A new Python-based infostealer called RedTiger is targeting Discord gamers to steal authentication tokens, passwords, and payment information. Learn how the malware works, its evasion tactics, and essential security steps like enabling MFA.
New interesting vulnerability CVE-2023-32784 was discovered for KeePass app last days. In this article I tested it, provided examples how to use it, and how to brute-force password vault with crafted dictionary attack. To not act as
Ring, the video doorbell maker dubbed the “largest civilian surveillance network the U.S. has ever seen,” is rolling out new but long overdue security and privacy features. The Amazon-owned company’s reputation was bruised after a spate of account breaches in late 2019, in which hackers broke into Ring user accounts and harassed children in their own […]
Online shopping service Instacart says reused passwords are to blame for a recent spate of account breaches, which saw personal data belonging to hundreds of thousands of Instacart customers stolen and put up for sale on the dark web.
The company published a statement late on Thursday saying its investigation showed that Instacart “was not compromised or breached,” but pointed to credential stuffing, where hackers take lists of usernames and passwords stolen from other breached sites and brute-force their way into other accounts.
“In this instance, it appears that third-party bad actors were able to use usernames and passwords that were compromised in previous data breaches of other websites and apps to login to some Instacart accounts,” the statement reads.
The statement comes after BuzzFeed News reported that data on more than 270,000 user accounts was for sale on the dark web, including the account user’s name, address, the last four digits of their credit card, and their order histories from as recently as this week.
Instacart said that the stolen data represents a fraction of the “millions” of Instacart’s customers across the U.S. and Canada, a spokesperson told BuzzFeed News.
But who’s really to blame here: the customers for reusing passwords, or the company for not doing more to protect against password reuse?
Granted, it’s a bit of both. Any internet user should use a unique password on each website, and install a password manager to remember them for you wherever you go. That means if hackers make off with one of your passwords, they can’t break into all of your accounts. You should also enable two-factor authentication wherever possible to prevent hackers from breaking into your online accounts, even if they have your password. By sending a code to your phone — either by text message or an app — it adds a second layer of protection for your online accounts.
But Instacart cannot shift all the blame onto its users. Instacart still does not support two-factor authentication, which — if customers had enabled — would have prevented the account hacks to begin with. When we checked, there was no option to enable two-factor on an Instacart account, and no mention anywhere on Instacart’s site that it supports the security feature.
Data published by Google last year shows even the most basic two-factor can prevent the vast majority of automated credential stuffing attacks.
We asked the company if it plans to roll out two-factor to its users. When reached, Instacart spokesperson Lyndsey Grubbs would not comment on the record beyond pointing to Instacart’s already published statement.
Instacart claims security is a “top priority,” and that it has a “dedicated security team, as well as multiple layers of security measures, focused on protecting the integrity of all customer accounts and data.”
But without giving users basic security features like two-factor, Instacart users can barely protect their own accounts, let alone expect Instacart to do it for them.
As cybercriminals remain steadfast in their pursuit of unsuspecting ways to infiltrate today’s businesses, a new report by IBM Security X-Force highlights the top tactics of cybercriminals, the open doors users are leaving for them and the burgeoning marketplace for stolen cloud resources on the dark web. The big takeaway from the data is businesses still control their own destiny when it comes to cloud security. Misconfigurations across applications, databases and policies could have stopped two-thirds of breached cloud environments observed by IBM in this year’s report.
IBM’s 2021 X-Force Cloud Security Threat Landscape Report has expanded from the 2020 report with new and more robust data, spanning Q2 2020 through Q2 2021. Data sets we used include dark web analysis, IBM Security X-Force Red penetration testing data, IBM Security Services metrics, X-Force Incident Response analysis and X-Force Threat Intelligence research. This expanded dataset gave us an unprecedented view across the whole technology estate to make connections for improving security. Here are some quick highlights:
Configure it Out — Two out of three breached cloud environments studied were caused by improperly configured Application Programming Interface (APIs). X-Force incident responders also observed virtual machines with default security settings that were erroneously exposed to the Internet, including misconfigured platforms and insufficiently enforced network controls.
Rulebreakers Lead to Compromise — X-Force Red found password and policy violations in the vast majority of cloud penetration tests conducted over the past year. The team also observed a significant growth in the severity of vulnerabilities in cloud-deployed applications, while the number of disclosed vulnerabilities in cloud-deployed applications rocketed 150% over the last five years.
Automatic for the Cybercriminals — With nearly 30,000 compromised cloud accounts for sale at bargain prices on dark web marketplaces and Remote Desktop Protocol accounting for 70% of cloud resources for sale, cybercriminals have turnkey options to further automate their access to cloud environments.
All Eyes on Ransomware & Cryptomining — Cryptominers and ransomware remain the top dropped malware into cloud environments, accounting for over 50% of detected system compromises, based on the data analyzed.
More and more businesses are recognizing the business value of hybrid cloud and distributing their data across a diverse infrastructure. In fact, the 2021 Cost of a Data Breach Report revealed that breached organizations implementing a primarily public or private cloud approach suffered approximately $1 million more in breach costs than organizations with a hybrid cloud approach.
With businesses seeking heterogeneous environments to distribute their workloads and better control where their most critical data is stored, modernization of those applications is becoming a point of control for security. The report is putting a spotlight on security policies that don’t encompass the cloud, increasing the security risks businesses are facing in disconnected environments. Here are a few examples:
The Perfect Pivot — As enterprises struggle to monitor and detect cloud threats, cloud environments today. This has contributed to threat actors pivoting from on-premise into cloud environments, making this one of the most frequently observed infection vectors targeting cloud environments — accounting for 23% of incidents IBM responded to in 2020.
API Exposure — Another top infection vector we identified was improperly configured assets. Two-thirds of studied incidents involved improperly configured APIs. APIs lacking authentication controls can allow anyone, including threat actors, access to potentially sensitive information. On the other side, APIs being granted access to too much data can also result in inadvertent disclosures.
Many businesses don’t have the same level of confidence and expertise when configuring security controls in cloud computing environments compared to on-premise, which leads to a fragmented and more complex security environment that is tough to manage. Organizations need to manage their distributed infrastructure as one single environment to eliminate complexity and achieve better network visibility from cloud to edge and back. By modernizing their mission critical workloads, not only will security teams achieve speedier data recovery, but they will also gain a vastly more holistic pool of insights around threats to their organization that can inform and accelerate their response.
Trust That Attackers Will Succeed & Hold the Line
Evidence is mounting every day that the perimeter has been obliterated and the findings in the report just add to that corpus of data. That is why taking a zero trust approach is growing in popularity and urgency. It removes the element of surprise and allows security teams to get ahead of any lack of preparedness to respond. By applying this framework, organizations can better protect their hybrid cloud infrastructure, enabling them to control all access to their environments and to monitor cloud activity and proper configurations. This way organizations can go on offense with their defense, uncovering risky behaviors and enforcing privacy regulation controls and least privilege access. Here’s some of the evidence derived from the report:
Powerless Policy — Our research suggests that two-thirds of studied breaches into cloud environments would have likely been prevented by more robust hardening of systems, such as properly implementing security policies and patching.
Lurking in the Shadows — “Shadow IT”, cloud instances or resources that have not gone through an organization’s official channels, indicate that many organizations aren’t meeting today’s baseline security standards. In fact, X-Force estimates the use of shadow IT contributed to over 50% of studied data exposures.
Password is “admin 1” — The report illustrates X-Force Red data accumulated over the last year, revealing that the vast majority of the team’s penetration tests into various cloud environments found issues with either passwords or policy adherence.
The recycling use of these attack vectors emphasizes that threat actors are repetitively relying on human error for a way into the organization. It’s imperative that businesses and security teams operate with the assumption of compromise to hold the line.
Dark Web Flea Markets Selling Cloud Access
Cloud resources are providing an excess of corporate footholds to cyber actors, drawing attention to the tens of thousands of cloud accounts available for sale on illicit marketplaces at a bargain. The report reveals that nearly 30,000 compromised cloud accounts are on display on the dark web, with sales offers that range from a few dollars to over $15,000 (depending on geography, amount of credit on the account and level of account access) and enticing refund policies to sway buyers’ purchasing power.
But that’s not the only cloud “tool” for sale on dark web markets with our analysis highlighting that Remote Desktop Protocol (RDP) accounts for more than 70% of cloud resources for sale — a remote access method that greatly exceeds any other vector being marketed. While illicit marketplaces are the optimal shopping grounds for threat actors in need of cloud hacks, concerning us the most is a persistent pattern in which weak security controls and protocols — preventable forms of vulnerability — are repeatedly exploited for illicit access.
Better personal security in everyday life isn’t something everyone considers — at least, not until something goes wrong. Securing home devices and personal accounts can be daunting for those who just aren’t that interested in the devices or cybersecurity. Learning the basics of personal cybersecurity is not the most appealing activity to everyone, and getting lectured by tech-savvy family members isn’t either.
Fortunately, there is a better way to teach cybersecurity. Giving the gift of better security can grant you an opportunity to discuss broader security topics in terms that specifically relate to your loved ones’ daily lives.
Here are six security awareness gifts for the person in your life who just isn’t that into security.
1. A New, More Secure Router
Home Wi-Fi security is an important part of overall personal cybersecurity that’s commonly overlooked. Default device passwords are often left unchanged after purchases, and owners aren’t always on the lookout for firmware updates. Older router models may also use outdated security protocols, so a new router can be a security awareness gift that secures the home network.
Gifting a new router may also mean spending part of your visit as a family tech support representative who reconnects devices and updates software. As painful as change might seem to your family members, a more secure home network will be worth the effort.
2. A Password Manager Subscription
Password reuse remains a gateway to multiple types of account information, especially as more personal record caches are being exposed online or sold on the dark web. Building better password habits and eliminating reuse can go a long way toward better personal security, and a password manager subscription can be a step in this direction.
As we all know, more secure passwords are but one of the many habits required to secure your digital world. Learning a new login workflow may not be for everyone, and new users may not like the change initially, but they may feel compelled to keep going if they understand how it can help them protect their accounts.
While risk and security vulnerabilities still exist, password managers are still a better tool than weak or reused passwords.
3. Encrypted File Storage/Backups
Ransomware gets a lot of press for good reason. A ransomware attack can result in total data loss when no backup exists, but secure file storage held locally or in the cloud can help eliminate much of the dread associated with data loss after a ransomware attack.
Giving the gift of an external encrypted storage device or a cloud-based encrypted backup service can grant your family members peace of mind. Knowing that important data will be secured even if your machine is overtaken by ransomware can ease worries over potential data loss.
4. Computer Monitor Privacy Filters
Privacy filters for monitors and laptop screens help protect your on-screen activity from prying eyes. They make it nearly impossible for someone to make out what’s on your screen unless they’re sitting right in front of it. Commuters and other travelers can benefit from this kind of physical barrier to their private information being displayed in public. Filters can also serve as a physical reminder to employ better personal security practices.
Privacy filters can be removed and may not protect against unauthorized access in cases where devices are stolen. If they’re used as part of an overall better approach to physical security and cybersecurity, however, they can decrease the likelihood of data loss during travel.
5. Anti-Malware and Ransomware Protection
Protecting against known malware threats and ransomware attacks is a must for personal devices. Not all family members are aware there are solutions to help prevent ransomware attacks. Coupled with an external or cloud-based encrypted backup, an anti-malware and ransomware service subscription can help protect your loved ones’ devices from attacks. Gifting several small security awareness gifts in this way can effectively build up defenses across a variety of otherwise vulnerable channels.
Bear in mind that false positive scan results and software bugs are possible when new definitions are installed, and this could be alarming to a user unfamiliar with anti-malware software. Teaching new users what to expect from their software (including potential bugs) may help to ease their minds.
6. A Virtual Private Network (VPN) Subscription
Virtual private networks (VPNs) can be a good way to separate and encrypt your own traffic away from everything else traveling with your data. They offer significantly more privacy and security compared to a standard internet connection.
As I’m sure you know, some security awareness gifts may require a little extra work. Finding an appropriate VPN service that is maintained by a reputable company might be a challenge. Also, VPNs can be very helpful but no device can be secured from every possible attack. Understanding a VPN’s role in overall security habits could help new users as they learn a new network connection workflow.
Teaching Better Security Through Useful Tech Gifts
Each of these gifts could include discussion around their purpose, which may provide a better way to teach cybersecurity. They all reinforce better security through physical means or by encouraging new habits, and they offer the new user an opportunity to learn more about cybersecurity, a topic they might otherwise neglect.
LoginTechCrunch - Dark Web
