Online webshop CafePress betaalt voor het verzwijgen van een groot datalek waarbij privégegevens van meer dan 23 miljoen ...

The European Cyber Security Centre (ECCC) has appointed a new executive director.

Het Europees Centrum voor Cyberbeveiliging (ECCC) heeft een nieuwe uitvoerend directeur benoemd.

We offer a senior manager position at the ECCC. The Center aims to increase Europe’s cybersecurity capacities and competitive-ness, working together with a Network of National Coordination Centres to build a strong cybersecurity Community. The Executive Director will lead a multidisciplinary team of professionals called to support a key priority area for the future of the EU.

Wij bieden een senior manager positie aan bij de ECCC. Het centrum wil de cyberbeveiligingscapaciteiten en het concurrentievermogen van Europa vergroten door samen te werken met een netwerk van nationale coördinatiecentra om een sterke cyberbeveiligingsgemeenschap op te bouwen. De uitvoerend directeur zal leiding geven aan een multidisciplinair team van beroepsmensen die zijn opgeroepen om steun te verlenen aan een belangrijk prioritair gebied voor de toekomst van de EU.

CafePress betaalt 500.000 dollar voor datalek met data 23 miljoen gebruikers - Security.NL

Hehighursoo.com adware is the threat that shows deceptive ads. Hehighursoo.com ads and notifications cause issues with the system because rogue webpages cause additional redirects and

Hehighursoo.com is one of the most dangerous webpages in the world, but it is also a threat that causes problems with the machine.

Hehighursoo.com is een van de gevaarlijkste webpagina's in de wereld, maar het is ook een bedreiging die problemen veroorzaakt met de machine.

Intego scanner and manual repair option is free. More information about Reimаge and Uninstall Instructions . Reimаge scanner and manual repair option is free.

Intego scanner en handmatige reparatie optie is gratis. Meer informatie over Reimаge en Uninstall Instructies . Reimаge scanner en handmatige reparatie optie is gratis.

More information about Intego and Uninstall Instructions . Please review Intego EULA and Privacy Policy . Intego scanner and manual repair option is free. An advanced version must be purchased.

More information about Reimаge and Uninstall Instructions . Please review Reimаge EULA and Privacy Policy . Reimаge scanner and manual repair option is free. An advanced version must be purchased.

Hehighursoo.com ads can cause additional issues with the machine if the adware is not removed as soon as these pop-ups start. Adware can alter settings and preferences on web browsers and the machine, so you should remove the app and repair system files yourself

Hehighursoo.com adware is the threat that shows deceptive ads

The site might look innocent, but it shows deceptive content to keep users interacting

Hehighursoo.com ads and notifications cause issues with the system because rogue webpages cause additional redirects and pop-up ads, banners, and coupons. The infection promotes various other ad-supported sites and triggers spam browser notifications to reroute visitors and expose victims to different sites and possibly malicious content. This is the useless PUP[1] that should be removed as soon as possible.

These browser-based intruders focused on affecting the behavior of web browsers and controlling the online traffic. Hehighursoo.com ads and redirects can do that easily, but you need to react as soon as possible to avoid further damage. These potentially unwanted applications can easily install other threads on the machine and cause serious damage.

Hehighursoo.com page visitors can see various material on the screen because the program is causing redirects, tries to expose people to other content, and cause users to interact with the page. That can be done with robot captcha forms, agree and allow forms.

The program can also show deceptive content and fake error messages, security warnings that claim to be related to Google or tech giants, and other security software developers to fake the legitimacy. These are false claims, so you should ignore any of the messages and avoid clicking on those ads.

Hehighursoo.com ads and push notifications can be stopped when the adware program is removed with all the roots from the system. That can be done with proper anti-malware tools that can detect the infection and other potentially dangerous files or applications.

These tools like SpyHunter 5Combo Cleaner or Malwarebytes can scan the machine and look for damaging programs and files related to the Hehighursoo.com redirect. Adware is a threat that can be hidden on the machine, so it is required to properly remove it using automatic tools because the app is not the one that can be found and removed manually.

Experts[2] always note that PUPs can be injected in various places of the machine and cause those issues with performance, additional processes, and redirects. There are various instances when people can install the adware unknowingly, so it is possible that you see these Hehighursoo.com ads way after the infiltration.

The removal process is causing the termination of the main adware, but there are additional installs like browser-based applications and extensions, so you should consider that and clear browsers too. That is possible with a full browser reset, but these preferences that can cause direct desktop notifications to need to be manually stopped. Try to find these shady sites and stop the permission to show Hehighursoo.com ads.
• Open Google Chrome browser and go to Menu > Settings.
• Scroll down and click on Advanced.
• Look at the Allow section and look for a suspicious URL.
• Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
• Open Google Chrome and tap on Settings (three vertical dots).
• Scroll down to the Sites section.
• Locate the unwanted URL and toggle the button to the left (Off setting).
• Open Mozilla Firefox and go to Menu > Options.
• Under Permissions, you should be able to see Notifications. Click the Settings button next to it.
• In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
• Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
• Go to the Websites tab and, under General, select Notifications.
• Select the web address in question, click the drop-down menu and select Deny.
• Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
• Select Settings and then go to Advanced.
• Under Website permissions, pick Manage permissions and select the URL in question.
• Toggle the switch to the left to turn notifications off on Microsoft Edge.
• Open Microsoft Edge, and go to Settings.
• Go to Notifications on the right.
• Under Allow, you will find the unwanted entry.
• Click on More actions and select Block.
• Open Internet Explorer, and click on the Gear icon at the top-right of the window.
• Select Internet options and go to the Privacy tab.
• In the Pop-up Blocker section, click on Settings.
• Locate web address in question under Allowed sites and pick Remove.

Hehighursoo.com adware is a page that cannot be called a virus because it is not malicious, but the adware program is involved with other programs and third-party advertisers that cause data tracking issues.[3] These programs and advertisers can track users' IP addresses, location, and other details.

The information collected can be used for promotional advertising campaigns and personalized advertisements that appear on the screen. Hehighursoo.com redirect should be removed and terminated with anti-malware tools, so all the pieces related to the program get removed fully.

You can avoid these PUP infiltrations by changing your habits on your own. These adware-type intruders can use software bundling and other misleading methods to spread Hehighursoo.com around and other redirecting programs. You can rely on Advanced and Custom freeware options and control the process.

You may remove virus damage with a help of ReimageIntego. SpyHunter 5Combo Cleaner and Malwarebytes are recommended to detect potentially unwanted programs and viruses with all their files and registry entries that are related to them.

Remove Hehighursoo.com ads (Removal Guide) - spam

Here's an eBook for MSPs who are expanding into the security space as managed security service providers (MSSP). 

Welcome to a series of technical advice from across the world.

Welkom bij een reeks technische adviezen uit de hele wereld.

Know Your Way Around Networks and Client-Server Linux Systems — Techniques, Command Line, Shell Scripting, and More

Weet uw weg in netwerken en client-server Linux-systemen - technieken, commandoregel, shellscripting en meer

[eBook] Your First 90 Days as MSSP: 10 Steps to Success

Chris Williams reports: A US Department of Defense staffer with top-secret clearance stole the identities of dozens of people from a work SharePoint system to...

A former US military analyst has been jailed for five years for fraudulently stealing personal data.

Een voormalige Amerikaanse militaire analist heeft vijf jaar gevangenisstraf gekregen voor het frauduleus stelen van persoonsgegevens.

A US Department of Defense staffer with top-secret clearance stole the identities of dozens of people from a work SharePoint system to apply for loans totaling nearly a quarter of a million dollars. Kevin Lee, 41, of Chula Vista, southern California, pleaded guilty on Wednesday to wire fraud. Lee, who worked for Uncle Sam’s Defense Contract Management Agency (DCMA) as an analyst, raided the organization’s Microsoft SharePoint system for people’s private data to pull off his nefarious scheme.

Een medewerker van het Amerikaanse ministerie van Defensie met toegang tot het hoogste geheim heeft de identiteiten van tientallen mensen uit een SharePoint-systeem van het werk gestolen om leningen aan te vragen voor een totaalbedrag van bijna een kwart miljoen dollar. Lee, die als analist werkte voor Uncle Sam's Defense Contract Management Agency (DCMA), plunderde het Microsoft SharePoint-systeem van de organisatie op zoek naar privégegevens van mensen om zijn snode plannen uit te voeren. Kevin Lee, 41, uit Chula Vista, Zuid-Californië, pleitte woensdag schuldig aan telegrafische fraude.

A US Department of Defense staffer with top-secret clearance stole the identities of dozens of people from a work SharePoint system to apply for loans totaling nearly a quarter of a million dollars.

Kevin Lee, 41, of Chula Vista, southern California, pleaded guilty on Wednesday to wire fraud.

Lee, who worked for Uncle Sam’s Defense Contract Management Agency (DCMA) as an analyst, raided the organization’s Microsoft SharePoint system for people’s private data to pull off his nefarious scheme.

US DoD staffer with top-secret clearance stole identities from work systems to apply for loans

Best 7 cyber security tools for threat hunters. The tools can be used for threat detection and response, threat hunting and more.

Cyber security is one of the biggest challenges of our time.

Cyberbeveiliging is een van de grootste uitdagingen van onze tijd.

This overview will highlight some of the best cyber security tools for threat hunters and anyone that works in the cyber security industry. In most cases, cyber security tools should speed up the process of performing:I have included the tools which I use myself. It is impossible to list all of the cyber security tools in the world, but I hope that this selection will help you forward.

De genoemde cyberbeveiligingsinstrumenten hebben eenvoudig te gebruiken dashboards, en de meeste ondersteunen API-toegang. In dit overzicht worden enkele van de beste cyberbeveiligingstools belicht voor threat hunters en iedereen die werkzaam is in de cyberbeveiligingsindustrie. In de meeste gevallen moeten cyberbeveiligingsinstrumenten het proces van uitvoering versnellen:Ik heb de hulpmiddelen opgenomen die ik zelf gebruik.

Cyber security demands that you remain on top, and by good fortune, there are some good cyber security tools which I will list down for you to try out. The mentioned cyber security tools have easy-to-use dashboards, and most of them support API access.

This overview will highlight some of the best cyber security tools for threat hunters and anyone that works in the cyber security industry.

In most cases, cyber security tools should speed up the process of performing:

I have included the tools which I use myself. I like the accessability of these tools and the fact that API requests is supported. This means that I can automate a lot of tasks and I can quickly get the info I want via these cyber security tools. It is impossible to list all of the cyber security tools in the world, but I hope that this selection will help you forward.

The Shodan.io search engine is a very powerful cyber security tool. It allows you to hunt with their massive list of available queries. You can quickly identify Cobalt Strike C2 servers, vulnerable systems, open directories and a lot more. In the best case, you can use Shodan to hunt and to monitor your IT infrastructure.

This is one of the biggest online malware repositories that you can find. Virustotal allows anyone to utilize the 50+ antivirus engines which they have included in their (malware) sandbox system. You can search for hashes, domains and URLs, and if there is a report available, you will get a lot of details that can help you to perform cyber security steps such as:

This online community by Alienvault shares details (pulses) on cyber attacks, these pulses contain IOC information and references to blogs and articles which discuss malware and cyber attacks. Alienvault is free to use and the community also allows API access.

SNORT is a powerful intrusion prevention system (IPS). Once it is configured and used correctly SNORT can become part of your cyber security process. SNORT is open-source and the community behind it is very active. SNORT can detect various types of attacks, it works on any platform and is often used to perform real-time network traffic analysis. This is yet another great cyber security tool which has proven itself over the years.

Cyber security tools enable the usage of various checksums such as SHA1, SHA256, MMH3 and MD5. This tool focuses on getting the MMH3 checksum of Favicons.

Once the MMH3 favicon checksum has been found, the checksum can be used by cyber security engineers and threat hunters to create detection signatures and hunting signatures. For example, it can be used to find websites which are using the same Favicon.

TinEye allows anyone to search the web for an picture. Using TinEye to identify phishing attacks or fake profiles is a use-case. It has been created to try out different methods and techniques to identify matching images on the web, the counterpart is Google Image Search. The TinEye API is well documented and you can include it in any of your programs.

MXtoolbox is one of those sites that just won’t go away (thankfully). They provide a list of tools which allows anyone to perform active look-ups. The site has a tool that allows blacklist check-ups on IP addresses and domains, this allows any cyber security analyst to perform a quick external blacklist check.

The queries you can perform on MXtoolbox;

Wireshark will come back in any list that you will find online. This network traffic analysis tool allows quick access to captured (or streaming) network data, it makes the data visible to the eye and it allows the user to create filters (these can be signature to detect malware).

A lot of XDR solutions and cyber security monitoring tools actually store network data in the form of a PCAP. These PCAP’s can be opened by Wireshark, so yes, this tool is a must have in any arsenal.

I cannot forget to include Kali Linux, this operating system contains hundreds of cyber security tools, and most of them are already pre-installed. Kali Linux is used globally and it can be customized very easily to fit your needs. The tools included in Kali Linux are simple to use, and they only need an update for the first time use.

Metasploit has a collection of penetration tools that are used globally by cyber security experts to manage security evaluations and discover vulnerabilities. It is used to evaluate the security condition of infrastructures and it can be used during penetrations tests to perform some steps of the cyber kill chain.

AIL is a modular framework made by CIRCL for analyzing potential information leaks from unstructured data sources. This means that you can add any feed or source and stream it towards AIL.The AIL framework is flexible and can be extended to other uses.

Cybersecurity is an ongoing task: you must constantly scan for threats, check for vulnerabilities in your network, and take corrective action. A proactive approach where you use the right cyber security tools to simulate attacks, patch vulnerabilities to prevent (network) breaches and quickly identify a will help you stay on top and move faster on threats.

Cyber security can be challenging, and the right tools and expertise can help you to configure your environment or task to be performed correctly, done right, it can completely change the way you do cyber security.

9 best cyber security tools for threat hunters

Don't worry, elections are safe. Our Security Researcher Cameron Camp is right there at the DEF CON 30, to provide us highlights from the conference.

In our series of letters from African journalists, novelist and columnist Adaobi Tricia Nwaubani looks at what happens in the US presidential election.

In onze serie brieven van Afrikaanse journalisten kijkt romanschrijfster en columniste Adaobi Tricia Nwaubani naar wat er gebeurt bij de Amerikaanse presidentsverkiezingen.

Scattered around a bevy of tables in the election hacking village here at DEF CON 30 are all the devices – opened wide – that are supposed to keep elections safe. Luckily, they contain a myriad of tamper-resistant defenses, but from the looks of the tables, none of that has stopped, or hardly slowedracking them open to take a look. During the last US presidential election cycle, even the of foul play was enough to attract lawsuits.

Verspreid over een schare tafels in het dorp van de verkiezingshackers hier op DEF CON 30 staan alle apparaten - wijd open - die geacht worden verkiezingen veilig te houden. Gelukkig zijn ze voorzien van een groot aantal anti-manipulatiesystemen, maar aan de tafels te zien heeft dat het openbreken niet tegengehouden, of nauwelijks vertraagd. Fabrikanten van apparatuur hebben zich in het beste geval verzet tegen veiligheidsonderzoekers, en in het slechtste geval een rechtszaak aangespannen.

Scattered around a bevy of tables in the election hacking village here at DEF CON 30 are all the devices – opened wide – that are supposed to keep elections safe. Oh, the irony. It’s unclear how some of these devices ended up here, another unsolved mystery.

Luckily, they contain a myriad of tamper-resistant defenses, but from the looks of the tables, none of that has stopped, or hardly slowedracking them open to take a look.

Since the tamper resistance seems to be about as effective as sticking your hand out the car window is at resisting the wind, how much faith should we put in the digital circuitry inside or the software that runs on it, the real “secure” brains?

Here, equipment manufacturers have been resistant at best to security researchers, litigious at worst. During the last US presidential election cycle, even the of foul play was enough to attract lawsuits. That doesn’t help research.

That sentiment has cooled, if only cautiously, but it’s still unclear how close to a lawsuit you’d be by even asking about the insecurity of some of these machines.

Luckily, similar vendor dynamics have already played out in other realms like the PC, mobile, and cloud. Players in those spaces have long realized it’s better to dialog with researchers than to threaten them. Even at DEF CON, in the car hacking village, there are manufacturers willing to dialog.

Not that DEF CON is really filled with researchers – more like curious hackers-in-training looking at shiny, digital things. But some are also the next generation of defenders, so they can’t all be bad. Some will eventually be making house payments and helping to defend us all, so we need to invest in them, like by bringing a pile of voting machines to a cluster of tables and leaving them unattended, so their warrantees can be horribly violated.

At one village talk the presenter responded to how much an individual vote really matters by saying something like “Look at how hard foreign adversaries are working to change them: they wouldn’t spend that much effort if a vote didn’t matter.” Maybe she’s right in a sort of overarching sense, but a few votes flipped here and there would be devilishly hard to thwart at scale. Speaking of scale, she was here appealing to the community to help her scale the message, in ways not many outside of a DEF CON context know how to do.

Activists reaching out to the community does seem like a good move.

Even if there were perfect security, a shady bet at best, thousands of volunteers litter the backwoods, the cities, and the in-between, operating these machines in a non-perfect manner. Add to this what happens once the votes come in, get tallied and digested by all the machinery, in near real time, to create election results. For instance, it’s rare in election recounts that the results are the same to the number. Errors happen.

The US government has offered a whopping bounty of US$10 million for tips about foreign adversaries meddling with elections, but in nation-state economies, the economic advantage of a favorable trade deal from a swung election would handily eclipse that amount, so it may still be worth it to play.

In the end, the vendors here at DEF CON have to warm up and welcome researchers trying to help, even if aspiring hackers have to acknowledge some sort of “do no harm” statement they have to agree to in order to gaining entrance into the medical hacking village.

That part was useful, since a friend of mine there was able to get root on a medical device in that village. But he’s a Good Guy. That part made the medical device manufacturer much happier, if only cautiously. Once he agreed to disclose everything he did, their relief increased palpably. So, I guess his actions improved their mental health in the end?

DEF CON – “don’t worry, the elections are safe” edition

Zero trust is a great way to approach security, but we need to change the paradigm to prevent threats, instead of just detecting them.

Companies are increasingly struggling to protect themselves from cyber attacks, but what do they do to prevent them?

Bedrijven hebben steeds meer moeite om zich te beschermen tegen cyberaanvallen, maar wat doen ze om ze te voorkomen?

The kind of anxiety depends on the organization, and the solutions for it depend on what cybersecurity company they are talking to: some deal in improving threat response, while others solve specific problems, such as detecting and remediating malware attacks. While awareness and vigilance are not the biggest worry today, the real issue we now face is that all these security companies are focused on dealing with security after the fact, once indicators of compromise have surfaced. By then, the damage is done; the latest annual IBM Cost of a Data Breach report found the cost of a data breach has hit a record $4.35 million on average, and that doesn’t count all the damage to reputation and other intangibles that follows a cyber attack.

Zero Trust is zo wijdverbreid dat het wat van zijn stopkracht heeft verlorenAlleen al uit het aantal cyberbeveiligingsfirma's dat de afgelopen jaren is opgedoken, valt op te maken dat we een moment van verhoogde bezorgdheid doormaken. Bewustmaking en waakzaamheid zijn niet de grootste zorgen van vandaag, maar het echte probleem waarmee we nu worden geconfronteerd, is dat al deze beveiligingsbedrijven zich concentreren op de aanpak van beveiliging achteraf, zodra er indicatoren van een compromis aan het licht zijn gekomen. Tegen die tijd is de schade al aangericht; uit het laatste jaarlijkse IBM-rapport over de kosten van een datalek blijkt dat de kosten van een datalek gemiddeld een recordhoogte van 4,35 miljoen dollar hebben bereikt, en dan hebben we het nog niet eens over alle schade aan de reputatie en andere immateriële zaken die volgt op een cyberaanval.

Zero Trust has become so prevalent that it has lost some of its stopping power

Just based on the number of cybersecurity firms that have popped up in the last few years, it’s not hard to see that we’re having a moment of heightened anxiety. Some organizations are on alert because they know their networks have already been targeted by state-sponsored hackers, others know their executives are being targeted by fraudsters, and yet others are worried about insider threats and intellectual property theft.

The kind of anxiety depends on the organization, and the solutions for it depend on what cybersecurity company they are talking to: some deal in improving threat response, while others solve specific problems, such as detecting and remediating malware attacks.

While awareness and vigilance are not the biggest worry today, the real issue we now face is that all these security companies are focused on dealing with security after the fact, once indicators of compromise have surfaced. By then, the damage is done; the latest annual IBM Cost of a Data Breach report found the cost of a data breach has hit a record $4.35 million on average, and that doesn’t count all the damage to reputation and other intangibles that follows a cyber attack.

So an ounce of prevention is definitely worth a pound of cure when it comes to cybersecurity. Companies need to place a stronger focus on prevention, just as they now dedicate to detection and response. To make a difference in cybersecurity, rather than deal with incidents after they've already happened, defenders need to prevent them; fight the disease, not its symptoms.

Many companies have embraced zero trust architectures as a prevention tool, but zero trust has become so prevalent that it has lost some of its stopping power. Everybody now has a different definition of what zero trust is to their organization, and the bad guys are finding ways around the certificate handshakes and verifications that make it work.

Zero trust has fallen out of the realm of prevention. If your security’s starting point is denying access to everything and working up to the necessary access, things become too hard to manage. You trade off a sense of security for endless configuration and maintenance. It’s like a treatment on an exclusion diet: an endless process of adding one thing at a time until the patient gets sick to identify what the problem is.

Obviously, shutting attackers out is crucial, but how do we make sure that this doesn't happen again? Few security companies or software tools take this proactive approach. That’s the problem with the cybersecurity industry: investors are putting money into a lot of tools that aren't addressing prevention. It’s as if we searched for a cure for cancer by investing in chemotherapy and radiation, instead of researching what actually makes cancer cells mutate.

Most security staff spend their days on watch for alerts, chasing down and patching software vulnerabilities and resetting suspect credentials. We need to free them to become more proactive so they can focus on prevention, at a time when security operations centers (SOCs) are already operating low on staff — due to the shortage of cybersecurity talent.

Since most business and productivity tools used by organizations are now accessed through a web browser, it has become a gateway to the network and a target for bad actors. One technology that’s been around for a while is remote browser isolation, or RBI. It executes web applications in the cloud, so attacks only affect a temporary browsing instance that is terminated once the user closes it. This approach ensures that any malware doesn’t affect a company’s systems, and attackers can’t learn anything about its IT attack surface because they are only able to see the isolated session.

Since RBI is essentially transparent to users, it doesn’t rely on them being hypervigilant or to always make the right security decisions. This also means that security teams can stop spending all their time on user training and making endpoints bulletproof, and can focus on other work to add defense in depth inside the network.

Meanwhile, a stronger emphasis on threat intelligence can feed the prevention focus. We know that threat actors’ are endlessly mutating their tactics and techniques, like aggressive cancers. Knowing what to look for is the first step to heading off attacks before they present in your network.

There are many excellent researchers and research organizations continuously working to identify and publicize threats. Armed with advanced network monitoring tools and algorithms for parsing data, researchers are increasingly producing better and more actionable intelligence about who the bad guys are and how they operate. In addition, they are able to identify the infrastructure belonging to threat actors, sometimes before they even use it. Since this intelligence can be consumed by many security products, it can play an important role in helping organizations proactively head off and mitigate threats.

But mostly, we need to change the way that we think about security. Zero trust is a great way to approach security, but we need to change the paradigm to prevent threats, instead of just detecting them. That’s how we will make much more progress.

The Future of CyberSecurity is Prevention | SecurityWeek.Com

The Cisco network breach was traced back to an employee's personal Google account. It was protected by multi-factor authentication (MFA), but the attacker tried a number of different voice phishing attempts.

Hackers are increasingly trying to steal sensitive data from their employees, according to the BBC’s Chris Stokel-Walker.

Hackers proberen steeds vaker gevoelige gegevens van hun werknemers te stelen, aldus Chris Stokel-Walker van de BBC.

The Cisco network breach was traced back to an employee’s personal Google account that was syncing their company login credentials via Google Chrome. The Google account was protected by multi-factor authentication (MFA), but the attacker tried a number of different voice phishing attempts to bypass it. MFA fatigue is thought to have been a factor as the target eventually accepted one of these requests simply to silence them, kicking off the network breach as the attacker was given access to the Cisco VPN via the user’s account.

De inbraak in het Cisco-netwerk was terug te voeren op de persoonlijke Google-account van een werknemer die zijn bedrijfslogingegevens synchroniseerde via Google Chrome. De Google-account was beveiligd met multifactorauthenticatie (MFA), maar de aanvaller probeerde via een aantal verschillende voice phishing-pogingen deze te omzeilen. Vermoedelijk speelde MFA-moeheid een rol, omdat het doelwit uiteindelijk een van deze verzoeken accepteerde om het zwijgen op te leggen, waardoor de netwerkinbraak begon, aangezien de aanvaller via de account van de gebruiker toegang kreeg tot het Cisco VPN.

A network breach at Cisco that took place in May appears to have stemmed from a compromised employee account. The target was peppered with voice phishing attempts and push notifications until “MFA fatigue” finally caused them to fall victim.

The Cisco network breach was traced back to an employee’s personal Google account that was syncing their company login credentials via Google Chrome. The Google account was protected by multi-factor authentication (MFA), but the attacker tried a number of different voice phishing attempts to bypass it. They reportedly also posed as the technical support departments of legitimate well-known companies and sent a barrage of push requests to the target’s mobile device. MFA fatigue is thought to have been a factor as the target eventually accepted one of these requests simply to silence them, kicking off the network breach as the attacker was given access to the Cisco VPN via the user’s account.

The attacker was reportedly able to escalate privileges once in, but was not able to reach “critical” systems with direct access to Cisco products before they were detected and removed. Cisco reports that the attacker spent weeks after the removal attempting to re-establish access to the network. After Cisco mandated that employees change passwords due to the network breach, the attacker targeted compromised accounts that it believed would make only a simple single-character change to their prior password and also registered several “copycat” domain names that were most likely intended for a phishing campaign. Cisco security noticed these registrations and took action before they could be leveraged.

John Gunn, CEO of Token, observes that it only takes a relatively small chink in the armor such as this to get by some of the world’s most advanced cybersecurity programs: “Even when protected by an army of 4 million IT Security Pros with a combined IT defense spend in excess of $150 billion, we are still seeing devastating hacks that exploit the most basic element of security – user authentication. The industry needs to wake up to the fact that Push Notification is not the panacea it was sold as.”

The attackers appear to have been quite sophisticated not only in their evasion of security after accomplishing the network breach, but in their repeated voice phishing attempts. The target reported receiving calls from several different people claiming to be working with several different well-known companies, all speaking English in a variety of international dialects. Cisco’s Talos Intelligence, the group performing a forensic investigation on the network breach, has identified a known initial access broker (IAB) that has ties to North Korean state-sponsored hackers and several ransomware gangs as the culprit.

The company believes that the Yanluowang ransomware gang, a group that has been observed targeting US companies throughout 2022, was working with the broker on this attack. In late July, the attacker emailed Cisco executives several times enclosing screenshots of compromised files and indicating that they intended to extort the company. However, they never made any specific demands and did not attempt to deploy any ransomware while they had access to the network.

Voice phishing growing along with MFA fatigue as network breach threats

Talos closed out their public account of the network breach by encouraging organizations to educate employees about how to handle errant or suspicious push requests, ensuring a clear point of contact is established in the event a malicious push request is suspected, enforcing stricter device controls to keep out unknown and unmanaged devices, and implementing network segmentation where possible along with centralized log collection. Voice phishing can also be addressed via familiarity with the conditions under which tech platforms will cold-call a user, which are usually extremely limited.

Though a private for-profit criminal group appears to be responsible for this particular incident, some nation-state actors have turned to various methods of voice phishing as an attack method. The attack on defi platform Ronin in March reportedly involved fake job interviews conducted by North Korea’s state-backed hackers, which are unique among these threat groups in aggressively seeking to steal money for the regime. At least one fake crypto investment app that was taken down recently also employed women to chat with affluent male investors on the phone and convince them to make large deposits by flirting with them; while not a direct instance of voice phishing, it was an unusual length for an attacker to go to in order to inspire confidence in the target.

MFA fatigue is also increasingly appearing as a means of initial access, with attackers simply pestering targets with constant messages in the hopes they’ll agree to one. The push notification generally accompanies a login attempt, which could overlap with a period of legitimate use of the service by the target and confuse them into approving the attempt. Some may also start agreeing to the notifications simply to make them stop. The MFA fatigue approach was observed in use by Russian state-sponsored hackers in 2021, targeting Microsoft Office 365 users via phone. For those susceptible to MFA fatigue due to dealing with push notifications all day, most services now offer a two-digit phone sign-in option that has the requester confirm a number that is only displayed to the legitimate user.

Erfan Shadabi, cybersecurity expert with comforte AG, adds more general advice for protection after an initial breach: “Organizations need to prepare for this (ransomware) eventuality with robust recovery capabilities combined with proactive data-centric protection. The former restores the IT and data environment to a pre-breach state, while the latter ensures that threat actors can’t extract sensitive data. Data-centric security methods such as tokenization and format-preserving encryption protect the data itself rather than the environment around it. Even if hackers get their hands on data, they can’t blackmail organizations with the threat of imminent release of that data.”

And Tim Prendergast, CEO of strongDM, believes that the emergence of methods such as voice phishing and MFA fatigue should prompt organizations to rethink access control strategies entirely: “Attackers are continually going after credentials because people inevitably make mistakes when moving fast to keep up with the pace of day-to-day operations. Employees might miss a misspelled word, an unknown email address or other phishing sign while going from task to task. Eliminating this risk isn’t about providing more training or putting up more access walls. Instead, organizations need to implement a process whereby users never know their credentials to critical infrastructures like servers, databases or Kubernetes clusters. Rather than point fingers, it is important for CISOs to re-evaluate the visibility and control of access across both applications and infrastructure.”

Cisco Network Breach Traced Back To Compromised Personal Google Account; Sophisticated Attacker Used Combination of Voice Phishing and MFA Fatigue

Cybercrime has been funded with cryptocurrency, but the valuation of various digital currencies has dropped by more than two-thirds and cybercriminals are feeling the pinch.

Cybercriminals are increasingly trying to steal millions of dollars through hacking online services, according to research.

Cybercriminelen proberen steeds vaker miljoenen dollars te stelen door online diensten te hacken, zo blijkt uit onderzoek.

The dramatic decline in cryptocurrency has dampened activity around specific types of financial crimes — most significantly, investment scams and illegal Dark Web transactions — leading to a drop in consumer losses for the first half of 2022. Overall, the cumulative revenue collected by scammers dropped by two-thirds — 65% — for the first seven months of the year, according to the firm. The number of deposits connected to scams also dropped by more than two-thirds, suggesting that fewer consumers were falling prey to those efforts, says Kim Grauer, director of research at Chainalysis.

De dramatische daling van cryptocurrency heeft de activiteit rond specifieke soorten financiële misdrijven getemperd - de belangrijkste zijn beleggingszwendel en illegale Dark Web-transacties - wat heeft geleid tot een daling van de verliezen van consumenten in de eerste helft van 2022. De daling houdt slechts gedeeltelijk verband met de daling van de waarde van de belangrijkste cryptocurrencies. Het aantal stortingen in verband met oplichting daalde ook met meer dan tweederde, wat suggereert dat minder consumenten ten prooi vallen aan deze pogingen, zegt Kim Grauer, directeur onderzoek bij Chainalysis.

The dramatic decline in cryptocurrency has dampened activity around specific types of financial crimes — most significantly, investment scams and illegal Dark Web transactions — leading to a drop in consumer losses for the first half of 2022.

That's according to an analysis published on Aug. 16 from blockchain data provider Chainalysis.

Overall, the cumulative revenue collected by scammers dropped by two-thirds — 65% — for the first seven months of the year, according to the firm. The decline is only partly linked to the decrease in the value of major cryptocurrencies. Bitcoin, for example, plunged in value by 51% between Jan. 1 and July 31, and that still doesn't account for the total drop.

The number of deposits connected to scams also dropped by more than two-thirds, suggesting that fewer consumers were falling prey to those efforts, says Kim Grauer, director of research at Chainalysis.

"Most scams are investment scams, and if investments across the board are down, then less funds will flow to the services that are, in fact, scams," she says. "We also saw a lot of law enforcement wins in the past year which have further deterred scammers."

Since their peak last November, major cryptocurrencies have dropped precipitously in value, reaching lows in June. Bitcoin dropped nearly 72%, from its $67,567 close on Nov. 7, 2021, to $19,018 on June 17. Similarly, Ethereum plunged nearly 80% to close at about $994 on June 17. Both digital assets have recovered from those lows in the past two months.

Cryptocurrency is the financial backbone of most online crimes, Chainalysis stated in its midyear update, so the drop in cryptocurrency has impacted other major cybercrimes, such as money laundering and ransomware. Both have dropped by 20% to 25% since the beginning of the year, according to cybersecurity firms.

That said, crimes that do not depend on enticing victims with cryptocurrency have been less affected by the volatility. Business e-mail compromise (BEC), for example, still accounted for 35% of the dollar losses in 2021, compared with 0.7% for ransomware, according to the FBI's Internet Crime Complaint Center (IC3).

"Nobody likes a crypto bear market, but the one silver lining is that illicit cryptocurrency activity has fallen along with legitimate activity, albeit not as sharply," the company stated. "This is especially encouraging in scams, where the decrease in market hype seems to mean fewer are fooled by scammers, and in darknet markets, where law enforcement’s [shutdowns of major markets] appears to have dampened the entire sector."

One constant? Hacking of digital wallets and decentralized financial (DeFi) services continued to grow. Overall, cybercriminals stole at least $1.9 billion in cryptocurrency through hacking online services so far in 2022, an increase of about two-thirds from the same period in 2021.

The majority of the hacking profits comes from hacking DeFi protocols, Chainalysis stated in the mid-year report.

"DeFi protocols are uniquely vulnerable to hacking, as their open source code can be studied ad nauseum by cybercriminals looking for exploits — though this can also be helpful for security as it allows for auditing of the code," the company stated. "[I]t's possible that protocols' incentives to reach the market and grow quickly lead to lapses in security best practices."

Specific regions have also focused on specific types of crime. North Korean nation-state actors have compromised specific DeFi protocols, leading to massive gains for the sanctioned government. The attackers stole approximately $1 billion so far in 2022, accounting for the majority of the $1.9 billion in losses from exchanges and services, as of July 2022.

"We have seen ransomware attacks coming out of North Korea, but right now DeFi hacking is the most profitable thing for the North Korean hacking organizations to carry out," Grauer says. "North Korean hacking organizations have realized how profitable this type of hacking can be if done correctly, so have continued to carry out attacks throughout 2022."

Financial institutions, consumers, and cybersecurity professionals should not expect the decline in fraud related to cryptocurrency to continue, Chainalysis stressed. Consumers need to be better educated about the risks, while the cybersecurity of decentralized financial protocols needs to be bolstered and audited. Finally, legitimate exchanges should have protections in place to prevent the transfer of money to known scams, and law enforcement should develop their capabilities to seize cryptocurrency from bad actors, the company stated.

With Plunge in Value, Cryptocurrency Crimes Decline in 2022

Researchers at AdvIntel warn that three more ransomware groups have begun using the BazarCall spear phishing technique invented by the Ryuk gang...

Hackers are increasingly using a sophisticated ransomware tactic to target targets, researchers say.

Hackers maken steeds vaker gebruik van een geraffineerde ransomwaretactiek om doelwitten te treffen, aldus onderzoekers.

Researchers at AdvIntel warn that three more ransomware groups have begun using the BazarCall spear phishing technique invented by the Ryuk gang (a threat group that subsequently rebranded as Conti). BazarCall callback phishing allows threat actors to craft much more targeted social engineering attacks designed for specific victims. The threat actor sends out a legitimate-looking email, notifying the target that they have subscribed to a service for which payment is automatic.

De bedreiger stuurt een legitiem ogende e-mail met de mededeling dat het doelwit zich heeft geabonneerd op een dienst waarvoor automatisch wordt betaald. De e-mail geeft een telefoonnummer dat de doelwitten kunnen bellen om hun abonnement op te zeggen. Wanneer exploitanten een telefoontje ontvangen, gebruiken ze een verscheidenheid aan social engineering-tactieken om slachtoffers ervan te overtuigen remote desktop control te geven, ogenschijnlijk om hen te helpen hun abonnementsdienst te annuleren.

Researchers at AdvIntel warn that three more ransomware groups have begun using the BazarCall spear phishing technique invented by the Ryuk gang (a threat group that subsequently rebranded as Conti). BazarCall callback phishing allows threat actors to craft much more targeted social engineering attacks designed for specific victims. The researchers outline the four stages of this technique:
• None “Stage One. The threat actor sends out a legitimate-looking email, notifying the target that they have subscribed to a service for which payment is automatic. The email gives a phone number that targets are able to call to cancel their subscription.
• None “Stage Two. The victim is lured into contacting a special call center. When operators receive a call, they use a variety of social engineering tactics, to convince victims to give remote desktop control, ostensibly to help them cancel their subscription service.
• None “Stage Three. Upon accessing the victim’s desktop, a skilled network intruder silently entrenches into the user’s network, weaponizing legitimate tools that were previously typical of Conti’s arsenal. The initial operator remains on the line with the victim, pretending to assist them with the remote desktop access by continuing to utilize social engineering tactics.
• None “Stage Four. In the final stage of BazarCall, the initiated malware session yields the adversary access as an initial point of entry into the victim’s network. This initial access is then used and exploited in order to target an organization’s data.”

The researchers conclude that more ransomware actors will likely incorporate this technique into their own attacks.

“Since its resurgence in March earlier this year, call back phishing has entirely revolutionized the current threat landscape and forced its threat actors to reevaluate and update their methodologies of attack in order to stay on top of the new ransomware food chain,” AdvIntel says.

“Other threat groups, seeing the success, efficiency, and targeting capabilities of the tactic have begun using reversed phishing campaigns as a base and developing the attack vector into their own. This trend is likely to continue: As threat actors have realized the potentialities of weaponized social engineering tactics, it is likely that these phishing operations will only continue to become more elaborate, detailed, and difficult to parse from legitimate communications as time goes on.”

Conti as such may no longer be an active brand, but its operators haven’t retired. New-school security awareness training can teach your employees to thwart evolving social engineering tactics.

CafePress betaalt 500.000 dollar voor datalek met data 23 miljoen gebruikers - Security.NL

Vergelijkbare publicaties

9 beste cyberbeveiligingstools voor bedreigingsjagers

DEF CON - "maak je geen zorgen, de verkiezingen zijn veilig" editie

De toekomst van CyberSecurity is Preventie | SecurityWeek.Com

Netwerkinbreuk bij Cisco terug te voeren op aangetast persoonlijk Google-account; geraffineerde aanvaller gebruikte combinatie van voicephishing en MFA-moeheid

Cryptocurrency-misdrijven dalen in 2022 door waardedaling

Kinderen van Conti gaan Phishing

Verwijder Hehighursoo.com advertenties (Verwijderingshandleiding) - spam

[eBook] Uw eerste 90 dagen als MSSP: 10 stappen naar succes

US DoD medewerker met top-secret toegang stal identiteiten van werksystemen om leningen aan te vragen