Home Blog Page 139

How to Detect Weak Passwords Using Google Chrome

User Verification Policy, zero trust approach

Your online security is highly dependent on your password habits. Using a strong password or passphrase will provide maximum security to your network and the devices you use. To prevent users from using weak passwords, Google Chrome has introduced a new safety check feature that will warn the users if their passwords are not strong enough. The upcoming feature automatically detects and reports weak passwords by performing a safety check scan.

How to Enable the New Password Check Feature?

While the new password safety check functionality is not yet available, Google says users can enable it in Chrome Canary.

Here’s how to do it:

Install Chrome Canary >> Enter Chrome://flags in the address bar and press enter >> Enable the “Safety check for weak passwords” and “Passwords weakness check” features.

To check the weak passwords, go to Settings >> Safety Check >> click on the Check Now option. Google Chrome will automatically scan your saved passwords and highlight the weaker ones. Users can change their weak passwords with the “Review” option.

Earlier, Chrome’s safety check issued warnings about potentially malicious extensions and passwords leaked in a data breach. With the latest update, the safety check feature becomes even more secure.

Related Story: 6 Practices to Strengthen Your Password Hygiene

Avoid Reusing Passwords

A recent study by the Microsoft threat research team revealed that 44 million users were reusing their usernames and passwords. The survey exposed that the largest percentage of passwords were weak and used for a long period. Using a common password for various accounts might seem convenient, but it could be a potential threat for other accounts if an attacker broke into one account. Even if you have a strong password, try to use different passwords for every account you use. Also, make sure that you change your passwords regularly. Read the full story here…

BEC Scammers Exploit Email Auto-Forwarding Rules, FBI warns

BEC Scammers Exploit Email Auto-Forwarding Rules, FBI warns

The FBI is warning organizations in the U.S. about the risks posed by email auto-forwarding rules. According to a Private Industry Notification (PIN) from the FBI’s Cyber Division, threat actors are exploiting auto-forwarding rules on victims’ web-based email accounts for launching business email compromise (BEC) attacks. The agency stated that the sudden shift to remote working increased the risk of email scams.

“The FBI is sharing this information to inform companies of this email rule forwarding vulnerability, which may leave businesses more susceptible to BEC,” the notification stated.

What are BEC Attacks?

In a BEC attack, cybercriminals first steal legitimate business email account credentials, which are later used to launch financial fraud campaigns like fraudulent email messages, requests for out-of-channel funds transfers, and deleted accounting trails. BEC actors create auto-forwarding rules within email accounts after they obtain employee credentials to decrease the victims’ ability to observe fraudulent communications.

How to Mitigate BEC Attacks?

The FBI recommended certain security measures to defend the evolving BEC attacks. These include:

  • Ensure both the desktop and web applications are running the same version to allow appropriate syncing and updates.
  • Be wary of the last-minute changes in established email account addresses.
  • Carefully check the email addresses for slight changes that can make fraudulent addresses appear legitimate and resemble actual clients’ names.
  • Enable multi-factor authentication for all email accounts.
  • Prohibit automatic forwarding of email to external addresses.
  • Frequently monitor the Email Exchange server for changes in configuration and custom rules for specific accounts.
  • Create a rule to flag email communications where the “reply” email address differs from the “from” email address.
  • Add an email banner to messages coming from outside your organization.
  • Consider the necessity of legacy email protocols, such as POP, IMAP, and SMTP, that can be used to circumvent multi-factor authentication.
  • Ensure changes to mailbox login and settings are logged and retained for at least 90 days.
  • Enable security features that block malicious emails, such as anti-phishing and anti-spoofing policies.

The FBI also highlighted that BEC scams reported more than $1.7 billion in worldwide losses in 2019. The agency urged users to report information concerning suspicious or criminal activity to their FBI’s 24/7 CyberWatch.

When your CSP has an outage, what does it mean for your SOC 2?

Misconfigured Cloud Storage Services Led to Over 200 Breaches in Past Two Years

Last Wednesday (November 25), as people across the world began preparing for a very different 2020 Thanksgiving, a large part of the internet experienced an outage. Amazon Web Services (AWS) announced early Wednesday morning that several of their key services were impaired causing API errors and other issues, including AWS’s ability to update their own status page.

By Jeff Cook, Co-Founder & CFO at ByteChek and AJ Yawn, Co-Founder and CEO at ByteChek

This type of outage may have an impact on your SOC 2 when you use CSPs such as AWS as your infrastructure provider.  In your SOC 2, it all comes down to your commitments and system requirements regarding service delivery to your customers.

What happened?

AWS is the market leader in cloud computing services and this outage demonstrated how many well-known companies were impacted, including Tampa Bay Times, The Philadelphia Inquirer, ByteChek, Glassdoor, Coinbase, and Adobe Spark. The issue appeared to be focused solely on the US-East-1 region and AWS informed The Verge that the issue was only impacting one of the 23 geographic regions.

Fortunately, the issue was resolved within 24 hours and all impacted companies appear to be operating normally. The root cause of the issue was outlined in detail by AWS here. Many CISOs and other executives of the organizations who relied on Amazon’s US-East-1 region are re-evaluating their business continuity and disaster recovery strategies in the cloud. One could argue that this incident makes the case for multi-cloud, or at least a multi-region deployment, but those decisions should be made based on the unique needs of each organization. Something that all CISOs and other executives should be aware of is the impact of this outage on their own SOC 2 reports.

AWS (or similar CSP) and your SOC 2

If you’re hosted on AWS, they very likely are listed in your SOC 2 report as a subservice organization. Hopefully, this doesn’t come as a surprise. The AICPA defines a subservice organization as “a vendor used by a service organization that performs controls that are necessary, in combination with controls at the service organization, to provide reasonable assurance that the service organization’s service commitments and system requirements were achieved.”

In non-accountant language, this means that AWS or any other subservice organization is a critical part of your control environment. Since AWS is a part of your control environment, for SOC 2 this most likely means that they impact the commitments you make to your customers regarding the security and availability of your system or application.

According to Description Criteria 7 Complimentary Subservice Organization Controls (CSOCs) for your system description (section 3), you have to disclose your subservice organization(s) and the criteria they help you meet.  In our example, you would have AWS helping you meet criterion A1.2 by providing controls relevant to backup, recovery, and redundancy.  Think of the cloud provider shared responsibility model. The providers are responsible for the physical security and environmental security of the cloud. If they fail to meet those requirements, you fail to meet criteria in your SOC 2 report associated with physical and environmental security controls.

In the SOC 2 guide, it discusses how if there are CSOCs, your CPA will have to perform procedures to determine if you found any deficiencies in the suitability of design or operating effectiveness of controls at AWS. The CPA will also have to review the AWS SOC report to determine if they agree with your evaluation.

If it is determined that the effect of the outage did not result in you failing to achieve one or more of your service commitments and system requirements, and the CPA agrees with that evaluation, it would not be necessary to modify your SOC 2 opinion on the suitability of design or the operating effectiveness (type 2) of controls because of the effect of the outage.

However, if you believe, and your CPA agrees, that the effect of the outage at AWS resulted in you failing to achieve one or more of your commitments and system requirements, modification of your SOC 2 assertion and the CPA opinion may be necessary (likely a qualified opinion). In that case, the service auditor would include an explanatory paragraph in the SOC 2 report to describe the outage at AWS and its effects on your failure to achieve one or more of your commitments and system requirements.

This incident’s impact on your SOC 2

Keep in mind that every scenario needs to be evaluated on an individual basis, and these types of situations are not always clear as to their effect on your report.  You should always discuss these situations with your CPA or trusted advisor to determine how you are impacted by your subservice organization(s), their responsibilities, and their performance.

Back to this specific outage, let’s say you commit in your SLA that you will deliver 99.99% service availability in any given month to your customers.

Scenario 1:

Since AWS was able to resolve the issue in a timely manner, it’s fair to assume that they have still met their availability commitments in the aggregate with no modifications to their SOC 2 opinion. In that case, you would review their SOC 2 Type 2 report that includes this period of time with the outage.  In your review, you determine that the outage did not materially affect availability, and you still met your commitment to 99.99% uptime. The CPA evaluates your review, looks at the AWS SOC 2 report and agrees with your determination.  No modification of your SOC 2 report is needed.

Scenario 2:

Now, let’s hypothetically determine that this outage did last for a significant amount of time which resulted in AWS not meeting their availability commitments (qualifying their SOC 2). Because of this AWS outage, your service availability for November dipped to 96%.

Due to AWS’s deficiency in their controls to deliver backup and recovery, and they’re being an integral part of your control environment (as a subservice organization) you have determined that you, in turn, have failed to meet your availability commitments to customers. This would potentially cause your SOC 2 opinion to be modified (qualified) with an explanatory paragraph stating the modification is due to failures at AWS.

What about DC4 (system incidents)

In the system description, DC4 discusses incidents and their effect on causing you to not meet your commitments and system requirements.  Similar to what we talked about above, if an incident causes the failure to meet commitments and system requirements, then you would disclose it in DC4 even if it came from the subservice organization.

We usually say a good rule of thumb (not official by any means) is if the organization sent out a press release, mass email, or something else to discuss an incident, then it likely would need disclosure.  With the AWS outage last week, they sent out emails and it was widely publicized, so likely that will require disclosure, even if it doesn’t modify the SOC 2 report.

Conclusion

The lessons learned from this outage will continue to develop as we learn more information and assess internal practices and processes. One lesson that you should immediately consider is how these outages from major cloud service providers impact your compliance efforts, specifically SOC 2 examinations. Security leaders must understand the long-term impacts beyond uptime and downtime of any incident and ensure all levels of management are aware of what this means to the organization.

About the Authors

Jeff Cook brings his information assurance and public accounting experience to ByteChek as a professional with over 9 years of IT audit and consulting experience and over 20 years of experience in public accounting and auditing. Jeff has worked extensively on SOC in addition to providing IT audit support for traditional financial statement audits. Jeff also has a functional knowledge of ISO standards, CSA STAR, C5, FISMA, and FedRAMP.

Jeff is also heavily involved with the AICPA, volunteering with the development of the SOC and CITP programs. Jeff was part of the SOC 2 working group, helping to develop the 2018 version of the AICPA SOC 2 guide, has developed numerous trainings for the AICPA, and is a prior recipient of the AICPA IMTA Standing Ovation Award for outstanding professional achievement in the IT specialization area.

Jeff is a part of the AICPA CITP credential committee, the AICPA IMTA SOC task force, and the AICPA Eye on Technology task force. Jeff is also a Board Member for Community IT, a Washington, DC-based managed service provider for non-profits. Jeff is a prior board member for the Maryland Association of CPAs.

AJ Yawn, Cloud securityAJ Yawn is the Co-Founder and CEO of ByteChek. He is a seasoned cloud security professional that possesses over a decade of senior information security experience with extensive experience managing a wide range of cybersecurity compliance assessments (SOC 2, ISO 27001, HIPAA, etc.) for a variety of SaaS, IaaS, and PaaS providers.

AJ advises startups on cloud security and serves on the Board of Directors of the ISC2 Miami chapter as the Education Chair, he is also a Founding Board member of the National Association of Black Compliance and Risk Management professions, regularly speaks on information security podcasts, events, and he contributes blogs and articles to the information security community including publications such as CISOMag, InfosecMag, HackerNoon, and ISC2.

Disclaimer

Views expressed in this article are personal. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Watch Out for These Three Cyberthreats in 2021

Avaddon ransomware, Microsoft and Fortinet flaws, apt

The unexpected crisis in 2020 impacted almost every business globally. The turmoil resulted in several changes in the traditional business operation models. Even cybercriminals changed their attack vectors with innovative hacking tools and techniques. Threat actors launched creative social engineering scams and phishing attacks by leveraging the fear surrounding the COVID-19 pandemic.

By Rudra Srinivas, Feature Writer, CISO MAG

Many organizations experienced security incidents in 2020. Here is a glimpse of threat areas that could change in the year ahead and become troublesome for businesses in the coming years.

1. Weaponized AI/ML for Advanced Cyberattacks

With Artificial Intelligence (AI) and Machine Learning (ML) becoming more prevalent in organizations, cybercriminals are also considering advanced AI tools to launch sophisticated cyberattacks. Threat actors often misuse advanced technologies to create new kinds of malicious operations. According to a research from the United Nations Interregional Crime and Justice Research Institute (UNICRI), Europol, and cybersecurity firm Trend Micro, cybercriminals are rampantly leveraging AI to spread a wide range of digital threats for ill purposes.  It is said that AI systems are being developed to enhance the effectiveness of malware and disrupt anti-malware and facial recognition systems.

2. Evolving Social Media Attacks

Threat actors are not limiting their social media-based attacks just for the sake of user credentials. Compromised social media accounts are used to tamper with elections, disinformation campaigns, and to spread fake news. Social media attacks could become more prevalent in 2021 if users continue their poor authentication practices. According to a report, nearly 48% of the U.K.’s CEOs deleted their social media accounts and erased their personal information online. It is also found that four-in-five CEOs (around 80%) have changed their online behavior fearing cyber risks.

3. Illicit Trading of Human Identities

Cybercriminals are known to pilfer users’ personal data and trade it on various hacking forums. According to an investigation, stolen users’ personal information like credit card details, online banking credentials, social media logins, and malware codes are put up for sale on several darknet forums at really low prices ranging from $12 and $70.

A Silver Lining

As cyberthreats emerge, so does our collective responsibility to safeguard the digital space.  To alleviate disastrous losses, most organizations across the globe are looking forward to enhancing their security measures to build malware defense mechanisms. After the pandemic forced businesses to go virtual, it became a challenge for organizations to protect their distributed work environment.

Recently, a security research highlighted that COVID-19 boosted security investments in the industry. Amid growing cybersecurity risks during the pandemic and the fear of compliance audit failure, most of the CISOs stated that boards are in plan to step up their cybersecurity budgets. Nearly, 90% of organizations are increasing their digital transformation budgets amid the pandemic.

At a time when every organization is thinking of improved cybersecurity, we wish the coming year witnesses even stronger security standards, making it near difficult for cybercriminals to survive.

About the Author

 

Rudra Srinivas is a Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

 

Apodis Pharma Exposes Over 1.7 TB of Confidential Company Data

data leak

French healthcare software company, Apodis Pharma, was notified by researchers at CyberNews about a possible data leak. CyberNews researchers discovered a misconfigured and unencrypted ElasticSearch database on October 22, 2020, which contained 1.7TB of Apodis Pharma’s confidential business data including information of their partners, business, and employee accounts, and some unsuspected patients’ information.

As per standard reporting procedure, the researchers promptly reported their findings to the company but did not get any response. Taking into consideration the gravity of the leak, the researchers then reported their findings to CERT France but even their efforts of reaching out failed. Eventually, CyberNews researchers established direct communication with Apodis Pharma’s CTO, Mathieu Bolard, who got the issue fixed instantly.

Related News:

Unprotected Elasticsearch Server Leaks 5 Billion Records

The researchers said they are not sure who accessed the database, “however, the database has already been indexed on at least one popular IoT search engine, which means that there is almost no doubt that the data has been accessed and possibly downloaded by outside parties for potentially malicious purposes.”

According to CyberNews, the Apodis Pharma database possibly leaked the following set of information:

  • Archived confidential pharmaceutical shipment data, shipment storage status, the precise time and locations of the shipments, and the quantity of pharmaceuticals in the shipments.
  • An archive of Apodis Pharma’s 25,000+ partner and client organizations, such as pharmaceutical laboratories and pharmacies.
  • Two archives of products stored in Apodis Pharma client warehouses, containing 17,324,382 entries and 32,960,114 entries each. It included product data like product quantities and IDs, as well as warehouse data.
  • Confidential product sales data containing 17,556,928 quarterly entries that include information such as sales dates, locations, prices, and quantities sold between pharmaceutical laboratories and pharmacies.
  • User data containing 4,436 entries, including full names of Apodis Pharma clients, partners, and employees.
  • Consumer and client data visualizations and analytics, including consumer gender statistics, and presumably, confidential client sales and warehouse stocks charts.

Experts suggest that at the very least, an ElasticSearch or any other database for that matter, hosted on any server with an IP address should have a strong and unique username and password. This is a basic yet often neglected technique of defense.

Related News:

Elasticsearch Database Leaks 100 GB Data of Peekaboo Moments App

GO SMS Pro Android App Still Vulnerable to Data Exposure

GO SMS Pro Android App Still Vulnerable to Data Exposure

Security researchers are warning users about a critical vulnerability in Android’s GO SMS Pro mobile application that has more than 100 million installs on the Play Store. According to Trustwave researchers, the instant messaging app is exposing the images, videos, and privately shared messages of millions of GO SMS Pro users. If exploited, the flaw could allow cybercriminals to obtain unrestricted access to users’ personal data.

“Any sensitive media shared between users of this messenger app is at risk of being compromised by an unauthenticated attacker or curious user,” Trustwave researchers said.

Vulnerability Disclosure

The vulnerability affects GO SMS Pro v7.91 versions. “It is unclear which other versions are affected but we believe this is likely to affect previous and potentially future versions as well,” the researchers added. Like all messenger apps, the GO SMS Pro app, allows users to send private text and media to other users. If the recipient does not have the app, the text/media file is delivered as a URL via SMS. The user is required to click on the link to view the files via a browser.

It is found that the link can be accessed without any authentication, allowing any user with the link to view the content. It is also suspected that a malicious user can abuse this procedure to access any text/media files sent via this process.

A new version of the app was introduced on the Play Store after Trustwave researchers notified the users about their vulnerability discovery. The researchers stated the new version of the app did not fix the issue.

“It seems like GOMO is attempting to fix the issue, but a complete fix is still not available in the app. For v7.93, it appears that they disabled the ability to send media files completely. In v7.94, they are not blocking the ability to upload media in the app, but the media does not appear to go anywhere. So, it appears they are in the process of trying to fix the root problem,” the researchers concluded.

CISA Alerts About Path Traversal Vulnerability in Fortinet VPNs

Fortinet VPNs Vulnerability

The Cybersecurity and Infrastructure Security Agency (CISA) is warning users about the potential password leaks on Fortinet devices. In an official notification, the agency stated that certain Fortinet VPN devices, located in the U.S., are vulnerable to a CVE 2018-13379 flaw. If exploited, the vulnerability could allow an attacker to illicitly access FortiOS system files.

Affected Products:

  • FortiOS 6.0 – 6.0.0 to 6.0.4
  • FortiOS 5.6 – 5.6.3 to 5.6.7
  • FortiOS 5.4 – 5.4.6 to 5.4.12

Fortinet also confirmed the vulnerability in a security advisory stating, “A path traversal vulnerability in the FortiOS SSL VPN web portal may allow an unauthenticated attacker to download FortiOS system files through specially crafted HTTP resource. If users fail to upgrade to the versions listed above, they can still mitigate it by enabling two-factor authentication for SSL VPN users. An attacker would then not be able to use stolen credentials to impersonate SSL VPN users.”

CISA has urged users and administrators to apply the necessary updates – FortiOS 5.4.13, 5.6.8, 6.0.5 or 6.2.0 immediately, to avoid potential online intrusions. It also recommended Fortinet users to conduct a review of logs on any connected networks to find any additional threat actor activity.

Update Before it’s Late

Recently, security researchers found a stack-based buffer overflow flaw in SonicWall Network Security Appliance (NSA) which could affect nearly 800,000 SonicWall VPNs across the globe, if left patched. According to the researcher Craig Young from Tripwire VERT, the vulnerability CVE-2020-5135 can be exploited by an unauthenticated HTTP request involving a custom protocol handler. The issue exists in the HTTP/HTTPS service, which is used for product management and for SSL VPN remote access. Read the full story here…

Defend Your Data with a Sense of Sertainty

Sertainty self protecting data platform

Sertainty Self-Protecting-Data is an advanced technology that provides data the awareness to act and react, enabling security directly at the data layer.

Have a look at its data security product suite below…

 

In recent years, CISO’s have increasingly invested in cybersecurity tools and processes that focus on data supply chain operations, user-based event analytics, and automated threat hunting capabilities. Security professionals have implemented countless defensive measures and complex encryption solutions, but attackers have somehow always managed a way to circumvent them. Attackers and threat actors have evolved, stolen, and exploited the most valuable customer and company asset – DATA. The size of the organization and the quantity of data does not matter, big or small, they are all TARGETS for attackers.

SPONSORED CONTENT

Data is a passive and defenseless participant in systems that are inherently vulnerable. Systems were never designed to control data but to protect it. The problem with data is that it is neither self-protecting nor self-aware, it can be manipulated, exposed, and exploited. But imagine a solution that transforms your data into a self-reliant, self-aware, and self-protecting asset.

Sertainty Quote

Have ‘Sertainty’ in Your Data Security

The Sertainty Self-Protecting-Data technology enables developers to mix intelligence into data-files, giving data an ability to act and react to its environment. It shifts data control and risk mitigation from an indirect/re-active paradigm to a direct/active paradigm by delivering “data-layer” governance, provenance, and protection into your intra and inter-network data workflow solutions.

Sertainty Self-Protecting-Data (SPD) reduces the dependency on trusted insiders and system hardware. SPD enables the data-owner to store and share valuable information without increasing the risk of data leak or manipulation. No longer is there a perimeter or extraneous control of data exerted by an application like a firewall or other system; the data controls, protects, and mitigates risks itself – in real-time.

Salient Features

 Governance 

With Sertainty, data governs itself by first determining its environment (physical device, location, time, etc.) when an entity attempts access to important information. If an anomaly is detected, the self-governing data takes appropriate action. This includes denial of access to data, alerting the data-owner, requesting access permission from external authority, presenting an alternate or hoax view to the user or process, and in certain scenarios self-destruct to mitigate risk.

 Provenance 

Sertainty deploys anti-tampering technology and maintains a record of ownership which assures integrity of the data. The record of ownership includes environment(s), access attempts and event occurrences. These event logs are irrefutable, provide a chain of custody, and are protected with Sertainty SPD technology.

 Protection 

Sertainty technology provides security and controls within the data file, reducing the dependency on infrastructure (hardware, firewalls, endpoints, etc.) for protection and governance. Encryption keys are never exposed. Instead, your data manages the keys internally, removing the vulnerability of shared/stolen keys.

Product Offering                                    

 Sertainty Self-Protecting-Data Technology Platforms 

Enterprise Self-Protecting-Data platforms include the Self-Protecting-Files Platform, Self-Protecting-Messages Platform and the Self-Protecting-Cloud Platform.  Each are augmented with Mobile Channel add-ons (Android, iOS) and SIEM plug-ins (Splunk, Devo, Elastic).  Sertainty SPD technology is agnostic to OS and cloud architectures.

 Self-Protecting-Files Platform 

The SPFiles Platform includes a developer’s kit (SDK) allowing custom build of an SPD application. SPD’s ability to selectively decrypt information in the data file for any given user ensures that the right user, at the right time, has the right information, without exposing any other information in the file.

 Self-Protecting-Messages Platform 

The Self-Protecting-Messages (SPMessages) Platform provides an effective way to implement secure machine-to-machine or node-to-node messages where encryption is heavy and maintenance intensive. SPMessages is a light-weight mechanism for IIoT, SCADA, ICS communication environments for machines, devices and applications to guarantee the integrity of the message and ensure both the sender and receiver to be legitimate.

 Self-Protecting-Cloud Platform 

Compliance with regulations such as GDPR, CCPA, HIPPA, PCI and NIST 800 is increasingly required of all participants in the supply chain and Sertainty’s SPD Platform enables an elegant and simple solution to comply with these regulations.

 

Spoofed Wi-fi: A Major Threat to Your Device Security

KCodes NetUSB, FragAttacks on Wi-Fi connected devices

Public hotspots are great. No matter whether there’s an issue with your service provider or you simply don’t want to waste your data plan, free wi-fi is a blessing to many. The thing is, though, that it might not entirely be free. Another surprise is that you won’t even have to pay for it with money. What they want is something different yet much more valuable – your data.

By Rene Mulyandari

But that’s kind of cryptic. What does it mean exactly, and how would you even pay with your data? Well, it’s not that you actually pay with it. They just take it from you without you even being aware of the whole process. Luckily, there’s a solution to it, and it’s not ditching hotspots once and for all.

Criminal Modus Operandi

There’s a way hackers do it. If you know it, you might be able to get one step ahead of them. That’s why it’s so important to understand how they operate. Although it might sound intimidating at first, it’s really not that hard to understand. After all, as you’ll see, the attack is so simple that virtually anybody can do it, making it even more dangerous as all you need is the right tools and close to no knowledge.

Preparation

In order to proceed with a wi-fi attack, we need a network. An ideal one would be used by many people. Therefore, public places such as coffee shops, hotels, airports are a great choice. The network itself can be either official, so set up by the owner, or created by the criminal only pretending to be legitimate. As long as people will connect to it, it doesn’t really matter.

Process

If you connect to a hotspot, the data you send and receive from the Internet will go through a router, which will then connect you to the web. That means that it can be intercepted, and that’s exactly what happens in the attack called man-in-the-middle. The name is pretty self-explanatory – the hacker places themselves between your device and the router.

By telling your device that they’re the router and the router that it should forward the information to their device, and not yours, they can see everything, you send and receive. Of course, that data is then forwarded again to the ‘real’ destination, meaning you will still see what you want.

Aftermath

Once the hacker can see everything that flows through the network, they can not only see sensitive data such as your bank credentials but also add something to it. Then, even after you disconnect from the network, your device will remain compromised, and the virus can then spread to other devices using the same network once you go back home, for example.

Solution

Luckily, there’s a simple way you can utilize. It takes advantage of how the system works, just like hackers do. The difference is that here, the goal is to actually help you.

What’s a VPN?

You’ve probably heard about it as this tool has been all over the media recently. It’s equally possible that you don’t fully know what it does or let alone have it installed on your device. A virtual private network is an extra layer between you and the Internet. Before you connect with the world, your connection will go through a server located anywhere in the world, making you invisible.

There’s so many

Just like with everything in the age of the Internet, we have too much to pick from. The same goes for VPN software, where you’ll find multiple options. They can offer more servers to which you can connect as well as locations of those servers. In addition to that, there could be limits of data you can send and receive. That’s why it’s so crucial to pick the one that will suit your needs the best as only you know what you really want.

Not only hackers

Using virtual private network software, you will not only become invisible to those who want to steal from you but also to those who claim to have no malicious intentions. That includes your internet service provider, or ISP, as well as government agencies, both of which might be interested in what you’re up to for different reasons.

The bottom line

Spoofed wi-fi is a major threat, but that doesn’t mean you can’t protect yourself against it. In fact, it turns out that it’s much easier than we think. All you need is one of the best ever VPNs, and you’ll be ready to go. It doesn’t matter whether you use public networks regularly or not, it’s always good to have this tool on your device as you never know why you might need it, and when the right time comes, it could turn out to be too late to get it.

SPECIAL FEATURES

Disclaimer

CISO MAG did not evaluate the advertised/mentioned product, service, or company, nor does it endorse any of the claims made by the advertisement/writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Operation Carding Action 2020 Cracks Down Credit Card Scammers

one million card data exposed

In a joint operation dubbed as “Carding Action 2020,” lead by Police authorities of Italy and Hungary, and assisted by authorities of the U.K. and Europol, nearly 90,000 pieces of card data that were being sold and purchased on the dark web, has been seized.

The operation was also assisted by a private cybersecurity firm, Group-IB, whose security researchers helped in tracking down the scammers’ activities on various underground forums. As per reports, the crackdown has prevented losses of approximately €40 million ($47 million).

Operation Carding Action 2020

The law enforcement agencies undertook the operation Carding Action 2020 with just the aim of targeting fraudsters selling and purchasing compromised credit card details on the dark web. Europol played a pivotal role in coordinating between the agencies of different countries, including their private sector partners. Europol’s experts provided an operational analysis of larger subsets of data and lent their expertise in the field of payment card fraud and scams.

In the operation that lasted over three months’ time, over 90,000 pieces of card data were analyzed by the authorities and Group-IB. This data included credit card data compromised during phishing attacks on websites and endpoint devices infected with banking Trojans, hijacked e-commerce websites, and JS-sniffers.

Related News:

Group-IB Finds Half a Million Credit Cards of Indian Banks on Darknet

Edvardas Šileris, Head of Europol’s European Cybercrime Centre (EC3), said, “Cybercrime can affect all aspects of our daily life, from paying in the supermarket, transferring money to our friends to using online communication tools or Internet of Things devices at home. Cybercriminals can attack us in different ways, and this requires a robust response not only from law enforcement but also from the private sector.”

E-skimming or Magecart attacks have surged in the recent past as the pandemic meant more and more people shopped online. Thus, Edvardas Šileris’s suggestion of a collaboration between private players and law enforcement agencies needs to be given a serious thought.

Related News:

Operation Falcon: INTERPOL Nabs Three Nigerian BEC Scammers

1...138139140...410Page 139 of 410