now browsing by tag
Dear Annie: Racy photos, dating emails have girlfriend second-guessing her relationship | #facebookdating | #tinder | #pof | romancescams | #scams
Dear Annie: I’ve been with “Robby” for three years. I just moved in with him a few weeks ago, and I’ve been discovering some unpleasant surprises while using his computer. […] View full post on National Cyber Security
#cybersecurity | #hackerspace | Coronavirus Scams: Prepare for Phishing Emails, Fake Alerts and Cyberthreats
Wherever you turn for news coverage online, Coronavirus alarm bells are ringing louder.
But users should not trust all of those bells, as fake news, phishing scams and even malicious malware is actively being distributed under the Coronavirus umbrella.
Sadly, a perfect storm may be brewing. As government officials and health experts appeal louder for calm, the public is actually getting more worried and searching the Internet for answers. For example:
On Friday, January 31, fears slammed the U.S. stock market, according to Axios. “Stocks saw the worst sell-off in months on Friday: the Dow Jones Industrials Average dropped 603 points (2.1%), while the S&P 500 and the Nasdaq declined 1.7% and 1.5%, respectively. …”
Meanwhile, the BBC reported that the U.S. and Australia have joined Russia, Japan, Pakistan and Italy in closing their borders to all foreign nationals arriving from China. These actions were taken despite conflicting advice from global health officials. “Travel restrictions can cause more harm than good by hindering info-sharing, medical supply chains and harming economies,” the head of the World Health Organization (WHO) said on Friday.
At the same time, Bloomberg news reported that China Virus Cases May Be Undercounted Even With 3,000% Surge. “The number of confirmed cases of the new coronavirus in China has skyrocketed to more than 9,000, surpassing the official count during the SARS epidemic. …”
Coronavirus is a Bonanza for Online Scams and Fake News
As expected, the rapid spread of the Coronavirus, along with the expanded media coverage of surrounding events related to this global health emergency, has led to hoaxes and the spread of panic. According to CNN, “In Los Angeles County, public health officials warned residents Thursday that a letter claiming a potential coronavirus outbreak in Carson City is (Read more…)
View full post on National Cyber Security
- Hundreds of email IDs and plaintext passwords belonging to Indian organizations are available on the dark web.
- The emails may have been shared among crooks for quite some time, but this has just been discovered.
- It is time for crucial government entities to use 2FA, and even better, 2SV physical security keys.
Researcher Sai Krishna Kothapalli has found 3202 email IDs on the dark web, belonging to people working on the Indian government and various organizations of the state. The infosec expert has been collecting data from dumps on the dark web for the past four years, creating a humongous database of 1.8 billion email IDs and passwords. According to him, approximately 85% of the passwords he holds are in plain text form, while others have been dehashed by hackers throughout the years. After analyzing this trove of data, Kothapalli recently found some ending with “.gov.in”.
The 365 email IDs belong to employees of the ‘Indira Gandhi Centre for Atomic Research’. Trailing just behind is the ‘Bhabha Atomic Research Centre’ with 325 email IDs. In third place, there is the ‘Securities and Exchange Board of India’ with 157 emails. In total, the 3202 emails belonging to 12 entities, as shown in the graph below.
The researcher tried to correlate his findings with the “Have I Been Pwned” service and found no entries there, so this was a fresh discovery. The conclusion that he drew was that this data must be the product of a targeted phishing campaign since there were no recorded breaches. This means that the employees who have had their IDs and passwords stolen could be at risk of having their accounts taken over. The employees could have changed their passwords in the meantime, but the chances of stuffing attacks against other accounts belonging to the same people remain high.
The researcher is still investigating the data and is in the process of contacting the governmental organizations to alert them about his findings. He points out that when he started investigating this, he was approached by someone who posed as an NDTV reporter. After additional research, he discovered that the email accounts used to contact him had been compromised in the previous months and that the news from back in the time attributed this to North Korean hackers.
The North Korean hackers sent hacking emails to the former chairman of the Atomic Energy Commission of India(AECI) and the Secretary to the Government of India and the Director of the Bhabha Atomic Research Centre(BARC). pic.twitter.com/UCv01aCq2X
— IssueMakersLab (@issuemakerslab) November 2, 2019
So, could this all be the work of state-supported actors from North Korea? It’s quite possible, but nothing can be said with certainty until the investigation is concluded. Right now, the important part is to secure the email accounts by resetting the credentials as soon as possible. Also, and as the researcher points out in his report, it is high time for the government and its organizations to adopt two-factor authentication for the email accounts of their employees, or even better, physical security keys.
The post #deepweb | <p> Indian Government Emails Found Wandering on the Dark Web <p> appeared first on National Cyber Security.
View full post on National Cyber Security
Source: National Cyber Security – Produced By Gregory Evans Cybersecurity researchers claim 3,2020 government emails have been leaked. The report claimed that the email IDs of 11 departments, including the Bhabha Atomic Research Center and the Ministry of Information, exist on the dark web. Sai Krishna Kothapalli, an IIT-Guwahati alumnus and founder of the cybersecurity […] View full post on AmIHackerProof.com
Phishing is still a vector to attack presidential campaigns. Many 2020 candidate organizations still aren’t using best practice by implementing a proper DMARC policy.
It seems they’ve not learned from the hack on Hillary’s campaign. In 2016, John Podesta got tricked by a crude phish—and it easily could happen again.
Things are better now, but there’s still acres of room for improvement. In today’s SB Blogwatch, we dig their DNS records.
Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: a decade in three minutes.
Can You Spell DMARC?
What’s the craic, Zack? Mister Whittaker reports—“Only a few 2020 US presidential candidates are using a basic email security feature”:
DMARC, an email security protocol that verifies the authenticity of a sender’s email and rejects spoofed emails … could prevent a similar attack that hobbled the Democrats during the 2016 election. … Only Elizabeth Warren … Joe Biden, Kamala Harris, Michael Bloomberg, Amy Klobuchar, Cory Booker, Tulsi Gabbard and Steve Bullock have … improved their email security.
The remaining candidates, including … Donald Trump, are not rejecting spoofed emails. … That, experts say, puts their campaigns at risk from foreign influence campaigns and cyberattacks.
In the run-up to the 2016 presidential election, Russian hackers sent an email to Hillary Clinton campaign manager John Podesta, posing as a Google security warning. [It] tricked Podesta into … allowing hackers to steal tens of thousands of private emails.
Or perhaps you prefer a different topical angle? G’day, David Braue—“You may be targeting Black Friday bargains, but cybercriminals are targeting you”:
Security firms are warning shoppers to be careful online as cybercriminals increase their activity in the runup to [the] retail season. … Shoppers need to be particularly wary of online scams and malware propagated through emails spoofing legitimate retailers.
Despite efforts by the Australian Signals Directorate to promote the use of next-generation DMARC email anti-fraud tools … research suggests that just 45 percent of Australia’s biggest online retailers have actually begun implementing DMARC – and just 10 percent have adopted the strictest level of security.
Returning to this hemisphere, Agari’s Armen Najarian claims, “2020 Presidential Candidates Remain Vulnerable”:
The kinds of email attacks that helped derail Hillary Clinton’s candidacy in 2016 are only getting more sophisticated. [But some] campaigns are not taking the threat as seriously as they should.
Meanwhile, we’re seeing new trends in how cybercriminals execute … advanced threats, which are liable to throw an entire candidacy off-course. After all, it only requires one campaign employee or volunteer to click on one link in a malicious email.
It’s likely only a matter of time before the unthinkable happens once again. … The Mueller Report … squarely pointed to spear phishing as the primary attack vector for Russian hackers seeking to gain access.
Unfortunately, candidates must not only be concerned about email directed to them and their campaign staff. … Imagine the damage that can be done by emails that appear to come from the legitimate domain of the candidate, but actually come from a malicious criminal who uses that domain to spread false information to potential … donors, voters, and the media.
This is entirely possible, and likely even probable, unless candidates take the steps they need to protect against it by implementing DMARC with a p=reject policy.
DMARC: HOWTO? Chad Calease obliges—“A Definitive Guide”:
This is the time of year we’re all too aware how much phishing really sucks. … While technology isn’t able to catch all of it 100% of the time, DMARC is one of these important layers of defense that helps to dramatically minimize the amount of phishing emails that get through to our inboxes.
DMARC stands for Domain-based Message Authentication, Reporting & Conformance. [It] is a set of 3 DNS records that work together to ensure email is sent only from authorized … mail servers, thereby helping block fraudulent messages.
DMARC sets a clear policy for what to do if a message hasn’t been sent from an authorized source. … DMARC helps prevent criminals from spoofing the “header from” or “reply-to” address: … First it checks that the DKIM … digital signature is a match. Then it checks the SPF record to ensure the message came from an authorized server. If both DKIM and SPF pass these checks, DMARC delivers the message.
But if one or more of these tests fails, DMARC behaves according to a policy we set:
‘none’ [which] doesn’t impose any actions …
‘quarantine’ [which] Flags messages … to be directed to the recipients’ spam or junk folders …
‘reject’ [which] outright refuses messages that fail … (this is the end goal of a good DMARC configuration).
OK, so why aren’t all the candidates on board? Here’s lostphilosopher:
I see this as a reflection of the candidates ability to find and listen to experts. I don’t expect a candidate to understand how to do tech “right” – I’m in the industry and still get half of it wrong! However, when you’re running a multi million dollar campaign you can afford to bring in experts to set this stuff up and audit your practices.
I assume these candidates are already doing this and that if they are still not following some basic best practices it’s because they are actively ignoring the experts. … That’s what worries me: If they can’t find or listen to these people now, what makes me think they’ll be able to in office?
And this Anonymous commentator agrees:
Think about this for a second! If the … candidates don’t care enough about their own email traffic, why would anyone vote for them to secure this nation? If your own private info is easily up for grabs, what do you honestly think national security would be like under any of them?
But gl4ss spots an oint in the flyment:
If you rely on DMARC … and just trust it blindly then you know what? You’re gonna get ****ed by someone on whthouse.org.co.uk.acva.com.
Sure the email is sent from that domain, but so what? The domain isn’t right.
It was ever thus. Ryan Dunbar—@ryandunbar2—looks back:
In 1980 we knew internet email was not secure.
2003 get email SPF
2007 get email DKIM
2012 get DMARC
2019 get ARC, BIMI
2025 get QUIC, yet email will still not be secure.
2050 get internet3
Why does it look like the ones running the internet don’t want a secure internet?
Meanwhile, El Duderino knows who to blame:
This is Al Gore’s fault because he invented the internet.
10 Years; 100 songs; 3 minutes
Previously in And Finally
You have been reading SB Blogwatch by Richi Jennings. Richi curates the best bloggy bits, finest forums, and weirdest websites… so you don’t have to. Hate mail may be directed to @RiCHi or firstname.lastname@example.org. Ask your doctor before reading. Your mileage may vary. E&OE.
Image source: Tia Dufour (public domain)
View full post on National Cyber Security
#cyberfraud | #cybercriminals | How compromised emails enable cybercrime and real estate scams — Quartz
Source: National Cyber Security – Produced By Gregory Evans The CEO of an unidentified Swiss company was scammed out of nearly $1 million by a multinational fraud ring, according to a criminal complaint unsealed last week in federal court. The executive, who is identified in the filing only as “S.K.,” was in the process of […] View full post on AmIHackerProof.com
#nationalcybersecuritymonth | Do You Know How To Protect Yourself Against Phishing Emails? – University Times
Source: National Cyber Security – Produced By Gregory Evans Close Illustration by Lauren Dahncke Illustration by Lauren Dahncke Illustration by Lauren Dahncke National Cybersecurity Awareness month recently came to an end, but phishing emails never seem to. According to Cal State LA’s Information Technology Security, phishing emails are sent to the recipient with the purpose […] View full post on AmIHackerProof.com
Bejon Haswell/ Stuff
About 15 members of SeniorNet South Canterbury attended a presentation on the digital future delivered by SeniorNet Federation executive officer Grant Sidaway.
Technology is wasted on youth, SeniorNet Federation’s executive officer told Timaru members at a digital future presentation.
Grant Sidaway delivered a presentation to 15 members at Ara Institute last week and a collective gasp rung out as he showed a mind boggling pie graph of what occurred online over 60 seconds, on average, around the world.
This information showed 187 million emails were sent, $862,823 spent, 3.7 million google searches and 18 million texts sent in an average minute.
While the information opened SeniorNet tutor Bill Small’s eyes to how fast technology was moving, for Graeme Holwell, who is in his 80s, there was too much change and he found it hard to adjust.
He used a computer for communication with friends and family only.
“I’m not saying it’s (technology) not an advantage but gee,” he told Stuff.
Sidaway said technology became more useful as people got older and it saved money. A smart speaker at a cost of between $60-$100 used with wifi, saved a user having to get into a computer, as it was voice activated.
“How useful is that if you have arthritis? . . It is an example of how technology has shifted.”
The device, with a hub, could be used to automate a home, making curtains shut or heaters turn on at the sound of a voice.
He said 30 years ago people had to be “geeks” to understand a computer whereas now they were much simpler and available to anyone.
SeniorNet has between 12,000 and 15,000 members throughout the country. The Timaru branch based in the Confucius Institute Resource Centre at Ara Institute runs workshops on different aspects of technology and online safety.
The fears many older people had of being online Sidaway allayed because for the majority of people who followed proper protocols it was a really safe environment.
SeniorNet worked alongside Cyber Security New Zealand and taught members about password protection and how to spot a scam.
Building confidence and skills in older users, so they could teach each other were some of the aims of SeniorNet. Young people often were not patient teaching parents or grandparents, Sidaway said.
“OIder people are afraid they’ll make a fool of themselves in the eye of young people.”
He told the group that technology reduces social isolation and offered independence to those not so mobile, through networking, online shopping and banking. It was estimated that an average user in a big city could save $1000 a year by not having to drive and pay to park to carry out their errands.
SeniorNet South Canterbury chair Dick Dodds said he found the presentation interesting especially about what technology was available.
Cyber Smart Week, from October 14-18, aims to raise awareness of cyber security and help people understand how to keep safe online.
#infosec #itsecurity #hacking #hacker #computerhacker #blackhat #ceh #ransomeware #maleware #ncs #nationalcybersecurityuniversity #defcon #ceh #cissp #computers #cybercrime #cybercrimes #technology #jobs #itjobs #gregorydevans #ncs #ncsv #certifiedcybercrimeconsultant #privateinvestigators #hackerspace #nationalcybersecurityawarenessmonth #hak5 #nsa #computersecurity #deepweb #nsa #cia #internationalcybersecurity #internationalcybersecurityconference #iossecurity #androidsecurity #macsecurity #windowssecurity
The post #computersecurity | 187 million emails sent every 60 seconds SeniorNet boss tells Timaru appeared first on National Cyber Security.
View full post on National Cyber Security
Senators belonging to the minority bloc on Thursday exposed hacking incidents that compromised e-mail accounts of some of their staff members, which they said appeared to link the Liberal Party and opposition groups to the Duterte administration’s narrative of a destabilization plot.
At a press briefing, Sen. Bam Aquino revealed that at least five e-mail accounts of his and Sen. Francis Pangilinan’s staff members were compromised and that the hacking incident happened as early as March 21 this year.
All e-mail accounts were accessed through the network in the Senate and the nature of the breach in all instances were the same—that unauthorized users sent e-mails using the staff and party addresses.
Aquino said they only discovered the breach in the e-mail accounts on the third incident on Sept. 26 when his staff found a dubious e-mail in his draft folder with the subject “Leaked Media Plan to Destroy PRRD,” referring to President Duterte.
“He opened his e-mail on that day and found in his draft folder an entry pertaining to a destabilization plot that he did not write,” Aquino told reporters.
This discovery led them to track down two previous hacking incidents involving the e-mail accounts of two of Pangilinan’s staff members, which occurred on March 21 and Sept. 7, he said.
In the first incident, the hacker sent an e-mail to opposition members with the subject “The investigation on DDS,” referring to so-called Davao Death Squad while the second incident involved an e-mail to the Government Service Insurance System asking if the agency had changed its website domain.
The last two recent incidents occurred on Wednesday, both in the offices of Aquino and Pangilinan.
An initial check to hunt those behind the hacking incidents showed that the Internet Protocol (IP) address used was based in the United States and all the rest were in the Philippines.
“It could mean that the hackers are really based in the US or just using a VPN (virtual private network) to cover their tracks,” said the senator.
The post Hackers break into e-mails of LP senators’ staffers appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
Better Business Bureaus across the country, including BBB serving the Northwest, have been receiving several calls and messages about emails businesses have been receiving. Scammers are using the BBB name and a logo indicating they have violated various federal laws such as “Fair Labor Standards Act” or “Safety and Health…
View full post on National Cyber Security Ventures