in the documents of customers and suppliers, which contains the name, e-mail and insurance certificate.

Tolstoy stressed that the reason for the incident was the lack of data protection, which is almost completely publicly available.

Peter Tolstoy reminded that in Russia there is a project Digital economy, which implies adequate protection of the rights of citizens. He believes that the collection of all information about a person under one file is against the law on personal data and is an extremely dangerous idea. In addition, he recalled the problem of availability of modern technologies for residents of certain areas, in some Russian villages there is no Internet and cellular communication.

According to him, now it is important to find an answer to the question of how to protect the rights of citizens and their interests in the implementation of a project on a Digital Economy.

"Any data processing of a citizen should be carried out only with his consent – voluntary and informed," said the Deputy.

As a result, at the suggestion of State Duma Speaker Vyacheslav Volodin, it was decided to create a working group that should deal with security issues within the framework of the national project. Deputies intend to listen to the first offers from colleagues in a month.

Google Using Gmail to Track User Purchases




The privacy of Gmail took a severe hit after a Reddit user's take on the matter related to privacy, he shared how he found that his Google Account's Purchases page carried a record of all his purchases made from other online platforms like Amazon; notably, it included the purchases made without using Google Pay.

Prior to appearing into your Google account, your Gmail messages undergo scanning by Google for purchases which happen at the expense of the privacy that the platform was supposedly providing.

While briefing his experience, the Reddit user told that when he checked his Google Account Purchases page, he discovered that the Purchases page also consists a record of the purchases he made from Adidas, Dominos, Amazon, Steam and some other online stores. To put the things into perspective, he further told that he does not use Google Pay.

On being enquired on the matter, Google stated that the source of information was Gmail messages. They also confirmed that the company is not making use of purchases or any other data stored in user emails and that this was configured to aid users in finding and tracking their valuable data.

Referencing from the company's statements, “To help you easily view and keep track of your purchases, bookings, and subscriptions in one place, we’ve created a private destination that can only be seen by you. You can delete this information at, any, time. We don’t use any information from your Gmail messages to serve you ads, and that includes the email receipts and confirmations shown on the Purchase page. We're always working to help people understand and manage their data.”


Security Bug Discovered in Google's Titan Security keys, Provides Free Replacement




A security bug in Google’s Titan Security Key which can potentially allow fraudsters located nearby to bypass the security provided by the key. While the company provided a replacement key for free to all the already existing users, it blamed a “misconfiguration in the Titan Security Keys’ Bluetooth pairing protocols” for the security bug.
Although the defected keys are reported to be still protecting against phishing attacks, the company decided to provide a replacement key regardless. The affected keys include all those which are sold in packages priced a $50; it also includes a usual NFC/USB key.
In order to exploit the security bug, the fraudsters need to in a Bluetooth range of around 30 feet, he is supposed to act promptly as the victim activates the key by pressing the button, then the fraudsters can employ falsely configured protocol to intercept your device’s connection to the key and connect theirs instead. Then given, they would be having access to your username and password, they would be able to log in to the victim’s account.
Google has given students to ensure that the bug does not intercept the security key’s ultimate purpose that is to provide security against phishing attacks; Google also urged the users worldwide to keep utilizing the keys until a replacement is provided.
In an announcement, the company said, “It is much safer to use the affected key instead of no key at all. Security keys are the strongest protection against phishing currently available,”
Around the time when Google launched its Titan keys, Stina Ehrensvärd, Yubico founder, wrote, “While Yubico previously initiated the development of a BLE security key, and contributed to the BLE U2F standards work, we decided not to launch the product as it does not meet our standards for security, usability and durability,”



Darknet: The digital underground



The arrest of two Delhi youths for the import and sale of illegal marijuana through the darknet in December last year sparked widespread discussion on the rising prominence of the darknet in India. With dark net being the new market for drug peddlers and illegal traders, it is slowly becoming one of the most challenging problems to be tackled in this cyber age.

What is the darknet?

The world wide web can be divided into three categories- the surface web, the deep web and the dark web. While pages on the surface web(visible web ) are indexed and can be easily accessed by the public, pages on the deep web are not indexed and hence cannot be readily accessed. The content of the deep web is hidden behind HTTP forms and includes many common uses such as webmail, online banking, and services that users must pay for, and which is protected by a paywall, such as a video on demand, some online magazines and newspapers, and many more. Content of the deep web can be located and accessed by a direct URL or IP address and may require a password or other security access past the public website page. The dark web is that part of the internet which can be accessed only by ‘overlay networks ‘ and needs special browsers like TOR to access. Browsers like TOR ensure anonymity to the host as well as the user, by protecting the IP address with its ‘overlay network’ structure.

Illicit drugs, weapons and online fraud : the endless dangers of darknet

The promise of anonymity the darknet offers has led to an alarming increase in its use in the last 4 years. A 2015 study showed that drugs are the most traded commodity on the dark web and 26 per cent of its content can be classified as ‘child exploitation’. A December 2014 study by Gareth Owen from the University of Portsmouth found that the most commonly hosted type of content on Tor was child pornography, followed by black markets. Stolen credit card details, forged documents, counterfeit currency and weapons are the other types of content. Reports of crowdfunded assassinations, hitmen and live streamed murders are believed to be available on the darknet.

How does it work?

Cryptocurrencies such as bitcoin are used for transactions on the darknet. Purchases on the darknet come with reviews and ratings just like on Amazon and Flipkart and are delivered to the customer’s doorstep just like any other order. Service providers like ‘escrow’ ensure that the transaction is made to the seller only after the customer receives the package. Often disguised, these illegal products mostly make their way through customs to the customers' doorstep.

Cracking the whip :

Though highly evasive, browsers like Tor aren’t completely untraceable. In early November, a coordinated action by the FBI and Europol known as Operation Onymous seized dozens of Tor hidden services, including three of the six most popular drug markets on the Dark Web. For now, just how the feds located those sites remains a mystery.

“ The Interpol, Europol and the FBI are the ones striving hard to keep the darknet dangers in check”, says J.Prasanna, Director of Cyber Security and Privacy Foundation, Singapore.

” The first step towards net safety comes down to parental supervision”, says J .Prasanna who provides dark web monitoring for banks.

“ The Indian government should ensure stringent punishment for the offenders using darknet for illegal trade and activities. The police department too should be technologically advanced to handle such crimes”, says V.Rajendran, Chairman, Digital Security Association of India.


The bright side :

It would be safe to say not everything is dark about the darknet. The privacy it provides is a major attraction to many who are looking to escape the watchful eyes of service providers and federal agencies. Anonymous messenger services and access to tonnes of resources (data, books, documents) argues the use of darknet for good.

Author:
Yamuna Chandran

Most of the Antivirus Android Apps Ineffective and Unreliable



In a report published by AV-Comparatives, an Austrian antivirus testing company, it has been found out that the majority of anti-malware and antivirus applications for Android are untrustworthy and ineffective.

While surveying 250 antivirus applications for Android, the company discovered that only 80 of them detected more than 30% of the 2,000 harmful apps they were tested with. Moreover, a lof of them showed considerably high false alarm rates.

The detailed version of the report showcased that the officials at AV-Comparatives selected 138 companies which are providing anti-malware applications on Google Play. The list included some of the most well-known names like Google Play Protect, Falcon Security Lab, McAfee, Avast, AVG, Symantec, BitDefender, VSAR, DU Master, ESET and various others.

ZDNet noted that the security researchers at AV-Comparatives resorted to manual testing of all the 250 apps chosen for the study instead of employing an emulator. The process of downloading and installing these infectious apps on an Android device was repeated 2,000 times which assisted the researchers in concluding the end result i.e., the majority of those applications are not reliable and effective to detect malware or virus.

However, the study conducted by AV-Comparatives also highlighted that some of the offered antivirus applications can potentially block malicious apps.

As some of the vendors did not bother to add their own package names into the white list, the associated antivirus apps detected themselves as infectious. Meanwhile, some of the antivirus applications were found with wildcards in order to allow packages starting with an extension like "com.adobe" which can easily be exploited by the hackers to breach security.

On a safer side, Google guards by its Play Protect which provides security from viruses on Android by default. Despite that, some users opt for anti-malware apps from third-party app stores or other unknown sources which affect safety on their devices.

The presence of malicious apps on Google Play was also noticed in the past and with the aforementioned study, Android is becoming an unsafe mobile platform.



QR-codes on historical buildings of Russian city Astrakhan that led to Adult sites have been removed


Hacker reportedly changed website location of the QR-codes on historical buildings of Russian city Astrakhan and replaced them with adult website link. There was no technical detail provided how hacker was able to change the location of QR code.

When residents and guests of the city scanned QR-codes, their phones opened resources for adults, instead of sites with historical references.

Galina Goteeva, the Minister of Culture and Tourism of the region, said on March 15 that the signs with QR codes on the historical buildings of Astrakhan were changed.

QR-codes on historically significant buildings of Astrakhan were placed a few years ago. It was assumed that people can get a historical reference about the building after scanning the code with a mobile phone. Already in November last year, the Media reported about QR codes leading to porn sites and dating sites for quick sex.

In fact, the Regional Ministry of Culture for a long time struggled with the elimination of porn content, the signs were removed with great difficulty. And only at the end of the year sex traffic was stopped completely.

However, it is still a mystery why the signs with QR-codes hung for so long and why they were not promptly replaced. In total, there are at least 15 signs. QR-codes stopped working more than a year ago, but officials did not pay any attention to it: first, the pages gave an error, and later they began to lead to porn sites.

Hackers Delivering New Muncy Malware Worldwide through DHL Phishing Campaign



With malicious intentions of targeting the users across the globe, attackers are reported to be disseminating new dubbed Muncy malware in the form of EXE file through DHL phishing campaigns.

Resorting to malspam emails, DHL phishing is amongst the most far-reaching campaigns which distributed several sophisticated malware. They made it appear legitimate by exploiting the deplorable configuration of SMTP servers and by employing email spoofing techniques.

DHL is a company of global repute which specializes in providing express mail services, international couriers and parcels. The reputation of the well-established company took some hits by the cybercriminals as they abused it to distribute malware. 

They did so by configuring the malicious emails to appear to be coming from DHL express. The email comprised of an infected attachment in PDF format.

How the malware is executed?

As soon as the targeted user accesses the PDF attachment, Muncy Trojan file sneaks into the system. Then the packed malware is unpacked and once unpacked it scans the whole C:\ drive for the files containing sensitive data. 

Expert takes

Commenting on the matter, Pedro Tavares, Founder, and Pentester at CSIRT.UBI told the GBHackers, “The phishing campaign is trying to impersonate DHL shipment notification and the malware is attached in the email.”

“This malware is on the rise and is affecting user’s in-the-wild while stealing sensitive information from their devices.”




Scammers disguise themselves as divisions of the Central Bank of Russia


Cyber Criminals performed a large-scale attack on Russian banks in late 2018, they managed to steal $ 20 million.

The attackers disguised themselves as divisions of the Central Bank FinCERT and Alfacapital. It is known that the attacks were carried out by hacker groups Silence and Cobalt, who had previously organized cybercrime. Also along with them operated a new hacker group, which had not been seen before.

The scheme of crimes was the same: the scammers on behalf of the FinCERT division of the Central Bank sent out malicious documents with macros. In addition, a compromised account of an employee of the company Alfacapital was used.

Representatives of many banks confirm the frequent attacks. The criminals tried to penetrate the infrastructure of the financial organization for the withdrawal of money.

The IT-company Positive Technologies conducted their own statistics and found that over 201 million people suffered from such attacks in 2018.

Moreover, banking infrastructure was attacked in 78% of cases, web resources - 13 %, ATMs and POS-terminals - 9 %, personal data - 39% , credential theft , card information, trade secret - 5%, personal correspondence and other information - 8%.

In addition, on February 18, Kaspersky Lab recorded an increase in attacks by Buhtrap and RTM banking Trojans in Russia. At the end of last year, experts recorded an increase in the activity of the banking Trojan RTM 50 times, compared to 2017.

Over 200 Million Chinese CVs Compromised On The Dark Web


Over 200 Million Chinese CVs Compromised Online







Recently, a database comprising of over 200 million Chinese CVs was discovered online in a compromised position where it was laid bare for the dark web to devour. Naturally, it spilled explicitly detailed information.



Having lacked, fundamentally basic security endeavors, the database exposed some really personal data of people.



The database encompassed their names, addresses, mobile phone numbers, email addresses, education details and other what-not.



The much detailed information on the base was developed by persistently scouring various Chinese job sites.



Reportedly, the director of the researching institution cited on the issue that at the outset, the data was thought to be gained from a huge classified advert site, namely, BJ.58.com.



Nevertheless, BJ.58.com, vehemently denied the citation and their relation with this accident.



They had thoroughly analysed and checked their databases and found nothing questionable, hence reassuring that they had no role to play in the data leakage.



They also mentioned that certainly some third-party CV website “Scraper” is to blame.



It was via twitter that the news about this data cache first floated among people, and soon after that, it was removed from Amazon cloud where it had been stored.



But, as it turned out while further analyzing, before it was deleted it had previously been copied around 12 times.



There has been a series of incidents where the Chinese have been cyber-affected, and this data loss is the latest of all.



From online rail bookings to allegedly stealing rail travelers personal data, the early days of January were quite bad for the Beijing people.



Reportedly, in August last year, the police of China were busy investigating a data breach of hotel records of over 500 million customers.



Personal data, including the booking details and accounts, registration details and other similar information were leaked.



Also, the Internet Society of China had released a report wherein the several phishing attacks and data breaches the country’s residents had faced were mentioned.

UK spymasters suspect Russia is using Kaspersky to spy on people

 

British Intelligence service is reportedly worried that Kaspersky Antivirus offered by Barclays to its customers may be being used by Russian Intelligence agency to spy, according to The Financial Times.

An unnamed official told The Financial Times that GCHQ, British intelligence agency has concerns over widespread distribution of Kaspersky in the UK.

Intelligence officials fear that this might allow Russia to gather intelligence from the computers of Government employees members of the military who are customers of the Bank and have downloaded the software.

The Financial Times added that "No evidence suggests that any data of Barclays customers have been compromised by use of Kaspersky software on their computers."

However, the bank said they were planning to end the deal with Kaspersky for commercial reasons that doesn't have any connection with the GCHQ concerns.

Kaspersky denied the allegations and said the company does not have inappropriate ties with any government.

"No credible evidence has been presented publicly by anyone or any organization. The accusations of any inappropriate ties with the Russian government are based on false allegations and inaccurate assumptions, including the claims about Russian regulations and policies impacting the company." Kaspersky said.

Earlier this year, US Spymasters and FBI chief said that they do not trust software from Russian antivirus company Kaspersky.

- Christina