Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label Network. Show all posts
TOR
anonymization Browser Cyber Security Darknet Encryption Network Online Privacy Security servers TOR

Exploring the Tor Network: A Comprehensive Look at Online Anonymity and Privacy

 

The Tor network, originally developed in the early 2000s by the U.S. Naval Research Laboratory, has been operated since 2006 by the independent non-profit organization, The Tor Project. The project's primary goal is to offer a free method for anonymizing internet traffic. Approximately 85% of The Tor Project’s funding comes from U.S. government entities, while the remaining 15% is sourced from private donations and NGOs.

Tor, which stands for "The Onion Router," functions by routing a user's connection through three randomly selected servers (nodes), layering encryption like the layers of an onion. The destination site only detects the IP address of the final node, called the exit server, masking the user's original address. The system refreshes the connection route every 10 minutes, though the access node remains stable for two to three months.

Data transferred within the Tor network is encrypted until it reaches the exit server. However, users must still encrypt any sensitive information entered on websites, as data exiting the network can be read if it's not further encrypted. To access Tor, users need a specialized browser—like the Tor browser, based on Mozilla Firefox and configured for secure browsing.

With about 6,500 servers currently active worldwide, individuals, companies, and organizations operate these nodes. Any internet user with a DSL connection can set up a Tor node. However, the network's openness can be a vulnerability; if an exit node operator is not vigilant, unencrypted data can be intercepted. Additionally, sophisticated entities, such as intelligence agencies, could potentially track Tor users by analyzing traffic patterns or compromising nodes.

Despite these risks, Tor remains the most secure method of maintaining anonymity online. Around two million people, particularly those in heavily monitored states, use the Tor network daily. The darknet, a collection of hidden websites, also depends on Tor's anonymization for access.
Read more »
Ransomware attack
Cyber Security Cyber Threats Los Angeles county Network Ransomware attack

LA County Superior Court Hit by Ransomware Attack

 


The Superior Court of Los Angeles County experienced a notable disruption early on July 19 when a ransomware attack forced the court to disable its network systems. This prompt action was taken to prevent any additional damage from occurring. Court officials have announced that the network shutdown will remain in place until at least Monday, allowing IT experts sufficient time to conduct a thorough investigation and resolve the issue comprehensively.

Based on preliminary investigations, officials have indicated that there is no evidence to suggest that the personal data of court users has been compromised. This initial assessment is crucial as it helps to reassure the public that their sensitive information remains secure despite the cyber attack. The court's proactive measures in disabling the network were aimed at safeguarding user data and preventing further infiltration by the ransomware, demonstrating a commitment to protecting the privacy and security of all individuals involved.

Support from Multiple Agencies

To aid in the investigation and mitigate the impact of the attack, the California Governor's Office of Emergency Services, alongside local, state, and federal law enforcement agencies, has provided substantial resources and support. The collective effort underscores the severity of the breach and highlights the importance of a swift and comprehensive response to such cyber threats. This coordinated approach ensures that all available expertise and resources are being utilised to address the situation effectively and limit any potential repercussions.

Cybersecurity Investments

In recent years, the LA County Superior Court has significantly invested in strengthening its cybersecurity infrastructure. These investments were aimed at protecting the court's digital assets from potential threats, reflecting a proactive stance towards cybersecurity. Despite these efforts, the attack highlights the ongoing risks that even well-prepared institutions face and the continuous need for robust cybersecurity measures. The court's experience serves as a reminder that cybersecurity is a changing field requiring constant vigilance and adaptation to new threats.

Global Context

Interestingly, the attack on the LA County Superior Court occurred concurrently with a worldwide issue related to CrowdStrike, a prominent cybersecurity company. However, court officials have clarified that the two events are not believed to be connected. This clarification is essential to avoid misinformation and ensure that efforts are focused on resolving the specific ransomware attack affecting the court. By distinguishing between the two incidents, officials can better direct their resources and attention to the immediate problem at hand.

The ransomware attack on the Superior Court of Los Angeles County is a stark reminder of the vulnerabilities that even the most fortified systems can face in today's digital infrastructure. While the court's immediate response and the lack of evidence of data compromise are positive signs, the incident underscores the need for continuous vigilance and improvement in cybersecurity practices. As the investigation unfolds, the support from various agencies will be crucial in restoring the court's systems and preventing future attacks. This incident serves as a wake-up call to all institutions, emphasizing the importance of preparedness and the need to stay ahead of evolving cyber threats.


Read more »
Technology
Cellular Network Connectivity eSIM Mobile Network Mobiles Network SIM Technology

Revolutionizing Connectivity: The Rise of iSIMs in the Mobile Industry

 

The mobile industry is on the verge of a groundbreaking transformation, spearheaded by the advent of integrated SIMs, or iSIMs. According to a new report from Juniper Research, the number of iSIMs in connected devices is expected to soar from 800,000 in 2024 to more than 10 million by 2026. This staggering 1,200% increase is anticipated to be driven by the release of the GSMA's SGP.41/42 specifications by the end of 2025. These specifications aim to standardize and streamline the rollout of iSIM-enabled devices, thereby enhancing their accessibility and adoption. 

An iSIM, also known as an Integrated Universal Integrated Circuit Card (iUICC), represents an evolution of the eSIM (embedded SIM) technology by integrating directly into the device’s processor. This innovation eliminates the need for a separate SIM module, heralding a future where traditional SIM cards are rendered obsolete and networks can preload plans onto devices during the manufacturing process. The GSMA's SGP.41/42 specifications will facilitate In-factory Profile Provisioning (IFPP), allowing iSIM profiles to be uploaded onto devices during production. This capability simplifies the process for both manufacturers and consumers by enabling devices to be shipped with pre-configured cellular connectivity.  

Despite the optimistic forecast, Juniper's report points out that the absence of an industry-wide standard for iSIM technology could pose challenges. Without an official standard, manufacturers might be reluctant to launch iSIM solutions. Elisha Sudlow-Poole, the author of Juniper Research’s report, emphasizes the need for eSIM vendors to develop standard-agnostic platforms that can adapt to various form factors, standards, and use-case requirements. Furthermore, eSIM vendors must cultivate trusted partnerships with manufacturers to ensure the widespread adoption of iSIM connectivity services once they become sought after in the market. 

Juniper's study projects that the number of iSIM connections will surge to 210 million globally by 2028. This growth will be fueled by the adoption of iSIM technology in sectors such as smart energy meters and remote logistics, where there is a demand for power-efficient and compact devices. As these and other industries recognize the advantages of iSIM technology, the mobile industry's landscape will continue to evolve, ushering in a new era of connectivity and convenience. 

The shift to iSIMs represents a significant milestone in the evolution of the mobile industry, promising improved efficiency, security, and user experience. With the expected release of standardized guidelines and the increasing adoption of iSIM technology, the coming years are likely to witness profound changes in how devices connect to networks, ultimately benefiting both consumers and businesses. This transition underscores the mobile industry’s commitment to innovation and its dedication to enhancing connectivity solutions for a rapidly advancing digital world.
Read more »
Tracking
Cyber Crime DNS DNS Hacking Network Tracking

Hackers Tracking Victims with DNS Tricks


 


Cybercriminals have adopted a highly intricate technique known as DNS tunnelling to carry out malicious activities such as tracking victims and scanning network vulnerabilities, posing a significant threat to cybersecurity. DNS tunnelling involves the encoding of data or commands within DNS queries, effectively transforming DNS into a covert communication channel, which can be challenging for traditional security measures to detect.

Hackers leverage various encoding methods, such as Base16 or Base64, to conceal their digital footprints within DNS records, including TXT, MX, CNAME, and Address records. This covert communication method allows them to bypass network firewalls and filters, using it for command and control operations and VPN activities, thereby upgrading their ability to evade detection by security tools.

The Palo Alto Networks' Unit 42 security research team has recently exposed two distinct campaigns that exploit DNS tunnelling for malicious purposes. The first campaign, dubbed "TrkCdn," focuses on tracking victim interactions with phishing emails, enabling attackers to evaluate their strategies and confirm the delivery of malicious payloads. Additionally, a similar campaign named "SpamTracker" utilises DNS tunnelling to track the delivery of spam messages, highlighting the versatility of this technique in cybercriminal operations.

Furthermore, the second campaign, identified as "SecShow," employs DNS tunnelling for network scanning purposes. Attackers embed IP addresses and timestamps into DNS queries to map out network layouts and identify potential configuration flaws that can be exploited for infiltration, data theft, or denial-of-service attacks. This demonstrates the advancing tactics of cybercriminals in exploiting DNS tunnelling for a wide range of fraudulent activities. 

DNS tunnelling provides threat actors with several advantages, including bypassing security tools, avoiding detection, and maintaining operational flexibility, making it a preferred method for carrying out cyber-attacks. To alleviate this growing threat, organisations are advised to implement DNS monitoring and analysis tools to detect unusual traffic patterns and peculiarities promptly. Additionally, limiting DNS resolvers to handle only necessary queries can reduce the risk of DNS tunnelling misuse, enhancing overall cybersecurity defences.

The discovery of hackers exploiting DNS tunnelling focuses on the importance of staying careful against the pervasive nature of cyber threats and implementing robust cybersecurity measures to protect against potential attacks. By understanding the risks posed by DNS tunnelling and taking the required steps to mitigate them, organisations can effectively safeguard their networks and data.


Read more »
Software
Cyberattacks CyberCrime Cybersecurity Data Breach Microsoft Network Software

Apple's Alarming Data Breach: 2.5 Billion Records at Risk

 


Earlier this week, a report commissioned by Apple highlighted, yet again, why end-to-end encryption must be used when protecting sensitive data against theft and misuse, and why analysts have long recommended it. 

In the report, a professor at the Massachusetts Institute of Technology has conducted an independent review of publicly reported breaches which has been conducted for the tech giant in response to the report. The study found that ransomware campaigns and attacks on trusted technology vendors over the past two years have been responsible for a dramatic increase in data breaches and the number of records that have been compromised due to these breaches. 

The number of records exposed for the first time in 2021 and 2022 had reached a staggering 2.6 billion, with 1.5 billion of those records being exposed last year alone. Considering the trends so far this year, it is highly likely that this number will be even higher in 2023.

There have already been 20% more data breaches in the first nine months of 2023 alone, compared to all of 2022 combined, and the 2017 number is only 20% lower than the 17% increase in 2022. By the end of August 2023, it is estimated that 360 million sensitive records belong to around 360 companies and institutions that were exposed as a result of corporate and institutional breaches. 

A study published in the Apple report states that 95% of organizations that experienced a recent breach had experienced at least one other breach in the past, according to IBM's Cost of a Data Breach Study, as well as a Forrester study quoted in the Apple report. 

Within the last 12 months, 75 per cent of the respondents had experienced at least one incident involving data compromise. In addition to the study's findings, 98% of companies currently have a relationship with a technology vendor that has suffered at least one recent data breach as part of their contract with them. 

Fortra, 3CX, Progress Software, and Microsoft are just a few of the organizations and individuals that were affected by breaches involving vendors and vendor technologies. These breaches have impacted a wide range of organizations and individuals. When considering encryption plans, organizations should also be aware of the rapid growth and adoption of cloud computing.

In Apple's study, data that was analyzed showed that over 80% of breaches involved cloud-stored data. As a result of these issues, it may be more challenging to encrypt data on the cloud than to encrypt it in a physical location. In organizations with good security practices, Ken Dunham, director of Cyber Threats at Qualys, says that good security practices usually give organizations a good level of visibility over their legacy networks. 

Nevertheless, if they migrate to the cloud, they often lose the ability to be able to control, see, manage, and operate in a way that is similar to what they have in place in the past when it comes to encryption." He adds that maintaining a hybrid network that combines legacy and modern technologies is a new layer of complexity for organizations when they embark on digital transformation initiatives. 

Considering the cloud as a primary provider of data encryption can be a mistake for organizations, says Ben-Ari: "While cloud providers offer valuable security measures, it is the organizations' responsibility to ensure that they encrypt their data." In addition, he recommended that organizations prioritize technologies that are user-friendly and easy to implement so that any disruption to existing operations will be minimized when they are implemented in phases.

The last recommendation he makes is that organizations make use of the shared responsibility model that many cloud providers and leading SaaS vendors offer, which provides organizations with the capability to bring a wide range of advanced encryption features to their users at a single click right from their browsers.
Read more »
Trojan
Data Exfiltration malware MMRat Mobile Network Privacy Protobuf Technology threats Trojan

Rare Technique Deployed by Android Malware to Illicitly Harvest Banking Data

 

Trend Micro, a cybersecurity research firm, has recently unveiled a novel mobile Trojan that employs an innovative communication technique. This method, known as protobuf data serialization, enhances its ability to pilfer sensitive data from compromised devices.

Initially detected by Trend Micro in June 2023, this malware, named MMRat, primarily targets users in Southeast Asia. Surprisingly, when MMRat was first identified, popular antivirus scanning services like VirusTotal failed to flag it as malicious.

MMRat boasts a wide array of malicious functionalities. These include collecting network, screen, and battery data, pilfering contact lists, employing keylogging techniques, capturing real-time screen content, recording and live-streaming camera data, and even dumping screen data in text formats. Notably, MMRat possesses the ability to uninstall itself if required.

The capacity to capture real-time screen content necessitates efficient data transmission, and this is where the protobuf protocol shines. It serves as a customized protocol for data exfiltration, using distinct ports and protocols to exchange data with the Command and Control (C2) server.

Trend Micro's report highlights the uniqueness of the C&C protocol, which is customized based on Netty, a network application framework, and the aforementioned Protobuf. It incorporates well-designed message structures, utilizing an overarching structure to represent all message types and the "oneof" keyword to denote different data types.

Researchers have uncovered instances of this malware concealed within counterfeit mobile app stores, masquerading as government or dating applications. While they commend the overall sophistication of these efforts, it's essential to note that these apps still request permissions for Android's Accessibility Service, a common red flag that clearly signals their malicious nature.
Read more »
Wi-fi
Cyber Security Data Privacy Hacking Internet Safety Network Prevention Protection Security Wi-fi

Secure Your Wi-Fi: Spot Hacking Signs and Preventive Tips

 

The discussion around being cautious regarding security while utilizing public Wi-Fi networks is well-known due to the susceptibility of these networks to compromise by criminals. Yet, it's essential to recognize that private Wi-Fi networks are also vulnerable to hacking.

Cybercriminals possess the ability to breach private Wi-Fi networks and gain access to personal data. Gaining insight into their techniques is crucial for enhancing network security.

Methods Employed by Cybercriminals to Compromise Wi-Fi Networks

The inherent wireless nature of Wi-Fi networks allows numerous devices to connect concurrently. However, vulnerabilities exist that attackers exploit to illicitly access browsing sessions. Several tactics are employed to achieve this...

1. Obtaining Router's Default Password
Relying on the default password of your Wi-Fi router poses risks, as intruders can deduce it from the device's settings. It is advisable to change the password immediately upon setting up your connection. Once this step is taken, the default passcode becomes invalid.

2. Utilizing Brute-Force Attacks
Merely altering the default password doesn't guarantee immunity against hacking. Malevolent actors can utilize brute-force techniques, attempting multiple combinations of usernames and passwords until a match is found. This process is automated to expedite testing numerous login credentials.

3. Executing DNS Hijacking
Hackers might execute a DNS hijack, redirecting traffic from your device to their malicious websites. This manipulation involves altering the queries generated by your Wi-Fi's DNS. Consequently, you unknowingly connect to their sites, enabling them to extract your data.

Detecting Signs of Wi-Fi Breach

Cybercriminals endeavor to execute non-intrusive infiltration of your Wi-Fi network. However, by remaining vigilant, you can discern potential indications of compromise:

1. Unfamiliar IP Addresses Connected
Each internet-connected device possesses a distinctive IP address. Your Wi-Fi maintains a roster of connected IP addresses. Although these devices might not be readily visible, they are stored in a designated area. Reviewing the IP address section in your device settings can reveal unfamiliar devices.

2. Browser Redirection
Hacked Wi-Fi networks often prompt web browsers to perform unintended functions. For instance, inputting a specific URL may result in redirection to unfamiliar websites. Such alterations indicate a DNS setting change, redirecting browsers to malicious sites for data extraction.

3. Modified Wi-Fi Password
Observing sudden password inaccuracies indicates potential intrusion. If you haven't modified the password, a hacker likely has. Changing the password is among the first steps taken by scammers post-breach, denying your immediate access and facilitating their control.

4. Sluggish Internet Connection
While occasional internet slowdowns are common, persistent sluggishness can denote unauthorized network access. Intruders could engage in bandwidth-intensive activities, causing noticeable network degradation.

Preventive Measures Against Wi-Fi Hacking

Despite Wi-Fi's associated security risks, several proactive steps can thwart potential attacks:

1. Enable Encryption Mode
Utilizing encryption safeguards against eavesdropping attacks that intercept communications. Encryption obfuscates data, rendering it indecipherable to external parties even if acquired. Contemporary Wi-Fi routers typically include default encryption options like WPA and WPA2, enhancing security.

2. Regular Password Changes
The security of your Wi-Fi network hinges on your password's strength. While robust passwords are advised, their invulnerability is uncertain. To preempt this, periodically alter your router's password. This continual modification deters intruders. Employing a password manager can alleviate the inconvenience while boosting security.

3. VPN Usage in Public Spaces
Public Wi-Fi networks are susceptible to intrusions. Utilizing a virtual private network (VPN) conceals your IP address, rendering you inconspicuous while browsing. This measure safeguards against criminal attempts to compromise your connectivity.

4. Deactivate Remote Administration
Remote access to Wi-Fi networks, though convenient, is exploited by attackers. Disabling remote administration, unless necessary, closes an exploitable gap.

5. Turn Off Wi-Fi When Inactive
Inactive Wi-Fi is impervious to hacking. Switching off your router during periods of inactivity eliminates immediate threats and prevents unauthorized usage by neighbors.

6. Fortify Wi-Fi Security Settings
Private Wi-Fi networks offer substantial user and security controls. Activation of multiple security features is advisable. Layers of security present formidable challenges for criminals attempting unauthorized entry.

In conclusion, while discussions often center on the vulnerability of public Wi-Fi networks, it's vital to recognize that private networks are not immune to hacking. Understanding the tactics employed by cybercriminals, recognizing breach indicators, and implementing comprehensive security measures are pivotal in safeguarding your Wi-Fi network and personal data.
Read more »
Threat actors
Cyber Attacks cybercriminals Cybersecurity Internet Security Awareness LockBit Network Ransomware Threat actors

Northern European Criminals Copy the Lockbit Gang

 


The threat group, known as LockBit, is one of the most notorious ransomware groups operating currently. As a result, they have become very active on dark web forums. In addition, they are exploiting the negative publicity created by other ransomware groups to recruit more hardened cybercriminals for their agenda. 

The rate at which ransomware attacks have targeted companies in northern Europe has increased significantly. It appears that these attacks are being conducted using a device known as the LockBit locker. This is believed to be one of the tools used by a criminal affiliation program dubbed Gangrel. 

There is a wide range of industries that have been targeted by the LockBit group. It has caused significant disruptions and financial losses for a wide range of companies, from small to multinational. 

As a result of the nature of these new attacks, one of the most concerning characteristics is how they are being undertaken. A company's network is at risk from the LockBit Locker group. This group exploits a variety of advanced security techniques to gain initial access to the network through phishing and social engineering, among others. Having gained access to a network, attackers use a wide variety of tools and techniques to reach various parts of the network and steal sensitive information. These include sensitive system information. 

There has been an increase in attacks on small and medium-sized businesses in Belgium, as reported by Computerland in the country. There was, however, a report by the company that explained that the company was targeted by a group of cybercriminals using a variant of the LockBit locker malware. This variant appeared to have been used by the company. Following a thorough investigation, it was discovered that these attackers were unlikely to be connected with the LockBit group but rather were "wannabes" who had gained access to leaked versions of the malware. Despite not being the real LockBit Locker group, these micro-criminals were still able to inflict significant damage by encrypting a large number of internal files. 

There was, however, no impact on the company's computer system as a result of the intrusion, as backups had been made, and none of the client workstations were lost. 

The incident is one of many highlighting the dangers of outdated software and systems. This is true especially for less sophisticated actors, even in the criminal underground, where extortion practices seem to be gaining popularity. 

According to the report, in this case, the attackers were able to utilize the company's FortiGate firewall to gain access to the company's sensitive data. They did this by taking advantage of unpatched vulnerabilities. According to the Known Exploited Vulnerabilities Catalog maintained by the Center for Internet Security Awareness, unpatched FortiGate firewalls are prone to several vulnerabilities currently being exploited by cybercriminals. However, in these recent cases, the flaws exploited were the infamous "Fortifuck" flaws that date back as far as 2018. 

Unattended exposure through a branch internet gateway has allowed exploits to be made of these flaws to be discovered and exploited. As a result, these gateway sites are usually less well-protected than the central network, which may put attackers at an advantage in terms of gaining access to the network. 

The recent ransomware attacks against small and medium-sized businesses in North Europe are highly concerning for several reasons. Even though the criminal operators' lack of experience reduced their effectiveness, extended outages and data exfiltration were experienced by the targeted industries despite the reduced effectiveness of the criminal operators. 

Briefing on Threat Actors   

There is a well-known ransomware affiliation program known as LockBit, which started in September of 2019 and involves the developers of the malicious software hiring unethical penetration testing teams to spread the ransomware as a third party. There are a few gangs that have established double-extortion practices. The Stealbit malware was part of the toolkits used by this gang to support such attacks.

It is well known that during Lockbit's infamous career, a large number of small and medium businesses and large corporations such as Accenture and Royal Mail were targeted. During the infection process, the victim will be redirected to a gang payment site managed by the ransomware developers once they have infected the environment. The attackers threatened the victim that they would leak the victim's data to get her to pay more money.
Read more »
Subscribe to: Posts (Atom)