Colleagues, cyber criminals believed to
be of Chinese origin recently gained access to a range of government resources in Central
Asia. This attack was based upon by inserting malicious scripts in the target
country’s websites in order to conduct watering hole attacks. Such attacks seek security exploits in which
the attacker attempts to corrupt a specific group of end users by infecting websites
that a pool of users are known to visit. The goal is to infect a targeted
user's computer and gain access to the network at the target's place of
employment. Officials attribute the attack to
LuckyMouse, a Chinese-speaking
actor (aka APT27 and EmissaryPanda). Some of the more
effective mitigation efforts include the use of micro visualization, whitelisting
risky web content, deploying Malwarebytes, install up-to-date
operating systems and loading all available patches for known vulnerabilities. Share your assessment while visiting us
today! Lawrence – Cyber
Security Defender (https://cybersecuritydefender.blogspot.com/)
Our mission is to provide world-class cybersecurity Training and Certification programs to individuals and businesses globally.
Monday, June 18, 2018
Friday, June 15, 2018
Cryptocurrencies: An Ever-Increasing Target for Cyber Crime – The Monero 5% Heist is the Latest Example
Colleagues,
Monero is by no means a tier 1
cryptocurrency. According to Satoshi Pulse it ranks 14th in
cryptocurrency market cap worldwide. However, the recent theft of some 5% of
the currency’s value at the hands of so-called “malicious miners” once again exposes the
vulnerabilities cryptocurrencies need to resolve. Key cybercrime targets in the
cryptocurrency world include ICO, mining, exchanges, wallets and the underlying
Blockchain. Cyber criminals undoubtedly will probe very component of the crypto
ecosystem to find the weakest links. Now that we have entered the era of
quantum computing-based cybercrime security is of tantamount
importance to the mass adoption of cryptocurrencies. Post a comment and visit us today! Lawrence, Cryptocurrency Academy (https://cryptocurrencyacademy.blogspot.com)
Monday, June 11, 2018
Coinrail Reports a $40m Heist – So just how secure are cryptocurrency exchanges against cyber theft?
Colleagues,
the recent Coinrail
loss of some $40m is just the latest in a steady stream of cybercrime attacks
against cryptocurrency exchanges. Coincheck lost an approximately $400m earlier
this year, last November saw Tether claim it lose $31 million following an
attack. Mt.
Gox hacking in 2014 is the mother of all crypto attacks. In total the
exchange lost around 744,408 BTC. That was worth around $350m in 2014. While Coinrail is by no means a tier 1
exchange this cyber heist raises serious questions about the security of
cryptocurrencies in general, and second the exchanges on which they are traded.
There is no silver bullet mitigation strategy, however, the Cryptocurrency
Academy would a couple of best practices for minimizing the risk to your crypto
investments: Currencies, exchanges and wallets. First, the top-tier currencies
such as BTC, Ethereum, Ripple, Litecoin, etc. generally have more security
on-board. Second, the larger and more established exchanges are likely to be
built on more secure platforms with cyber security professionals on staff. And
third, although opinions surely vary, hardware wallet such as the
industry-leading Nano Ledger S are
believed to offer more security … especially when compared to cloud-based
wallets. Send us a comment and subscribe today! Lawrence, Cryptocurrency Academy (https://cryptocurrencyacademy.blogspot.com)
Friday, June 8, 2018
How to mitigate the increased threat of cryptocurrency theft?
Colleagues,
currency theft is nothing new. However, with the meteoric rise in
cryptocurrency trading in the past 2-3 years the opportunity for cyber thieves
and risk to investor has never been greater. Cloud security firm Carbon Black has issued a new threat
report entitled “Cryptocurrency
Gold Rush on the Dark Web“ in which it claims some $1.1b USD in
cryptocurrencies have been illicitly stolen so far this calendar year. Moreover,
Japanese
cryptocurrency exchange Coincheck had
$600m in XEM stolen by
hackers in January 2018. A number which is likely to grow
dramatically over time. The malware needed to commit cryptocurrency theft can be
obtained for a mere $224. Two key questions emerge: First, which components of
the cryptocurrency ecosystem are vulnerable to attack – mining, wallets, exchanges,
etc? And second, which mitigation strategies can the ecosystem in general and
investors in particular, take to reduce risk? For the moment, concrete answers
to these question appear illusive. Nonetheless, the Cryptocurrency Academy will
pursue these issues and keep you informed. Please share a comment and
subscribe today! Lawrence, Cryptocurrency Academy (https://cryptocurrencyacademy.blogspot.com)
Wednesday, May 30, 2018
How will cyber criminals exploit the RCE vulnerability in EOS Blockchain using Smart Contracts?
Colleagues,
Chinese researchers at Qihoo 360
have discovered an RCE (remote
code execution) vulnerability in Blockchain EOS when
using smart contracts. This bug potentially
allows hackers to take complete control over node servers. Commonly referred to as Blockchain 3.0, EOS
is an open source platform smart contracts. The RCE flaw is considered by some
to be a 51% attack.
Bottom line question: How vulnerable are node servers on a Blockchain to the
RCE bug? Specific mitigation methods are rather illusive. However, CSD
recommends your review of “Bug
Characteristics in Blockchain Systems: A Large Scale Empirical Study”
published by the Singapore
Management University. Share your
mitigation recommendations and subscribe today! Lawrence, Cyber Security Defender
(https://cybersecuritydefender.blogspot.com)
Tuesday, May 29, 2018
How Secure is AWS Authentication when using Google’s identity service for user identification?
Colleagues,
Amazon Cognito can provide
authentication, authorization, and user management for AWS users of mobile
apps. This process involves a better
understanding of federated authentication mechanism, a simplified credential
management for teams who already have Google
accounts, Customize authentication mechanisms at very low maintenance costs
while serving as a good alternative to deploying and configuring our own IDP
service Codecentric
recommends a three step process: First, build a simple web service using AWS API Gateway and AWS Lambda. Second,
use AWS IAM is the AWS service for access control. And third, employ using the AWS
Secure Token Service together with Google Sign-In. Given the
significant growth of both Amazon AWS customers who also use Google’s identity
service the critical question is just how secure is this process? Without doubt
both vendors systems are highly secure, however we are less certain about the
security and viability of using the two disparate system in tandem.
Share a comment and subscribe today! Lawrence, Cyber Security Defender
(https://cybersecuritydefender.blogspot.com)
Thursday, May 24, 2018
VPNFilter Router Malware Attack – Is Russia Up to its Common Tactics?
Colleagues,
the US FBI and DHS along with the UK’s National Cyber
Security Center jointly warned that hackers working on behalf of the Russian
government are compromising
large numbers of routers, switches, and other network devices .
Code-named VPNFilter, this malware
has primarily targeted some 500,000 consumer and small business router
worldwide … yet with a geographic focus on the Ukraine. Sound suspicious? It
contains the RC4 encryption
cipher BlackEnergy.
BlackEnergy has been used
in a variety of attacks tied to the Russian government. The type of devices
targeted by this actor are difficult to defend. Most of the impacted routers
are on the perimeter of the network with no IPS and commonly without do not
have an AV package. Read the Cisco Talos
security report by clicking here. So who is behind VPNFilter? CSD supports the
Russian origin theory. What about you? Share a comment and subscribe today!
Lawrence, Cyber Security
Defender (https://cybersecuritydefender.blogspot.com)
Wednesday, May 23, 2018
How Serious is the ZipperDown iOS App Programming Vulnerability?
Colleagues,
China-based jailbreaker Pangu Labs has identified a vulnerability which they project impacts some 9.5%
of the 168k Apple iOS apps may have. The root cause appears to be an app programming error that can lead
to code execution and data overwritten in the affected apps." Some
of the more noteworthy iOS apps impacted include but not limited to QQ Music, MOMO, Weibo, Kwai and NetEase
Music. The ZipperDown web site provides a good FAQ yet is short on mitigation
details. Bottom line: How far reaching are the consequences of ZipperDown? And is there a comparable bug in Android apps?
Details to follow. For now, share a comment and subscribe today! Lawrence, Cyber Security Defender (https://cybersecuritydefender.blogspot.com)
Tuesday, May 22, 2018
RSA Conference’s Cybersecurity Tech Accord – Substance or Delusion?
Colleagues,
during last month’s RSA Conference
34 tech companies including Microsoft, Facebook, HPE, ABB, Arm, Cisco, Nokia, Oracle, and
Trend Micro announced a Cybersecurity Tech Accord (aka Digital
Geneva Convention) pledging to mount a united effort against state-sponsored
cybercrime and warfare. Notable abstentions included Amazon, Alphabet and
Apple. According to Juniper
Research cybersecurity attacks on organizations and commercial
entities is expected to
reach an $8 trillion impact by 2022. The essence of the Accord is a
four-fold commitment to: 1) Share
threats and minimize the potential for malicious code to be introduced into
cyberspace, 2) Protect all customers globally regardless of the motivation of
the attack, 3) Will not help governments launch cyberattacks against innocent
citizens, and 4) Empower users to make effective use of their products with new
security practices and new features. Here at CSD applaud this move …
particularly in light of increased cyber threats from Russia, Iran, North Korea
and non-state bad actors. Bottom line: Will the four-fold commitment of the
Accord be fulfilled in concrete deeds not just words on a signed piece of paper
to appease the public and free-democratic governments? Share a
comment and subscribe today! Lawrence, Cyber Security Defender (https://cybersecuritydefender.blogspot.com)
Monday, May 21, 2018
“Roaming Mantis” – Assessing the Impact of Android Malware on Users
Colleagues, rapid evolution, cryptojacking, global scope, mobility and
DNS hijacking. These are the traits of a Tier 1 malware threat to the 2
billion+ Android-based devices across the world and Roaming Mantis appears to have them all. This voracious malware was first identified in in Japan
during March 2018 when infected routers began redirecting users to compromised
websites. Roaming Mantis
currently supports 27 different languages and has expanded to users on four
continents. This new version contains a script for the popular cryptocurrency
miner Coinhive and the capability to target iOS devices in addition to
Android devices. What are
the most effective mitigation techniques? Security
Affairs focuses on mitigation beginning with securing routers, using up-to-date
firmware, enforcing strong passwords for admin access and disabling remote
access to the administration interfaces on the routers. This attack targets DNS
services running on routers. A DNS service running on a server inside your
network is not at risk to this attack. And only install software from trusted
app stores such as Google Play and the Apple App Store. We also recommend the SecureList’s
APT Mitigation in-depth checklist. Comment
and subscribe
today! Lawrence, Cyber
Security Defender (https://cybersecuritydefender.blogspot.com)
Subscribe to:
Posts (Atom)