Issue 51 - Week of Feb 8th

1.       IRS defeats 'automated attack' against tax e-filing systems: e-Taxpayers are given a five-digit e-filing code, used to authenticate the user when filing taxes. Hackers used an automated Bot to generate these codes with 464,000 stolen Social Security Numbers. The codes would have given them access to lot of information about those tax payers. Though the bot successfully generated e-filing codes for over 101,000 Social Security numbers, No taxpayer data was compromised or disclosed by IRS systems The tax agency wasn't so lucky last year when it was hit by a data breach, in which hackers pilfered tax information of more than 100,000 Americans.

2.       US Govt. looking for CISO: After a series of high-profile attacks against US government departments, agencies, and systems - President Barack Obama announced a $5 billion hike in cybersecurity spending, taking the total funding to $19 billion, in an effort to make cyber-defenses and protections a top priority. The Obama administration also set out to hire its first chief information security officer to take on federal responsibility for cybersecurity policy and strategy.

3.       Cops arrest teen for hack and leak of Dept. of Homeland Security (DHS), FBI data: A 16-year-old boy living in England has been arrested in connection with the recent hack of FBI and DHS data, as well as the personal email accounts of CIA director. The boy stole and leaked the names, titles and contact information for 20,000 FBI employees and 9,000 DHS employees. This was possible through a compromised Department of Justice email. The teen is suspected of being the leader of a group of hackers who call themselves “Crackas with Attitude” or CWA.

4.       Ukraine railway, mining company attacked with BlackEnergy malware: Weeks after the malware played a role in 'first known hacker-caused power outage' in Ukraine, BlackEnergy and its cohort KillDisk were used in attacks on mining and rail transportation firms as well. BlackEnergy has been floating around since 2011 and was originally used to collect information from industrial control systems. The US ICS-CERT issued a new YARA signature for detecting BlackEnergy. Everything that relies on an industrial control system, whether it be an oil and gas facility, a pipeline, a ship or a power generator could be compromised by this malware.

5.       Poseidon cybercriminals - first hack, then blackmail to sign contract: Poseidon launches spear phishing campaigns specifically tailored for victim companies, and they may include job applications with resumes for specific posts sent to HR. The phishing emails contain malicious RTF or DOC files. If the attachment is opened, the malware connects to the attacker's command and control (C&C) center and launches IGT malware (also called 'treasure stealer'). IGT now knows the apps, commands and vulnerabilities that can exploit this network. Armed with this data, they approach the victim and force them to sign Poseidon as their 'security consultants'. If a company refuses to hire them - they leak all stolen information. There are 35 Enterprise players across the US, France, Kazakhstan, UAE, India and Russia that have become targets, although Poseidon heavily leans upon businesses within Brazil.

6.       AlienSpy RAT strikes over 400,000 victims worldwide: Also known as Adwind, this malware is a Remote Access Tool (RAT) based on Java which is distributed using a malware-as-a-service platform. Hackers rent this platform and begin by sending the payload via Phishing campaigns.  If a victim opens the email attachment, the malware installs itself on the PC and attempts to communicate with the operator's command and control (C&C) server for additional instructions. The malware is able to collect keystrokes, steal cached passwords and data submitted through Web forms, take screenshots and pictures, as well as record video and sound. Half of the RAT's victims were based in the UAE, Germany, India, US, Italy, Russia, Vietnam, Hong Kong, Turkey and Taiwan. It is believed that subscriptions to the MaaS platform generate an annual income of approximately $200,000.

7.       Valentine's Day Inspires DDoS Attacks Against Online Florists: Several online florists experienced a surge in their traffic during the week leading to Valentine's day. Contrary to what some might expect, the traffic did not appear to be opportunistic in nature. Rather, it looked as if the florists were being individually targeted in denial-of-service campaigns apparently designed to extort money from them. The sudden spike in malicious traffic directed at online florists reflects a common tendency among cyber crooks to escalate malware campaigns and attacks around seasonal events and major news happenings.

8.       IoT Could Be Used by Spies, U.S. Intelligence Chief Says: Billions of new systems, devices and sensors connecting each year - widens the attack surface for hackers. Add to this, lack of security in many of these connected devices and their growing popularity in homes and businesses, makes the issue very concerning. But it's not all bad news, especially for spies: while these badly-designed devices will undermine security, the flip-side of that means ‘new opportunities for spies to collect intelligence’. It's not hard to think of scenarios where poorly secured devices in the home, from toys with built-in webcams to home automation systems, could be hacked into and used by intelligence agencies to gather all sorts of information.

9.       Pakistani man admits to massive telephone hacking scheme: Last week, A Pakistani man admitted to his role in a massive hacking scheme, in which he broke into various companies EPABX, found unused numbers and directed them to dial into premium telephone lines controlled by his criminal organization. AT&T paid the phony companies set up by the criminal group for the phone calls and collected the costs from the businesses that got hacked. The man also admitted to laundering $19.6 Million, the money ill-earned through this telecom fraud scam.

10.   Metel APT hacking group rolls back ATM transactions to dupe banks: Metel targets financial institutions through APT-style spying missions and custom malware. It's new tactic- is to gain control over bank machines which have access to transactions - such as support center PCs. Once this is done, the hackers legally withdraw money from the ATM of different Bank. After the cash is drawn, the hackers using their access to support center PCs - cancel the transaction and that rolls back the money drawn, back to the account. Now the hacker goes to another bank's ATM and draws money using the same card which is then  followed by rolling back the transaction. This is repeated several times during one night or on a holiday, the victim bank can only figure this out the next day.

Issue 50 - Week of Feb 1st

1.       Online 'Batman' Takes On Dridex Trojan: Someone appears to have disrupted at least part of the channel that distributes the malware and replaced the malicious links with installers for a free antivirus tool (Avira) instead. So users who click on malicious links get Avira’s antivirus tool instead of the banking Trojan. The hacker who has discovered how to do a good thing but perhaps with not strictly legal methods - is being dubbed as the Online Batman. Dridex has caused considerable damage and has so far resisted Govt. efforts to take it down.

2.       Linux.Wifatch - White hat virus that helps:  A new virus called Linux.Wifatch has been spotted that instead of hijacking the  internet routers and IoT devices for criminal purposes, is improving their security. Most often these devices have poor security and top of that -people use default settings and default admin password. The Virus tends to address these issues - It closes the telnet protocol so that nothing else can get in, it leaves a message asking the router's administrator to change the password on the router's firmware, and the goes hunting in the router for any other malware it can kill off. However it still is a virus and one cannot be really sure of its long term intentions.

3.       US Homeland security’s $6B Firewall has many frightening blind spots: A recent audit revealed the US Cybersecurity Protection System—aka EINSTEIN—does not scan for 94% of threats and doesn't monitor web traffic. The system is signature-based and can detect only known patterns of malicious traffic. It is also limited in regards to detecting advanced persistent threats (APTs) and Zero day attacks. In terms of known vulnerabilities in common applications - it was able to identify only 29 of the 489 known  vulnerabilities. Information sharing is another goal of EINSTEIN which is also in need of attention as 1 in every 4 notifications are not received by agencies who use the Firewall.

4.       Login duplication allows 20m Alibaba accounts to be attacked: To begin with - Hackers obtained a database of 99 million usernames and passwords from a number of websites in China. They then tried out these credentials on Alibaba and were able to access 20.59 million accounts. The hackers used compromised accounts to place fake orders, a practice known as "brushing" in China and used to raise sellers' rankings. The hackers also sold these accounts to fraudsters. Hackers have exploited the human tendency to frequently use the same set of credentials for all applications and websites, it probably helps to remember at least 2 credentials - one for sensitive apps/Websites and other one for rest.

5.       PGP co-founder says Ad companies are the biggest privacy problem today, not governments: The big tech companies today- Apple, Facebook, Google, and Microsoft,  have more data on you than anyone or anything else out there. Apple and Microsoft use the data to make their products better and their revenue primarily depends on selling these products to us. On the other hand, Facebook and Google are ‘free to use’ and advertising revenue is what keeps it that way. For better ads - they collect data like browsing habits, search results, and other demographic data (such as your age, location, and education). Many find the ads intrusive and don't like being tracked.

6.       Mattel's Smart Toy Bear & HereO watches - patch vulnerabilities: The Wi-Fi-enabled stuffed animal, was vulnerable to a remote flaw. An attacker could trick the web service (API) to send requests that shouldn't be authorized. From there, an attacker could allow easily access children's profiles (reminds of Vtech hack). The attacker could also force the toy to perform actions that the child user didn't intend, interfering with normal operation of the device. A similar flaw affecting HereO, a smart GPS watch designed for children, allows a hacker to trick a family's group into accepting a request to join their group and be able to access every family member's location and location history. Both these companies were receptive to these findings and have since fixed these vulnerabilities.

7.       Apple Phone's 'Error 53' - its security v/s convenience: When those iphone6 users who had their ‘home button replaced by non-Apple technicians’ were trying to update their iOS, their expensive phones got bricked. It becomes permanently unusable and can be at best used as a brick. Many customers were furious and felt Apple was arrogant enough to do this. Apple has hit back at criticism, claiming it is part of measures to protect customers’ security. When iOS finds a mismatch in hardware, Touch ID including Apple Pay use, is disabled. If a customer encounters Error 53 or any other issues it is better to contact Apple Support. Maybe Apple should have informed users about this feature before the OS update.

8.      Hack Hall of Shame – January 2016:

a.       A new hacktivist group called New World hacking emerges - BBC, Trump web attacks "just the start," says hacktivist group.

b.      Anonymous keep themselves busy - They hack Saudi Arabian government websites, Thai police sites, Nigerian government websites & Nissan websites.

c.       Scathing report shows Microsoft failed to warn the Chinese Govt. hack on thousands of Hotmail accounts of China’s Tibetan & Uighur minorities.

d.      Britain’s Opposition Leader had his Twitter account hacked.

e.      Tech support scam points to Dell breach

f.        US Spy Chief pranked by teen hackers

g.       Hyatt names hotels hit by malware

h.      LastPass susceptible to phishing attack

i.         Melbourne hospital’s computer system is taken down by virus

j.        Java bug also found in PayPal

9.       Hackers are sending social-engineering emails to SMBs in India to steal money: Hackers begin by either stealing somebody’s email account or spoofing - to send emails to Finance dept. of targeted companies. These emails either contains a link to some malicious site or a malicious attachment. The subject line and body of the email are designed to LURE these employees to open the link / attachment. Once they do so, their machine gets compromised and from there on the hacker has full control on the machine. The hackers objective is to steal money. They use their access to the machine to observe the user and trick them to transfer money. There have been instances where the hackers would change the bank details for remittances etc. ONGC is classic Business Email Compromise (BEC) example.

10.   Deceptive-site-ahead; Google will warn legit sites carrying Malvertising: Google is casting a wider net with its Safe Browsing technology to protect Chrome users, not just from deceptive websites but also from deceptive ads on legitimate sites. Google notes the new Safe Browsing feature may have an impact on legitimate websites that display deceptive ads. The warning Google posts in its blog demonstrates that its alerts will indicate that the site itself is deceptive.

Issue 49 - Week of Jan 25th

1.       Wendy's investigates possible data breach: Wendy's is an American international fast food restaurant chain, like McDonald and Burger King. Last week, Wendy's confirmed in a statement that they have launched a comprehensive investigation - after learning of reports that fraudulent charges may have occurred elsewhere after payment cards were legitimately used at some of its restaurants. Target data breach -probably tops the PoS hacks; P.F. Chang's and Dairy Queen are other recent victims in the food business. EMV cards (Chip and PIN Credit card), contact-less credit cards with NFC (Near Field Communication) and RFID technology which do not require swiping of card  - lower the chances of data leakage.

2.       Another Angler exploit kit victim: Last issue we discussed Officeholiday[.]com, on similar lines - a famous European transport company's website was hacked and visitors were silently redirected to Angler EK, which then exploited the latest known vulnerabilities in Adobe Flash Player to downloaded and execute CryptoWall 4.0 ransomware. Angler EK continues to be one of the biggest threats, it tends to exploit newest vulnerabilities in Adobe Flash Player and uses high profile websites. It is important to keep up to date with software updates, especially for Adobe Flash Player which is often the weapon of choice for malware actors when it comes to finding vulnerabilities.

3.       Bumper week for Ransomware: Apart from the above transport company, other big victims of Ransomware last week were - Israeli Electric Authority & Lincolnshire County Council (in UK). It also surfaced that hackers are now using fake salesforce notifications to LURE users to click links or download malicious attachments leading to ransomware. Android ransomware - Lockdroid was in news, New ransomware detected called 7ev3n, which demands 13 bitcoins which is a deviation from the usual demand of 1 bitcoin.

4.       Hackers launch cyberattack against cPanel systems: cPanel, is a Texas based company that offers Web hosting platform management tool and is used by millions. Last week, the company said in a statement that one of the cPanel customer databases "may" have been breached. cPanel was able to "interrupt" the breach, and so it is not known whether customer data was exposed. The database included names, contact information and passwords. However, luckily for users, the passwords were encrypted and salted, which makes it difficult for cyberattackers to crack and elicit this account data. All users of this service are advised to change their passwords.

5.       Critical Open SSL bug patched: OpenSSL is an open-source library that is the most widely used in applications and Websites for secure data transfers using SSL or TLS encryption. However, after serious security vulnerabilities were discovered in OpenSSL over the last few years, the crypto library has been under much investigation by security researchers. The OpenSSL Foundation has released the promised patch for a high severity vulnerability in its cryptographic code library that let attackers obtain the key to decrypt HTTPS & TLS based communications. The latest bugs affect OpenSSL versions 1.0.1 and 1.0.2, which has been patched in new releases of OpenSSL, versions 1.0.1r and 1.0.2f.

6.       Lenovo used third 'worst password' in file-sharing backdoor flaw: Recall the image that we used in Issue 48, '12345678' is the third worst password and Lenovo has hardcoded that to its  file sharing software SHAREit that could be exploited by anyone who can guess this password. Researchers have disclosed four vulnerabilities in Lenovo ShareIT, the worst of which is – ‘Lenovo ShareIt for Windows’, which when configured to receive files, a Wi-Fi HotSpot is set with the hardcoded password, any system with a Wi-Fi Network card could connect to that Hotspot by using '12345678' as password. The vulnerabilities were discovered and privately disclosed to Lenovo in Oct’15 and have been patched last week.

7.       Critical Flaws in Magento leave Millions of E-Commerce Sites at Risk: If you are using Magento to run your e-commerce website, it's time for you to update it now. Millions of online merchants are at risk of hijacking attacks due to a number of critical cross-site scripting (XSS) vulnerabilities in the Magento. Virtually all versions of Magento Community and Enterprise Edition, are vulnerable to the Stored Cross-Site Scripting (XSS) flaws. The flaws are awful as they allow attackers to take over the site, Escalate user privileges, Siphon customers’ data and Steal credit card information. However, the good news is that the vulnerabilities are patched, and an update has been made available to the public after a security firm discovered and privately reported the vulnerability to the company.

8.       Dridex Trojan targets UK banks, avoids two factor authentication checks: The latest version of Dridex was first detected this month, it is believed to be responsible for stealing up to £20 million from UK accounts. Dridex spreads through email phishing campaigns and includes features such as the ability to spy on victim PCs, with the overall aim of stealing credentials which can be used to access bank accounts and cash reserves. When the victim tries to access any banks, the Trojan will redirect the user to a fake replica and harvest credentials including the 2FA codes.

9.       FinFisher spyware linked to Indonesian government found in Sydney: This spyware is capable of remotely controlling any computer it infects, copy files, intercept Skype calls, and log keystrokes. The sophisticated spyware suite is usually sold to government agencies. Last week, an instance of this belonging to the Indonesian government was found in Australian Datacenter. That would mean -Information from users infected by an Indonesian department was going through Australia. In 2013, the Australian government was accused of spying on Indonesia thanks to the documents leaked by Edward Snowden. Now, it looks like the Indonesians are taking revenge from the kangaroos.

10.   If your SIM stops working, check your bank account: A tech entrepreneur in Bangalore has joined the long list of victims of phishing. Criminals procured a duplicate SIM card of the victim and siphoned off ₹ 45 lakh (≈$70k) between January 13 and January 18. A few days after his mobile phone stopped functioning, he went to the Reliance store to enquire about the reason. He was informed about the issue of a duplicate SIM card. Criminals procured a duplicate SIM card from a Reliance store at Jayanagar by producing a copy of his Aadhaar card. This new SIM card was used to siphon the money.  Service providers should be more careful in issuing duplicate SIMs, maybe they should call the number once or have some other sensible checks.

Issue 48 - Week of Jan 18th

1.       Cyber-scammers steal $54 million from Austrian Airplane manufacturer: Last week, FACC announced that its finance department had become a victim to cyber-crime executed from outside of the company in which it roughly lost $54 million. According to experts, the incident is a classic CEO Fraud incident, also known as Business Email Compromise (BEC), in which, attackers send emails to company employees or CEOs, posing as other employees or partners, asking for urgent money transfers. If staff members don't double-check big money transfers via telephone calls, fraudsters can trick employees into sending large amounts of cash to accounts under their control.

2.       Linux malware: Malware researchers have identified a new Trojan (Linux.BackDoor.Xunpes.1) for Linux devices  that takes screenshots and logs keystrokes. The malware runs a package creating a backdoor that establishes an encrypted connection to a remote server that executes several commands, including ones for taking screenshots and logging keystrokes, and then re-transmits the resulting data. Last week another Linux malware was also detected (Linux.Ekoms.1). This takes screenshots every 30 seconds and sends them to a remote server. Nov’15 - thousands of sites infected with Linux encryption ransomware were detected.

3.       Public Holidays Website Leads to RIG EK & Drive-by Download of Qakbot Malware: Researchers have found evidence that a famous 'public holiday' website called Officeholiday[.]com was hacked last week and visitors to this site were silently redirected to an exploit kit called RIG. This kit attempts to find and exploit vulnerabilities in Adobe Flash Player on the system in order to download the Qakbot malware. Qakbot is capable of stealing passwords, certificates, cookies & browser traffic. The malware was also in news last week after it downed Melbourne Health's systems.

4.       Angler exploit kit & CryptoWall 4.0 ransomware update: We discussed this combo in issue 41, since then, Angler has become one of the largest exploit kit found in the market and has been making news for its ransomware campaigns. It is estimated that Angler now infects 90,000 victims a day and generates more than $60M annually. Several servers running these campaigns have been identified and details published, it is believed that this will dent Angler income by 50%.

5.       TeslaCrypt 2.0 cracked, victims need not pay ransom: The flaw leveraged by researchers to crack the ransomware - is not in the encryption algorithm itself, but rather how encryption keys are stashed on a victim's PC. Given today computing capabilities, researchers were able to build tools that could retrieve the keys and decrypt the machines without having to pay any ransom. Unfortunately, the latest 3.0 version of the malware has patched the design flaw.

6.       Kovter Actors Now Turning Machines Into Zombies: Kovter is one of the oldest malware strains around, one that has adapted to fit various needs and niches, and survived mainly as a click-fraud toolkit, ideal for making a quick buck out of online ads. The malware is distributed using malicious emails with ZIP attachments and subject lines like ‘Notice to Appear in Court’ or 'You have received a new fax'. When opened, these ZIP files automatically execute a JavaScript file which connects to a Web server and downloads the Kovter malware, which could then either - run a proxy or a bot on the machine to create ad impressions that are seen by no one but often get charged to marketers as a viewed promotion. It is estimated that bots will inflict $7.2 billion in damages to digital advertisers in the coming year.

7.       Ad blockers - Google reveals it now has over 1,000 staff just fighting bad ads: Google says last year it eliminated 780 million "plain bad" ads carrying malware, promoting fake goods or leading to phishing sites. Malvertising has become a popular mechanism for distributing malware, it harms internet users and threatens the multi-billion dollar ad industry. Google developed a similar humans and machine strategy for combating bad apps on Google Play, last year hiring its first human reviewers to help identify apps that violate its store policies.

8.       AMX fixes backdoor vulnerability 10 months on: AMX, owned by HARMAN International, is a manufacturer of video switching and control devices. Way back in March last year it was discovered that an administrative account with hardcoded credentials was added to an internal user database that can be used to access SSH and its web interface. This "Black Widow" account was deliberately hidden and had additional features like- ‘packet capture’ on the network interface which not even an administrator account could perform. The company claims they have released firmware updates for the affected products, while denying the account was deliberately hidden. AMX's client portfolio includes The White House, Fortune 100 companies and various other departments. Juniper and Fortinet have had similar issues.

9.       'Asacub' Trojan converted to mobile banking weapon: This Trojan has been around since last June and was originally used for stealing browser histories, contact lists, and other data from infected mobiles- including incoming SMS messages. Last week it was found that the new versions of the Trojan contained phishing screens with the logos of major European banks - designed to steal credentials. It also had additional capabilities like tracking and sending current location data, and taking a snapshot using the device camera. Other Mobile malware discovered recently include - Bankosy, Faketoken (Steals OTP) & SlemBunk, Marcher (steals credentials using rigged lookalike apps).

Phishing attack could steal LastPass password manager details: LastPass stores user’s passwords in the cloud in an encrypted protected vault. A security researcher has released a tool (calling it LostPass) that can steal the login details and two-factor authentication key. The attack relies on a user visiting a malicious website, it will detect if the browser is using LastPass, mimic a LastPass notification, remotely log-out the user and request the password and two-factor authentication key. The hacker would then be able to gain full access to every password stored in a LastPass user’s vault. The company has responded and a primary change was made - LastPass now requires all users to perform the email verification step, which  will significantly mitigate a LostPass-type attack.

Issue 47 - Week of Jan 11th

1.       Hyatt Hack: In Issue 45, we spoke about Hyatt hack. More details emerged last week. According to Hyatt, 318 hotels out of 627 in the firm's portfolio were infected last year. Hyatt has published the list of properties that were compromised across 54 countries - China, India and the United States are at the top of the list for malware-ridden hotel systems, with 22, 20 and 99 infected sites respectively.  The malware stole financial data including cardholder names, card numbers, expiration dates as they passed through Hyatt's infected payment processing systems. Hyatt Regency Lost Pines, also figures in the list and had suffered infection from Aug to Dec 2015.

2.       US intelligence chief's personal email, phone hacked: The hacker that targeted a CIA director last year is back to claim another senior government scalp: the Director of National Intelligence. Hackers claim to have broken into a series of accounts associated with Director, including his personal email account. The FBI warned last year that US police and officials were targets of hacktivist groups, and should in particular "be aware of their online presence and exposure."

3.       Suspected members of Bitcoin extortion group DD4BC arrested: DD4BC -- otherwise known as Distributed denial-of-service for Bitcoin -- is a group dedicated to extorting virtual currency from companies. Emerging in the middle of 2014, DD4BC used the threat of DDoS attacks and held companies to ransom unless they agreed to pay a fee in Bitcoin. For organizations such as banks, financial institutions and even gambling websites, network downtime is equated with an immediate loss of revenue, which can lead them to give in to demands. European law enforcement has arrested and detained two alleged members of a hacking group.

4.       Windows users face a dangerous world with end of support for older Internet Explorer versions: Microsoft ends support of Windows 7, 8 and IE 8,9,10. The tens of millions of IE users, will be at risk almost immediately, considering nearly every month IE remains one of the most likely target of hackers and attackers. IE 11 would be the last version of the aging browser, which first debuted in 1995. The browser has long been known for its security flaws and issues, which have bogged both Microsoft and its users down for years. When Windows 10 was released, the company began pushing its new Edge browser more aggressively as an alternative. The browser was heralded as being safer than its predecessor as it prevents adware and toolbars from hijacking dynamic link libraries.

5.       Serious security flaw in OpenSSH puts private keys at risk: A major vulnerability has been found and fixed in OpenSSH, an open-source remote connectivity tool using the Secure Shell protocol. The flaw was the result of an "experimental" feature that allows users to resume connections. The malicious server can trick an affected client to leak client memory, including a client's private user keys. The software is used on many commercial routers and firewalls, some versions of Ubuntu & Red Hat  operating system are affected by the flaw. Developers and admins are advised to regenerate and rotate keys, the Bottom line is - Patch now, and patch fast.

6.       Simple eBay security flaw exposed millions of users to spear phishing campaigns: EBay has patched a severe XSS security vulnerability which exposed potentially millions of users to phishing campaigns and subsequent data theft. Despite being informed of the bug privately, the online auction trading site allegedly left a critical XSS flaw open to abuse on the ebay.com domain, and only rallied to fix the issue after the media caught wind of the flaw. The Cross-Site Scripting (XSS) vulnerability, implemented through Java, allowed an attacker to inject their own malicious page within eBay via an iframe.

7.       Brazilian cyber-crime flourishes, catching up to Russian, Chinese groups: For years Brazilian operators used to be customers of Russian hackers but now they have started using their own homegrown tools. In terms of technical expertise - they seem to have caught up and they are now placed just behind Russia and China. Like the Russians, they focus on financial institutions but unlike the Russians or Chinese they do not have a relationship with their govt. While the basic skills in each country are the same, there are regional differences - Japan's hackers are focused on forging documents, Germany's underground is strong in encryption, the U.S. underground focuses on illicit goods, and while Russia and China are known for their espionage attacks against U.S. systems and focus on financial crimes and the creation of criminal tools.

8.       Juniper Networks moves to replace vulnerable code: At the end of 2015, Juniper Networks publicly disclosed that it had found previously unknown backdoor code on some of its firewalls. Juniper patched the issues and is now going a step further by replacing a core cryptography component in its ScreenOS operating system to further reduce any potential risk. Last week, a security researcher discovered a highly suspicious code in Fortinet's FortiOS. A SSH backdoor with a hardcoded password (now leaked) that can be used to access the firewall. A fact to be noted is anyone using this backdoor account doesn't appear in the device's access logs, as the backdoor might be tied to its FortiManager maintenance platform.

9.       Hack WiFi password from smart doorbells: The buzz around Internet of Things (IoT) is rapidly growing. Another household device to join the IoT world is a Smart Doorbell. With these Internet-connected Smart Doorbells, one can get an alert on the smartphone app every time a visitor presses the doorbell and also view who's in front of the door. Security researchers have discovered a critical security hole in  Wi-Fi-enabled video doorbell that could be used to expose the home network password. Hackers can access a button behind the doorbell to slip the device in setup mode and access the password in the config file using their mobile's wifi.

10.   Indian Banks & Big industry targeted in Ransomware racket demanding Bitcoin: Three banks and a pharmaceutical company in India have been revealed as targets of a ransomware that saw a ransom demand in bitcoin. In what is now the first known instance of an online extortionist demanding ransom in bitcoins from Indian targets, the Economic Times has revealed that hackers disrupted operations by crippling computers at three banks and a pharma company. In all four cases, the hackers are said to have used the Lechiffre ransomware. Having encrypted all files, the hackers demanded one bitcoin each (about Rs 30,000 at current prices) per computer for a total running into millions of dollars.

Issue 46 - Week of Jan 4th

1.       Time Warner Cable says 320,000 customers may have been breached: The company said there are ‘no indications’ its systems were breached, but pointed the finger at third-party firms that may have stored customer information. The company also said that email addresses and passwords may have been taken in the breach. Affected customers have been notified by email and direct mail. The company did not say if the breach was connected to a similar attack against Comcast, which led to 200,000 accounts being reset in November.

2.       Fake Tech Support scams evolve to include support, purchase history: The fake tech support scam is more than a decade old but it has now become more vicious, with  scammers having access to purchase history of the victims and other records that make them look authentic. There have been several cases reported wherein people have been getting calls from fake DELL tech support or R&D department and these scammers are able to share details that, it would seem, only Dell or perhaps its contractors would know. Once they gain trust, they remotely install malware and in some cases they have installed ransomware and tried to extract a lot of money.

3.       Former director of Basketball team (St. Louis Cardinals), pleads guilty to Cyber-Espionage charges: When an employee with the basketball team (Cardinals) quit to join a competing team (Houston Astros), he had to hand over his official laptop and password. Using a variation of this password the director accessed the employee's Astros email account and other details. He was charged with five counts of unauthorized access of a protected computer. Each conviction carries a maximum possible sentence of five years in federal prison and a possible $250,000 fine. Sentencing is set for April 11.

4.       New technique permits Trojan to be delivered via a .JPG file: Last week researchers noticed a Spam email that contained a Macro file which downloaded a Kangaroo image from C&C site. The image had the Ursnif malware appended to it, which is known to steal credentials and banking information. Hackers are always looking for new ways to fool victims and trick researchers and investigators. Their motivation is your money and they will use any means necessary to obtain user credentials and banking information. It is important to be aware of suspicious e-mails that you receive and to never open anything that you are unsure about.

5.       BBC, Trump web attacks "just the start," says hacktivist group: 'New World Hacking' has claimed responsibility for downing BBC and Trump's campaign website last week using DDoS attacks. One of the members of the group, told that the attacks were a "test of power" and server strength and their main target was ISIS. The hacktivist said the group is compiling a list of Islamic State-related targets and plans to release the list this week. Prior to these attacks, the group was involved in a number of activities, including unmasking members of the Ku Klux Klan. The group also said it was involved in the hacking of a major US retailer.

6.       Japanese Banks Targeted With New Rovnix Trojan: Researchers have begun to detect Rovnix attacks in Japan as well, hitherto a European malware. The hack begins with an email message containing the Rovnix downloader as an attachment. Recipients who click on the attachment -typically disguised as a package delivery waybill from an international transport company -end up downloading the malware. It uses a Web injection mechanism that is capable of perfectly imitating a targeted bank’s Web pages. Later, when the victim goes to a bank online - the malware will serve a page that looks and feels exactly like the bank’s actual site and steal credentials. In some cases it tries to get victims to download a malicious Android app on their smartphone so it can intercept authorization codes send via SMS by the bank.

7.       Apple, Google, Microsoft attack UK government hacking plans: Few provisions in the draft Investigatory Powers Bill would allow the intelligence and security services, police and the armed forces to hack into devices to obtain data, such as communications, when they have a warrant to do so. While the Govt. argues that these are required to intercept encrypted communications of Criminals, the tech companies have warned that the plan would be in the wrong direction which will set a dangerous precedent that would be followed by other countries and will damage trust in their services.

8.       Cloud host Linode resets user passwords after suspected hack: The company said that it found two Linode user credentials on an 'external machine', implying that usernames and passwords could have been read from its database, either offline or online. This statement came last week, after a massive distributed denial-of-service (DDoS) attack was launched  against its systems - by a 'bad actor' who purchased a large amount of botnet capacity in an attempt to significantly damage company’s business. In 2012, the accounts of eight Linode customers that held bitcoin electronic currency were compromised and roughly 40,000 bitcoins were stolen. In 2013, Linode’s web servers were accessed and the company had reset all account passwords.

9.       Social media survey results: 9% of users weren't aware that people outside their friends list could be seeing their posts on Facebook, leaving them vulnerable to identity theft and other security related concerns. This has nothing to do with Facebook or its security, but merely the ignorance of the users. There are several privacy related options on Facebook that allows users to hide their posts from those who aren't on their friends list. If you were one among the 9% mentioned above, make sure you make the changes accordingly. It is also advised to be cautious about whom you befriend and trust on in social media and never click on a link that you are not expecting.

10.   Indian hackers attack Pakistani websites as a tribute to Lt Col Niranjan Kumar: As a tribute to Pathankot terror attack martyr, National Security Guard (NSG) officer Lieutenant Colonel Niranjan Kumar, a group of Indian hackers have attacked a host of Pakistani websites last week. The Indian Black Hats hacker group has attacked more than six websites, and it is being dedicated to the officer's two-year-old daughter. However, the hackers haven't deleted the contents of the websites as it is not a cyber-war and their intention is only to give Pakistan a warning. The group had defaced Pakistani websites during seventh anniversary of 26/11 Mumbai attacks.

Issue 45 - Week of Dec 28th

1.       In TalkTalk aftermath: After Target, Home Depot, JPMC were breached their stocks showed no noticeable impact, but when UK telecom giant TalkTalk joined the breach victim club in Oct'15, its stock took a jaw-dropping beating, and it hasn't recovered. A lot of people are wondering "why"? Was something different about talk Talk’s break-in, or are we now entering the era where cyber-attacks can damage more than a company's reputation. In the past there have been few examples like Heartland Payment Systems & Global Payment Systems, whose stock value eroded post cyber-attacks but in general, Shareholders don't have good metrics, tools, and approaches to measure the impact of cyber-attacks on businesses and hence it does not translate into a dollar value erosion.

2.       191 Million US Voters' Personal Info Exposed by Misconfigured Database: The database includes voters' full names, their home addresses, unique voter IDs, date of births and phone numbers. The database was discovered by a white hat hacker, fortunately, the database doesn't contain Social Security Numbers, driver license numbers, or any financial data, but it's still a massive amount of data when it comes to protecting users privacy and security. The crazy part of the data breach is no one is taking responsibility for the exposed database.

3.       Steam confirms DoS revealed user details: Gaming platform Steam has confirmed that a denial-of-service (DoS) attack took place on Christmas Day, has caused around 34,000 users to have their sensitive personal information returned and possibly seen by other users. The company is working on identifying affected users. Earlier in Dec'15, it was admitted that up to 77,000 accounts each month are hijacked on Steam, with users having their digital items stolen and sold, resulting in the company implementing increased security such as implementing two-factor authentication, Mobile Authenticator, self-locking features, and user notifications of any risk.

4.       BBC says website knocked down due to apparent DDoS attack: Service was out for more than three hours last week. Users received an error message and the broadcaster said on Twitter the outage was due to technical problems. BBC later apologized for the outage. A news story posted on the website said it had been due to a "distributed denial of service" attack in which a website is swamped with more traffic than it can handle. This is a relatively common way to target a website and temporarily make it inaccessible.

5.       Hyatt Hotels Reports Data Breach: Hyatt Hotels has announced a data breach affecting its customers' financial data, which at a later investigation proved to originate from a malware infection on its PoS systems. Hotel representatives did not specify what brands were affected, what hotel properties, and what kind of data was stolen. It is yet unknown if the malware infection was found on the hotels' own reservation system PoS, or on the payment processing system used by gift shops and restaurants located on the hotels' premises. In the past, data breaches have been reported by the Trump Hotel Collection, Starwood Hotels, and Hilton Hotels.

6.       Convenience meets continuing complexities: The Internet Of Things will help (and hurt) us all. The websites, apps and electronic devices that comprise the Internet of Things (IoT), make navigating personal and business tasks more convenient than ever, but their popularity also means a wider attack surface, expanse of data and range of vulnerabilities for threat actors to exploit. Industries, such as healthcare and manufacturing , that utilize a large number of connected devices and networked systems in the course of their everyday business are likely to face a wider range of security vulnerabilities and threats.

7.       Microsoft has pledged to inform users if their online communications (Outlook.com email and OneDrive) are being targeted and monitored by government entities: MS is the latest to follow the foot-steps of Facebook, Twitter, Google and more recently Yahoo to warn its users of state attacks. Experts’ advice the additional ways to keep personal data and accounts safe, is by not opening suspicious emails and clicking on links or downloading attachments. The links in the fraudulent emails will REDIRECT the users to malicious websites and attachments will deliver malware payloads, both of these can steal user credentials as well as compromise their systems.

8.       Tor Project launches bug bounty program: Anonymizing network Tor has secured the help of sponsors to launch a bug bounty network designed to stamp out vulnerabilities which may risk user privacy. The Tor Project is a non-profit organization which operates the Onion network, a relay-and-node system designed to make user tracking online very difficult. However no system is completely full-proof and there have been reports of Tor users being identified. There are several Govt. and people that are interested cracking Tor, for eg: A Cybersecurity firm offers up to $30,000 for previously unreported zero-day vulnerabilities impacting the Tor network.

9.       Indian Financial services continue to face high number of cyber threats: The scale and size of cyber-attacks on BFSI is the highest among all verticals. The technological changes such as mobile banking, mobile wallets, payment gateways have increased the potential attack vectors. Hackers continue to steal credentials and other sensitive information thru Phishing emails and Phishing websites, DDoS attacks are not infrequent, Internal threats are becoming serious. The solution for BFSI is comprehensive investment in PPT (People Process and Technology).

10.   Everything about you is already known (most probably): Increasing frequency of data breaches, such as the many seen in 2015 (780 breaches), are changing the way we think about PII - Personally Identifiable Information (177 million data records exposed in 2015). We are, in fact, moving to a “post-privacy” society, where it is not uncommon for an attacker to have access to information that we have previously considered as personal. Data Theft Prevention and post breach activities will become increasingly important though it will be hard to be fully prepared for such an unknown. Defenders must take careful stock of their data handling processes, be nimble in this changing technology landscape and invest in (re)training key personnel.