Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label VPN. Show all posts
Websites
address Privacy VPN Websites

Remove Your Home Address From the Internet - Here's How

 




This is not only an issue of personal privacy but also safety. Many organisations sell address data to brokers, who then distribute their contents to advertisers, identity thieves, or even burglars. Here's the step-by-step process of how to delete your home address off the web.


Share Your Address Only When Necessary 


Keep your address private by limiting how often you give out your home address. Share it only when you must, like when opening a bank account or registering to vote. You can use an alternate address elsewhere, for example, when signing up for a gym membership or getting deliveries. That little change makes a big difference to the privacy of your home address online.


Mask Your Address in Mapping Apps


Online maps usually have very clear street views of your home. Thankfully, apps such as Google Maps and Apple Maps can blur your home for privacy. For Google Maps, enter your address, go to Report a Problem, then the areas you'd like to blur. For Apple Maps, write to their team at mapsimagecollection@apple.com, with details of your home, and they will handle it.

Remove Your Address from Search Results


You have the right to request its removal, if it appears on a search engine. Google offers users the ability to track and control personal information online. One can visit their Google Account and navigate to the Results About You section to set alerts and even request removal of the address from certain search results. Remember that Google could retain content from government or business sites.


Know your Social Media Profiles


Review your social media profiles for those instances where you published your house address. Never post a photo with your street or house number. Periodically update your privacy setting to restrict access to your information.


Opt Out from Whitepages


Whitepages is the biggest collection of addresses online. To remove yourself from it, visit their Suppression Request page, search for your profile, and make a suppression request for removal of it. You can easily do this in a few minutes.


Cleaning Up Unused Accounts


Most websites and services save your address whenever you sign up. Accounts you don't use anymore—like old shopping sites or subscription services—and delete them or request that your data be erased. That's fewer chances of a leak or misuse. You could also use a Post Office Box as an alternative.

The use of a post office box can make certain that one private home address does not have to be revealed. You can apply through USPS to lease a box for as low as $15 monthly online. This address could be used for deliveries or other accounts; it conceals your place of residency.

 

Use a Virtual Mailbox


Added to that is the security factor - virtual mailboxes have a secure option. They scan and forward your mail and allow you to access it online. It's thus comfortable for a frequent traveller, thus anyone who wants to avoid physical mail at his doorstep.


Securing Your Address with a VPN


Finally, make use of a virtual private network (VPN) to encrypt your internet data. Also, keep the physical location private. It conceals where you are physically based as you go online. Many browsers also have this built-in VPN option for additional security as well.

Removing your home address from the internet may take some effort, but the peace of mind it brings is worth it. By following these steps, you can protect your privacy and stay safer in an increasingly connected world. 


Read more »
VPN
Cyberattacks CyberCrime Cyberhackers Cyberthreats Default End-to-End Encryption E222 Technology VPN

The Role of End-to-End Encryption in Modern Cybersecurity

 


It is a type of messaging that is protected from everyone, including the messaging service itself, because of end-to-end encryption (E2EE). Using E2EE, a message cannot be decrypted until the sender and the recipient can see it in the form that was originally intended to be decrypted. As a result, sending an email represents the beginning of the conversation, and the recipient represents the end of the conversation. 

Consider end-to-end encryption like a sealed envelope through which a letter is sent through the mail in which no one can read the contents. Those who sent the letter, as well as those who received it, may read the letter. Both may read it, and each may open and read it on their own. Postal service employees can't read the letter because it is enclosed in an envelope and remains sealed.

A device where data or communications are created, received, or transmitted can be encrypted at the time of creation and sent. The encrypted data or communications can then be decrypted once it reaches the intended recipients, where the data can be accessed. Therefore, the data is protected at every stage of its transmission, thereby ensuring that it remains safe throughout.  

It is unlikely that any third party or unauthorized viewer will be able to read the communication even if it has been intercepted by third parties. It is vitally important that E2EE maintains a secure communication system and data storage system. In order to read it, one must be a recipient as well as a sender who has an intended recipient. As far as the encrypted messages are concerned, not even the service provider or server can read them.  An end-to-end encryption process can be described as a relatively simple approach in which data is converted from its original form into an unreadable format, transmitted securely, and finally converted back into its original form at the destination after it has been transmitted. 

A typical E2EE process consists of the following four steps: 
Encryption 
Transmission 
Decryption 
Authentication 

1. Encryption   In all of the E2EE applications, sensitive data is encrypted as soon as it is received before it goes through encryption. In this algorithm, the data is scrambled up into an unreadable form that is known as ciphertext to protect it from access by unauthorized people. The messages can only be read by authorized users who have a secret key, which is known as the decryption key, for decrypting them. The E2EE system has two different types of encryption schemes: asymmetric, in which the encryptor and decryptor use two different keys to encrypt and decrypt the data, and symmetric, in which there is one shared key to encrypt and decrypt the data.  E2EE does use both of these methods (see "Symmetric versus asymmetric encryption" for a description of the two).  

2. Transmission The data that is encoded (ciphertext) is transported over a communication channel, such as the Internet or any other network that uses encryption. Despite this, the message retains its unreadable nature when it moves to its destination. Neither application servers, internet service providers (ISP), hackers, nor other entities can read the message as it moves. Any person who intercepts that message will see random unintelligible characters flowing across the screen. 

3. Decryption In asymmetric encryption, it is the recipient's private key that is used to decrypt the ciphertext when it receives the ciphertext, while in symmetric encryption, it is the shared key. Data that is encrypted by a private key can only be decrypted by the recipient that possesses that key. 

4. Authentication Upon the decryption of data, it is verified to make sure that its integrity and authenticity have been retained. As part of this step, the recipient might be required to verify the sender's digital signature or other credentials to verify that the data was not tampered with during transmission by anyone else. There is no doubt that end-to-end encryption provides the highest level of security. 

Even though hackers could intercept the communication, they would not be able to read it without the private key that has been shared only by the sender and recipient.  In the case of E2EE, however, the devices that send the communications need to be secured to work. Whenever even one of these elements is compromised, the entire message chain becomes readable as a whole. When using encryption-in-transit, the information can be protected more often than when using encryption from end to end, since the server can also read these messages. 

Senders and recipients of E2EE can only decipher the message to get into the intended recipient's mind.  It should be mentioned that end-to-end encryption, like many other methods of encryption, makes use of cryptography to convert readable text into indecipherable text by the use of cryptography. As a result of this technology, the user will be able to make sure their VPN is as secure as possible. This encryption technique protects users' messages from being read by anyone else besides users' intended recipient, thus keeping them safe from prying eyes and increasing the level of privacy users can maintain.  

It is a more secure method of encrypting data since it encrypts users' message before encrypting it and only decrypts the message when it is deciphered by the recipient's device, which is why it maintains users' data's security from beginning to end. There are several messaging services available today that use end-to-end encryption to ensure that users' communication is protected from unauthorized access and theft, which include WhatsApp, Signal, Telegram, and SMS messaging.  The most popular encryption method for end-to-end communication uses asymmetric cryptography, in which a public key and a private key are used to encrypt and decrypt data.

Public keys are issued by trusted certificate authorities, which are anonymous and accessible to the general public.  Decrypting messages is done by using a public key that is stored on a server. E2EE makes perfect sense for protecting communications because it prevents third parties from eavesdropping on conversations. Without it, cybercriminals could intercept and read sensitive information, including personal messages, files, and login details. Hackers could exploit this information to access accounts, steal credit card data, or even impersonate someone online. That said, not all messaging apps use end-to-end encryption, and even those that do might not have it turned on by default. 

It’s always a good idea to check and ensure that E2EE is enabled to keep users' conversations secure. But encryption doesn’t stop at messaging. If someone wants to protect all their online data, not just messages, using a Virtual Private Network (VPN) is a simple solution. A reputable VPN encrypts all internet traffic, so no one can spy on browsing activity, banking information, or file sharing. Even if a messaging service doesn’t offer end-to-end encryption, a VPN will automatically provide it, covering not only communication but all online activities.

Most VPNs use military-grade AES-256-bit encryption, which is incredibly secure and almost impossible to crack. Some VPN providers are even preparing for the future by offering post-quantum encryption. Quantum computers, once fully developed, could potentially break current encryption methods, so advanced VPNs are already adopting encryption methods designed to resist such threats. For example, NordVPN, one of the leading VPN providers, is already implementing these cutting-edge security measures. 

E2EE has been around for a while, with Pretty Good Privacy (PGP) being one of the first widely used applications for securing emails, stored files, and digital signatures. Nowadays, end-to-end encryption is common in messaging apps like Apple’s iMessage, Jabber, and Signal Protocol (formerly TextSecure Protocol). Even Point-of-Sale (POS) providers like Square use E2EE to help maintain PCI compliance and protect transactions. In 2019, Facebook made waves by announcing that all its messaging services would adopt E2EE. 

However, this sparked a debate. While E2EE ensures user privacy, law enforcement agencies argue that it makes it harder to police illegal activities, especially when it comes to child abuse on private messaging platforms. This debate continues, as companies balance the need for privacy with the demands for security and monitoring illegal content on their platforms.
Read more »
VPN
crypto industry Cyber Crime Cypto North Korea VPN

How North Korea is Exploiting the Crypto Industry

How North Korea is Exploiting the Crypto Industry

North Korean operatives have penetrated the blockchain world, and the covert operation has significant implications for global cybersecurity and the integrity of the crypto market.

Recent warnings from U.S. authorities highlight that North Korean IT workers are infiltrating tech and crypto companies, channeling their earnings to support the state's nuclear weapons program. A 2024 UN report states these workers generate up to $600 million annually for Kim Jong Un's regime. 

Hiring these workers, even unintentionally, violates U.N. sanctions and is illegal in the U.S. and many other countries. It also poses a significant security risk, as North Korean hackers often use covert workers to target companies.

North Korea's Cyber Arsenal

North Korea's cyber operations are nothing new, but their infiltration into the crypto industry represents a new frontier. Using fake identities and fabricated work histories, North Korean IT workers managed to secure positions in over a dozen blockchain firms. These operatives, often disguised as freelancers from countries like South Korea, Japan, or China, have leveraged the decentralized nature of the crypto industry to mask their origins and intentions.

The Crypto Industry's Blind Spot

The crypto industry's decentralized and often anonymous nature makes it an attractive target for cybercriminals. The article reveals how North Korean operatives exploited this blind spot, slipping through the cracks of standard vetting procedures. They infiltrated companies by providing fake credentials and using VPNs to obfuscate their actual locations. This tactic allowed them to access sensitive information and potentially manipulate blockchain networks.

Economic Warfare

North Korea's entry into the crypto industry is part of a broader strategy to circumvent international sanctions. By infiltrating blockchain firms, North Korean operatives can siphon off funds, conduct illicit transactions, and launder money. The stolen assets are then funneled back to the regime, bolstering its finances and supporting its nuclear ambitions.

Consequences and Countermeasures

The infiltration severely affects the targeted firms, exposing them to legal risks and undermining their credibility. It also raises broader concerns about the security of the crypto industry. To combat this threat, companies must adopt more stringent vetting processes, enhance cybersecurity measures, and collaborate with international agencies to identify and neutralize such threats.

Read more »
VPN
Compromised Passwords Data Breach Specops User Privacy VPN

Specops Unearths Millions of Compromised VPN Passwords

 

The moment a password is discovered, a virtual private network (VPN) becomes public quickly. In a report published last week, password management provider Specops Software revealed 2,151,523 VPN credentials exposed by malware over the past year.

One professional at the company revealed that many users aren't protecting, or even caring all that much about, a valuable network entrypoint based on the 2 million+ VPN passwords that were pulled from the company's threat-intelligence platform. 

“If we look at some of the content of those passwords, that’s where we really start seeing where there’s still, unfortunately, a general apathy around security, and password security in particular,” Darren James, senior product manager at Outpost24 (which acquired Specops in 2021), stated. 

This is Qwerty. The report's most popular passwords are certainly familiar to you; they are the usual consecutive numbers and versions of "password" and "qwerty." The top compromised password—found 5,290 times, according to Specops—is "123456.” 

And, in fact, 5,290 represents progress—a "quite low" figure, according to the Specops team, given that the information contained almost 2 million VPN passwords. "This could suggest that end users may have generally been using unique, or even strong passwords for their VPN credentials," according to the Sept. 17 blog. 

Even complex passwords can be stolen, according to James, when spyware known as keystroke loggers monitor logins and phishing emails trick users into disclosing VPN credentials. According to a recent report by cyber insurance provider At-Bay, self-managed VPNs accounted for 63% of remote-access ransomware attacks in 2023. 

While several VPN-specific discoveries suggested consumer-level vulnerabilities, given the linked email addresses, the analysis also revealed corporate risk. Several discovered passwords meet the length and complexity requirements for Active Directory in many organisations.

Specops researchers recommend blocking several of the alleged stolen business passwords, such as Abcd@123# and Lordthankyou2.

“Ultimately, it comes down to password reuse. Even if you’ve got a super-strong password, you need to be able to check that that password hasn’t become breached or hasn’t been stolen since the last time you’ve set it,” James added.
Read more »
Web browsing
Internet Privacy Tor project VPN Web browsing

Tor Project Assures Users It's Safe Amid Controversy of Deanonymizing Users

Tor Project Assures Users It' Safe Amid Controversy of Deanonymizing Users

Tor Project, A Privacy Tool

Tor is a privacy software used for keeping your identity secret by rerouting your web traffic through several nodes (computers) worldwide, which makes it difficult to track where the user traffic is coming from. In a change of events, an investigative report warned that law enforcement from Germany and across the have collaborated to deanonymize users via timing attacks. 

The Tor project, however, is trying to assure users that the network is still safe. The team behind Tor assures proper measures are followed for users using the latest versions, stressing that timing attacks is an old technique and solutions can mitigate it.

Catching Child Abusers Using Tor

Known for its privacy services, Tor is generally used by journalists and activists while communicating with sources to avoid censorship in countries that curb press freedom. The project boasts a long list of genuine users, but because of its secrecy, threat actors also use Tor to host illegal marketplaces and avoid law enforcement.

German portal Panorama has issued an investigative that says court documents revealed that law agencies use timing analysis attacks via Tor nodes in large numbers to track and arrest the main culprits behind the child abuse platform “Boystown.”

In the Tor timing attack, the users are deanonymized without abusing any vulnerabilities in the tool, the focus is on noticing the timing of data entering and exiting the network.

If the threat actor is controlling the Tor nodes or tracking exit and entry points, they can compare the entry and exit time data, and in case of a match, use the data to trace the traffick back to a particular user.

If the attacker controls some of the Tor nodes or is monitoring the entry and exit points, they can compare the timing of when data enters and leaves the network, and if they match, they can trace the traffic back to a particular person.

Tor’s Reply 

The Tor Project is not happy about not getting access to the court documents that can help them understand and verify security-related questions. “We need more details about this case. In the absence of facts, it is hard for us to issue any official guidance or responsible disclosures to the Tor community, relay operators, and users,” reads the Tor statement.

Read more »
VPN
Digital Security Online Activity Technology Torrent VPN

Can VPN Conceal Torrenting? Is it Safe to Torrent With a VPN?

 

Nowadays, keeping your internet behaviour private can seem impossible, especially if you torrent. This type of file sharing is strongly discouraged by both ISPs, which may throttle your internet connections if you are detected, and government organisations, which are looking out for copyright offences. 

So, what's the solution if you still want to torrent? A VPN (virtual private network). A VPN not only hides your traffic inside a private tunnel, preventing prying eyes from tracking you, but it also encrypts your data for further security. Below, I'll explain how torrents operate, if a VPN truly covers your torrent activity, and whether using a VPN to torrent is good for you. 

What is torrenting? 

Torrenting is a method of sharing files across a decentralised, peer-to-peer (P2P) network. Rather than downloading a full file from a single source, a torrent file is divided into "packets" that are downloaded/uploaded from multiple sources on the network simultaneously. This strategy minimises network load and accelerates the download process.

Torrenting is an excellent method for efficiently sharing and downloading files. However, decentralisation might have consequences. Torrenting is typically prohibited by internet service providers (ISPs) because it is frequently used to share pirated content, creating a liability for the ISP; and torrenting can consume a significant amount of bandwidth on the ISP's network. 

Furthermore, downloading and sharing data from many sources via torrents puts you at increased risk of malware and infections. When torrenting, you should use both a reliable VPN and efficient antivirus software to help mitigate these threats. 

Role of VPN

When you use your regular home internet connection, your ISP can monitor everything you do online. As previously stated, ISPs dislike torrenting (regardless of the content), and if you torrent regularly, your internet connection may be throttled. If you download something you shouldn't, your ISP can see it and may report your conduct to government officials, potentially resulting in a DMCA violation email and a significant penalty.

It just goes to explain how closely this type of conduct is being monitored. By employing a VPN, all of your traffic is diverted through the VPN's private servers rather than your ISP's, ensuring that your ISP cannot snoop on your online activities while connected. 

The VPN encrypts data to create a private tunnel. Most VPNs employ military-grade AES-256 encryption technology or something similar for all data that passes through their servers. This makes it unreadable to outside organisations, providing an additional layer of protection, especially when downloading torrent files. 

Finally, because your traffic is routed through VPN servers, the IP address allocated to your computer by your ISP is changed to that of the VPN's servers, ensuring that your activity cannot be traced back to your house. 

Furthermore, if your VPN has a certified no-logs policy, as it should, no record of your activities will ever be gathered or retained for further review. This is significant because law enforcement's most common data sharing request to VPN providers is for information on DMCA violations.
Read more »
VPN
Data Leak malware Middle East Palo Alto VPN

Threat Actors Install Backdoor via Fake Palo Alto GlobalProtect Lure

 

Malware disguising itself as the authentic Palo Alto GlobalProtect Tool is employed by malicious actors to target Middle Eastern firms. This malware can steal data and run remote PowerShell commands to further penetrate company networks. A reliable security solution from Palo Alto Networks that supports multi-factor authentication and offers secure VPN access is called Palo Alto GlobalProtect. 

The tool is frequently used by businesses to guarantee that partners, contractors, and distant workers may securely access private network resources. By utilising Palo Alto GlobalProtect as bait, it is evident that attackers target high-value business entities that use enterprise software, as opposed to random users.

Trend Micro researchers have not been able to figure out how the malware is delivered, but based on the bait employed, they believe the attack begins with a phishing email. It checks for indicators of running in a sandbox before executing its main code. Then it sends profile information about the compromised system to the command and control (C2) server. 

As an additional evasion layer, the malware encrypts the strings and data packets that will be exfiltrated to the C2. The C2 IP detected by Trend Micro used a newly registered URL containing the "sharjahconnect" string, making it appear to be a legal VPN connection portal for Sharjah-based offices in the United Arab Emirates. Given the campaign's targeting scope, this choice allows the threat actors to blend in with normal operations while minimising warning signs that could raise the victim's suspicion. 

Using the Interactsh open-source tool, beacons are sent out at regular intervals to communicate the malware status with threat actors during the post-infection phase. While Interactsh is a legal open-source tool employed by pentesters, its linked domain, oast.fun, has already been spotted in APT-level operations, such as the APT28 campaigns. However, no attribution was provided in this operation involving the Palo Alto product lure. 

The following commands were received from the command and control server: 

  • time to reset: Stops malware operations for a specified duration. 
  • pw: Implements a PowerShell script and sends the result to the hacker's server.
  • pr wtime: Reads or writes a wait time to a file. 
  • pr create-process: Starts a new process and returns the output.
  • pr dnld: Downloads a file from a specified URL. 
  • pr upl: Uploads a file to a remote server. 
  • invalid command type: Returns this message if an unrecognized or erroneous command is encountered.

Trend Micro reports that, while the attackers are unknown, the operation looks to be highly targeted, with unique URLs for the targeted companies and newly established C2 domains to avoid blocklists.
Read more »
VPN
Cyber Attacks PLCs Security Sensitive data VPN

Ewon Cosy+ Industrial Devices Vulnerable to Serious Security Exploits


 

Recently, severe security flaws were identified in the Ewon Cosy+ industrial remote access devices, which could allow attackers to gain complete control over the systems. This vulnerability presents a serious risk, as it could lead to unauthorised access, allowing attackers to decrypt sensitive data, steal credentials, and hijack VPN sessions to launch further attacks on industrial networks.

Root Access Exploits and VPN Session Hijacking

Security researcher Moritz Abrell from SySS GmbH brought these critical vulnerabilities to light during a presentation at DEF CON 32. The identified flaws could enable attackers to achieve root-level access on Ewon Cosy+ devices, providing them with the ability to decrypt protected firmware and data, such as passwords stored in configuration files. More alarmingly, attackers could obtain valid VPN certificates, enabling them to take over VPN sessions, thereby compromising the security of both the devices and the connected industrial networks.

Ewon, in response to these findings, issued a security update on July 29, 2024, which addresses these vulnerabilities in the latest firmware versions. The update tackles several issues, including data leaks through cookies, cross-site scripting (XSS) vulnerabilities, and improper encryption practices. Notably, the update fixes critical issues such as the ability to execute processes with elevated privileges and vulnerabilities that could allow attackers to inject malicious code.

How the Vulnerabilities Were Exploited

The Ewon Cosy+ system relies on a VPN connection that is managed through a platform called Talk2m, which uses OpenVPN for secure communication. Researchers found that it was possible to exploit a command injection vulnerability within the system, allowing unauthorised access to the device. Additionally, a persistent XSS vulnerability was discovered, which could be used to gain administrative control.

One particularly troubling vulnerability involved the storage of session credentials in an unprotected cookie, encoded in Base64. This flaw allows an attacker to gain root access by simply waiting for an administrator to log in to the device. With root access, attackers can install persistent threats, extract encryption keys, and decrypt sensitive firmware files. The presence of a hard-coded encryption key within the system further heightens the risk, as it can be used to extract even more sensitive data.

Risk of VPN Session Takeover

Among the concerning risks associated with these vulnerabilities is the possibility of VPN session hijacking. The Ewon Cosy+ devices communicate with the Talk2m platform via HTTPS, using mutual TLS (mTLS) for authentication. However, the system's reliance on the device's serial number for generating Certificate Signing Requests (CSR) poses a security flaw. An attacker could exploit this weakness by creating a CSR with a serial number matching the target device, thereby hijacking the VPN session and rendering the original device inaccessible.

Once the VPN session is taken over, the attacker can reroute the connection to their infrastructure, potentially intercepting critical data, such as programmable logic controller (PLC) programs, which are essential to the operation of industrial systems.

This is a reminder of the challenges faced in securing industrial remote access solutions. The potential for attackers to gain root access and hijack VPN sessions could have devastating consequences, not only for the individual devices but also for the wider industrial networks they are connected to.

Organisations using Ewon Cosy+ devices are strongly urged to apply the recommended firmware updates immediately and review their security protocols to minimise the risk of exploitation. Regular updates and stringent security practices are essential to protecting industrial systems from the developing threat of cyberattacks.

As attackers continue to exploit weaknesses in remote access tools, it is critical for companies to remain proactive in securing their systems. By addressing these vulnerabilities promptly and ensuring their systems are up to date, organisations can protect their infrastructure from the risks posed by these security flaws.


Read more »
VPN
Bug Exploit malware North Korea Organization security VPN

How North Korean Attackers Deployed Malware Via VPN Bug Exploit

How North Korean Attackers Deployed Malware Via VPN Bug Exploit

In a concerning event, North Korean state-sponsored have again displayed their advanced cyber capabilities by abusing flaws in VPN software updates to plant malware. The incident highlights the rising threats from state-sponsored actors in the cybersecurity sector. "The Information Community attributes these hacking activities to the Kimsuky and Andariel hacking organizations under the North Korean Reconnaissance General Bureau, noting the unprecedented nature of both organizations targeting the same sector simultaneously for specific policy objectives," NCSC said.

Attack Vector Details

The NCSC (National Cyber Security Center) recently detected two infamous North Korean hacking groups named Kimsuky (APT43) and Andariel (APT45) as the masterminds of these attacks. The groups have a past of attacking South Korean companies and have set their eyes on exploiting bugs in VPN software updates. Threat actors leveraged these flaws, gained access to networks, deployed malware, and stole sensitive data, including trade secrets.

How the attack works

The actors used a multi-dimensional approach to attack their targets. First, they identified and compromised vulnerabilities in the VPN software update mechanisms. Once the update started, the attackers secretly installed malware on the victim's system. The malware then set up a backdoor, letting the hackers build persistent access to the compromised network.

A key tactic used by attackers was to disguise the malware as a genuine software update. Not only did it help escape detection, but it also ensured that the dangerous malware was planted successfully. The malware was built to extract sensitive information, including intellectual property and secret business info that can be used for economic espionage purposes or can be sold on the dark web.

Learnings for the Cybersecurity Sector

The incident underscores important issues in cybersecurity, the main being the importance of strengthening software update mechanisms. Software updates are a routine part of keeping the system secure, and users trust them easily. This trust gives threat actors leverage and allows them to attack, as shown in this case.

The second issue, the attack highlights an urgent need for strong threat intelligence and monitoring. Organizations must stay on alert and constantly look out for signs of attacks. A sophisticated threat detection system and frequent security audits can help detect and mitigate possible threats before they can cause major damage.

Tips on Staying Safe

Here are some key strategies organizations can adopt for multi-layered security:

Regular patching and updates ensure all software like VPNs, are updated with the latest security patches, reducing the risk of flaws being abused.

Implementing a "Zero Trust Framework" which assumes internal and external threats, the model requires strict authorization for each user and device trying to access the network.

Using advanced endpoint protection solutions that can identify and respond to suspicious activities on individual systems.

Read more »
VPN security
CISA Cyber Attacks Ivanti Ivanti security flaws Ivanti VPN Exploitation Security Breach VPN VPN security

Lessons from the Ivanti VPN Cyberattack: Security Breaches and Mitigation Strategies

 

The recent cyberattack on Ivanti’s VPN software has prompted swift action from the Cybersecurity and Infrastructure Security Agency (CISA). This incident not only highlights the need for stronger cybersecurity measures but also raises important questions about exploit techniques, organizational responses to security breaches, and the escalating costs associated with downtime. 

The vulnerabilities in Ivanti’s VPN gateway allowed threat actors to bypass authentication and gain unauthorized access. Attackers could send maliciously crafted packets to infiltrate the system without needing to steal credentials, giving them access to user credentials, including domain administrator credentials. A second vulnerability enabled the injection of malicious code into the Ivanti appliance, allowing attackers to maintain persistent access, even after reboots or patches. Security researchers, including Mandiant, identified that Ivanti’s initial mitigations were insufficient. 

CISA warned that Ivanti’s interim containment measures were not adequate to detect compromises, leaving systems vulnerable to persistent threats. This uncertainty about the effectiveness of proposed mitigations necessitated CISA’s prompt intervention. The ability of attackers to gain persistent access to a VPN gateway poses significant risks. From this trusted position, attackers can move laterally within the network, accessing critical credentials and data. The compromise of the VPN allowed attackers to take over stored privileged administrative account credentials, a much more severe threat than the initial breach. In response to the breach, CISA advised organizations to assume that critical credentials had been stolen. 

Ivanti’s failure to detect the compromise allowed attackers to operate within a trusted zone, bypassing zero-trust principles and exposing sensitive data to heightened risks. The severity of the vulnerabilities led CISA to take the unusual step of taking two of Ivanti’s systems offline, a decision made to protect the most sensitive credentials. Despite later clarifications from Ivanti that patches could have been applied more discreetly, the miscommunications highlight the importance of clear, open channels during a crisis. Mixed messages can lead to unnecessary chaos and confusion. System-level downtime is costly, both in terms of IT resources required for shutdown and recovery and the losses incurred from service outages. 

The exact cost of Ivanti’s downtime remains uncertain, but for mission-critical systems, such interruptions are extremely expensive. This incident serves as a warning about the costs of addressing the aftermath of a cyberattack. CISA’s decision to shut down the systems was based on the potential blast radius of the attack. The trusted position of the VPN gateway and the ability to export stored credentials made lateral movement easier for attackers. 

Building systems based on the principle of least privilege can help minimize the blast radius of attacks, reducing the need for broad shutdowns. The Ivanti VPN cyberattack underscores the pressing need for robust cybersecurity measures. Organizations must adopt proactive infrastructure design and response strategies to mitigate risks and protect critical assets. Reducing the number of high-value targets in IT infrastructure is crucial. Privileged account credentials and stored keys are among the highest value targets, and IT leaders should prioritize strategies and technologies that minimize or eliminate such targets. 
Read more »
VPN
Cyber Security Data Safety IP Address User Privacy VPN

Here's How to Change IP Address Without VPN

 

The internet is becoming an increasingly important aspect of people's lives since it allows them to perform an array of activities with minimal effort. However, it is also becoming a more dangerous place, as many hackers harm you by breaking into your servers and networks and stealing your private data. Hiding or changing your IP address is one way to secure your online activity. In this article, we'll go over how to change it without a VPN and why you should use one. 

What is an IP address? 

IP addresses, often known as "internet protocol," are a string of digits that help identify the network that each individual is using. They will let you send and receive data across a network. They normally include a lot of data on your online activities, location, and data. They are an important aspect of the internet and how it functions. 

However, because it contains a large amount of private information about internet users, it can lead to a variety of issues and cybercrimes, which is why remaining safe and protected is critical, and one way to do so is to change your IP address, with or without a VPN. 

You may be wondering how you can change your IP address without using a VPN. That is possible, and to assist you change it so that you stay safe and keep your data secure, here are multiple ways to change IP address without VPN: 

Change your network: This is the most obvious and straightforward approach to change your IP address. Changing your network and using a new one will instantly generate you a new IP address. 

Tor Browser: When you use the Tor browser, nodes conceal your IP address when you connect to any network. The nodes will change every time you use them. That ensures your privacy as well. 

Disconnect the modem: If you unplug your modem for a few hours, you can get a new IP address when you turn it back on. 

Proxy server: Depending on the server you connect to, a proxy will mask and disguise your IP address before assigning a new one. 

Your internet service provider might be able to modify your IP address for you if you request it and provide an appropriate reason.
Read more »
Wifi vulnerability
Browser Security Cyber Security DNS Hackers attack Internet Speed Network Security VPN WiFi Routers Wifi vulnerability

Signs Your Home Network Has Been Hacked and How to Protect Yourself

 

While many are aware of the risks associated with public Wi-Fi, fewer realize that home networks are also vulnerable to cyberattacks. Hackers can infiltrate home networks to access sensitive information like bank details, private conversations, and personal photos. Here are key indicators that your home network may be compromised and steps to enhance your security. 

One sign of a compromised network is a sudden drop in internet speed. If your connection slows down without any issues from your provider, it could mean hackers are using your bandwidth for malicious purposes. Another warning sign is the appearance of unfamiliar devices on your network. Hackers might connect their devices to your network to steal information. To check for this, log into your router and review the list of connected devices. Unrecognized entries should be investigated. Unexpected changes to your Wi-Fi password are also concerning. If you haven't changed it but find it different, someone might have hacked into your network to lock you out. 

Additionally, spotting unfamiliar software on your devices can indicate malware installation by hackers aiming to steal your data. Browser hijacking is another serious threat. If hackers gain access to your router, they can alter its DNS settings, redirecting your internet traffic to malicious sites that can steal information and install harmful software. If your browser frequently redirects to suspicious websites, your network might be compromised. Understanding how hackers operate can also help in recognizing threats. 

For example, they may pose as buyers in online transactions, sending phishing links to steal bank details from sellers. To protect your home network, ensure your router’s firmware is up to date and use strong, unique passwords for your Wi-Fi and devices. Enable network encryption, such as WPA3, and disable remote management features that can provide easy access to hackers. Using a virtual private network (VPN) can further secure your internet traffic and protect your online activities. 

Securing your home network requires vigilance and proactive measures. By staying aware of potential warning signs and implementing strong security practices, you can protect your personal information and maintain your digital privacy. Continuous learning and adaptation to new cyber threats are essential for keeping your network safe.
Read more »
VPN security
Cyber Security cyber threat Free VPN VPN VPN security

The Dark Side of Free VPNs: Hidden Dangers and Privacy Risks

 

Virtual Private Networks, or VPNs, have become essential tools for internet users worldwide. By encrypting web traffic and masking IP addresses, VPNs promise an extra layer of privacy and security. However, not all VPNs live up to this promise. Alarmingly, many free VPNs may actually compromise user privacy, posing significant risks, especially to vulnerable groups like children. The Lure and Risks of Free VPNs Free VPNs are particularly attractive to students seeking to bypass school internet filters and access restricted content, such as pornographic sites or social media platforms. 

Yet, recent research, set to be shared with U.S. lawmakers, highlights a more sinister aspect. Some free VPNs have connections to China and may be funneling user data to the Chinese government. This alarming discovery is compounded by a recent case where a Chinese national allegedly used malware-infested free VPNs to create a botnet, compromising millions of computers and generating substantial fraudulent revenue. 

Privacy Concerns and Security Flaws 

A comprehensive study by the Commonwealth Scientific and Industrial Research Organisation (CSIRO) in Australia revealed that many free VPNs fall short of providing adequate security. Of the 283 Android VPN apps analyzed, a staggering 67% embedded at least one tracking library to monitor user activity. Even more concerning, 84% of these apps failed to properly encrypt user data, leaving it vulnerable to hackers and other malicious entities. 

Why Free VPNs Are Risky 

Malware Infections: The CSIRO study found that six out of the ten VPNs most likely to be infected with malware were free. These infections were primarily ad-related, as free VPNs often rely on advertising revenue. 

Embedded Tracking: Only 28% of free VPNs did not use third-party trackers. Many had multiple trackers, compromising user privacy for analytics and advertising purposes. 

Content Unblocking Failures: Free VPNs often struggle to bypass geo-restrictions, making them ineffective for accessing content like region-locked Netflix shows. 

Slower Connections: Free VPNs are notorious for slowing down internet speeds. Some may intentionally throttle speeds to push users towards their paid versions. 

Ad Delivery: To sustain their operations, free VPNs bombard users with pop-up ads, which not only irritate but also slow down browsing. 

Browser Hijacking: Some free VPNs hijack browsers and redirect users to unwanted websites, further eroding trust. 

Data Collection by Governments: Many free VPNs are operated by companies based in countries with weak privacy laws. This raises the possibility that these services may share user data with their respective governments. 

Expert Recommendations: Given these risks, experts advise opting for paid VPN services from reputable vendors like F-Secure or ProtonVPN. Paid VPNs typically offer robust encryption, better privacy policies, and fewer advertisements. They also invest more in their infrastructure, ensuring faster and more reliable connections.
Read more »
VPN
Cyber Security Data protection Encryption internet Security IP address hiding Online Privacy VPN

Understanding the Complexities of VPNs: Balancing Privacy and Security in the Digital Age

 

Virtual private networks (VPNs) are crafted to safeguard online privacy through the encryption of internet traffic and concealment of IP addresses, thereby preventing the determination of user locations. This functionality becomes apparent when users attempt to access websites or services while abroad. 

Typically, an IP address triggers the loading of a URL based on the local area, potentially limiting access to U.S.-based services or sites. VPNs offer a workaround for such constraints. For instance, a U.S. traveler in Europe might face restrictions accessing certain paid streaming services available in the U.S., which can be circumvented by a VPN masking the local European IP address, thus granting access to U.S.-based content.

When utilizing a VPN, a VPN server substitutes its IP address as it transmits encrypted data to the public internet. For example, if an individual resides in New York but connects to a VPN server in Amsterdam, their IP address will reflect a location in the Netherlands. While VPNs appear to conceal a user's digital footprint, they don't ensure absolute anonymity. Internet service providers (ISPs) can detect VPN usage but cannot access specific online activities protected by VPN encryption, such as browsing history or downloaded files. VPNs are effective in preventing government agencies from surveilling users' online activities by creating an encrypted tunnel that shields data from prying eyes.

Despite their advantages, VPNs are not foolproof. In the event of a system breach, cybercriminals can bypass VPN protection and access user data. Furthermore, under certain circumstances, law enforcement agencies can obtain access to VPN data. In cases of serious crimes, police may request online data from a user's ISP, and if a VPN is employed, the VPN provider may be compelled to disclose user details. VPN logs have facilitated law enforcement in apprehending individuals involved in criminal activities by revealing their actual IP addresses.

Law enforcement agencies can legally request specific information from VPN providers, including logs of websites visited and services used while connected to the VPN, actual IP addresses, connection timestamps, and billing information. While some VPN providers claim to adhere to a no-logs policy to enhance anonymity, data may still be accessible under legal compulsion or through undisclosed logging practices. The level of cooperation with law enforcement varies among VPN providers, with some readily providing information upon request and others being less cooperative.

In terms of tracking IP addresses, police may obtain access to VPN connection logs, allowing them to trace a user's actual IP address and identify the user's device and identity. However, live encrypted VPN traffic is challenging to track, limiting law enforcement's ability to monitor online activities in real-time. Nevertheless, malware attacks and breaches in VPN security can compromise user data, emphasizing the importance of maintaining updated software and security measures.

Data retention laws vary by country, impacting the degree of privacy offered by VPNs. Users are advised to select VPN providers located in countries with strong privacy protections. Conversely, countries with stringent data retention laws may compel VPN providers to share user data with government agencies, posing risks to user privacy. Certain nations, such as China and North Korea, have extensive internet censorship measures, making it essential for users to exercise caution when using VPNs in these regions.

While VPNs alter IP addresses and encrypt data, they do not guarantee complete anonymity. Technically proficient individuals may find ways to track VPN data, and sophisticated tracking techniques, such as browser fingerprinting, can potentially reveal a user's identity. Moreover, corporate VPN users may be subject to monitoring by their employers, highlighting the importance of understanding the privacy policies of commercial VPN providers.

In conclusion, while VPNs offer enhanced privacy and security for online activities, users should be aware of their limitations and potential vulnerabilities. Maintaining awareness of privacy laws and selecting reputable VPN providers can mitigate risks associated with online privacy and data security.
Read more »
Vulnerabilities and Exploits
Cyber Attackers Data Safety DHCP. TunnelVision VPN Vulnerabilities and Exploits

Unpatchable VPN Vulnerability Exposes Data to Attackers: What You Need to Know

 

In a recent revelation that has sent shockwaves through the cybersecurity community, researchers have unearthed a significant vulnerability in virtual private networks (VPNs) dubbed TunnelVision. This flaw, described as deep and unpatchable, poses a substantial threat to data security, allowing malicious actors to intercept sensitive information without leaving a trace. The implications of this discovery are profound, shedding light on the inherent limitations of VPNs as a stand-alone security solution and underscoring the urgent need for a more robust and comprehensive approach to cybersecurity. 

By manipulating DHCP option 121, attackers can reroute data traffic within the encrypted VPN tunnel to a malicious gateway under their control. This interception occurs stealthily, without triggering any alarms or alerts, as the VPN software remains unaware that its contents have been rerouted. Consequently, organizations may remain oblivious to the breach until it's too late, allowing threat actors to siphon off data undetected. 

What makes TunnelVision particularly insidious is its ability to evade detection by traditional security measures. Unlike conventional attacks that leave behind telltale signs of intrusion, TunnelVision operates covertly within the encrypted VPN tunnel, making it virtually invisible to standard intrusion detection systems and VPN monitoring tools. As a result, organizations may be blindsided by the breach, unaware that their data is being compromised until it's too late to take action. 

The discovery of TunnelVision has profound implications for organizations that rely on VPNs to secure their networks and safeguard sensitive information. It exposes the inherent vulnerabilities of VPNs as a single point of failure in the security infrastructure, highlighting the need for a more holistic and layered approach to cybersecurity. Simply put, VPNs were never designed to serve as a comprehensive security solution; they are merely a means of establishing encrypted connections between remote users and corporate networks. 

To mitigate the risks posed by TunnelVision and similar vulnerabilities, organizations must adopt a multifaceted cybersecurity strategy that encompasses strong encryption, enhanced network monitoring, and a zero-trust security model. By encrypting data before it enters the VPN tunnel, organizations can ensure that even if intercepted, the data remains protected from prying eyes. Additionally, implementing rigorous network monitoring protocols can help detect and respond to anomalous behaviour indicative of a breach. 

Moreover, embracing a zero-trust security model, which assumes that no entity—whether inside or outside the network perimeter—is inherently trustworthy, can help organizations better defend against sophisticated attacks like TunnelVision. The discovery of TunnelVision serves as a wake-up call for organizations to reevaluate their cybersecurity posture and adopt a more proactive and comprehensive approach to threat mitigation. By addressing the underlying vulnerabilities in VPNs and implementing robust security measures, organizations can better protect their sensitive data and safeguard against emerging threats in an increasingly hostile digital landscape
Read more »
VPN
Customer Information DHCP. Technology TunnelVision VPN

New Attack Renders Most VPN Apps Vulnerable

 


A new attack, dubbed TunnelVision, has materialised as a threat to the security of virtual private network (VPN) applications, potentially compromising their ability to protect user data. Researchers have detected vulnerabilities affecting nearly all VPN apps, which could allow attackers to intercept, manipulate, or divert traffic outside of the encrypted tunnel, undermining the fundamental purpose of VPNs.


How TunnelVision Works

TunnelVision exploits a flaw in the Dynamic Host Configuration Protocol (DHCP) server, the system responsible for assigning IP addresses on a network. By manipulating a specific setting called option 121, attackers can divert VPN traffic through the DHCP server, bypassing the encrypted tunnel meant to secure the data. This manipulation allows attackers to intercept, read, drop, or modify the traffic, compromising the user's privacy and the integrity of the VPN connection.


Implications for VPN Users

The consequences of TunnelVision are severe. Despite users trusting that their data is securely transmitted through the VPN, the reality is that some or all of the traffic may be routed outside of the protected connection. This means that sensitive information, such as passwords, financial details, or personal communications, could be exposed to interception or manipulation by unauthorized parties.

The vulnerability affects a wide range of operating systems and devices, with the exception of Android, which does not implement option 121 in its DHCP server. For other operating systems, including Linux, there are no complete fixes available. Even with mitigations in place, such as minimising the effects on Linux, TunnelVision can still exploit side channels to compromise security.

While there is no foolproof solution to the TunnelVision attack, certain measures can reduce the risk. Running the VPN inside a virtual machine or connecting through a cellular device's Wi-Fi network can enhance security by isolating the VPN connection from potential attacks. However, these solutions may not be accessible or practical for all users, highlighting the need for further research and development in VPN security.

TunnelVision represents a harrowing threat to the integrity of VPNs, undermining their ability to protect user data from interception and manipulation. With the potential for widespread exploitation, it is essential for VPN providers and users to be aware of the risks and take appropriate measures to steer clear of potential attacks. 


Read more »
VPN
Cookies Cyber Threats phishing Privacy Software VPN

Here’s Why You Shouldn’t Trust VPNs Blindly


 

In an era where we should be gravely concerned about online privacy and security, Virtual Private Networks (VPNs) have come through as indispensable tools for safeguarding digital identities. However, amidst the buzz of VPN advertisements promising invincibility against cyber threats, it's crucial to peel back the layers of misinformation and understand the realities of VPN capabilities.

A VPN, short for Virtual Private Network, encrypts internet traffic, creating a secure tunnel for data transmission. By masking users' IP addresses and their locations, VPNs offer concentrated anonymity and access to geo-restricted content. While these features provide a layer of protection, it's essential to acknowledge the limitations inherent in VPN technology.

Social Media Risks

Despite VPN encryption, personal information voluntarily shared on social media platforms remains vulnerable. From name and email address to posts and shares, users expose sensitive data, susceptible to exploitation by malicious actors. Enabling users to review privacy settings and exercise caution in sharing personal information is paramount in mitigating social media risks.

Phishing Scams

Phishing, a prevalent form of online scam, exploits human vulnerability rather than technical weaknesses. While VPNs can deter interception of internet traffic, they cannot thwart users from falling victim to phishing schemes. Combating phishing necessitates user education on identifying suspicious messages and exercising caution while sharing sensitive information online.

Harmful Software 

While some VPNs offer malware-blocking features, they are not comprehensive antivirus solutions. Collaborating VPNs with robust antivirus software enhances defence mechanisms against malware and viruses. Being careful while selecting reputable VPN providers and deploying supplementary security measures is imperative in maintaining your digital resilience.

Tracking Cookies Intrusions 

VPNs mitigate anonymity risks at the network level but fall short in combating tracking cookies embedded in web browsers. Regularly clearing cookies on devices mitigates privacy intrusions, albeit at the expense of convenience. Balancing privacy concerns with usability demonstrates the challenging endeavour in exploring the digital world safely. 

Online Accounts Digital Footprints 

Despite VPN usage, online activities remain traceable, particularly within centralised platforms like Google. Logging out from accounts during sensitive transactions and diversifying usage of privacy-focused services minimise digital footprints. Embracing alternative platforms prioritising user privacy essentially presents a paradigm shift towards decentralised digital ecosystems.

VPNs serve as go-to tools for navigating online privacy and security. However, they are not reliable for all digital threats. We need to get a hold of VPN limitations and empower users to adopt a multifaceted approach to digital defence, integrating VPNs with supplementary security measures and prudent online practices.

By synthesising expert insights and user-centric perspectives, it's evident that coursing through the VPNs requires a nuanced understanding of both its offerings and constraints. 


Read more »
VPN
Android Flaw Block Chain Cyber Bug Cyber Data Cyberattacks Cybersecurity Data Leaks DNS Mullvad Privacy VPN

Android Flaw Exposes DNS Queries Despite VPN Kill Switch

 


Several months ago, a Mullvad VPN user discovered that Android users have a serious privacy concern when using Mullvad VPN. Even with the Always-On VPN feature activated, which ensures that the VPN connection is always active, and with the "Block connections without VPN" setting active, which acts as a kill switch that ensures that only the VPN is the one that passes network traffic, it has been found that when switching between VPN servers, Android devices leak DNS queries. 

It is important to understand that enabling the "Block Connections Without VPN" option (also known as the kill switch) ensures that all network traffic and connections pass through an always-connected VPN tunnel, preventing prying eyes from tracking all Internet activity by users. During the investigation, Mullvad discovered that even with these features enabled in the latest version of Android (Android 14), a bug still leaks some DNS information. 

As a result, this bug may occur when you use apps that make direct calls to the getaddrinfo C function. The function provides protocol-independent translation from a text hostname to an IP address through the getaddrinfo function. When the VPN is active (and the DNS server is not configured) or when the VPN app re-configures the tunnel, crashes or is forced to stop, Android leaks DNS traffic. 

This leakage behaviour is not observed by apps that are solely based on Android's API, such as DNSResolver, Mullvad clarified. As a result, apps such as Flash Player and Chrome that currently have support for getting address information directly from the OS are susceptible to this issue since they can access the address information directly. This is rather concerning since it goes against what you would expect from the OS, even if security features are enabled. 

Users may want to use caution when using Android devices for sensitive tasks, and may even want to employ additional protective measures until Google addresses this bug and issues a patch that is compatible with both original Android and older versions of Android, in light of the severity of this privacy issue. 

The first DNS leak scenario, which occurs when the user changes the DNS server or switches to a different server, is easily mitigated if the VPN app is set to use a bogus DNS server at the same time. It has also failed to resolve the VPN tunnel reconnect DNS query leak, which is a significant issue for all other Android VPN apps because this issue is likely to affect all other VPN apps as well. 

Mullvad also discovered in October 2022 that, every time an Android device connected to a WiFi network, the device leaked DNS queries (such as IP addresses and DNS lookups), since the device was performing connectivity checks. Even when the "Always-on VPN" feature was enabled with the "Block connections without VPN" option enabled, Android devices still leaked DNS queries.

The leak of DNS traffic can potentially expose users' approximate locations and the online platforms they use as well as their precise locations, posing a serious threat to user privacy. Since this is a serious issue, it may be best to stop using Android devices for sensitive activities or to adapt additional safeguards to mitigate the risk of such leaks until Google fixes the bug and backports the patch to older versions of Android to mitigate the risk.
Read more »
Subscribe to: Posts (Atom)