Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

TikTok
IPO Rubrik Startups Technology TikTok

The Tech Landscape: Rubrik, TikTok, and Early-Stage Startups


The idea that the public markets are not as exclusive to tech firms as some believed was reinforced by Rubrik's aggressive IPO pricing and the positive response it received from the public markets following its listing. If Rubrik's outcome is insufficient to end the deadlock, perhaps there is another issue at hand.

1. Rubrik’s IPO Triumph

Rubrik, a data management company, recently made waves by going public through an initial public offering (IPO). The reception was nothing short of remarkable, signaling a shift in sentiment toward tech startups. For years, the public markets seemed somewhat closed to these fledgling companies, but Rubrik’s success challenges that notion.

The IPO process is a litmus test for any company. It involves transparency, financial scrutiny, and investor confidence. Rubrik’s strong pricing and positive market response indicate that investors are willing to embrace tech startups, provided they demonstrate robust fundamentals and growth potential.

As Rubrik’s stock ticker symbol blinks across trading screens, it serves as a beacon for other startups eyeing the public markets. The message is clear: If you have a compelling product, a solid business model, and a vision for the future, the IPO route is viable.

2. TikTok’s Regulatory Quandary

TikTok, the viral short-form video platform, has been on a rollercoaster ride. Loved by millions for its entertaining content, it also faces regulatory hurdles. The United States government has demanded that TikTok divest from its parent company or face a ban. This move underscores the geopolitical complexities surrounding tech companies.

Why the scrutiny? TikTok’s Chinese ownership raises concerns about data privacy, national security, and censorship. As the app continues to captivate users globally, governments grapple with how to balance innovation and security. The TikTok saga serves as a cautionary tale for tech companies operating in a globalized world.

For startups, understanding regulatory landscapes is crucial. Navigating legal frameworks, data protection laws, and geopolitical tensions requires strategic foresight. TikTok’s experience highlights the need for transparency, compliance, and proactive engagement with regulators.

3. TechCrunch Early Stage Event

Tech Crunch hosted its annual Early Stage event. This gathering brought together startups, investors, and industry experts. The event’s focus? Empowering early-stage companies to thrive.

In Boston, where the event took place, entrepreneurs pitched their ideas, networked, and absorbed insights from seasoned veterans. The buzz around early-stage startups was palpable. Investors scouted for promising ventures, and founders honed their pitches.

Why does this matter? Early-stage support is the lifeblood of innovation. Startups need mentorship, capital, and exposure to flourish.

Read more »
Threat actors
Cyber Security Cybersecurity Deceptive npm packages malware installation North Korean social engineering campaign Software Developers Threat actors

Deceptive npm Packages Employed to Deceive Software Developers into Malware Installation

 

A persistent scheme aimed at software developers involves fraudulent npm packages disguised as job interview opportunities, with the intention of deploying a Python backdoor onto their systems.

Securonix, a cybersecurity company, has been monitoring this campaign, dubbed DEV#POPPER, which they attribute to North Korean threat actors. 

"During these fraudulent interviews, the developers are often asked to perform tasks that involve downloading and running software from sources that appear legitimate, such as GitHub," security researchers Den Iuzvyk, Tim Peck, and Oleg Kolesnikov said. "The software contained a malicious Node JS payload that, once executed, compromised the developer's system."

Details of this campaign surfaced in late November 2023, when Palo Alto Networks Unit 42 revealed a series of activities known as Contagious Interview. Here, the threat actors masquerade as employers to entice developers into installing malware such as BeaverTail and InvisibleFerret during the interview process.

Subsequently, in February of the following year, Phylum, a software security firm, uncovered a collection of malicious npm packages on the registry. These packages delivered the same malware families to extract sensitive information from compromised developer systems.

It's important to distinguish Contagious Interview from Operation Dream Job, also linked to North Korea's Lazarus Group. The former targets developers primarily through fabricated identities on freelance job platforms, leading to the distribution of malware via developer tools and npm packages.

Operation Dream Job, on the other hand, extends its reach to various sectors like aerospace and cryptocurrency, disseminating malware-laden files disguised as job offers.

The attack sequence identified by Securonix begins with a GitHub-hosted ZIP archive, likely sent to the victim during the interview process. Within this archive lies an apparently harmless npm module housing a malicious JavaScript file, BeaverTail, which serves as an information thief and a loader for the Python backdoor, InvisibleFerret, retrieved from a remote server. This implant can gather system data, execute commands, enumerate files, and log keystrokes and clipboard activity.

This development underscores the continued refinement of cyber weapons by North Korean threat actors, as they update their tactics to evade detection and extract valuable data for financial gain.

Securonix researchers emphasize the importance of maintaining a security-conscious mindset, particularly during high-pressure situations like job interviews, where attackers exploit distraction and vulnerability.
Read more »
User Privacy
Data Leak Data Privacy Private Data Search Engines Technology User Privacy

How to Erase The Personal Details Google Knows About You

 

One can get a sense of the volume of data they are giving away to Google every day by considering all the things they do on Chrome, Gmail, YouTube, Google Maps, and other Google services. That is... a lot for most of us. 

Google at least offers a thorough web dashboard that you can use to view some of the data being acquired, regardless of whether you believe the targeted advertising and data collecting are worth the free apps you receive in return.

It allows you to eliminate all of the data that Google has already gathered, prevent it from collecting further, or have your data automatically deleted after a predetermined amount of time (such as three months). If you intend to delete your Google account, you can also utilise these tools to clean the records; however, doing so should also remove all of the data linked to your account.

Here's how to use the options that are accessible to you.

Locate your data 

Getting started is really simple: Open your Google account page in your preferred web browser, and sign in if necessary. This screen displays your Google subscriptions, the devices to which you are signed in with your Google account, and any passwords that you may have saved, among other details. 

  • On the left, click "Data and privacy."
  • Look for the history settings. It is divided into three major categories: Web and apps, location, and YouTube.
  • To get a complete list of this data, click the My Activity icon at the bottom of the section. You'll see everything you've done that has been recorded in Google products, beginning with the most recent.
  • Select filter by date & product to narrow the results to certain date ranges or apps.
  • To delete a filter you've applied, click the X at the top of the list. 
  • If additional information is available, click on any entry in the list to view it. You can open YouTube videos or websites that you've visited.

Delete your data

  • When it comes to data that Google has already acquired and logged, you can delete it in a number of ways. 
  • If you are viewing the entire activity list, click Delete (to the right of the filter). 
  • You can delete records from the last hour, day, or a custom range. You can also select Always to erase everything.
  • If you filtered the list by date or product, click Delete results to remove everything that matched the filter.
  • Whether or not the list is filtered, clicking the X next to any single entry deletes it. 

It's useful to have a central repository for all of your data accessible via a single online site, but some sorts of data can also be found elsewhere. You can remove your web activity from within Chrome as long as you are signed in to Google, for example, or access your YouTube view history via the YouTube website.
Read more »
Supply Chain
AI Attacks Cyber Security Cyber Security awareness digital safety Information Security Online Privacy Supply Chain

Safeguarding Your Digital Future: Navigating Cybersecurity Challenges

 

In the ever-expanding realm of technology, the omnipresence of cybercrime casts an increasingly ominous shadow. What was once relegated to the realms of imagination has become a stark reality for countless individuals and businesses worldwide. Cyber threats, evolving in sophistication and audacity, have permeated every facet of our digital existence. From cunning phishing scams impersonating trusted contacts to the debilitating effects of ransomware attacks paralyzing entire supply chains, the ramifications of cybercrime reverberate far and wide, leaving destruction and chaos in their wake. 

Perhaps one of the most alarming developments in this digital arms race is the nefarious weaponization of artificial intelligence (AI). With the advent of AI-powered attacks, malevolent actors can orchestrate campaigns of unparalleled scale and complexity. Automated processes streamline malicious activities, while the generation of deceptive content presents a formidable challenge even to the most vigilant defenders. As adversaries leverage the formidable capabilities of AI to exploit vulnerabilities and circumvent traditional security measures, the imperative for proactive cybersecurity measures becomes ever more pressing. 

In this rapidly evolving digital landscape, the adoption of robust cybersecurity measures is not merely advisable; it is indispensable. The paradigm has shifted from reactive defense mechanisms to proactive strategies aimed at cultivating a culture of awareness and preparedness. Comprehensive training and continuous education serve as the cornerstones of effective cybersecurity, empowering individuals and organizations to anticipate and counter emerging threats before they manifest. 

For businesses, the implementation of regular security training programs is essential, complemented by a nuanced understanding of AI's role in cybersecurity. By remaining abreast of the latest developments and adopting proactive measures, organizations can erect formidable barriers against malicious incursions, safeguarding their digital assets and preserving business continuity. Similarly, individuals can play a pivotal role in fortifying our collective cybersecurity posture through adherence to basic cybersecurity practices. 

From practicing stringent password hygiene to exercising discretion when sharing sensitive information online, every individual action contributes to the resilience of the digital ecosystem. However, the battle against cyber threats is not a static endeavor but an ongoing journey fraught with challenges and uncertainties. As adversaries evolve their tactics and exploit emerging technologies, so too must our defenses adapt and evolve. The pursuit of cybersecurity excellence demands perpetual vigilance, relentless innovation, and a steadfast commitment to staying one step ahead of the ever-evolving threat landscape. 

The spectrum of cybercrime looms large in our digital age, presenting an existential threat to individuals, businesses, and society at large. By embracing the principles of proactive cybersecurity, fostering a culture of vigilance, and leveraging the latest technological advancements, we can navigate the treacherous waters of the digital domain with confidence and resilience. Together, let us rise to the challenge and secure a safer, more resilient future for all.
Read more »
TCS
AI Revolution BPO Call Center Cyber Attacks CyberCrime Cybersecurity IT Systems Policymakers Software TCS

TCS CEO Predicts AI Revolution to Decimate India's Call Center Industry in Just One Year

 


As early as next year, Tata Consultancy Services' head said, artificial intelligence will generate a "minimal" need for call centres, as AI's rapid advancements to date are set to disrupt a vast industry across Asia and beyond. AI's rapid advancements are expected to result in the demise of vast call centres across the globe. 

The chief executive of TCS, K Krithivasan, told the Financial Times that although he had not seen any job reductions at the company so far, the wider adoption of generative artificial intelligence by multinational clients will transform the kinds of customer support centres that have created a lot of jobs in countries like India and the Philippines because of the massive growth in customer service. 

The author believes that chatbots equipped with generative artificial intelligence will be capable of analysing customer transaction histories as well as performing tasks traditionally handled by call centre agents. As a result of the possibility that generative AI might negatively affect white-collar jobs, such as call centre employees and software developers, policymakers around the globe have expressed concern. 

In the $48.9 billion IT and business process outsourcing industry that accounts for over five million jobs in India according to Nasscom, this is a significant threat to the country, which is known for its back-office services. It has been highlighted once again in the comments of the TCS CEO that AI is likely to take over many jobs, including call centre agents and software developers in the future.

The remarks of the TCS CEO are very important for India, which, according to Nasscome, employs over five million people in IT and BPO processes. In his opinion, AI will have a far greater impact on society than has been anticipated in the short term, even though there have been exaggerated expectations regarding its immediate effects. 

The chairman also mentioned that a growing need for individuals with technological skills will be observed in the coming years. Among the more than 600,000 employees of TCS, an arm of India’s Tata conglomerate, which develops IT systems for multinational companies, the company generates revenues of more than $30 billion annually. 

The flow is expected to be "significantly increased" and will almost double over a few more quarters, according to Krithivasan. To date, the company has been able to pay off its investment by selling a record number of orders worth $42.7 billion for the financial year that ends in March. Due to factors such as inflation, geopolitical tensions, and past elections, Krithivasan explained that previously, IT services spending had been clouded with "uncertainty." 

These factors have forced businesses to postpone investments in new technology projects due to the risk associated with such uncertainties. The CEO explained that considering TCS's revenue growth declined by 3% in 2005 as a result of this uncertainty. The chairman goes on to explain that TCS itself has an ongoing pipeline of generative AI projects of $900 million worth, he continues. It was also Krithivasan who stated during the announcement of TCS's Q4 financial results that the company have seen greater traction in the market since its AI. 

The cloud business unit was launched during the quarter. According to Krithivasan, TCS is also working on projects of generative AI, and as reported by the Financial Times, for the quarter ended at the end of the third quarter, the value of the project had doubled to be worth $900 million, an increase of 80% over the prior quarter. According to him, in the following quarters, order flows are expected to increase significantly. 

According to Krithivasan, this would not hurt employment if the demand for tech talent is increased, but not decreased as a consequence of this situation. His advice is that they need to train their workforce if they are to meet this demand, especially in India, where there is a high demand. According to the third quarter earnings report published on April 12 by the biggest IT services firm in India on the Fourth quarter earnings for the financial year 2023-24 (Q4 FY24), the company posted a net profit of Rs 12,434 crore, up 9.1 per cent from the third quarter. 

A revenue of Rs 61,237 crore was also reported for the quarter, an increase of 3.5 per cent from the previous quarter, corresponding to an increase of one per cent over the year-ago quarter. The notable difference between generative AI and traditional AI, however, is that Krithivasan warns that the benefits of generative AI shouldn't be overestimated, despite the expected disruptions. 

Krithivasan, the CEO of TCS, acknowledged the current buzz surrounding AI and its potential impact on jobs, but he stressed that its true effects will unfold gradually, possibly presenting new job opportunities rather than simply displacing existing ones. Addressing concerns about job losses, Krithivasan expressed confidence in the rising demand for tech talent, especially in countries like India. 

He proposed that the evolution of AI would result in the emergence of more skilled professionals, ultimately leading to job growth rather than reduction. However, a recent report from McKinsey Global Institute titled "Generative AI and the Future of Work in America" paints a contrasting picture. According to the report, jobs involving tasks that can be automated, such as data collection and repetitive duties, will likely be taken over by AI to enhance efficiency. 

Sectors like office support, customer service, and food service are expected to be particularly impacted by this AI-driven transformation, potentially leading to significant changes in employment dynamics.
Read more »
Websites
Black hat malware Online Security URL Websites

Cybercriminals Exploit Web Hosting Platforms to Spread Malware


 

Cybersecurity researchers at Zscaler ThreatLabz have uncovered a concerning trend in which cybercriminals are exploiting popular web hosting and blogging platforms to disseminate malware and steal sensitive data. This sophisticated tactic, known as SEO poisoning within the realm of Black Hat SEO techniques, has been employed to manipulate search engine results, pushing fraudulent websites to the forefront of users' search queries, thereby increasing the risk of unwittingly accessing malicious content.


How They Operate

The cybercriminals orchestrating these operations have devised intricate strategies to evade detection and entice unsuspecting users into downloading malware. They fabricate fraudulent websites spanning a wide array of topics, ranging from pirated software to culinary recipes, often hosted on well-established platforms such as Weebly. By adopting the guise of legitimate sites, complete with endorsements like "Powered by Weebly," they exploit users' trust in reputable services to perpetrate their malicious activities.


The process commences with cybercriminals setting up sham sites on web hosting services, adeptly avoiding detection by both hosting providers and users. When individuals search for relevant content and click on links from search results, they unknowingly find themselves on these malevolent sites. To circumvent scrutiny from security researchers, the perpetrators implement evasion techniques, including scrutinising referral URLs. Should a user access the site directly, indicating a potential analysis, the site tactfully sidesteps redirection to preserve its cloak of invisibility.


The Payload Delivery System

Malicious payloads are secretly delivered through multi-layered zipped files concealed within seemingly innocuous content. For instance, an individual seeking cracked software may inadvertently download malware instead of the anticipated content. Upon execution, the malware puts together a sequence of activities, encompassing process hollowing and DLL sideloading, aimed at downloading additional malware and establishing communication with command-and-control servers.


Tricks to Avoid Detection

To further complicate their activities, threat actors employ techniques, including string concatenation, mathematical manipulation, and the utilisation of password-protected ZIP archives. These tactics serve to confound security measures, rendering the malicious code arduous to decipher and bolstering the malware's ability to slightly pass over detection.


Data Theft and Deceptive Tactics

Once ensconced within a system, the malware embarks on an mission to harvest extensive troves of data, encompassing system information, browser data, credentials, and browsing history. Additionally, it sets its sights on emails pertaining to cryptocurrency exchanges, adeptly modifying email content and intercepting one-time authentication codes to facilitate unauthorised access.


How To Protect Yourself?

Keeping in mind such campaigns, users are advised to exercise utmost caution when procuring software from unfamiliar sources and to prioritise visiting reputable websites. Staying abreast of emerging cybersecurity threats and securing defences with robust protocols can substantially mitigate the risk of succumbing to potential infections.



Read more »
Malware Detection
countries Cybersecurity Godfather Banking Trojan malware Malware Detection

Godfather Banking Trojan Multiplies, Spreading to 1.2K Variants in 57 Nations

 

Over a thousand variants of the Godfather mobile banking Trojan have been detected in numerous countries worldwide, targeting a wide array of banking applications.

Initially uncovered in 2022, Godfather has emerged as a pervasive malware-as-a-service tool in cybercrime circles, particularly within mobile cybercrime. 

According to Zimperium's 2023 "Mobile Banking Heists Report," Godfather had been focusing on 237 banking apps spanning across 57 countries as of late last year. Its operators redirected stolen financial data to at least nine countries, mainly in Europe and the US. To counteract potential disruptions from security software, the developers of Godfather have been automatically generating new variants for their clients at a remarkable pace.

This trend isn't limited to Godfather alone. Nico Chiaraviglio, Zimperium's chief scientist, warns of a broader escalation in mobile malware campaigns. He notes the emergence of a massive mobile malware family, still undisclosed, boasting over 100,000 distinct samples in circulation. This proliferation represents a significant shift in the mobile threat landscape, indicating a move towards more expansive and sophisticated attacks.

The surge in mobile malware diversity poses a considerable challenge for security measures, particularly those reliant on signature-based detection. Unlike desktop security, where antivirus software is widely adopted, mobile protection remains underutilized, leaving a substantial portion of devices vulnerable. With mobile threats rapidly evolving and diversifying, traditional antivirus programs struggle to keep pace due to the sheer volume and variation of malware samples.

Chiaraviglio suggests that adaptive security solutions, leveraging techniques like code reuse analysis and behavioral analysis powered by artificial intelligence (AI), offer promising avenues for combating this evolving threat landscape. 

By focusing on malware behavior rather than specific code signatures, these solutions can potentially mitigate the impact of constantly evolving malware variants. However, he acknowledges that this is an ongoing challenge, as threat actors continually adapt their tactics to evade detection, potentially leading to the rise of more sophisticated polymorphic malware in the mobile sphere.
Read more »
Sophos
Cyber Attacks Junk-Gun RaaS Ransomware Sophos

Junk Ransomware: Getting the Job Done For Hackers


Sophos detects ransomware

In an April 17 analysis from its Sophos X-Ops research team, cybersecurity firm Sophos observed an increase in low-cost, primitive ransomware—a boon for aspiring threat actors and a headache for defenders.

It's far more difficult to find something that there are only twenty copies of in the world, said Christopher Budd, director of threat research at Sophos X-Ops.

The group linked the choices to the cheap handguns that flooded the US firearms market in the 1960s and 1970s, known as junk guns.

Between June 2023 and February 2024, the Sophos team spotted 19 different types of "independently produced, inexpensive, and crudely constructed ransomware." Some missed clean graphics, while others used programming languages like C# and.NET, which "have a shallower learning curve," noted the paper.

It seems to be a fairly recent thing,"  noting that poor-quality malware has existed for decades.

Varying costs

Sophos discovered one with no price indicated, two open-source models, one for $20 (later reduced to free), and one for 0.5 BTC (about $13K).

According to a 2023 research by cybersecurity firm CrowdStrike, the cost of a Ransomware as a Service (RaaS) kit "ranges from $40 per month to several thousand dollars." RaaS models depend on affiliates purchasing ransomware and consenting to a subscription fee based on the victim's payment.

Junk-gun ransomware

Junk-gun ransomware destroys that commission: capitalism in action, in a sense.

In most instances, you don't have any kind of partner fees to pay, Budd stated.

Only three of the "junk" kinds paid a subscription fee

Ransomware groups such as LockBit have become large enough to be tracked and halted by government agencies. Junky ransomware has the potential to fly under the radar and bypass detection technology.

There is no single source of knowledge for investigators and researchers to track, the Sophos report stated.

Budd and his crew saw users asking basic inquiries in forums praising the cheap items. What is the best language for creating ransomware? Is writing in C# worthwhile? How should malware be priced and sold?

Budd describes a forum featuring inexpensive ransomware and beginner queries as a welcome place for young hackers waiting for their chance in the big leagues.

Step forward

Junk-gun ransomware presents specific problems for small enterprises, the general public, and the security industry. We saw threat actors expressly refer to assaults against smaller companies and individuals, even as they tried to figure out which types of companies to target and how much ransom to demand because such targets are often less well-defended, knowledgeable, and prepared.

At this point, junk-gun ransomware causes several challenges for the security industry. It is difficult to get samples of junk-gun ransomware, assess how widely it has been deployed in the wild, and monitor new variants. 

Threat actors may also adopt the 'brand names' of well-known ransomware families, presumably to capitalize on their reputations, which can lead to misunderstanding among experts.
Read more »
Token Management
Digital Assets NFTs Technology Token Management

Here's How NFTs Can Transform Asset Management

 

NFTs are frequently discussed in terms of their role in digital art, but beneath the surface, there is a massive, unexplored potential for revolutionising real-world asset ownership and transaction.

This possibility was the focus of a recent conversation between Roundtable host Rob Nelson and Brittany Kaiser, chair of the board of Gryphon Digital Mining (GRYP) and co-founder of the Own Your Own Data Foundation. 

Together, they analysed the broader ramifications of tokenization beyond digital collectibles. Nelson began the conversation by clarifying common misconceptions about NFTs and emphasising their value beyond art collecting. 

"NFTs and tokenization bring real utility, wealth sharing, and growth opportunities," he said, laying the groundwork for an informative discussion of how these technologies may be applied in more traditional sectors. 

Kaiser presented a rudimentary overview of what a "token" actually entails, stating that at its foundation, a token is a smart contract. With her legal knowledge, she skillfully illustrated how these contracts automate and enforce themselves technologically rather than legally.

"A smart contract is a self-executing digital contract that encapsulates data or transactions in a secure, enforceable format," Kaiser said. 

She highlighted the practical advantages of this technology, particularly in data management. Individuals can govern how their data is utilised and ensure it is inaccessible after a set amount of time by using smart contracts, as opposed to traditional techniques, which leave data susceptible indefinitely.

Kaiser's ideas were applied on a broad scale, including the transfer of real-world assets and financial transactions. She described how tokenization may expedite the time-consuming due diligence processes traditionally connected with real estate purchases, transforming them into efficient and secure exchanges.
Read more »
VPN
Bitcoin BTC Chivo Wallet Code Leak cryptocurrency Cyberattacks CyberCrime Cybersecurity El Salvador Privacy Security Breach Technical Breach VPN

Cryptocurrency Chaos: El Salvador's Bitcoin Wallet Code Leaked, Privacy at Risk

 


There was a security breach with El Salvador's state Bitcoin wallet, Chivo, after hackers from the group CiberInteligenciaSV leaked a part of its source code to a hacking forum. In the earlier leak of personal data belonging to nearly all of El Salvador's adults, the code from Chivo Wallet ATMs as well as VPN credentials had been exposed. According to the wallet administration, there has been no compromise with the security of the wallet's data. 

Chivo Wallet had several challenges since it was revealed that it would be the official Bitcoin storage tool after its launch, so this event has become another blight on the Chivo Wallet. President Nayib Bukele set Bitcoin (BTC) as legal tender in El Salvador in 2021 to make digital payments more convenient. However, security breaches and technical issues have made the adoption of Bitcoin (BTC) difficult. 

The Chivo Wallet has been criticized by consumers for its slow operation, app crashes, vulnerabilities to exploitation, and lack of official backing, despite its official backing. The Chivo Wallet company has responded to allegations that it was linked to a data breach in which over 5 million Salvadorans' personal information was allegedly exposed. 

In addition to full names, unique identifiers, dates of birth, addresses, phone numbers, emails, and photographs, all of this data was leaked. The data had been rumoured to be related to the KYC processes that the Salvadoran government required its citizens to complete before they could be offered incentives, such as $30 in Bitcoin at the wallet’s launch, by the Salvadoran government. 

On April 6, the hacker group CiberInteligenciaSV compromised 5.1 million Salvadoran data. Recently, the same hackers leaked the source code for Chivo Wallet and the VPN credentials for the ATM network. The Chuvo Bitcoin wallet, backed by the government, has caused controversy among peer-to-peer money enthusiasts and crypto punks alike for its custodial status. 

In a press release published on X (formerly Twitter) on April 24, the company commented on the matter, describing it as “fake news.” Furthermore, a group of individuals from the Salvadoran community who downloaded the wallet have released over 144 GB of data containing their personal information. Even though it was available for purchase on various channels since August, it was only leaked for download on April 5. 

This data includes a user's full name, unique identifier, date of birth, address, and a high-definition picture of their face, as well as their full name, unique identifier, and date of birth. Also included in this week's leaked information was the file Codigo.rar, which contained information on El Salvador's Chivo ATM network, including the code and VPN credentials for the network.

Government officials have yet to come out with a formal statement regarding either of the hacks that took place this month. As a result of the leak of the code and VPN details of the source, the Chivo wallet system is at risk of being compromised, making hackers able to gain access to users' accounts or control them unauthorizedly. 

The particularity of the data exposed previously affects almost the entire adult population of El Salvador, which makes them fear identity theft and fraud as a result of the exposure of personal data previously exposed. In light of these breaches, security experts advise users to be vigilant and to monitor their accounts for any suspicious behaviour if they see anything strange. 

El Salvador is a country where incompetence is prevalent and there is a good chance that this will have a significant impact on the financial ecosystem as well, as trust in the government's digital solutions might wane as a result. In the beginning, the Chivo software was plagued with numerous software bugs and technical glitches as users reported numerous problems with the software. 

Despite the President's promise to give them $30 for downloading the Chivo wallet, some people were not able to withdraw money from Chivo because some had trouble getting it. The Salvadoran government announced last year that over 100 ATMs across the country will be equipped with lightning network technology in Q4 2024. 

Over 100 ATMs across the country will be equipped with this technology. In theory, this technology could allow Salvadorians to withdraw and deposit Bitcoins in an easier and faster manner with a lower fee. It was reported in October by a Salvadoran newspaper that only about 2% of the Salvadoran population was making remittance payments through the wallet, which had been its main selling point for a long time. 

It has yet to be decided whether or not the Salvadoran government will declare a policy on this issue or formally address the issue. The state of El Salvador has become the first in the world to adopt Bitcoin as a legal tender in 2021, promoting the Chivo wallet as one of the official mediums used to engage with Bitcoin by its citizens. 

The fact that these security issues exist in addition to the absence of communication from the authorities leaves the Salvadorans with an uncomfortable sense of uncertainty as to whether or not their personal information is safe and if this digital wallet offered by the state is reliable.
Read more »
Security Breach
Avast Cyber Attacks DLL hijacking eScan GuptiMiner malware Hackers HTTP Malware Attack North Korea Hackers Security Breach

The GuptiMiner Attack: Lessons Learned from a Five-Year Security Breach

 

In a startling revelation, security researchers from Avast have uncovered a sophisticated cyberattack that exploited vulnerabilities in the update mechanism of eScan, an antivirus service, for a staggering five years. The attack, orchestrated by unknown hackers potentially linked to the North Korean government, highlights critical flaws in cybersecurity infrastructure and serves as a cautionary tale for both consumers and industry professionals. 

The modus operandi of the attackers involved leveraging the inherent insecurity of HTTP protocol, enabling them to execute man-in-the-middle (MitM) attacks. By intercepting the update packages sent by eScan's servers, the perpetrators clandestinely replaced genuine updates with corrupted ones containing a nefarious payload known as GuptiMiner. This insidious malware facilitated unauthorized access and control over infected systems, posing significant risks to end users' privacy and security. 

What makes this breach particularly alarming is its longevity and the level of sophistication exhibited by the attackers. Despite efforts by Avast researchers to ascertain the precise method of interception, the exact mechanisms remain elusive. However, suspicions linger that compromised networks may have facilitated the redirection of traffic to malicious intermediaries, underscoring the need for heightened vigilance and robust cybersecurity measures. 

Furthermore, the attackers employed a myriad of obfuscation techniques to evade detection, including DLL hijacking and manipulation of domain name system (DNS) servers. These tactics, coupled with the deployment of multiple backdoors and the inclusion of cryptocurrency mining software, demonstrate a calculated strategy to maximize the impact and stealth of their operations. 

The implications of the GuptiMiner attack extend beyond the immediate scope of eScan's compromised infrastructure. It serves as a stark reminder of the pervasive threat posed by cyber adversaries and the imperative for proactive defense strategies. Moreover, it underscores the critical importance of adopting industry best practices such as delivering updates over secure HTTPS connections and enforcing digital signing to thwart tampering attempts. 

For users of eScan and other potentially affected systems, vigilance is paramount. Avast's detailed post provides essential information for identifying and mitigating the threat, while reputable antivirus scanners are likely to detect the infection. Additionally, organizations must conduct thorough security assessments and implement robust cybersecurity protocols to safeguard against similar exploits in the future. 
 
Ultimately, the GuptiMiner attack serves as a wake-up call for the cybersecurity community, highlighting the pressing need for continuous innovation and collaboration in the fight against evolving threats. By learning from this incident and implementing proactive measures, we can bolster our defenses and mitigate the risk of future breaches. Together, we can strive towards a safer and more resilient digital ecosystem.
Read more »
Hackers
antivirus updates Cyber Attacks Cybersecurity eScan GuptiMiner malware Hackers

Hackers Utilize Antivirus Update Mechanism to Deploy GuptiMiner Malware

 

North Korean hackers have been utilizing the updating system of the eScan antivirus to infiltrate major corporate networks and distribute cryptocurrency miners via the GuptiMiner malware, according to researchers.

GuptiMiner, described as a highly sophisticated threat, possesses capabilities such as performing DNS requests to the attacker's DNS servers, extracting payloads from images, signing its payloads, and engaging in DLL sideloading.

The delivery of GuptiMiner through eScan updates involves a technique where the threat actor intercepts the normal virus definition update package and substitutes it with a malicious one labeled 'updll62.dlz.' This malicious file contains both the required antivirus updates and the GuptiMiner malware disguised as a DLL file named 'version.dll.'

Upon processing the package, the eScan updater unpacks and executes it as usual. At this stage, the DLL is sideloaded by legitimate eScan binaries, granting the malware system-level privileges.

Following this, the DLL retrieves additional payloads from the attacker's infrastructure, establishes persistence on the host through scheduled tasks, manipulates DNS settings, injects shellcode into legitimate processes, utilizes code virtualization, encrypts payloads in the Windows registry, and extracts PEs from PNGs.

To evade sandbox environments, GuptiMiner checks for systems with more than 4 CPU cores and 4GB of RAM, and it also detects the presence of certain security tools such as Wireshark, WinDbg, TCPView, and others, deactivating them if found.

Researchers from Avast suggest a potential link between GuptiMiner and the North Korean APT group Kimsuki, noting similarities in information stealing functions and the use of common domains.

The hackers deployed multiple malware tools, including enhanced versions of Putty Link as backdoors targeting Windows 7 and Windows Server 2008 systems, and a modular malware designed to scan for private keys and cryptocurrency wallets.

Additionally, the XMRig Monero miner was used in some instances, possibly to divert attention from the primary attack.

Following disclosure of the vulnerability to eScan, the antivirus vendor confirmed that the issue was addressed. eScan has implemented more robust checking mechanisms for updates and transitioned to HTTPS for secure communication with clients.

However, despite these measures, new infections by GuptiMiner persist, potentially indicating outdated eScan clients. A list of GuptiMiner indicators of compromise (IoCs) has been provided to aid defenders in mitigating this threat.
Read more »
Privacy
consumer rights Data Sharing General Motors Insurance Company Privacy

General Motors Under Fire for Secretly Spying on Drivers

 

In a developing story that has captured public attention, General Motors (GM) finds itself embroiled in controversy amidst accusations of clandestine surveillance and unauthorised data sharing with insurance companies. The unfolding narrative, spearheaded by investigative journalist Kashmir Hill of The New York Times, sheds light on a concerning pattern of behaviour within the automotive giant, raising significant questions about privacy and consumer rights.

What Are The Practices?

Hill's extensive investigation unveils a troubling narrative surrounding GM's alleged surreptitious enrollment of customers into its Smart Driver program. Despite the absence of explicit consent or enrollment in OnStar services, Hill and her husband were taken aback to discover that their driving data had been discreetly shared with insurers via third-party data brokers.

Lack of Transparency

Central to the controversy are instances implicating GM dealerships in the alleged scheme, with allegations suggesting customers were unwittingly enrolled in data-sharing initiatives during vehicle purchases. The pressure purportedly exerted on dealerships by GM to achieve high enrollment rates in connected services adds a layer of complexity to the narrative.

Legal and Ethical Implications

The emergence of federal lawsuits against GM underscores the legal and ethical consequences of its data collection practices. Amidst accusations of non-disclosure and lack of transparency, concerns have been raised about the company's adherence to regulatory standards and commitments to consumer privacy.

Corporate Response and Accountability

In response to mounting scrutiny, GM has announced the discontinuation of its Smart Driver program and pledged to unenroll all affected customers. Additionally, the cessation of data sharing with third-party brokers signals a proactive effort to address concerns and restore trust among consumers.

Calls for Reform and Regulatory Oversight

The controversy surrounding GM's data collection practices serves as a catalyst for broader discussions on consumer privacy rights and corporate accountability. Industry experts and consumer advocacy groups have called for strengthened regulatory oversight and transparency measures to safeguard against similar instances of covert data collection in the future.

As the narrative continues to unfold, the General Motors saga stresses the inherent tensions between technological innovation, consumer privacy, and corporate responsibility. The fallout from these revelations serves as a telling reminder of the critical importance of transparency, accountability, and ethical conduct in the digital age.


Read more »
malware
Banking Trojan Brokewell Browser Chrome Google malware

Banking Malware "Brokewell" Hacks Android Devices, Steals User Data

Banking Malware "Brokewell" Hacks Android Devices

Security experts have uncovered a new Android banking trojan called Brokewell, which can record every event on the device, from touches and information shown to text input and programs launched.

The malware is distributed via a fake Google Chrome update that appears while using the web browser. Brokewell is in ongoing development and offers a combination of broad device takeover and remote control capabilities.

Brokewell information

ThreatFabric researchers discovered Brokewell while examining a bogus Chrome update page that released a payload, which is a common approach for deceiving unwary users into installing malware.

Looking back at previous campaigns, the researchers discovered that Brokewell had previously been used to target "buy now, pay later" financial institutions (such as Klarna) while masquerading as an Austrian digital authentication tool named ID Austria.

Brokewell's key capabilities include data theft and remote control for attackers.

Data theft 

  • Involves mimicking login windows of targeted programs to steal passwords (overlay attacks).
  • Uses its own WebView to track and collect cookies once a user logs into a valid website.
  • Captures the victim's interactions with the device, such as taps, swipes, and text inputs, to steal data displayed or inputted on it.
  • Collects hardware and software information about the device.
  • Retrieves call logs.
  • determines the device's physical position.
  • Captures audio with the device's microphone.

Device Takeover: 

  • The attacker can see the device's screen in real time (screen streaming).
  • Remotely executes touch and swipe gestures on the infected device.
  • Allows remote clicking on specific screen components or coordinates.
  • Allows for remote scrolling within elements and text entry into specific fields.
  • Simulates physical button presses such as Back, Home, and Recents.
  • Remotely activates the device's screen, allowing you to capture any information.
  • Adjusts brightness and volume to zero.

New threat actor and loader

According to ThreatFabric, the developer of Brokewell is a guy who goes by the name Baron Samedit and has been providing tools for verifying stolen accounts for at least two years.

The researchers identified another tool named "Brokewell Android Loader," which was also developed by Samedit. The tool was housed on one of Brokewell's command and control servers and is utilized by several hackers.

Unexpectedly, this loader can circumvent the restrictions Google imposed in Android 13 and later to prevent misuse of the Accessibility Service for side-loaded programs (APKs).

This bypass has been a problem since mid-2022, and it became even more of a problem in late 2023 when dropper-as-a-service (DaaS) operations began offering it as part of their service, as well as malware incorporating the tactics into their bespoke loaders.

As Brokewell shows, loaders that circumvent constraints to prevent Accessibility Service access to APKs downloaded from suspicious sources are now ubiquitous and widely used in the wild.

Security experts warn that device control capabilities, like as those seen in the Brokewell banker for Android, are in high demand among cybercriminals because they allow them to commit fraud from the victim's device, avoiding fraud evaluation and detection technologies.

They anticipate Brokewell being further improved and distributed to other hackers via underground forums as part of a malware-as-a-service (MaaS) operation.

To avoid Android malware infections, avoid downloading apps or app updates from sources other than Google Play, and make sure Play Protect is always turned on.

Read more »
Personal Data
Cyberattacks CyberCrime Cybersecrurity Data Breach DPRK Hackers hacking groups Malware attacks Personal Data

DPRK Hackers Compromise South Korean Defense Contractors

 


It was reported on Tuesday that the North Korean hacking groups have been mounting "all-out" cyberattacks against South Korean defence companies, infiltrating their internal networks and stealing their technical data over the past year, South Korean police said. 

According to the police, a group of hackers, known as Lazarus, Kimsuky, and Andariel, who work directly or through contractors, planted malicious codes directly in the data systems of the defence companies, according to the authorities.

During the hacking process, state-sponsored hackers exploited vulnerabilities in the targeted systems of defence companies and installed malware to compromise their subcontractors. Even though the campaign lasted over a year, local reports claim that they managed to steal sensitive information from 10 of the 83 defence contractors and subcontractors that they targeted between October 2022 and July 2023. 

According to KPNA, many of these companies were completely unaware that they were breached when they were contacted by the police, as it has been revealed that they were completely unaware that they were. A special inspection was conducted between January 15th and February 16th by the National Police Agency and the Defense Acquisition Program Administration, and protective measures were implemented to secure critical networks as a result of the inspection.

A special investigation of the company discovered that multiple companies had been compromised since late 2022, but they weren't aware until authorities informed them of the breach. Lazarus targeted a contractor, for example, in November 2022, who was cyber-aware enough to operate separate internal and external networks. 

However, the hackers took advantage of their negligence when it came to managing the system linking the two. The hackers were able to breach an external network server, which was then infected by the hackers. As the network connection system was down for a network test, they tunnelled through it and got inside the innards of the network while the defences were down. 

To steal important information from the six employee computers, they began harvesting and exfiltrating data. It was not until police came along during the investigation that the defence companies were aware that they had been hacked. While North Korea is a country that is isolated from the rest of the world, the country has extremely strong cybersecurity capabilities and has a history of launching successful attacks against global targets over the past few decades. 

An attack on a Bangladesh central bank caused the loss of £64.6 million ($81 million) in addition to the detailed designs for a supersonic jet and a submarine, both of which would weigh three tons. In several South Korean firms, weak cybersecurity practices have enabled North Koreans to succeed in attacking their employees’ systems, with employees using the same password to access both their professional and personal accounts. 

Additionally, Andariel obtained login information, starting around October 2022, from an employee of a company which was responsible for the remote maintenance of the defence contractor in question. Infecting the company's servers with malware and exfiltrating data regarding defence technology, infected the company's servers using the hijacked account.

A police investigation also revealed an incident that took place between April and July 2023, when Kimsuky exploited the groupware email server of a partner company of a defence firm. By exploiting a vulnerability, an attacker could download large files that were sent internally via email, allowing an unauthorized attacker to download them. 

 A security breach committed by subcontractor employees who used the same password for their official and personal email accounts, as well as the hacker's ability to gain access to defence business networks and extract sensitive technical data, was utilized by the hackers. Police officers have not disclosed the nature of the compromised data and the names of the companies responsible. 

Since the signing of contracts worth billions of dollars to supply mechanized howitzers, tanks, and fighter jets in the last few years, South Korea has gained a significant place as a leading global defence supplier. It has been reported that North Korean hacking gangs gained access to global defence corporations' networks, in addition to those of South Korean financial institutions, news outlets, as well as South Korea's nuclear power operator in 2014, as a result of a significant security breach. 

There has been widespread speculation that North Korean hackers have been responsible for large-scale thefts of Bitcoin, which subsequently allowed them to finance their weapons development with the proceeds. The North Korean government denies any involvement with cyberattacks or cryptocurrency thefts carried out by other countries.
Read more »
Ransom
Cyber Attacks Data Leak Healthcare Breach Patient Data Ransom

UnitedHealth Paid Ransom After Massive Change Healthcare Cyber Assault

 

The Russian cybercriminals who targeted a UnitedHealth Group-owned company in February did not leave empty-handed.

"A ransom was paid as part of the company's commitment to do everything possible to protect patient data from disclosure," a spokesperson for UnitedHealth Group stated earlier this week. 

The spokesperson did not reveal how much the healthcare giant paid following the cyberattack, which halted operations at hospitals and pharmacies for more than a week. Multiple media outlets claimed that UnitedHealth paid $22 million in bitcoin. 

"We know this attack has caused concern and been disruptive for consumers and providers and we are committed to doing everything possible to help and provide support to anyone who may need it," UnitedHealth CEO Andrew Witty said in a statement Monday. 

UnitedHealth attributed the intrusion on the Russian ransomware gang ALPHV, also known as BlackCat. The group claimed responsibility for the attack, stating that it took more than six terabytes of data, including "sensitive" medical records, from Change Healthcare, which handles health insurance claims for patients who visit hospitals, medical centres, or pharmacies. 

The attack's scale—Change Healthcare performs 15 billion transactions every year, according to the American Hospital Association—meant that even people who were not UnitedHealth clients could have been affected. The attack has already cost UnitedHealth Group almost $900 million, company officials said in reporting first-quarter earnings last week. 

Ransomware attacks, which include disabling a target's computer systems, are becoming more widespread in the healthcare industry. In 2022, a study published in JAMA Health Forum found that the yearly frequency of ransomware attacks against hospitals and other providers increased.

It was "straight out an attack on the U.S. health system and designed to create maximum damage," Witty informed analysts last week during an earnings call about the Change Healthcare incident. According to UnitedHealth's earnings report, the cyberattack is ultimately estimated to cost the organisation between $1.3 billion and $1.6 billion this year.
Read more »
Online Banking
2FA Banking Security Cyber Security CyberCriminal data security Mobile App Online Banking

Is Online Banking Truly Safe? Understanding the Safety Loopholes in Bank Websites

 

In today's increasingly digital landscape, ensuring the security of online banking platforms is paramount. With cyber threats evolving and becoming more sophisticated, financial institutions face the constant challenge of fortifying their systems against unauthorized access and data breaches. 

Recently, Which?, a respected consumer advocate, conducted an extensive investigation into the security measures implemented by major current account providers. This evaluation carried out with the assistance of independent computer security experts, aimed to scrutinize the efficacy of banks' online banking systems in safeguarding customer data and preventing fraudulent activities. 

The assessment, conducted over two months in January and February 2024, focused on examining the apps and websites of 13 prominent current account providers. While the evaluation did not encompass testing of back-end systems, it honed in on four critical areas essential for ensuring robust security protocols: security best practices, login processes, account management, and navigation & logout functionalities. 

Through rigorous testing, the investigation revealed significant variations among providers, with some demonstrating commendable security measures while others fell short of expectations. Among the findings, TSB and the Co-operative Bank emerged as the lowest-ranked institutions in both mobile app and online security. 

Notably, TSB's app exhibited a serious vulnerability, allowing sensitive data to be accessed by other applications on the device, raising concerns about data integrity and privacy. Similarly, the Co-operative Bank's failure to enforce two-factor authentication (2FA) on a test laptop highlighted potential weaknesses in their security infrastructure, necessitating urgent attention and remediation. 

Conversely, NatWest and Starling emerged as frontrunners in online banking security, earning an impressive score of 87%. Their robust security protocols and stringent authentication processes set them apart as leaders in safeguarding customer information. 

Meanwhile, HSBC and Barclays led the pack in mobile banking security, with HSBC notably eschewing SMS-based login verification, opting for more secure alternatives to protect user accounts. In addition to holding financial institutions accountable for maintaining rigorous security standards, consumers must also take proactive steps to protect their financial data when banking online. 

Which? recommends six essential tips for enhancing online security, including protecting mobile devices, using strong and unique passwords, and promptly reporting any suspicious activity. By adopting these best practices and remaining vigilant, consumers can mitigate the risks associated with online banking and thwart the efforts of cybercriminals seeking to exploit vulnerabilities. 

In an era where digital transactions are ubiquitous, prioritizing security is imperative to safeguarding personal and financial information from unauthorized access and fraudulent activities.
Read more »
rebrand
CD Projekt Cisco data Cyber Security Cybersecurity HelloKitty Ransomware reanimation rebrand

Revived Ransomware HelloKitty Returns with Rebranding, Leaks CD Projekt and Cisco Data

 

HelloKitty, a notorious ransomware that became defunct in late 2023 after its developer leaked both the builder and source code on a hacker forum, has resurfaced under a new name and a fresh data leak website. According to reports from BleepingComputer, the ransomware and its associated dark web portal have been rebranded as HelloGookie, likely in reference to the developer and operator, Gookee/kapuchin0, who was behind the original HelloKitty ransomware.

Originally created and maintained by a hacker known as Guki, HelloKitty was infamous for its targeting of large organizations and corporations since its establishment in late 2020. One of its notable breaches occurred in February the following year when it infiltrated CD Projekt Red, a renowned Polish game studio famous for titles like the Witcher series and Cyberpunk 2077. 

The Witcher series alone has sold over 50 million copies globally, while Cyberpunk 2077 boasts approximately 25 million sales. Both games, being open-world RPGs, have garnered numerous accolades, with Witcher 3 often hailed as one of the greatest RPGs ever developed.

During the attack on CD Projekt Red, HelloKitty pilfered about 450GB of uncompressed source code, which included files for an unreleased version of Witcher 3 purportedly featuring ray tracing, a cutting-edge rendering technique that simulates realistic lighting effects in computer graphics. 

This technique was eventually integrated into Witcher 3 via a 2022 update. In a bid to mark its resurgence, the operator of the ransomware released the pilfered data from the CD Projekt Red breach, along with data acquired from a 2022 attack on Cisco. Additionally, four private decryption keys were made public to facilitate the unlocking of files encrypted by HelloKitty.

As of now, there have been no new data leaks on the HelloGookie website, nor any indication of ongoing attacks. HelloKitty once held a significant position in the ransomware landscape, and it remains to be seen whether HelloGookie will achieve similar levels of success as its predecessor.
Read more »
VPN security
Safe Browsing Technology VPN VPN Hacking VPN security

Is Your VPN Safe? Or Can It be Hacked?


A virtual private network is one of the simplest ways for consumers to secure their internet activity. VPNs utilize tunneling technology to encrypt a user's online traffic and make it unreadable to prying eyes.

This additional layer of security has become a popular choice for both businesses and customers seeking to secure their privacy. According to Statista, more than 24% of all internet users in 2023 utilized a VPN to protect their internet connection.

With such widespread use, one might wonder if VPNs are impervious to hacking. Are they susceptible to hacking? Can VPNs be used to steal user data instead of securing it?

Can VPNs be hacked?

VPNs, like any other software, can be hacked. No software is perfect, and VPNs, like all internet-based technologies, are vulnerable to various threats. That being said, a good VPN will be extremely difficult to crack, especially if it has a secure server infrastructure and application.

VPNs function by creating a secret connection via which your internet activity is encrypted and rendered unreadable. Your internet traffic is routed via a VPN server, which masks your IP address and gives you an extra degree of privacy online.

This encryption protects critical user data including your IP address, device location, browsing history, and online searches from your internet service provider, government agencies, and cybercriminals.

VPNs provide simple safety for your online activity by encrypting user data and routing it over a secure channel. However, this does not render them invincible.

There are a few vulnerabilities in VPNs that hackers can exploit or target. Let's look at a few of them:

How VPNs Can Be Hacked

Breaking the VPN encryption

One approach to hack VPNs is to break through the encryption. Hackers can employ cryptographic attacks to break poorly constructed encryption ciphers. However, breaking encryption requires a significant amount of effort, time, and resources.

Most current VPNs use the Advanced Encryption Standard (AES-256) encryption method. This encryption standard encrypts and decrypts data with 256-bit keys and is commonly regarded as the gold standard in encryption.

This is because AES-256 is nearly impregnable, taking millions to billions of years to brute force and crack even with today's technology. That is why many governments and banks employ AES-256 encryption to protect their data.

In any event, most modern VPN companies use AES-256 encryption, so there isn't anything to worry about.

VPNs employing outdated tunneling protocols

Hackers can also attack older VPN tunneling standards. Tunneling protocols are simply a set of rules governing how your data is processed and transmitted via a certain network.

We wish to avoid utilizing old protocols like PPTP and L2TP/IPSec. These protocols are outdated and are regarded as medium to low security by modern standards.

PPTP, in example, is an older technology with documented weaknesses that unscrupulous actors can exploit. In contrast, L2TP/IPSec provides better security but slower performance than newer protocols.

Fortunately, more recent VPN protocols such as OpenVPN, WireGuard, and IKEv2 offer an excellent balance of high-level security and speed.

DNS, IP, and WebRTC leaks

Malicious actors can also steal user data via VPN leaks. VPN leaks occur when user data is "leaked" from the secure VPN tunnel as a result of a bug or vulnerability inside the software. The primary types of VPN leaks include the following:

DNS leaks occur when the VPN reveals your internet activity, such as DNS queries or browsing history, to the ISP DNS server despite being connected over an encrypted VPN connection.

IP leaks occur when your IP address is accidentally leaked or exposed to the internet, undermining the primary function of a VPN in disguising your true IP address and location.

WebRTC leaks are browser-based leaks in which websites gain unauthorized access to your actual IP address by bypassing the encrypted VPN connection.

VPNs inherently log user data

Finally, hacking is possible when VPN providers access customer data without their authorization.

While many VPN services promise to have no-logs policies, indicating that they are not keeping user data, VPNs have been shown to store user information notwithstanding these rules.

Why should you still invest in a VPN?

Even after understanding the various ways VPNs can be exploited, utilizing a VPN is significantly more secure than not using one. VPNs enable you and your organization to mask your IP address with the touch of a button.

Hiding your IP address is critical because criminal actors can exploit it to send you invasive adverts, learn your location, and collect information about your personal identity. VPNs are one of the simplest and most accessible ways to accomplish this.

VPNs are also an excellent solution for larger enterprises to maintain the security of company data, especially if your company has distant employees who access company resources via the Internet.

Read more »
Social Media
2FA data security Discord Privacy Social Media

Discord Users' Privacy at Risk as Billions of Messages Sold Online

 

In a concerning breach of privacy, an internet-scraping company, Spy.pet, has been exposed for selling private data from millions of Discord users on a clear web website. The company has been gathering data from Discord since November 2023, with reports indicating the sale of four billion public Discord messages from over 14,000 servers, housing a staggering 627,914,396 users.

How Does This Breach Work?

The term "scraped messages" refers to the method of extracting information from a platform, such as Discord, through automated tools that exploit vulnerabilities in bots or unofficial applications. This breach potentially exposes private chats, server discussions, and direct messages, highlighting a major security flaw in Discord's interaction with third-party services.

Potential Risks Involved

Security experts warn that the leaked data could contain personal information, private media files, financial details, and even sensitive company information. Usernames, real names, and connected accounts may be compromised, posing a risk of identity theft or financial fraud. Moreover, if Discord is used for business communication, the exposure of company secrets could have serious implications.

Operations of Spy.pet

Spy.pet operates as a chat-harvesting platform, collecting user data such as aliases, pronouns, connected accounts, and public messages. To access profiles and archives of conversations, users must purchase credits, priced at $0.01 each with a minimum of 500 credits. Notably, the platform only accepts cryptocurrency payments, excluding Coinbase due to a ban. Despite facing a DDoS attack in February 2024, Spy.pet claims minimal damage.

How To Protect Yourself?

Discord is actively investigating Spy.pet and is committed to safeguarding users' privacy. In the meantime, users are advised to review their Discord privacy settings, change passwords, enable two-factor authentication, and refrain from sharing sensitive information in chats. Any suspected account compromises should be reported to Discord immediately.

What Are The Implications?

Many Discord users may not realise the permanence of their messages, assuming them to be ephemeral in the fast-paced environment of public servers. However, Spy.pet's data compilation service raises concerns about the privacy and security of users' conversations. While private messages are currently presumed secure, the sale of billions of public messages underscores the importance of heightened awareness while engaging in online communication.

The discovery of Spy.pet's actions is a clear signal of how vulnerable online platforms can be and underscores the critical need for strong privacy safeguards. It's crucial for Discord users to stay alert and take active measures to safeguard their personal data in response to this breach. As inquiries progress, the wider impact of this privacy violation on internet security and data protection is a substantial concern that cannot be overlooked.


Read more »
Subscribe to: Posts (Atom)