Chinese Android Smartphones Sending Data to China through Secret Software

This article is just another reason to not buy technology products made in China. Of course I am not sure there is any way around it because  many technology components and products are made in China. The Chicom Android phones are of course attractive to some because they are a lot cheaper than the name brand Android phones from Samsung and Google. It was discovered that the CHicom made cellphones from Chicom companies such as ZTE and Huawei have been found to be transferring User's private data back to China every 72 hours. Its not known if its for marketing or intelligence purposes, who cares, China is not your friend, buy American!

 

Adult Friend Finder Breach

 

The big story is that the website Adult Friend Finder was hacked and 412 million account username and passwords were stolen, which is the equivalent of 20 years of data. It looks like it is the new number 1 data breach in history. Its not the whole story though. 412 million accounts on Adult Friend Finder, I didn't think so, its actually part of a group of 6 adult content websites owned by Friend Finder Network Inc. The Passwords were stored by Friend Finder Network either in plain visible format or SHA1 hashed (peppered). Neither method is considered secure. An interesting concept of "peppering" was mentioned which I was unaware of until reading this article.

 

In cryptography, a pepper is something that is added to another value (for example a password) prior to the value being hashed using a cryptographic hash function. A pepper can be added to a password in addition to a salt value. A pepper performs a similar role to a salt, however whereas a salt is commonly stored alongside the value being hashed, for something to be defined as a pepper, it should meet one of the following criteria that define it a more carefully hidden 'secret' than the salt value:

• The pepper is held separately from the value to be hashed
• The pepper is randomly generated for each value to be hashed (within a limited set of values), and is never stored. When data is tested against a hashed value for a match, this is done by iterating through the set of values valid for the pepper, and each one in turn is added to the data to be tested (usually by suffixing it to the data), before the cryptographic hash function is run on the combined value.

 

8 Hot Skills Sought By IT Security Departments

 

Troubleshooting - Which is really asking all the right questions to discover the issue and solutions. Always room for improvement in that skill.

 

Innate Curiosity - This a good one that brought back unfortunate memory of getting denied an internal position because I wasn't deemed "curious enough". What a great, but BS excuse to deny someone a job? Moral of the story, fake until you make it, try to show your curious even  if your really not.

 

Knowledge of the Latest Attack Trends - self explanatory, but who truly has the time for this outside of work or during work?

 

Knowledge of the Latest Vulnerabilities - self explanatory, but who truly has the time for this outside of work or during work?

 

Incident Response (Automation) - Essentially creating scripts to do things such as finding a malware string for scanning servers. For a recent malware issue, nobody knew how to create the script  to accomplish this quickly. Had to locate people in the organization that could

 

Data Analysis and Dashboard/Visualization Creation - Creating pretty graphs and charts to describe or summarize issues for Management, they really like that.

 

Philosophy of Servitude (be a Superhero) - They mention volunteering and commitment, I see it as stepping up volunteering for crap details that Managers ask for volunteers. I do it occasionally, but I admit I am loath to get involved in more nonsense than I am already in, but I should be volunteering more

 

Communication - The ability to communicate the issues to Management in the most concise and brief documentation that gives understanding of what the issue

 

 

 

 This IoT Scanner Shows if Your Device is Vulnerable to be used in DDoS Attacks
 
 
I have to admit, I lose sleep at night wondering if my toaster is going to virtually run off and join an IOT BotNet or start a Skynet LAN with the fridge and the TV. What a relief when I read this article that talks about an online scanner by BullGuard's Internet of Things Scanner that can scan your devices to see if they are public on the Shodan website, an IOT search engine. BullGurad states there could be more than 185 million vulnerable IoT's out there. It’s time to start practicing safe surfing for your technological children. I think I smell toast burning?

 This IoT Scanner Shows if Your Device is Vulnerable to be used in DDoS Attacks
 
 
I have to admit, I lose sleep at night wondering if my toaster is going to virtually run off and join an IOT BotNet or start a Skynet LAN with the fridge and the TV. What a relief when I read this article that talks about an online scanner by BullGuard's Internet of Things Scanner that can scan your devices to see if they are public on the Shodan website, an IOT search engine. BullGurad states there could be more than 185 million vulnerable IoT's out there. It’s time to start practicing safe surfing for your technological children. I think I smell toast burning?

This IoT Scanner Shows if Your Device is Vulnerable to be used in DDoS Attacks

I have to admit, I lose sleep at night wondering if my toaster is going to virtually run off and join an IOT BotNet or start a Skynet LAN with the fridge and the TV. What a relief when I read this article that talks about an online scanner  by BullGuard's Internet of Things Scanner that can scan your devices to see if they are public on the Shodan website, an IOT search engine. BullGurad states there could be more than 185 million vulnerable IoT's out there. Time to start practicing safe surfing for your technological children. I think I smell toast burning?

Happy Halloween, skip the Pumpkin Spice, how about some Pumpkin Locky instead?

I was drawn to this article due to its holiday theme, but there's more to it than just pumpkins. It really discusses the current state of Ransomware. There has been about a 2 week lull in new Ransomware campaigns, which shows the bad guys like a little time off from work also. Also with Locky and other  Ransomware, they are not re-inventing the wheel, they are constantly tweaking and updating previous versions to get past defenses . A Benjamin Franklin quote mentioned by the author of the article that I never heard before, but applicable to our line work, "Distrust and caution are the parents of security".

Happy Halloween, skip the Pumpkin Spice, how about some Pumpkin Locky instead?

I was drawn to this article due to its holiday theme, but there's more to it than just pumpkins. It really discusses the current state of Ransomware. There has been about a 2 week lull in new Ransomware campaigns, which shows the bad guys like a little time off from work also. Also with Locky and other  Ransomware, they are not re-inventing the wheel, they are constantly tweaking and updating previous versions to get past defenses . A Benjamin Franklin quote mentioned by the author of the article that I never heard before, but applicable to our line work, "Distrust and caution are the parents of security".

Happy Halloween, skip the Pumpkin Spice, how about some Pumpkin Locky instead?

I was drawn to this article due to its holiday theme, but there's more to it than just pumpkins. It really discusses the current state of Ransomware. There has been about a 2 week lull in new Ransomware campaigns, which shows the bad guys like a little time off from work also. Also with Locky and other  Ransomware, they are not re-inventing the wheel, they are constantly tweaking and updating previous versions to get past defenses . A Benjamin Franklin quote mentioned by the author of the article that I never heard before, but applicable to our line work, "Distrust and caution are the parents of security".

Leftover Factory Debugger Doubles as Android Backdoor

A new vulnerability was discovered for some Android devices called "Pork Explosion". The name caught my eye and made laugh. Its actually a backdoor on Android devices made by Foxconn in Taiwan. Foxconn forgot to turn off the debugging, so any competent hacker or the Government can access the data on that phone if they have physical access to it. I would like to order a side of Pork Explosion for IPhone please.

Unfortunately, there isn't a list of affected OEMs and smartphone models yet. You can look up who Foxconn manufactures devices for, Foxconn

 

Web based keylogger

Here's a new one, but not really surprising, a web based keylogger. Web based keylogger attacks have been around for awhile apparently, I didn't know that. There has been an ongoing campaign occurring since May of this year called Magecart.  Essentially the attackers inject the keylogger code directly into the website, which steals credit card and other information at checkout  on e-commerce websites. The attackers targeted several e-commerce platforms including Magento, Powerfront CMS and OpenCart and attacks against several payment processing services, such as Braintree and VeriSign. Practicing safe e-commerce has just got tougher.

Android Lockscreen Ransomware Amps Up Annoyance With Pseudorandom Passcodes

Not a fan of free apps since they require permissions to read your contacts, locations, memory cards etc. I still need to clean the crap I do have on my phone. I imagine the paid apps pull the same crap, I haven't looked in awhile.  So I found this article interesting, you can get infected with ransomware that hijacks your lock screen, if you download the wrong free app. No worries if you have the latest android OS,  Nougat, which blocks all apps from changing your lock code if you have already set one. The permission requests to look out for are permission to lock the screen, change device settings and overlay messages above other applications. I 'll admit I have been somewhat complacent ponder my cell' phones security, but I am somewhat aware  since I despise the requirements some of these free apps want , so I never install. Unfortunately there is still a lot of people that just click through without reading what they are accepting. You gotta ask yourself, are you one those click through without reading people?

Android Lockscreen Ransomware Amps Up Annoyance With Pseudorandom Passcodes

Not a fan of free apps since they require permissions to read your contacts, locations, memory cards etc. I still need to clean the crap I do have on my phone. I imagine the paid apps pull the same crap, I haven't looked in awhile.  So I found this article interesting, you can get infected with ransomware that hijacks your lock screen, if you download the wrong free app. No worries if you have the latest android OS,  Nougat, which blocks all apps from changing your lock code if you have already set one. The permission requests to look out for are permission to lock the screen, change device settings and overlay messages above other applications. I 'll admit I have been somewhat complacent ponder my cell' phones security, but I am somewhat aware  since I despise the requirements some of these free apps want , so I never install. Unfortunately there is still a lot of people that just click through without reading what they are accepting. You gotta ask yourself, are you one those click through without reading people?

 

I am probably beating a dead horse, and here we go again. It didn't matter how strong your password was, your Yahoo account has been compromised anyways by a hack, back  in 2014,  no less. Technically its too late to change your password, since its been sitting out there for the past 2 years along with your account information. I changed my yahoo password anyways, but I think I need to closely examine my credit report. Also I think I need to institute a personal password policy, change them every week or sooner.

Someone famous recently said, "there is no such thing as privacy anymore" . I agreed and really didn't think much about it. We all know about smart devices such as TV's and refrigerators using a Wi-Fi connection at home that can be hacked. This article blew my mind, no pun  intended, seriously. Its time to start wondering or worrying about expectations of privacy with smart devices that work with an app on your mobile phone.  Disclaimer: If your sensitive to consenting  adult recreational content, avoid going to the link.

ClixSense Plain Text Password Dump




Here's a new but makes sense concept that I am not surprised exists. Getting paid to click on internet ads. Company's pay websites to post their ads and then other companies pay people to click on those ads to make it look the website ads are getting traffic. The internet is a big advertising scam, sort of, I am sure the ads to work somewhat., but its kind of like paying for friends, its not real. Anyhoo, The pay to click on ads company ClixSense's user password database was hacked affecting over six million passwords.  It was an easy job because the user  passwords were stored as plaintext in a database, nothing to crack.

A good takeaway from this incident:

Don’t use the same passwords on two different sites. Even if you choose a super-strong password, it only takes one careless site to leak that password in directly usable form.

I would bet we are all guilty of using the same password on multiple websites, I admit I am guilty of that. What's the alternative? where are you going to store a list of  individual strong passwords for each website that is readily available? I guessing an encrypted  document with only one strong password to memorize.

Cryptomining malware on NAS servers – is one of them yours?



Say what? Cryptomining, never heard of it. I vaguely know what Bitcoin is, an online currency. Bitcoin is known as the first cryptocurrency . Honestly, today was the first time I have either term "coined", get it? I have to cut back on my youtube cartoon watching apparently. So bitcoin is a digital currency aka Geek Coin to me, that can't be taxed or regulated and the Users are anonymous, so it tends to attract criminals. So, you can buy bitcoin on an exchange or you can earn it cryptomining it. Which is getting people to use their computer's to perform cryptographic calculations  until they "mine a bitcoin. Some ingenious criminals created cryptomining malware that essentially hijacks computers to form a cryptomining botnet to increase the amount of bitcoins they can get. Its amazes me how so many people have so much time for these shenanigans, but it must be a job or career for some.

     DropBox Password Hack

Me, I am not a fan of storing my personal files in the cloud.  Any Dip S*** who supports the cloud would have access to it. Its also a great way to steal company data, which is why smart IT security makes sure to block it. I found this article interesting because  it adds to the argument, if you want your data private, don't store it online. Second, I am always seeing tickets for employee credentials being displayed on sites like pastebin because they used their company domain username  and password as a login credentials online and we have to make them change their password just in case a bad actor attempts to use those credentials. The hack occurred in 2012, wonder what kind of damage was inflicted until it was discovered this year?

Linux Botnets on a Rampage

I found this article interesting because the syllabus video mentioned how Windows used to be considered the main operating system to attack . This article talks about the rise of using  DDOS botnets to attack Linux operating systems, especially against China.