The people at TheHackerNews.com wrote a article on a new attack against Android devices that tricks users into believing they have powered off their device so they can spy on them. The original post can be found HERE.
My buddy Aamir Lakahni at drchaos wrote a interesting post about criminals using RAT tools to steal boat loads of money from banks. The original post can be found HERE.
Another week, another hack. A group of cybercriminals used phishing attacks to install remote access toolkits (RATs) and steal over $300 million from banks and other financial institutions (source: http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html)
Using RATs is not new, and common method cybercriminals use. We had an in-depth look at njRAT and the Sweet Orange Exploit on this site. It is also not uncommon to use phishing and other social engineering attacks by attackers to trick users into installing sophisticated malicious tools. Continue reading
NSS Labs just released their latest Threat Capabilities Report found HERE. Its a short yet interesting report covering widely used applications that were exploited after September of 2014. They list the top applications, operating systems and countries hosting command and control call homes. This one is free to download. Below is a summary from the report.
Data breaches continue to hit the news yet are only a fraction of what is being reported. Some recent ones are Sony (more on this HERE … and yes I saw The Interview because of the press behind this) and Anthem (more on this HERE). The reasons why organizations don’t report a breach vary from the fear of having critical infrastructure confiscated (which today usually isn’t the case like it was in the past), have negative press or costs associated with an investigation. Hopefully these and other concerns don’t become barriers for reporting data crimes. The more criminals get away with crimes, more likely they will do it again with less concern of being caught.
One really good resource you can check out to learn more about known data breaches is datalossdb.org. The people at Open Security Foundation do a pretty good job keeping up with documenting data breaches as they become public. Continue reading
The people at Propublica.org wrote a really cool piece on the creature of GPG, Enigmail and GPG4Win Werner Koch (original post can be found HERE). Until recently, Werner has been the one man band behind developing and maintaining a few versions of free email encryption software applications. Large organizations and governments tend to dump funds into spying and cyber defense yet can’t seem to fund developers of really important things such as email encryption. PGP isn’t good enough so its great to see Werner finally received some funding.
The man who built the free email encryption software used by whistleblower Edward Snowden, as well as hundreds of thousands of journalists, dissidents and security-minded people around the world, is running out of money to keep his project alive. Continue reading
Andrea Allievi & Earl Carter from the security group at Cisco, Talos, wrote a interesting post covering the latest Cyrptowall 3.0 ransomware. The original post can be found HERE. They really break down how the new attack functions. Check it out below.
Ransomware continues to impact a large number of organizations and the malware continues to evolve. In January, we examined Cryptowall 2.0 and highlighted new features incorporated into the dropper and Cryptowall binary. When Cryptowall 3.0 appeared, we were interested in seeing what new functionality was incorporated into this latest variant in the Cryptowall series. Continue reading
Imagine your are watching your favorite tv show and start chatting about sensitive subjects. Those things could be leaked through your TV according Samsung’s warning about users of their smart TVs. Thats right, the TV that suppose to be providing entertainment is also listening for commands … BUT ALWAYS LISTENING. And anything said could be sent to a third party (whose identity isn’t public) for evaluation. What about our cleared citizens? Are they suppose to be not be permitted smart TVs at home (no smart TVs in the white house)? What if you have sex or if there is a legal alteration near the TV. Can that be used in court or end up on the web? These are questions we all should be asking regarding our privacy rights with this technology. BTW this isn’t the first time voice activated technology has been used. Think about gaming systems, mobile devices, alarms, etc.
BBC News posted an article on Samsung’s warning HERE and a general warning about this technology HERE. Below is the Samsung article. Continue reading
The people at RiskIQ posted a interesting article covering the Anthem breach. The original post can be found HERE. 80 Million Personal Records Compromised!!!!! WOW
It should come as no surprise that another major data breach is in the headlines. Anthem, the nation’s second largest insurance provider, may have had as many as 80 million personal records compromised. There are several factors that make this breach notable. Primarily, it is the first major health insurance breach of its scale. The largest breach prior was the loss of over 4 million records by CHS. Continue reading