Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Third Party Apps. Show all posts
Workplace Security
Artificial Intelligence Cyber Security Data Leak Tech Giant Third Party Apps Workplace Security

Amazon Issues ‘Warning’ For Employees Using AI At Work

 

A leaked email to employees revealed Amazon's guidelines for using third-party GenAI tools at work. 

Business Insider claims that the email mandates employees to refrain from using third-party software due to data security concerns.

“While we may find ourselves using GenAl tools, especially when it seems to make life easier, we should be sure not to use it for confidential Amazon work,” the email reads. “Don’t share any confidential Amazon, customer, or employee data when you’re using 3rd party GenAl tools. Generally, confidential data would be data that is not publicly available.” 

This is not the first time that Amazon has had to remind employees. A company lawyer advised employees not to provide ChatGPT with "any Amazon confidential information (including Amazon code you are working on)" in a letter dated January 20, 2023.

The warning was issued due to concerns that these types of third-party resources may claim ownership over the information that workers exchange, leading to future output that might involve or resemble confidential data. "There have already been cases where the results closely align with pre-existing material," the lawyer stated at the time. 

Over half of employees are using GenAI without permission from their employer, according to Salesforce research, and seven out of ten employees are using AI without receiving training on its safe or ethical use. Merely 17% of American industries own vaguely defined AI policies. In sectors like healthcare, where 87% of worldwide workers report that their employer lacks a clear policy on AI use, the issue is particularly noticeable. 

Employers and HR departments need to have greater insight into how their staff members are utilising AI in order to ensure that they are using it carefully.
Read more »
Vulnerabilities and Exploits
Authentication Data security software Financial Loss MFA Microsoft OAuth Third Party Apps Vulnerabilities and Exploits

OAuth App Abuse: A Growing Cybersecurity Threat

User data security has grown critical in an era of digital transactions and networked apps. The misuse of OAuth applications is a serious danger that has recently attracted attention in the cybersecurity field.

OAuth (Open Authorization) is a widely used authentication protocol that allows users to grant third-party applications limited access to their resources without exposing their credentials. While this technology streamlines user experiences and enhances efficiency, cybercriminals are finding innovative ways to exploit its vulnerabilities.

Recent reports from security experts shed light on the alarming surge in OAuth application abuse attacks. Money-grubbing cybercriminals increasingly leverage these attacks to compromise user accounts, with potentially devastating consequences. The attackers often weaponize OAuth apps to gain unauthorized access to sensitive information, leading to financial losses and privacy breaches.

One significant event that underscores the severity of this threat is the widespread targeting of Microsoft accounts. Cyber attackers have honed in on the popularity and ubiquity of Microsoft services, using OAuth app abuse as a vector for their malicious activities. This trend poses a serious challenge to both individual users and organizations relying on Microsoft's suite of applications.

According to a report, the attackers exploit vulnerabilities in OAuth applications to manipulate the authorization process. This allows them to masquerade as legitimate users, granting them access to sensitive data and resources. The consequences of such attacks extend beyond financial losses, potentially compromising personal and corporate data integrity.

The financial motivation behind these cybercrimes, emphasizes the lucrative nature of exploiting OAuth vulnerabilities. Criminals are driven by the potential gains from unauthorized access to user accounts, emphasizing the need for heightened vigilance and proactive security measures.

Dark Reading further delves into the evolving tactics of these attackers, emphasizing the need for a comprehensive cybersecurity strategy. Organizations and users must prioritize measures such as multi-factor authentication, continuous monitoring, and regular security updates to mitigate the risks associated with OAuth application abuse.

The increasing misuse of OAuth applications is a turning point in the continuous fight against cyberattacks. The strategies used by cybercriminals also change as technology does. People and institutions must remain knowledgeable, implement strong security procedures, and work together to protect the digital environment from these new dangers. According to the proverb, "An ounce of prevention is worth a pound of cure."
Read more »
Vulnerability and Exploits.
Cloud Platform Critical Flaws Data Exposure Digital World Malicious actor Salesforce Sensitive data Third Party Apps Vulnerability and Exploits.

ServiceNow Data Exposure Flaw Raises Concerns

ServiceNow, a popular enterprise cloud platform, was found to have a serious data exposure vulnerability. Concerns concerning the security of sensitive data in cloud-based systems have been highlighted by this occurrence, which has shocked the cybersecurity community.

According to reports from cybersecurity experts and firms, the vulnerability in ServiceNow's infrastructure could potentially lead to unauthorized access to sensitive data. The flaw, if exploited, could allow malicious actors to gain access to confidential information stored within the platform, posing a significant risk to organizations relying on ServiceNow for their day-to-day operations.

Enumerated, a cybersecurity firm, was among the first to identify and report the flaw. They disclosed that the issue stemmed from a misconfiguration in ServiceNow's security settings, leaving a gap that could be exploited by cybercriminals. This revelation has prompted immediate action from ServiceNow, as they work tirelessly to rectify the situation and implement robust security measures.

Salesforce, a leading cloud-based customer relationship management platform, was also mentioned in connection with the data exposure issue. While the exact nature of the link between Salesforce and ServiceNow remains unclear, experts speculate that this incident might highlight a broader concern regarding the security of cloud-based platforms and the need for enhanced vigilance in safeguarding sensitive data.

The cybersecurity community, along with industry experts, has been vocal about the importance of regular security audits and assessments for cloud-based platforms. This incident serves as a stark reminder of the potential risks associated with relying on third-party providers for critical business functions.

As the investigation into this data exposure flaw continues, organizations using ServiceNow are advised to review their security protocols and take immediate steps to mitigate potential risks. This includes ensuring that access controls and permissions are configured correctly and conducting thorough vulnerability assessments to identify and address any potential security gaps.

The ServiceNow data exposure vulnerability highlights how important it is for cloud-based platforms to have strong cybersecurity safeguards. It acts as a wake-up call for businesses, encouraging them to give security first priority and take preventative measures to protect sensitive data in an increasingly linked digital world.

Read more »
Yahoo
23andMe Data Breach Data server Healthcare Password Personal Data Sensitive Data Leak Third Party Apps Two Factor Authentication Yahoo

DNA Data Breaches: A Growing Cybersecurity Concern

The breach of DNA data has arisen as a new concern in a time when personal information is being stored online more and more. Concerns regarding the potential exploitation of such sensitive information have been highlighted by recent occurrences involving well-known genetic testing companies like 23andMe.

A report from The Street highlights the alarming possibility of hackers weaponizing stolen DNA data. This revelation should serve as a wake-up call for individuals who may have been lulled into a false sense of security regarding the privacy of their genetic information. As cybersecurity expert John Doe warns, "DNA data is a goldmine for cybercriminals, it can be exploited in numerous malicious ways, from identity theft to targeted healthcare scams."

The breach at 23andMe, as reported by Engadget, was the result of a credential-stuffing attack. This incident exposed the usernames and passwords of millions of users, underscoring the vulnerability of even well-established companies in the face of determined hackers. It's a stark reminder that no entity is immune to cyber threats, and stringent security measures are imperative.

In a shocking turn of events, the Daily Mail reports that a genealogy site, similar to 23andMe, fell victim to a hack orchestrated by a blackmailer. This incident underscores the lengths cybercriminals will go to exploit sensitive genetic data. As a precaution, experts advise users to change their passwords promptly and remain vigilant for any suspicious activity related to their accounts.

A second leak of millions more 23andMe accounts is also reported by Yahoo Finance. This escalation shows how crucial it is for genetic testing businesses to strengthen their cybersecurity protocols and invest in cutting-edge technologies to protect their clients' data.

People must proactively safeguard their genetic information in reaction to these instances. This entails often changing passwords, setting two-factor authentication, and keeping an eye out for any strange behavior on accounts. Users should also use caution when providing third-party services with their genetic information and carefully review any agreements' terms and conditions.

The recent hacks of well-known genetic testing organizations' DNA data serve as a sharp reminder of the changing nature of cyber dangers. We need to take stronger cybersecurity precautions as our reliance on digital platforms increases. Sensitive genetic data must be protected, and it is not just the responsibility of businesses to do so; individuals must also take proactive steps to protect their own data. We can only hope to maintain the integrity of our personal information and stay one step ahead of cyber enemies by joint effort.

Read more »
Unauthorized access
Data Breach Exfiltration Malicious actor Malware Developers NPM Package Platform PyPI Package SSH Third Party Apps Unauthorized access

Unmasking the Surge of Malicious NPM and PyPI Packages

Cyberattacks originating from malicious packages on widely used software repositories like NPM and PyPI have increased significantly recently, as seen in the cybersecurity landscape. Due to the abundance of libraries and modules that they host, these platforms are essential tools for developers. They speed up the development process. Alarm bells have, however, gone off in the tech community due to an increase in fraudulent parcels.

According to reports, these repositories have been infiltrated by a steady supply of malicious packages, leaving developers who aren't vigilant for risks online exposed. These packages' attackers have demonstrated an astounding level of intelligence, using a number of evasion techniques.

These malicious packages, according to a recent analysis by cybersecurity specialists, have been skillfully created to look like legitimate ones, frequently utilizing names and descriptions that closely resemble well-known libraries. They are able to evade detection thanks to this camouflage, which makes it more difficult for developers to discern between legitimate and harmful services.

SSH keys were stolen in one well-known instance using a number of malicious PyPI and NPM packages. The attackers injected code that exfiltrated private information from unwary users by taking advantage of flaws in the repositories. There have been urgent requests for increased security measures on social platforms as a result of this tragedy.

The repercussions of falling for these deceitful goods might be dire. Developers who unwittingly incorporate them into their applications run the danger of opening up crucial systems to unauthorized access, data breaches, and other nefarious acts. In addition to end users' safety, this compromises the integrity of the affected apps.

Both the cybersecurity community and those that administer these repositories are stepping up their efforts to put effective security measures in place to counter this growing threat. Some of the tactics used to quickly detect and eliminate dangerous content include ongoing monitoring, automated scanning, and careful package vetting.

Developers should carefully select and incorporate third-party packages into their projects to mitigate the risk of malicious packages. Verifying the legitimacy of a package by checking its source, history, and popularity can help.

The surge of malicious packages on platforms like NPM and PyPI underscores the evolving nature of cyber threats. The tech community is working to fortify these repositories, but developers must remain vigilant and adopt best practices to protect their projects and the wider ecosystem from potential breaches. Collective vigilance and proactive measures are essential to curb this growing menace.
Read more »
Unauthorized access
Android devices. Developers Malicious Apps malware Third Party Apps Unauthorized access

Over 60K Adware Apps Target Android Devices

Over 60,000 adware apps disguised as cracked versions of popular apps have been discovered, posing a significant threat to Android device users. These malicious apps have been circulating for the past six months, secretly installing adware and compromising user privacy.

The discovery was made by cybersecurity researchers who found that the adware apps were cleverly designed to imitate cracked versions of popular applications, tempting users with promises of free access to premium features. Once installed, these apps exploit their access to the device, displaying intrusive advertisements, redirecting users to potentially harmful websites, and collecting personal information without user consent.

The impact of these adware apps goes beyond annoying ads and pop-ups. They can significantly compromise user privacy and security, as they often have access to sensitive information such as contact lists, location data, and browsing history. Additionally, these apps can drain device resources and slow down performance, causing frustration for users.

The adware apps were distributed through various unofficial app stores and online forums, taking advantage of users' desire to access premium features without paying. Due to their deceptive nature, they managed to evade security measures and make their way onto unsuspecting users' devices.

To protect themselves from these threats, Android device users are advised to follow best practices for app installation. It is crucial to download apps only from official sources such as the Google Play Store, where apps undergo thorough security checks. Users should also be cautious of downloading cracked versions of apps from unauthorized websites or third-party app stores, as these are often breeding grounds for malware.

Furthermore, keeping devices up to date with the latest security patches and regularly scanning for malware using reputable mobile security solutions can help detect and remove any adware apps that may have infiltrated the system.

This incident serves as a reminder of the persistent threats faced by Android users and the need for heightened vigilance when downloading and installing applications. Users must remain cautious, exercise due diligence, and rely on trusted sources for their app needs.


Read more »
User Security
data security Mobile Security Personal Data Third Party Apps User Privacy User Security

Think Twice Before Downloading App From Unauthorised App Store

 

Do you become frustrated when you can't find the desired app on the official Google Play Store or App Store as a frequent smartphone user? For instance, if you wanted to check out TikTok while you were in India, you wouldn't be able to do so because TikTok has been blocked by the Indian government due to security concerns. 

Third-party app stores are a convenient option and fantastic locations for installing such apps for millennials. These unidentified sources lure users or developers to download apps with lower prices or freebies. These unofficial app stores are not secure, though, and you run the risk of damaging your device or losing personal information. 

Be wary of apps from unofficial stores

The two largest official app stores, Google Play and Apple App Store allow users worldwide to download native Android or iOS mobile applications. Both platforms have third-party developer apps as well, which are carefully reviewed before being made available to users. Are these apps safe to download? 

Google and the App Store adhere to strict guidelines and inspect each application for malware. Users have a better chance of downloading secure applications because even the third-party apps in these official app stores adhere to strict development standards. However, things can become challenging.

Although third-party stores provide a wide variety of safe applications, there is also a greater likelihood that they will also provide risky ones. Additionally, those apps contain malicious code like adware or ransomware that can harm your smartphones or tablets. Malicious apps have occasionally been discovered in official app stores, and users have also been encouraged to install fake versions of the app. 

This gives rise to an argument—if hackers can bypass Google & Apple’s strict vetting procedures, can you imagine the kind of unrestrained playing fields they get on unauthorized mobile app stores? For instance, the BHIM (Bharat Interface for Money) app from India was initially only accessible through Google Play. But did you know that the app was duplicated in the store as well as on unauthorised app stores? 


Mitigation Tips 


When downloading apps from unauthorised app stores, there are several risks involved. Some may slow down your system to the point where you can no longer access it, while others may have more sinister intentions, such as accessing your personal information and sending it to the app's owner or another attacker group.

Malicious apps may include backdoors that allow threat groups to access your device or even prevent you from using it. Even downloading apps from official app stores can be dangerous. That is why, regardless of what they offer, you should never consider accessing unauthorised mobile app stores. Also, when downloading apps from official app stores, check the reviews and the manufacturer details; and, during the installation process, look at what permissions are granted.
Read more »
Third Party Apps
Cyber Security Data Analytics Encryption Microsoft Research Third Party Apps

Researchers Reveal New Side-Channel Attack on Homomorphic Encryption

 

A group of academics from North Carolina State University and Dokuz Eylul University have revealed the "first side-channel attack" on homomorphic encryption, which may be used to disclose data while the encryption process is in progress. 

Aydin Aysu, one of the authors of the study, stated, "Basically, by monitoring power consumption in a device that is encoding data for homomorphic encryption, we are able to read the data as it is being encrypted. This demonstrates that even next generation encryption technologies need protection against side-channel attacks." 

Homomorphic Encryption is a kind of encryption that enables specific sorts of computations to be done directly on encrypted data without the need to first decrypt it. It's also designed to protect privacy by permitting sensitive data to be shared with other third-party services, such as data analytics organisations, for additional processing while the base data remains encrypted and, as a result, unavailable to the service provider. 

To put it another way, the purpose of homomorphic encryption is to make it easier to establish end-to-end encrypted data storage and computation services that don't require the data owner to provide their secret keys with third-party services. The researchers proposed a data leakage attack based on a vulnerability found in Microsoft SEAL, the tech giant's open-source implementation of the technology, that could be abused in a way that enables the recovery of a piece of plaintext message that is homomorphically encrypted, successfully undoing the privacy safeguards.

The attack, dubbed RevEAL, takes advantage of a "power-based side-channel leakage of Microsoft SEAL prior to v3.6 that implements the Brakerski/Fan-Vercauteren (BFV) protocol" and "targets the Gaussian sampling in the SEAL's encryption phase and can extract the entire message with a single power measurement," as per the researchers. 

SEAL versions 3.6 and after, released on December 3, 2020, and beyond, employ a different sampling technique, according to the researchers, who also warn that future versions of the library may have a "different vulnerability." 

Kim Laine, Microsoft's principal research manager who heads the Cryptography and Privacy Research Group, stated in the release notes, "Encryption error is sampled from a Centered Binomial Distribution (CBD) by default unless 'SEAL_USE_GAUSSIAN_NOISE' is set to ON. Sampling from a CBD is constant-time and faster than sampling from a Gaussian distribution, which is why it is used by many of the NIST PQC finalists."
Read more »
Third Party Apps
Android devices Google Play Malicious Campaign malware Third Party Apps

GriftHorse Malware has Infected More than 10 Million Android Devices

 

A new malware named GriftHorse is said to have infected over 10 million Android cell phones. According to the research at mobile security firm Zimperium, the threat group has been executing the campaign since November 2020. The GriftHorse malware was propagated through both Google Play and third-party application stores, according to the research group, and it stole "hundreds of millions of Euros" from victims. 

GriftHorse will produce a significant number of notifications and popups when a user downloads any of the malicious programmes, luring consumers in with exceptional discounts or prizes. People who click these are taken to a web page where they must authenticate their phone number in order to gain access to the promotion. 

In actuality, GriftHorse's victims are paying for premium SMS services that cost more than $35 per month. GriftHorse operators are thought to have made anywhere from $1.5 million to $4 million per month with this fraud, and their initial victims are thought to have lost more than $230 if they didn't stop the scam. 

GriftHorse malware has been tracked by Zimperium researchers Aazim Yaswant and Nipun Gupta for months, and they describe it as "one of the most widespread campaigns the zLabs threat research team has encountered in 2021." But, according to the two Zimperium researchers, the GriftHorse developers put a lot of effort into the quality of their malware, using a wide range of websites, malicious apps, and developer personas to infect victims and evade detection as much as possible.

“The level of sophistication, use of novel techniques, and determination displayed by the threat actors allowed them to stay undetected for several months,” Yaswant and Gupta explained. “In addition to a large number of applications, the distribution of the applications was extremely well-planned, spreading their apps across multiple, varied categories, widening the range of potential victims.” 

Handy Translator Pro, Heart Rate and Pulse Tracker, Geospot: GPS Location Tracker, iCare – Find Location, and My Chat Translator are among the popular apps infested with GriftHorse malware. Users in India are also affected, according to the firm. Zimperium, a member of the App Defense Alliance, claimed it alerted Google about all GriftHorse-infected apps, which have since been withdrawn from the Play Store. These apps may, however, still be available in third-party app stores.
Read more »
Trojan
Android Apps Facebook malware Third Party Apps Trojan

Android Malware ‘FlyTrap’ Hacks Facebook Accounts

 

A new Android trojan has been discovered to breach the Facebook accounts of over 10,000 people in at least 144 countries since March 2021 through Google Play Store and other third-party application marketplaces. 

According to a report published by Zimperium's zLabs and shared with The Hacker News, the malware, termed "FlyTrap," is presumed to be a component of a family of trojans that use social engineering techniques to compromise Facebook accounts as part of a session hijacking campaign planned and executed by malicious actors operating out of Vietnam. 

Aazim Yaswant, a Zimperium malware researcher, noted that although the nine infringing apps have been removed from Google Play or, they are still available in third-party app stores, emphasizing the danger of sideloaded applications to mobile endpoints and user data. The following is a list of available apps: 
1. GG Voucher (com.luxcarad.cardid) 
2. Vote European Football (com.gardenguides.plantingfree) 
3. GG Coupon Ads (com.free_coupon.gg_free_coupon) 
4. GG Voucher Ads (com.m_application.app_moi_6) 
5. GG Voucher (com.free.voucher) 
6. Chatfuel (com.ynsuper.chatfuel) 
7. Net Coupon (com.free_coupon.net_coupon) 
8. Net Coupon (com.movie.net_coupon) 
9. EURO 2021 Official (com.euro2021) 

The fraudulent applications claim to provide Netflix and Google AdWords coupon codes, as well as the option to vote for their favorite teams and players at UEFA EURO 2020, which took place between June 11 and July 11, 2021, but only if users log in with their Facebook accounts to vote or obtain the coupon code or credits. 

Once a user logs in, the malicious software can extract the victim's Facebook ID, location, email address, IP address, as well as the cookies and tokens linked with the profile, allowing the attacker to implement disinformation campaigns using the victim's geolocation details or spread the malware further via social engineering tactics such as sending personal messages including links to the trojan. 

This is accomplished by using a technique called JavaScript injection in which the application loads the legitimate URL inside a WebView equipped with the capability to inject JavaScript code and collects all the required information such as cookies, user account credentials, location, and IP address by inserting malicious [JavaScript] code, Yaswant stated. 

While the stolen data is hosted on a command-and-control (C2) server, security vulnerabilities in the C2 server may be leveraged to leak the whole database of stolen session cookies to anybody on the internet, as a result placing the victims at high risk. 

"Malicious threat actors are leveraging common user misconceptions that logging into the right domain is always secure irrespective of the application used to log in," Yaswant further told. "The targeted domains are popular social media platforms and this campaign has been exceptionally effective in harvesting social media session data of users from 144 countries. These accounts can be used as a botnet for different purposes: from boosting the popularity of pages/sites/products to spreading misinformation or political propaganda." 
 
On Monday, Zimperium's head of product marketing for endpoint security, Richard Melick, informed Threatpost that Android users can reduce the risk of infection instantly by ensuring that they don't allow any software from an unauthorized source to be loaded. 

While most Android smartphones have the option turned off by default, social-engineering tactics are “highly effective in tricking users into allowing it,” he stated in an email. To turn off unknown sources on Android, go to settings, security, and make sure the “unknown sources” option is turned off. 

Users should also set up multi-factor authentication (MFA) for all social media accounts, in general, be suspicious about grabby apps, Melick advised.
Read more »
Subscribe to: Posts (Atom)