Chinese Android Smartphones Sending Data to China through Secret Software

This article is just another reason to not buy technology products made in China. Of course I am not sure there is any way around it because  many technology components and products are made in China. The Chicom Android phones are of course attractive to some because they are a lot cheaper than the name brand Android phones from Samsung and Google. It was discovered that the CHicom made cellphones from Chicom companies such as ZTE and Huawei have been found to be transferring User's private data back to China every 72 hours. Its not known if its for marketing or intelligence purposes, who cares, China is not your friend, buy American!

 

Adult Friend Finder Breach

 

The big story is that the website Adult Friend Finder was hacked and 412 million account username and passwords were stolen, which is the equivalent of 20 years of data. It looks like it is the new number 1 data breach in history. Its not the whole story though. 412 million accounts on Adult Friend Finder, I didn't think so, its actually part of a group of 6 adult content websites owned by Friend Finder Network Inc. The Passwords were stored by Friend Finder Network either in plain visible format or SHA1 hashed (peppered). Neither method is considered secure. An interesting concept of "peppering" was mentioned which I was unaware of until reading this article.

 

In cryptography, a pepper is something that is added to another value (for example a password) prior to the value being hashed using a cryptographic hash function. A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is commonly stored alongside the value being hashed, for something to be defined as a pepper, it should meet one of the following criteria that define it a more carefully hidden 'secret' than the salt value:

• The pepper is held separately from the value to be hashed
• The pepper is randomly generated for each value to be hashed (within a limited set of values), and is never stored. When data is tested against a hashed value for a match, this is done by iterating through the set of values valid for the pepper, and each one in turn is added to the data to be tested (usually by suffixing it to the data), before the cryptographic hash function is run on the combined value.

 

8 Hot Skills Sought By IT Security Departments

 

Troubleshooting - Which is really asking all the right questions to discover the issue and solutions. Always room for improvement in that skill.

 

Innate Curiosity - This a good one that brought back unfortunate memory of getting denied an internal position because I wasn't deemed "curious enough". What a great, but BS excuse to deny someone a job? Moral of the story, fake until you make it, try to show your curious even  if your really not.

 

Knowledge of the Latest Attack Trends - self explanatory, but who truly has the time for this outside of work or during work?

 

Knowledge of the Latest Vulnerabilities - self explanatory, but who truly has the time for this outside of work or during work?

 

Incident Response (Automation) - Essentially creating scripts to do things such as finding a malware string for scanning servers. For a recent malware issue, nobody knew how to create the script  to accomplish this quickly. Had to locate people in the organization that could

 

Data Analysis and Dashboard/Visualization Creation - Creating pretty graphs and charts to describe or summarize issues for Management, they really like that.

 

Philosophy of Servitude (be a Superhero) - They mention volunteering and commitment, I see it as stepping up volunteering for crap details that Managers ask for volunteers. I do it occasionally, but I admit I am loath to get involved in more nonsense than I am already in, but I should be volunteering more

 

Communication - The ability to communicate the issues to Management in the most concise and brief documentation that gives understanding of what the issue

 

 

 

 This IoT Scanner Shows if Your Device is Vulnerable to be used in DDoS Attacks
 
 
I have to admit, I lose sleep at night wondering if my toaster is going to virtually run off and join an IOT BotNet or start a Skynet LAN with the fridge and the TV. What a relief when I read this article that talks about an online scanner by BullGuard's Internet of Things Scanner that can scan your devices to see if they are public on the Shodan website, an IOT search engine. BullGurad states there could be more than 185 million vulnerable IoT's out there. It’s time to start practicing safe surfing for your technological children. I think I smell toast burning?

 This IoT Scanner Shows if Your Device is Vulnerable to be used in DDoS Attacks
 
 
I have to admit, I lose sleep at night wondering if my toaster is going to virtually run off and join an IOT BotNet or start a Skynet LAN with the fridge and the TV. What a relief when I read this article that talks about an online scanner by BullGuard's Internet of Things Scanner that can scan your devices to see if they are public on the Shodan website, an IOT search engine. BullGurad states there could be more than 185 million vulnerable IoT's out there. It’s time to start practicing safe surfing for your technological children. I think I smell toast burning?

This IoT Scanner Shows if Your Device is Vulnerable to be used in DDoS Attacks

I have to admit, I lose sleep at night wondering if my toaster is going to virtually run off and join an IOT BotNet or start a Skynet LAN with the fridge and the TV. What a relief when I read this article that talks about an online scanner  by BullGuard's Internet of Things Scanner that can scan your devices to see if they are public on the Shodan website, an IOT search engine. BullGurad states there could be more than 185 million vulnerable IoT's out there. Time to start practicing safe surfing for your technological children. I think I smell toast burning?

Happy Halloween, skip the Pumpkin Spice, how about some Pumpkin Locky instead?

I was drawn to this article due to its holiday theme, but there's more to it than just pumpkins. It really discusses the current state of Ransomware. There has been about a 2 week lull in new Ransomware campaigns, which shows the bad guys like a little time off from work also. Also with Locky and other  Ransomware, they are not re-inventing the wheel, they are constantly tweaking and updating previous versions to get past defenses . A Benjamin Franklin quote mentioned by the author of the article that I never heard before, but applicable to our line work, "Distrust and caution are the parents of security".