Daily Archives: November 5, 2019

#nationalcybersecuritymonth | Do You Know How To Protect Yourself Against Phishing Emails? – University Times

Source: National Cyber Security – Produced By Gregory Evans

Illustration by Lauren Dahncke

Illustration by Lauren Dahncke

Illustration by Lauren Dahncke

National Cybersecurity Awareness month recently came to an end, but phishing emails never seem to. 

According to Cal State LA’s Information Technology Security, phishing emails are sent to the recipient with the purpose of obtaining personal information such as usernames, passwords and financial account information. 

Recently, with the email subject titled “MATTER OF URGENCY,” an example of a phishing email that was sent to Cal State LA students and staff this past September read:

Attention: User

To avoid cancellation of your account in the next 24 hours we advise you to click HERE to verify your email.

Warms regards,

Aceves Amberly,

IT Service Support (c) 2019.

In phishing emails such as these, the sender’s name often differs, but the IT Service Support signature is often there as an attempt to legitimize the fake request.

Information Technology Services (ITS) alerted the Cal State LA community via Twitter to contact the ITS Help Desk about any “suspicious email,” and urged students to share a post on social media to bring awareness.

Clicking the links on these phishing emails directs the recipient to a deceitful website or message that may seem legitimate. 

To protect your account, a 2-Step verification tool is an option for students and staff looking to add an “extra layer of security.” This method requires a second identification method such as your phone, code, or another registered device to confirm your identity. According to ITS, even if someone gets ahold of your password, they cannot access your account if they do not have access to the device you registered the 2-step verification method with.

To familiarize yourself with phishing emails and to make it easier to recognize and avoid them, IT Security has a Phishing and Spam Archive with numerous examples of phishing emails. Some of the emails from the past two years use the logos of well-known companies such as banks and airlines.

IT Security also has a Phishing Email Do’s and Don’ts list, which includes a tip to verify whether an email is real or not by calling the company that supposedly sent it. However, don’t use the contact information provided in the suspicious email. Instead, get a hold of the company’s legitament number or email.

Students and staff are encouraged to contact ITS at (323)-343-6170, [email protected], or @mycalstatela on social media if they have received a phishing email or have clicked the emailed link the scammers provided.

Print Friendly, PDF & Email

Source link

The post #nationalcybersecuritymonth | Do You Know How To Protect Yourself Against Phishing Emails? – University Times appeared first on National Cyber Security.

View full post on National Cyber Security

hacker proof, #hackerproof




Disclosure Does Little to Dissuade Cyber Spies

Source: National Cyber Security – Produced By Gregory Evans

In the past, outing nation-state cyber espionage groups caused a few to close up shop, but nowadays actors are more likely to switch to new infrastructure and continue operations.

When cybersecurity services firm Mandiant released its APT 1 report in 2013, the Chinese group immediately shut down, and the command-and-control servers that had been used by the group to manage its infrastructure went quiet. 

The incident has driven a naming-and-shaming policy pursued by the United States, which has filed indictments against a number of cyber-espionage actors in Russia, China, and Iran. However, such tactics increasingly appear to fail to have the intended effect, according to a report planning to be published on Nov. 5 by defense giant BAE Systems. While an Iranian group, which BAE Systems calls Operation Cleaver, ceased operations following a report in late 2014, many other Iranian groups continued to operate, including Team Ajax, Shamoon, and others, the analysis said.

It is clear that the Operation Cleaver report just led to a retasking of resources, BAE Systems’ analysts concluded in the report.

“A leading theory for the group’s disappearance is that Operation Cleaver splintered, and the members dispersed and/or restructured, spent nearly a year retooling and reorganizing, and returned in autumn 2015 as OilRig. However, this remains unconfirmed,” the analysis stated. “What is more clear is that Iranian operations which targeted aerospace, defence, and energy didn’t entirely disappear but re-emerged around the same time as OilRig and continued with similar tasking.”

The analysis of cyber-espionage groups’ activities following being outed by security researchers, government agencies, and non-government organizations (NGOs) does not come to any particular conclusion, but it does show that — aside from a few early, and only purported, successes — outing cyber-espionage groups does little to disuade them from future actions. With state-sponsored cyber espionage considered a legitimate political activity, the penalties for being caught are small, says Saher Naumaan, threat intelligence analyst at BAE Systems Applied Intelligence.

“Conducting [these] operations is the new norm, which diminishes the severity of the consequences because it’s just what states do now,” she says. “The groups don’t have to disappear anymore because this is understood to be legitimate espionage activity.”

While some early groups have gone quiet, most have changed up their infrastructure. A few have retaliated. Predictably, disclosure of attackers’ tactics also led to other groups adopting those same tactics, although linking disclosure with the adoption of techniques is difficult, BAE Systems stated. 

“Disclosure has benefits and drawbacks,” the company’s researchers stated in the analysis. “The thousands of public blogs and reports made on the activity of the hundreds of threat groups who have been reported on has contributed to a shared ‘body of knowledge’ which has driven evolution of attack techniques.”

The most common strategy for cyberattackers, however, is to change tactics. 

The Chinese group APT10, also known as Stone Panda, had used dynamic DNS infrastructure to carry out attacks against managed service providers (MSPs) — operations that were publicly outed in 2017. While the group stopped using some tools and expanded its infrastructure options, it continued operations. 

“The group became careful and siloed its campaigns based on tools, targets, and infrastructure, which led to increased difficulty in mapping out its operations,” BAE Systems stated. “This again shows that threat actors no longer feel obligated to shut down all operations due to disclosure and can adapt to changing circumstances.”

Another way that cyber-espionage groups attempt to hide their trails is to adopt the techniques of other nation’s cyber spies. In October, for example, the UK’s National Cyber Security Center revealed that a Russian-backed group, known as Turla, used attack infrastructure that it apparently stole from an Iranian group known as APT34.

“The timeline of incidents, and the behaviour of Turla in actively scanning for Iranian backdoors, indicates that whilst (the attack) tools were Iranian in origin, Turla were using these tools and accesses independently to further their own intelligence requirements,” the NCSC’s advisory stated. “The behaviour of Turla in scanning for backdoor shells indicates that whilst they had a significant amount of insight into the Iranian tools, they did not have full knowledge of where they were deployed.”

Only rarely do attackers decide to strike back at the disclosers in some way, according to BAE Systems’ report. Charming Kitten, also known as APT35, impersonated the security firm ClearSky and one of its researchers after the company outed some details of the group’s operations.

In the end, there are still benefits to disclosure, but companies, organizations, and researchers should all consider the consequences, not just to the attacker but to the work of researchers when attackers’ methods are disclosed, says Naumaan.

“Our job is to disrupt adversary activity or make it difficult — disclosure forces attackers to improve, which has a cost, [such as] creating new infrastructure, building new tools, etc.,” she says. “Disclosure, [however,] has moved away from major releases [and] whitepapers to quick turnaround tweets and simultaneously doesn’t have as significant an impact on attackers as it used to.”

Related Content:

https://www.darkreading.com/

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

More Insights

Click here for the Source link

The post Disclosure Does Little to Dissuade Cyber Spies appeared first on National Cyber Security.

View full post on National Cyber Security

hacker proof, #hackerproof




Hackers Can Silently Control Your Google Home, Alexa, Siri With Laser Light

Source: National Cyber Security – Produced By Gregory Evans

hacking voice controllable devices with laser light

A team of cybersecurity researchers has discovered a clever technique to remotely inject inaudible and invisible commands into voice-controlled devices — all just by shining a laser at the targeted device instead of using spoken words.

Dubbed ‘Light Commands,’ the hack relies on a vulnerability in MEMS microphones embedded in widely-used popular voice-controllable systems that unintentionally respond to light as if it were sound.

According to experiments done by a team of researchers from Japanese and Michigan Universities, a remote attacker standing at a distance of several meters away from a device can covertly trigger the attack by simply modulating the amplitude of laser light to produce an acoustic pressure wave.

“By modulating an electrical signal in the intensity of a light beam, attackers can trick microphones into producing electrical signals as if they are receiving genuine audio,” the researchers said in their paper [PDF].

Doesn’t this sound creepy? Now read this part carefully…

Smart voice assistants in your phones, tablets, and other smart devices, such as Google Home and Nest Cam IQ, Amazon Alexa and Echo, Facebook Portal, Apple Siri devices, are all vulnerable to this new light-based signal injection attack.

“As such, any system that uses MEMS microphones and acts on this data without additional user confirmation might be vulnerable,” the researchers said.

Since the technique ultimately allows attackers to inject commands as a legitimate user, the impact of such an attack can be evaluated based on the level of access your voice assistants have over other connected devices or services.

Therefore, with the light commands attack, the attackers can also hijack any digital smart systems attached to the targeted voice-controlled assistants, for example:

  • Control smart home switches,
  • Open smart garage doors,
  • Make online purchases,
  • Remotely unlock and start certain vehicles,
  • Open smart locks by stealthily brute-forcing the user’s PIN number.

As shown in the video demonstration listed below: In one of their experiments, researchers simply injected “OK Google, open the garage door” command to a Google Home by shooting a laser beam at Google Home that was connected to it and successfully opened a garage door.

In a second experiment, the researchers successfully issued the same command, but this time from a separate building, about 230 feet away from the targeted Google Home device through a glass window.

Besides longer-range devices, researchers were also able to test their attacks against a variety of smartphone devices that use voice assistants, including iPhone XR, Samsung Galaxy S9, and Google Pixel 2, but they work only at short distances.

According to the researchers, these attacks can be mounted “easily and cheaply,” using a simple laser pointer (under $20), a laser driver ($339), and a sound amplifier ($28). For their set up, they also used a telephoto lens ($199.95) to focus the laser for long-range attacks.

How can you protect yourself against the light vulnerability in real-life? The best and common solution is to keep your voice assistant of the line of sight from outside and avoid giving it access to things that you don’t want someone else to access.

voice activated smart assistant hacking

The team of researchers—Takeshi Sugawara from the Japan’s University of Electro-Communications and Mr. Fu, Daniel Genkin, Sara Rampazzi, and Benjamin Cyr from the University of Michigan—also released their findings in a paper [PDF] on Monday.

Genkin was also one of the researchers who discovered two major microprocessor vulnerabilities, known as Meltdown and Spectre, last year.

The Original Source Of This Story: Source link

The post Hackers Can Silently Control Your Google Home, Alexa, Siri With Laser Light appeared first on National Cyber Security.

View full post on National Cyber Security

hacker proof, #hackerproof

#school | #ransomware | Las Cruces Public Schools computers still offline a week after hacking attack

Source: National Cyber Security – Produced By Gregory Evans

Education

LAS CRUCES, New Mexico — The computer network for the Las Cruces Public Schools remained offline a week after a ransomware attack by hackers forced the shutdown of the entire system.

After originally trying to get existing servers for dozens of schools back online late last week, computer technicians for the district said late Monday they were now working to “restore critical computers and put them on a new network so schools can access student information.”

Officials said it was “still unclear how long the technology will be down,” noting that each and every computer in the district had to be cleaned in “an effort to avoid another ransomware attack.”

While originally saying it didn’t think any staff or student data breaches had occurred, the school district said it has now hired outside computer forensic experts to ensure that no information was compromised. Police also continued to investigate the hacking attack.

Biz/Tech / New Mexico / News / Top Stories

Source link

The post #school | #ransomware | Las Cruces Public Schools computers still offline a week after hacking attack appeared first on National Cyber Security.

View full post on National Cyber Security

hacker proof, #hackerproof