Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label online threats. Show all posts
Spear Phishing
AI threats Business Email Compromise CISOs Cyber Security Email Safety Generative AI Impersonation online threats Security Policies Spear Phishing

Adapting Cybersecurity Policies to Combat AI-Driven Threats

 

Over the last few years, the landscape of cyber threats has significantly evolved. The once-common traditional phishing emails, marked by obvious language errors, clear malicious intent, and unbelievable narratives, have seen a decline. Modern email security systems can easily detect these rudimentary attacks, and recipients have grown savvy enough to recognize and ignore them. Consequently, this basic form of phishing is quickly becoming obsolete. 

However, as traditional phishing diminishes, a more sophisticated and troubling threat has emerged. Cybercriminals are now leveraging advanced generative AI (GenAI) tools to execute complex social engineering attacks. These include spear-phishing, VIP impersonation, and business email compromise (BEC). In light of these developments, Chief Information Security Officers (CISOs) must adapt their cybersecurity strategies and implement new, robust policies to address these advanced threats. One critical measure is implementing segregation of duties (SoD) in handling sensitive data and assets. 

For example, any changes to bank account information for invoices or payroll should require approval from multiple individuals. This multi-step verification process ensures that even if one employee falls victim to a social engineering attack, others can intercept and prevent fraudulent actions. Regular and comprehensive security training is also crucial. Employees, especially those handling sensitive information and executives who are prime targets for BEC, should undergo continuous security education. 

This training should include live sessions, security awareness videos, and phishing simulations based on real-world scenarios. By investing in such training, employees can become the first line of defense against sophisticated cyber threats. Additionally, gamifying the training process—such as rewarding employees for reporting phishing attempts—can boost engagement and effectiveness. Encouraging a culture of reporting suspicious emails is another essential policy. 

Employees should be urged to report all potentially malicious emails rather than simply deleting or ignoring them. This practice allows the Security Operations Center (SOC) team to stay informed about ongoing threats and enhances organizational security awareness. Clear policies should emphasize that it's better to report false positives than to overlook potential threats, fostering a vigilant and cautious organizational culture. To mitigate social engineering risks, organizations should restrict access to sensitive information on a need-to-know basis. 

Simple policy changes, like keeping company names private in public job listings, can significantly reduce the risk of social engineering attacks. Limiting the availability of organizational details helps prevent cybercriminals from gathering the information needed to craft convincing attacks. Given the rapid advancements in generative AI, it's imperative for organizations to adopt adaptive security systems. Shifting from static to dynamic security measures, supported by AI-enabled defensive tools, ensures that security capabilities remain effective against evolving threats. 

This proactive approach helps organizations stay ahead of the latest attack vectors. The rise of generative AI has fundamentally changed the field of cybersecurity. In a short time, these technologies have reshaped the threat landscape, making it essential for CISOs to continuously update their strategies. Effective, current policies are vital for maintaining a strong security posture. 

This serves as a starting point for CISOs to refine and enhance their cybersecurity policies, ensuring they are prepared for the challenges posed by AI-driven threats. In this ever-changing environment, staying ahead of cybercriminals requires constant vigilance and adaptation.
Read more »
Scams
malware Malware attacks Minecraft Source Packs online gaming scams online threats Scams

Malware Lurking in Minecraft Source Packs

In the world of gaming, customization is king. Players love tweaking their favourite games to make them even more exciting. But while mods and customizations can enhance your gaming experience, they can also hide dangerous threats. A new version of this malware (identified as d9d394cc2a743c0147f7c536cbb11d6ea070f2618a12e7cc0b15816307808b8a) was recently found concealed within a WinRAR self-extracting archive, cunningly masquerading as a Windows screensaver. Enter zEus, a sneaky malware that is making its way into Minecraft source packs. 


Let's Understand In Detail How It Works

Unsuspecting players download what seems like a harmless source pack, only to find themselves unknowingly installing zEus onto their systems. Once activated, the malware gets to work, stealing sensitive data and sending it off to a Discord webhook, where the perpetrators eagerly await their ill-gotten gains. But the trickery doesn't stop there. 

The self-extract file not only runs the malicious software but also opens an innocuous-looking image file, featuring the word "zEus." This simple image serves as a distraction while the malware does its dirty work in the background. It's a cautionary tale for gamers everywhere: be vigilant when downloading mods and source packs, especially from unverified sources. Stay safe by sticking to reputable platforms and avoiding suspicious links and downloads. After all, in the world of gaming, it is not just high scores you need to watch out for—it is also stealthy malware like zEus. 

When zEus malware is executed, it first checks if it's being analyzed. If not, it collects sensitive data and deploys script files for flexibility. It creates folders in C:\ProgramData to store stolen data and malicious scripts. To avoid detection, it compares computer names and running processes against blacklists. The malware steals various information, storing each piece in text files within corresponding folders. 

It grabs IP details using online tools and collects hardware info using command-line utilities and PowerShell. It also targets browsers like Chrome and Firefox, copying login data, cookies, history, and bookmarks. Additionally, zEus steals login data from software like Steam and Discord and searches for Discord backup codes. It copies .ldb files from Discord's Local Storage, extracting account details. It also gathers data from game-related folders to understand the victim's interests. 

After collecting data, it compresses it into a zip file and deletes the original folders. The malware sends the zip file and system information like execution date, username, processor, and antivirus software. It also checks for cryptocurrency wallets and searches for files with keywords related to login mechanisms and sensitive data.
Read more »
Threat Landscape
Artificial Intelligence Cyber Security Machine learning online threats Threat Landscape

How Can Businesses Use AI to Strengthen Their Own Cyber Defence?

 

We are at a turning point in the development of cybersecurity. When generative AI models like ChatGPT first gained widespread attention, their promise to protect networks from hackers was only matched by its potential to aid hackers. Although a diverse array of cutting-edge cybersecurity technologies have lately been launched by technology companies, the size and sophistication of threat actors continue to rise. 

In order to ensure the utmost protection of data transmission, storage, and access, which is a critical component of the fight against cyberattacks, cybersecurity practices are put into place here. 

How to use AI in the cybersecurity sector 

In many sectors, including cybersecurity, AI has many benefits and uses. AI may help businesses by staying up-to-date in terms of security, which is advantageous given the quickly growing nature of cyberattacks and the emergence of sophisticated attacking mediums.

Compared to manual methods and conventional security systems, AI can automate threat detection and offer a more efficient response. This aids organisations in maximising their cybersecurity defences and avoiding emerging threats. Here are a few major advantages of utilising AI in the field of cyber security.

Threat detection: Businesses can tremendously benefit from AI-based cybersecurity practices in identifying cyber threats and disruptive activities by cyber criminals. In fact, the proliferation of new malware is happening at an alarming rate, making it extremely challenging for traditional software systems to keep up with the evolving threat landscape. 

AI algorithms, however, discover patterns, recognize malware and find any unauthorised activities done before they impact a system. This makes AI a valuable tool for protecting against cybercrime and maintaining the security of business operations. 

Bot defence: The defence against bots is one more area where AI is used to counter digital threats. Bots create a substantial portion of online traffic in today's virtual world, some of which may be security risks. Cybercriminals employ bots, also known as automatic scripts or software, to launch attacks on websites, networks, and systems. 

Additionally, detrimental acts like Distributed Denial of Service (DDoS) attacks, account takeovers, and the scraping of private data can all be carried out via bots. 

Phishing detection: By identifying complex phishing attempts, AI can significantly improve the cybersecurity landscape. Incoming emails and communications can be analysed and categorised by machine learning models powered by AI to determine whether they are authentic or fake.

AI can search for words, phrases, and other indicators that are frequently linked to phishing assaults by utilising natural language processing techniques. The ability for security teams to quickly detect and handle potential risks minimises the possibility of a successful phishing attack. 

AI cybersecurity limitations 

Despite their increasing sophistication, AI systems are still constrained by their knowledge base. These systems are potentially impotent in the face of unforeseen or complex dangers that lay outside of their specified domain because they can only operate with the help of their trained data sets. 

Furthermore, these restrictions make them vulnerable to false positives and false negatives, making it easier for unknown threats and needless signals to take place. 

The existence of ingrained biases and the resulting discrimination is a serious threat AI systems must contend with. These biases can result from imbalanced data sets or flawed algorithms, leading to biassed or erroneous judgements that could have catastrophic repercussions. 

Finally, an over-reliance on AI systems poses a serious risk since it can cause dangerous complacency and, eventually, a false sense of security. This could subsequently result in a disappointing lack of attention being paid to other essential facets of cybersecurity, like user education, the application of laws, and regular system updates and patches.
Read more »
Technology
Cloud Devices IoT online threats Remote Work Technology

Remote Work and the Cloud Create Various Endpoint Security Challenges

At the recent Syxsense Synergy event, cybersecurity experts delved into the ever-evolving challenges faced by security and endpoint management. With the increasing complexity of cloud technologies, advancements in the Internet of Things, and the widespread adoption of remote work, the landscape of cybersecurity has become more intricate than ever before. 

These experts shed light on the pressing issues surrounding this field. Based on a survey conducted by the Enterprise Strategy Group (ESG), it has been discovered that the average user presently possesses approximately seven devices for both personal and office use. 

Moreover, the ESG survey revealed a notable connection between the number of security and endpoint management tools employed within an enterprise and the frequency of breaches experienced. Among the organizations surveyed, 6% utilized fewer than five tools, while 27% employed 5 to 10 tools. 33% of organizations employed 11 to 15 tools, whereas the remaining organizations implemented more than 15 tools to manage their security and endpoints. 

Understand the concept of Endpoints and why their security is important while working remotely?

Endpoints encompass various physical devices that establish connections with computer networks, facilitating the exchange of information. These devices span a wide range, including mobile devices, desktop computers, virtual machines, embedded devices, and servers. 

Additionally, endpoints extend to Internet-of-Things (IoT) devices such as cameras, lighting systems, refrigerators, security systems, smart speakers, and thermostats. When a device establishes a network connection, the transmission of information between the device, such as a laptop, and the network can be linked to a conversation taking place between two individuals over a phone call. 

Endpoints are attractive targets for cybercriminals due to their vulnerability and their role as gateways to corporate data. As the workforce becomes more distributed, protecting endpoints has become increasingly challenging. Small businesses are particularly vulnerable, as they can serve as entry points for criminals to target larger organizations, often lacking robust cybersecurity defenses. 

Data breaches are financially devastating for enterprises, with the global average cost being $4.24 million and $9.05 million in the United States. Remote work-related breaches incur an additional average cost of $1.05 million. The majority of breach costs are attributed to lost business, including customer turnover, revenue loss from system downtime, and the expenses of rebuilding reputation and acquiring new customers. 

With the increasing mobility of workforces, organizations face a range of endpoint security risks. These common threats include: 

Phishing: A form of social engineering attack that manipulates individuals into divulging sensitive information. 

Ransomware: Malicious software that encrypts a victim's data and demands a ransom for its release.

Device loss: Leading to data breaches and potential regulatory penalties, lost or stolen devices pose significant risks to organizations. 

Outdated patches: Failure to apply timely software updates leaves systems vulnerable, enabling exploitation by malicious actors. 

Malware ads (malvertising): Online advertisements are used as a medium to distribute malware and compromise systems. 

Drive-by downloads: Automated downloads of software onto devices without the user's knowledge or consent. 

According to Ashley Leonard, Syxsense founder, and CEO, the biggest reason behind increasing challenges related to endpoint security is lack of training. “If people are not properly trained and grooved in on their endpoint and security tools, you are going to find devices and systems misconfigured, not maintained properly, and with critical patches undeployed. Training is vital, but it is much easier to train people on a single tool,” he further added.
Read more »
Youtube
Cybersecurity email security online threats Phishing scam Youtube

Don't Get Hooked: How Scammers are Reeling in YouTube Users with Authentic Email Phishing

YouTube phishing scam

Are you a YouTube user? Beware of a new phishing scam that has been making rounds lately! In recent times, YouTube users have been targeted by a new phishing scam. The scammers use an authentic email address from YouTube, which makes it difficult to differentiate between a genuine email and a fraudulent one. 

What is a phishing scam?

Phishing scams are fraudulent attempts to obtain sensitive information, such as usernames, passwords, and credit card details, by disguising themselves as trustworthy entity in electronic communication. Typically, scammers use social engineering techniques to trick users into clicking on a malicious link or downloading malware.

What is the new YouTube phishing scam?

The new YouTube phishing scam involves the use of an authentic email address from YouTube. The email appears to be from YouTube's support team, and it informs the user that their channel is at risk of being deleted due to a copyright infringement violation. 

The email contains a link to a website where the user is asked to enter their YouTube login credentials. Once the user enters their login credentials, the scammers can access the user's account and potentially steal sensitive information or perform unauthorized actions.

How to identify the new YouTube phishing scam?

The new YouTube phishing scam is difficult to identify because the email address used by the scammers appears to be genuine. However, there are a few signs that you can look out for to identify the scam:

  • Check the sender's email address: Even though the email address appears to be genuine, you should always check the sender's email address carefully. In most cases, scammers use a similar email address to the genuine one but with a few minor differences.
  • Check the content of the email: The new YouTube phishing scam typically informs the user that their channel is at risk of being deleted due to a copyright infringement violation. However, if you have not received any copyright infringement notice, then you should be cautious.
  • Check the link in the email: Always check the link in the email before clicking on it. Hover your mouse over the link and check if the URL is genuine. If you are unsure, do not click on the link.

How to protect yourself from the new YouTube phishing scam?

To protect yourself from the new YouTube phishing scam, follow these tips:

  • Enable two-factor authentication: Two-factor authentication adds an extra layer of security to your account. Even if the scammers obtain your login credentials, they will not be able to access your account without the second factor of authentication.
  • Do not share your login credentials: Never share your login credentials with anyone, even if the email appears to be from a genuine source.
  • Report suspicious emails: If you receive a suspicious email, report it to YouTube immediately. This will help to prevent other users from falling victim to the scam.
  • Keep your software up to date: Keep your operating system and software up to date to ensure that you have the latest security patches and updates.

Stay cautious

The new phishing scam using an authentic email address is a serious threat to YouTube users. However, by following the tips mentioned in this blog, you can protect yourself from falling victim to the scam. Always be vigilant and cautious when dealing with emails that request sensitive information. Remember, if you are unsure, do not click on the link.


Read more »
TikTok
Cyber Attacks Cyberthreats online threats social media risks TikTok

Expert Suggested Ban on TikTok for Government-issued Phones in Australia

The Australian government recently decided to stop their employees from using TikTok, which is an app that lets people make and share short videos. The government is worried that the company that owns TikTok has connections to the Chinese government and that the Chinese government could get access to information about TikTok users. 

Following the action, some experts think that it is a good idea to ban TikTok, and they also think other social media apps should be banned too. Furthermore, an increasing number of government agencies in Australia are taking action to prohibit the use of the widely-used ByteDance app. 

This is due to heightened security concerns surrounding the app's connection to China, prompting worries about potential risks and threats to national security. 

“I don’t think it’s as simple as TikTok – bad; American companies – good, I think they’re all bad,” Professor Vanessa Teague, a cybersecurity researcher at the Australian National University reported. 

The Canberra Times newspaper has reported that almost half of the government agencies in Australia have stopped their employees from using TikTok on devices owned by the government. 

Teague mentioned that although Apple and Google offer users more control over what data they share with social media apps, these apps can still gather a significant amount of information on their users.

“It’s all well and good to turn off location permission, but if you then upload a photo or a video that has your GPS coordinates … then you told them where you are, so it’s better but it doesn’t completely solve the problem…,” Teague told. “…I don’t actually think they’re really solving the problem unless they’re solving the problem of Australians’ privacy and security, which would mean strong privacy laws, better education, encouragement of end-to-end encryption, and an end to this nonsense that encryption is only for paedophiles.”

Although many people are mainly worried about TikTok, the Department of Home Affairs is looking at all social media apps to see if they are safe to use or not. The home affairs minister has asked for this review, and the report will be ready in the first three months of this year. 
Read more »
Subscribe to: Posts (Atom)