now browsing by tag
Source: National Cyber Security – Produced By Gregory Evans Introduction When it comes to quickly making wide-ranging modifications to Windows systems, Group Policy is usually at the top of the list for ease-of use and raw power. The problem is that most people think of Group Policy as this all-encompassing voodoo that is only for […] View full post on AmIHackerProof.com
Source: National Cyber Security – Produced By Gregory Evans Federal investigators on Friday arrested a Virginia man accused of being part of a neo-Nazi group that targeted hundreds of people in “swatting” attacks, wherein fake bomb threats, hostage situations and other violent scenarios were phoned in to police as part of a scheme to trick […] View full post on AmIHackerProof.com
#cybersecurity | #hackerspace | Trusted Computing Group Honors KIOXIA’s Hiroshi Isozaki for Contributions to Standards Development
SAN JOSE, Calif.–(BUSINESS WIRE)–The drive to secure and protect data in PCs and data centers shows no signs of slowing down, and KIOXIA continues to lead the way when it comes to SSD security. KIOXIA America, Inc. (formerly Toshiba Memory America, Inc.) today announced that Hiroshi Isozaki, chief specialist for KIOXIA Corporation, has been honored … Continue reading “Trusted Computing Group Honors KIOXIA’s Hiroshi Isozaki for Contributions to Standards Development”
The post Trusted Computing Group Honors KIOXIA’s Hiroshi Isozaki for Contributions to Standards Development appeared first on Trusted Computing Group.
*** This is a Security Bloggers Network syndicated blog from Trusted Computing Group authored by TCG Admin. Read the original post at: https://www.businesswire.com/news/home/20191218005120/en/Trusted-Computing-Group-Honors-KIOXIA%E2%80%99s-Hiroshi-Isozaki#new_tab
View full post on National Cyber Security
Source: National Cyber Security – Produced By Gregory Evans The Institute of Electrical and Electronics Engineers recently announced its 2020 IEEE Fellows, with numerous Indian American and South Asian-origin engineers making the cut. IEEE Fellowships are conferred by the IEEE Board of Directors upon a person with an outstanding record of accomplishments. The total number […] View full post on AmIHackerProof.com
Cybersecurity services provider Fishtech Group, which has a Top 200 MSSP arm, has announced plans to open a 10,000-square-foot Cyber Defense Center (CDC) in Rogers, Arkansas.
Fishtech’s Arkansas CDC will complement the company’s CDC in Martin City, Missouri. It will initially house 20 employees and expand to host up to 100 onsite staff, the company stated.
Also, the new CDC will be run by Fishtech CISO Kerry Kilker, a former Walmart executive who joined the company earlier this year. It is expected to open in the second quarter of next year.
Fishtech’s Arkansas CDC will bring cybersecurity training, technology and resources to Northwest Arkansas, the company said. In doing so, the CDC will help organizations bridge the cybersecurity resource and talent gap.
Approximately 58 percent of enterprises have unfilled cybersecurity positions, according to the 2019 “State of Cybersecurity” survey from information security organization ISACA. Furthermore, 62 percent of survey respondents said they have to wait three to six months to fill open cybersecurity positions.
Fishtech Joins the OneLogin Accelerate Partner Program
In addition to announcing plans to open a new CDC, Fishtech in April joined the OneLogin Accelerate identity and access management (IAM) partner program. Fishtech has incorporated the OneLogin unified access management (UAM) platform into its offerings and added IAM solutions to its portfolio.
Fishtech provides data-driven cybersecurity solutions designed to help organizations identify security gaps and comply with industry mandates, the company indicated. It also partners with other cybersecurity companies to deliver on-premises and cloud security solutions.
The post Fishtech Group Preps North Arkansas Cyber Defense Center appeared first on National Cyber Security.
View full post on National Cyber Security
Officials from Serbia recently detained a Belgrade resident who’s doubted as belonging to a hacking group named DarkOverlord or The Dark Overlord.
The resident, a man aged 38, uses the initials “S.S” for his name and is a Belgrade citizen.
Except for these, nothing about his identity is known.
The Federal Bureau of Investigation has kept silent giving no remarks about the arrest. However, Serbian officials state they executed the detention when they were conducting an operation for exposing the people using the moniker “The Dark Overlord” online.
Running active from 2016, DarkOverlord has gained notoriety for hacking schools and medical providers to seize their personal files followed with blackmailing the institutions into paying money if they don’t want their information to be sold on the underground world. Earlier, the hackers had apparently seized addresses, phone numbers and Social Security Numbers belonging to innumerable medical patients that could’ve been utilized for committing ID-theft. In.pcmag.com posted this, May 17, 2018.
Beginning from June 2016, The Dark Overlord infiltrated the systems of 50-or-so victims, stealing a variety of data such as intellectual property and crucial health information followed with demanding ransoms in exchange of leaving the filched data safe.
The hackers’ syndicate is well-known with regards to executing one cyber-crime series spanning 2-yrs and comprising extortion along with hacking followed with revealing episodes contained in a Netflix sequence namely “Orange-is-the-New-Black” and also breaking into U.S. school computers as well as threatening the country’s students with murder.
At times the crooks weren’t satisfied with hacking they’d start physical violence threat against the hacked entities. During 2017, an infamous campaign carried out in USA included breach of systems of high schools and then theft of personal data to be followed with holding those data for ransoms. And in case the schools did not pay up, the gang would find out the contact details of staff and students from the filched data and then threaten them.
It’s not clear whether The Dark Overlord group consists of one person or several individuals. However on Twitter, it frequently uses the words “us” and “we” as reference to the gang while blackmailing hacked victims.
View full post on National Cyber Security Ventures
THIS WEEK, SAKS Fifth Avenue, Saks Off 5th, and Lord & Taylor department stores—all owned by The Hudson’s Bay Company—acknowledged a data breach impacting more than five million credit and debit card numbers. The culprits? The same group that’s spent the last few years pulling off data heists from Omni Hotels & Resorts, Trump Hotels, Jason’s Deli, Whole Foods, Chipotle: A mysterious group known as Fin7.
Data breaches dog consumers every day, whether they’re ordering food from Panera, or tracking their nutrition with an Under Armour app. But if you’ve particularly had your credit card number stolen from a restaurant, hotel, or retail store in the past few years, you may have experienced FIN7 up close.
While lots of criminal hacking gangs are simply out to make money, researchers regard FIN7 as a particularly professional and disciplined organization. The group—which often appears to be Russian-speaking, but hasn’t been tied to a home country—generally works on a normal business schedule, with nights and weekends off. It has developed its own malware tools and attack styles, and seems to have a well-funded research and testing division that helps it evade detection by antivirus scanners and authorities more broadly. In the Saks breach, FIN7 used “point of sale” malware—software secretly installed in the cash register transaction systems customers interact with—to lift the financial data, a signature move.
“They’re connected to almost every major point of sale breach,” says Dmitry Chorine, cofounder and CTO of Gemini Advisory, a threat intelligence firm that works with financial institutions and that first reported the Saks/Lord & Taylor breach. “From what we’ve learned over the years the group is operated as a business entity. They definitely have a mastermind, they have managers, they have money launderers, they have software developers, and they have software testers. And let’s not forget they have the financial means to stay hidden. They make at least $50 million every month. Given that they’ve been in business for many years, they probably have at least a billion dollars on hand.”
Researchers have carefully tracked FIN7 for years, identifying their tools and watching their techniques evolve and advance. And many of the observers have even gone head-to-head with the group during network attacks, learning the group’s ethos by actively sparring with it.
The anonymity of cyberspace makes it difficult to pin down exactly who commits which crimes, though, and whether they’re actually all part of the same group or simply using similar tools.
As a result, FIN7 is known by many names. Many. The “FIN7” name itself is often associated with retail and hospitality credit card number heists, while another group—perhaps another division of the same entity, or a pre-existing gang that FIN7 spun off from—focuses on targeting financial organizations to directly steal and launder money. This bank heist operation has been called Carbanak or Cobalt (after a tool called Cobalt Strike), or some variation; FIN7 is sometimes called by these names as well. The security firm Crowdstrike also has its own versions of the names, Carbon Spider and Cobalt Spider. Carbon Spider targets the retail and hospitality industries; and Cobalt Spider hits financial institutions and ATMs. Adding to the confusion, Gemini Advisory also sometimes calls FIN7 “JokerStash,” after the dark web marketplace where the group sells the credit card data is steals.
It’s a mess. But while it’s virtually impossible to know the exact breakdown, all of these actors evolved from malware campaigns between 2013 and 2015 that used the banking trojans Carberp and Anunak to attack financial institutions. “There’s definitely a relationship between what we call Carbon Spider and Cobalt Spider,” says Adam Meyers, vice president of intelligence at the security firm CrowdStrike. “There’s some overlap in the malware that’s used and there are a lot of theories. Did Carbon Spider split from Cobalt? Do they have shared tooling? Did somebody leave the group and bring some of the tools with them?”
Regardless of the name, FIN7’s effectiveness stems from a rigorous, professional approach—including devious phishing schemes that trick victims into infecting their own networks—that researchers say is more typical of nation state hacking than criminal skulduggery. The group has also demonstrated a powerful ability to quickly evolve new strategies and adapt tools. Last fall, the security firm Morphisec showed that it only took FIN7 a day to create a fileless malware attack for a newly discovered weakness in Microsoft applications.
“The feeling you get working against them on an incident response team is that they aren’t going down without a fight,” says William Peteroy, CEO of the security firm Icebrg, which has helped clients remediate FIN7 attacks. “They are very committed to getting access to certain targets, they are very committed to maintaining access to those targets, and it’s for the overall goal of pulling as much credit card data out of the environment as they can. They’re not the best-trained, best operations security people on the internet, but they are professional. They go to work in the morning and their job is to steal credit card numbers.”
Based on Icebrg’s research and firsthand experience, Peteroy sees the group’s focus on evading antivirus scans as one of its biggest assets. FIN7 constantly tests its hacking tools against malware scanners to see if they raise an alarm, and tweaks them if they do to fly under the radar for another day.
“They have a pretty incredible track record of staying one step ahead of antivirus vendors,” Peteroy says. “They do constant testing of their toolsets. You would not expect to see a technique like that from a criminal organization. But it’s really just like a business maximizing your profitability. You’re not trying to develop things that are 10 steps ahead, you’re just trying to keep one step ahead.”
So far FIN7 has largely succeeded at staying just out of reach, but it works at such a massive scale on so many heists at once that there are bound to be missteps. Just last week, Spanish police working with Europol, the FBI, and a group of other international agencies arrested what they called the “mastermind” behind Carbanak’s financial institution hacking, particularly a spree of ATM jackpotting and other money laundering. “The arrest of the key figure in this crime group illustrates that cybercriminals can no longer hide behind perceived international anonymity,” Steven Wilson, the head of Europol’s European Cybercrime Centre, said of the operation last week.
Though an impressive step, researchers are skeptical that the arrest will really destabilize or neuter such a robust criminal syndicate. “Someone who was using part of the tools was arrested in Spain. He may be at a higher level of the food chain, but it definitely doesn’t necessarily mean the whole group has been dismantled,” says Gemini Advisory’s Chorine. “Even if you observe the chatter on criminal forums, there’s no clear indication of who was arrested.”
So as has been the case for years now, FIN7 will likely live to steal another credit card number. Or, more likely, millions of them.
The post THE #BILLION-DOLLAR #HACKING GROUP BEHIND A #STRING OF BIG #BREACHES appeared first on National Cyber Security Ventures.
View full post on National Cyber Security Ventures
Source: National Cyber Security News
A Russian-backed hacker group known for many high-level cyber attacks was able to infiltrate the German government’s secure computer networks, the dpa news agency reported Wednesday.
Dpa cited unidentified security sources saying the group APT28 hacked into Germany’s foreign and defence ministries and managed to steal data.
The attack was noticed in December and may have lasted a year, dpa reported.
The Interior Ministry said in a statement that “within the federal administration the attack was isolated and brought under control.” The ministry said it was investigating.
A spokesman wouldn’t give further details, citing the ongoing analysis and security measures being taken.
“This case is being worked on with the highest priority and considerable resources,” the ministry statement said.
APT28, which has been linked to Russian military intelligence, has previously been identified as the likely source of an attack on the German Parliament in 2015, as well as on NATO and governments in eastern Europe.
Also known by other names including “Fancy Bear,” APT28 has also been blamed for hacks of the U.S. election campaign, anti-doping agencies and other targets.
View full post on National Cyber Security Ventures