now browsing by tag


Tinder #vulnerability allows #hackers to take over #accounts with just one #phone number

Source: National Cyber Security News

After it was reported last month that online dating app Tinder had a security flaw, which allows strangers to see users’ photos and matches, security firm, Appsecure has now uncovered a new flaw which is potentially more damaging.

Infiltrators who exploit the vulnerability will be able to get access to users’ account with the help of their login phone number. The issue has, however, been fixed after Tinder was alerted by Appsecure.

Appsecure says, the hackers could have taken advantage of two vulnerabilities to attack accounts, with one being Tinder’s own API and the other in Facebook’s Account Kit system which Tinder uses to manage the logins.

In a statement sent to The Verge, a Tinder spokesperson said, “Security is a top priority at Tinder. However, we do not discuss any specific security measures or strategies, so as not to tip off malicious hackers.”

The vulnerability exposed the access tokens of the users. If a hacker is able to obtain a user’s valid access token then he/she can easily take over a user account.

“We quickly addressed this issue and we’re grateful to the researcher who brought it to our attention,” The Verge quoted a Facebook representative as saying.

Read More….


View full post on National Cyber Security Ventures

Cyber security #lessons we can we #take into #2018

Source: National Cyber Security – Produced By Gregory Evans

If 2017 is remembered for anything in the cyber sphere, it is remembered as the year of malware. 
There have been quite a few high-profile breaches and ransomware campaigns such as WannaCry and NotPetya. The question is, what can we learn from last year to improve things for this year?

One thing is clear: ransomware is evolving and is being deployed with more regularity. While targets, attack groups and tactics may change, there is growing concern that ransomware could easily be combined with nation-state developed exploits to spread through networks at an alarming rate. An example of this would be the Bad Rabbit attacks which were specifically designed to infect a large number of networks, using watering hole attacks.

“What we are learning from these attacks is that it is vital to patch any known vulnerabilities the moment a fix is available. At the same time, it’s important that we understand how security can be undermined and to research the exploits that are available for popular software,” advises Anvee Alderton, channel manager at Trend Micro Southern Africa.

Business Email Compromise (BEC) is also one of the major threats that many organisations may encounter. The FBI reported that between October 2013 and December 2016, $5,3-billion was lost due to BEC. Predictions are that this number may increase to $9-billion this year.

“BEC is actually one of the easiest attacks to prevent. BEC relies on social engineering and with better staff education and something as simple as ensuring two finance managers need to sign off on the transfer of large sums can mitigate the damage that such attacks could incur,” Alderton continues.

Last year saw big name firms such as Yahoo, Uber and Equifax come under attack. What this has highlighted is that it’s important to get the basics of cybersecurity right — no matter what size your organisation. The cost financially, as well as to a company’s reputation, can be irreparable.

Another great concern is the advent of the implementation of GDPR across Europe. Worryingly, a lack of interest from senior executives means that more than half shun responsibility for it. This is of particular concern since organisations have to comprehend what data they hold and be able to produce a breach notification plan. This is in addition to implementing top shelf technology to prevent cyber-attack.

“It really doesn’t matter when it comes to the size of the firm or whether the breach occurs through IoT or the cloud, or through social engineering. Vulnerabilities are the biggest threat all companies face. If there’s a hole in your security, someone will find a way through it. Use those patches as soon as they become available and educate staff. There is no better cure for attack than prevention and being prepared,” says Alderton.

New vulnerabilities and attack methods emerge daily — some of which could be devastating for the security of a company’s networks and systems. This is the year for CISOs to become hypervigilant and ensure that they have the right patch available at the right time, as well as the ability to respond to threats swiftly and efficiently.

The post Cyber security #lessons we can we #take into #2018 appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

Here is #why you need to take #Cybersecurity #seriously

Source: National Cyber Security – Produced By Gregory Evans

There is no doubt that there are numerous threats to organisations worldwide, and that it can seem increasingly difficult to manage your chances adequately. Whereas many years ago cyber-attacks were a rare warning sign, nowadays cybersecurity has increased in danger and frequency.

It seems that every day you can encounter another article on the topic, and this has managed to create a real and significant concern for both small and large organisations. More and more people are turning to reliable services such as those provided by Prosyn, a London IT services company dedicated to implementing safe and stress-reducing IT solutions.

Although some have taken precautionary measures against these possible attacks, many organisations have continually underfunded their importance. Here is why you need to take cybersecurity seriously:

Cybersecurity Threats are everywhere

As a general rule of thumb, we view technology as an intriguing subject which is bound to increase our lifespan and quality of life. However, it’s essential to understand that while some people can focus on innovative ways to help others, there will always be the ones who will look for an easy way to make money.

Professional hackers are paid to understand possible cybersecurity problems, and this is done in order to make the technology of a specific company safer and more reliable. Nonetheless, it appears that a reoccurring theme can be spotted: we are not getting better, and our security problems are not changing. While we depend more and more on technology and potential advancements, we are opening ourselves more and more to the possibility of an attack.

Hackers will tell you that most technology is prone to these attacks, rendering it vulnerable. There are many examples in our everyday lives, starting from smartphones, home alarm systems, cars, plane systems, and even medical pacemakers. Of course, the goal is not to instil fear in you, but to make you aware that even critical infrastructure such as dams or power grids can and have been hacked in the past. Thus comes the question, how confident are you in your cyber security measures?

Loss of revenue

According to experts in the industry, a staggering 60% of smaller businesses suffer a data breach each year, and that sometimes includes bigger names you might not expect. Yahoo and UPS are two clear examples of this threat, and so is JP Morgan –having lost the details of 76 million customers during an attack. This loss means that you are exposing your customer’s sensitive information, endangering their financial health, and causing significant revenue loses for your company.

According to a 2015 report published by the World Economic Forum (WEF), a whopping 90% of companies worldwide recognise the fact that they are ill prepared in case of a cyber-attack or breach of confidential data. In fact, it is estimated that this problem costs the global economy over US$400 billion per year –based on a prognosis by the Centre for Strategic and International Studies

The consequences of cyber crime

There are two main aspects that organisations should have in mind when dealing with cyber-attacks: are they meant as a data security breach or a deliberate act of sabotage? A security breach can be viewed as intellectual property or company secrets that an attack might target –ranging from information about bids to personal data. In comparison, sabotage is when fake messages flood web services, or when there is an effort to disable infrastructure systems which are being used by millions each day.

The direct result of these problems is not only a commercial loss, but also a disruption of public relations, with the goal of potentially extorting an individual, company, or organisational chain. Of course, there are also modern-day vigilantes who tirelessly work to expose negligence claims, fraud, and other issues which an organisation may try to sweep under the rug.

Whatever the reason for the cyber-crime, it should be noted that most of these incidents are often not reported, and that loss of information is rarely if ever mentioned. This problem does go hand-in-hand with companies not wanting to damage their reputation or be seen as unsafe by its customers. Besides, it’s hard to take legal action against the culprits –many of them have not even been identified.

Why do some companies underestimate the threat?

One of the main reasons that experts highlight is the difficulty of predicting the likelihood of a cyber-attack happening in your company. It’s also incredibly hard to estimate potential losses; thus the question many have on their mind is “should I invest this much to protect something that might never happen to me?”

An article published in the Harvard Business Review revealed that many decision makers are faced with making the judgement of how much they are willing to invest in cybersecurity, and most of them don’t fully understand the dangers of it. Here are the three main reasons highlighted in the article:

 An empirical assumption that security frameworks like FISMA or NIST represent sufficient security

 A security breach has never been an issue in the past, so there is no need to fix what isn’t broken

 Companies have previously dealt with a small cyber-attack which was quickly resolved

It’s easy to see how individuals would follow this mindset. However, the problem with these mental models is that they view cybersecurity as a problem that can be solved, rather than on-going process which requires a robust prevention strategy. In fact, cybersecurity should focus mainly on risk management and minimise the possibility of future attacks rather than on risk mitigation. As previously discussed, some attacks could cost millions or even put you out of business.


The reality is that cyber-attacks are not solely related to one geographical area or another; criminals operate across borders, and very few of them have moral principles relating to uncovering corruption plots or cases of fraud. Therefore, there is a need to respond to cyber-attacks by having a global vision and strategy, all while understanding how law enforcement agencies work and how IT services can aid you.

The post Here is #why you need to take #Cybersecurity #seriously appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

IS #militants #hack into #Swedish #radio station in #Malmo, take over #broadcast

Source: National Cyber Security – Produced By Gregory Evans

The attack occurred Friday morning in the southern city of Malmo, but went unnoticed until listeners began calling in. Experts say it is unlikely the prepetrators will be caught.

Islamic State militants hacked into a Swedish radio station Friday, taking over its transmission and broadcasting an English language propaganda song aimed at recruiting more militants.

The song entitled, “For the Sake of Allah” played for about 30 minutes on the Mix Megapol station in Malmo. Mix Megapol is an FM and internet-based radio station that is part of a private radio network.

Jakob Gravestam, a Marketing Director for the Bauer Media Group, which operates the Malmo-based station, issued a statement that said “Somebody interfered with our frequency using a pirate transmitter.”

Mix Megapol is one of Sweden’s biggest radio stations, and has about 1.4 million listeners daily. But the pirated transmission was only heard in parts of the southern city of Malmo, Sweden’s third largest metropolis, with a population of about 350,000.

The song features male voices singing, in English, such lyrics as: “For the sake of Allah we will march to gates of the paradise where our maidens await. We are men who love death just as you love your life, we are soldiers who fight in the day and the night.”

Preventing such attacks

The hack occurred during a popular morning show ‘Anders & Gry with Friends’ but the hosts didn’t notice anything was askew until listeners called in and asked what was going on.

“A lot of people have called us about this,” Gravestam told the 24Malmo website. “We are very happy that people are vigilant and we treat this very seriously.”

Gravestam said the attack highlights the need for broadcasters to discuss how to “prevent” such incidents. He added that Bauer Media will organize such a discussion and invite other broadcasters, as well as the Swedish Post and Telecom Authority (PTS), which monitors the electronic communications and postal sectors, to the meeting.

The post IS #militants #hack into #Swedish #radio station in #Malmo, take over #broadcast appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

Businesses #leaders need to take the #reins with #cyber security

Source: National Cyber Security – Produced By Gregory Evans

Businesses #leaders need to take the #reins with #cyber security

Recent high-profile incidents are yet again highlighting the damage that cyber-attacks can make to a company’s reputation, customer relationships and, of course, bottom line. It tells us one thing – businesses are still not doing enough to combat these threats.

Findings from our Advanced Trends Report 2017reinforces this worrying state of information security, with nearly one in five (18%) British businesses admitting to being unprepared for a cyber-attack. It’s not good enough – in the face of digital disruption, cyber security is critical.

This can’t be stressed enough. While digital innovation presents a huge opportunity for our economy, it also goes hand in hand with a need for greater emphasis on cyber security.

The growing infiltration of, and dependency on, the Internet, along with technology trends such as the Internet of Things (IoT) and Artificial Intelligence (AI), is changing how we do business and therefore widening the area of opportunity for attack. Now more than ever, it is vital that organisations fully appreciate the risks of cyber crime and take the necessary steps to mitigate them.

The consequences for firms that fail to implement robust cyber security measures are stark – ranging from severe operational disruption to financial losses, redundancies or even bankruptcy.

This is echoed by recent high profile attacks, which show that organisations are not detecting attacks quickly enough, are slow to respond to them and do not understand the impact of an attack on their business once it is underway.

What’s more, the ways in which cyber criminals attack are becoming more sophisticated. While the Government has greatly increased its cyber crime budget, it is down to organisations to take control and create a culture of security which needs to be led at all levels and backed up with robust policies created and maintained to reduce and detect risks early and regularly.

A good internal culture will also make the management of data easier, will carry on through to all interactions with external relationships and hopefully encourage clients and partners to be more security conscious too.

Britain’s success in the digital era – dubbed the fourth industrial revolution – therefore goes beyond simply investing in new technologies and techniques. It requires cultural shifts, new business models and the ability to adapt and innovate. But above all, it requires strong leadership.

Responsibility at board level

The increased threat of cyber attacks and impending General Data Protection Regulation (GDPR) place significant responsibilities on business leaders to ensure every employee understands how to protect corporate and personal data.

Unquestionably, the entire leadership team needs to be on board, driving this change. However, according to the same Advanced report, nearly one in three (31%) UK employees have no confidence in the leadership of their company to create and run a modern digital infrastructure. This is very troubling, given that a successful digital infrastructure is dependent on effective security and data protection measures.

Leaders urgently need to get a handle on the regulation and security challenges if they are to move forward in the digital era. They shouldn’t leave anything to chance and should ensure cyber security is high on their agenda, calling on third party experts if they need specialist support. Why? Because the consequences in today’s business landscape are frightening.

While we know a breach can affect a company’s reputation, customer relationships and bottom line, we have increasingly seen leaders lose their jobs as a result – most notably former CEO Dido Harding at TalkTalk. But the repercussions of a data breach or loss would be even more damaging if a company failed to safeguard its data under the GDPR.  Equifax, for example, could have been fined up to $124 million if the regulations had already come into effect.

The bottom line is that cyber resilience is critical for every organisation. No one is immune, which is why cyber security must be a top-level priority for organisations, from the boardroom down. Only then can then leaders (and their employees) confidently adopt innovations like IoT to AI and make the right investments for their digital future.

The post Businesses #leaders need to take the #reins with #cyber security appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures


Source: National Cyber Security – Produced By Gregory Evans


SSH private keys are being targeted by hackers who have stepped up their scanning of thousands of servers hosting WordPress websites in search of private keys. Since Monday, security researchers said they have observed a single entity scanning as many as 25,000 systems a day seeking vulnerable SSH keys to be used to compromise websites.

“What triggered our concern was a customer who notified us that they have been monitoring their live traffic and seeing scans for SSH keys,” said WordFence CEO Mark Maunder, in an interview with Threatpost. “When we examined our own honeypots we found that this was not an isolated case and that 25,000 scans were taking place in waves each day.”

Those scans began on Monday and are ongoing, Maunder said and reported in a blog post. Adversaries are using terms such as “root,” “ssh,” or “id_rsa” in hopes of finding web directories containing private SSH keys, most likely mistakenly stored on public directories.

SSH (Secure Shell) is a cryptographic network protocol most often used for secure remote logins to remote computer systems. Successful theft of a private key would give a threat actor access to any server or system where that private key is used for authentication. That risk, security experts note, is not just limited to WordPress but also Linux and Unix systems and embedded devices that also rely heavily on SSH for secure logins and connections.

“Scanning for private SSH keys in public directories is not new. But, the type of increase we are seeing is alarming,” said Justin Jett, director of audit and compliance for Plixer.

He said, seldom are good SSH security practices followed. Unlike digital certificates that expire, SSH have no expiration date and passwords are seldom changed.

“What we find is most businesses and enterprises have no idea what SSH keys are or how to manage them,” said Venafi vice president of security strategy Kevin Bocek. “SSH is unfortunately a secret of systems administrators who create them and tend to them.”

Bocek said Venafi has also seen a recent increase in scanning for SSH keys and not only on public directories, but also in Git or SVN, or subversion, repositories.

Private keys should never be stored in publicly accessible directories. However, too often admins lose track of SSH keys and host both the public and private keys online.

“Exposed SSH keys pose a serious threat to organizations. Anyone gaining access to them has the ‘keys’ to the kingdom,” Jett said.

Earlier this week a report by Venafi disclosed that companies lacked sufficient SSH security controls. A study of 410 IT security professionals by the company found 54 percent of respondents said they do not limit the locations from which SSH keys can be used. It also found 61 percent of respondents do not limit or monitor the number of administrators who manage SSH.

The post HACKERS TAKE #AIM AT #SSH KEYS IN NEW #ATTACKS appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

10 Approaches You Can Take To Shield Yourself Against Ransomware Attacks

Source: National Cyber Security – Produced By Gregory Evans

The WannaCry attack earlier this year is one of the more notable ransomware attacks in recent memory. The attack, which hit everything from home users to the United Kingdom’s National Health Service, locked key data inside an encryption and then demanded bitcoins in exchange for the key to the data….

The post 10 Approaches You Can Take To Shield Yourself Against Ransomware Attacks appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures

Hacking fears take small businesses offline

more information on sonyhack from leading cyber security expertsSource: National Cyber Security – Produced By Gregory Evans After Ken Taylor’s personal computer was hacked he is concerned about the impact hacking would have on his restaurant Templestowe Living Room. “I went into a website which was a bogus site and it basically took a hold of my computer,” Taylor says. “I got a […] View full post on AmIHackerProof.com | Can You Be Hacked?

Windows 10 users need to update their PC TODAY, or hackers could take control

Source: National Cyber Security – Produced By Gregory Evans

Windows 10 users at a risk from a “critical” vulnerability that lets cybercriminals take over their PCs, unless they update their computers now, Microsoft have patched dozens of major security vulnerabilities that affect all supported versions of Windows. One “critical” vulnerability enabled a hacker to exploit how Windows Search handles…

The post Windows 10 users need to update their PC TODAY, or hackers could take control appeared first on National Cyber Security Ventures.

View full post on National Cyber Security Ventures