Latest Hacking News And Events - dA1337: Cyber Crime

The Rise of "Onion-Layered" Attacks , IBM Says

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC6GD3GMOyFxbsHTMNlbTPAAAAjmzlVa5mq105cGGhyphenhyphenX7TbJ57SJdOzXZUsIHC-xxJMZik3vfGNW-1TQmiiv40qjvQE1uBTMSciQShWjp0mP2kW2SL8E1Z9NyTHhV-LuhZ8ElD3PEyC28/s1600/The-Rise-of-Onion-Layered--Attacks--IBM-Says.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC6GD3GMOyFxbsHTMNlbTPAAAAjmzlVa5mq105cGGhyphenhyphenX7TbJ57SJdOzXZUsIHC-xxJMZik3vfGNW-1TQmiiv40qjvQE1uBTMSciQShWjp0mP2kW2SL8E1Z9NyTHhV-LuhZ8ElD3PEyC28/s640/The-Rise-of-Onion-Layered--Attacks--IBM-Says.png" width="640" /></a></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong style="font-family: 'trebuchet ms', geneva; font-size: medium;">"Onion-layered" security incidents have been on the rise throughout 2015, according to the IBM X-Force Threat Intelligence Quarterly report for Q4 2015.</strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Released this week, IBM’s report (<a href="http://public.dhe.ibm.com/common/ssi/ecm/wg/en/wgl03099usen/WGL03099USEN.PDF" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">PDF</a>) cites four key trends that have been observed this year, with onion-layered and ransomware attacks joined by attacks coming from inside an organization and by an increased management awareness of the need to address security threats proactively.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">IBM explains that onion-layered security incidents involve a second, more damaging attack hidden behind a visible one. Usually, these attacks are carried by two actors, namely a script kiddie, an unsophisticated attacker launching highly visible attacks which can be easily caught, and a </span></span><span style="font-family: "trebuchet ms" , "geneva"; font-size: small;">more sophisticated </span><span style="font-family: "trebuchet ms" , "geneva"; font-size: small;">stealthy attacker who might expand their grip of the victim’s network without being detected for weeks or even months.</span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">"As the name suggests, an 'onion-layered' security incident is one in which a second, often significantly more damaging attack is uncovered during the investigation of another more visible event," the report said.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Such attacks demand large amounts of resources and time to investigate and mitigate, IBM says, given that stealthy attackers use sophisticated tools, are careful to cover their tracks, and use anti-forensic techniques to remain undetected. IBM also notes that anti-virus software alerts about malware on Internet-facing servers, unexpected reboots of servers and other unusual behavior, suspicious log records, and frequent user lockouts are signs that stealthy attackers have infiltrated a network.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Undetected attacks could prove highly damaging to companies, especially if the cybercriminals behind them manage to get hold of valuable data.  </span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“While the recovery of systems compromised by script kiddie attacks might take only a few days of an operation team’s time and effort, the job of finding a root cause, then fully understanding and remediating the work of the stealthy attackers could take months,” IBM said. Meanwhile, an undetected attacker could roam the network undetected, ultimately trying to gain access to the client’s crown jewels.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Earlier this year, Corero Network Security warned that distributed denial-of-service (DDoS) attacks were being leveraged to circumvent cybersecurity solutions, disrupt service availability and infiltrate victim networks.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">"The danger in partial link saturation attacks is not the ‘denial of service’ as the acronym describes, but the attack itself," Corero said. "The attack is designed to leave just enough bandwidth available for other sophisticated multi-vector attacks with data exfiltration as the main objective, to fly in under the radar, while the distracting DDoS attack consumes resources."</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Based on investigations conducted by Mandiant/FireEye throughout 2014, the median number of days that attackers were present on a victim’s network before being discovered was 205 days.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">IBM provided fundamental advice, suggesting that organizations keep systems updated and increase their visibility into the network, as well as build an internal security operations center, create operational procedures, and ensure an appropriate level of logging, in addition to periodically performing penetration testing exercises.</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

"Onion-layered" security incidents have been on the rise throughout 2015, according to the IBM X-Force Threat Intelligence ...

Docker Boosts Security for Containerized Applications

10:10 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlwaOMks-rJcaPpi9o6CQFO4HntxPNurQSe3jUgtbGi428PuTzUCthG1x5YxYhgrk5oYUaMjIv7aLFFq7dz-oNv2h127uhLVqtcH-wW9QPpu-SQ7G4O7EP5Df8cDiS4at0F9C-V7mOuHo/s1600/Docker-Boosts-Security-for-Containerized-Applications.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhlwaOMks-rJcaPpi9o6CQFO4HntxPNurQSe3jUgtbGi428PuTzUCthG1x5YxYhgrk5oYUaMjIv7aLFFq7dz-oNv2h127uhLVqtcH-wW9QPpu-SQ7G4O7EP5Df8cDiS4at0F9C-V7mOuHo/s640/Docker-Boosts-Security-for-Containerized-Applications.png" width="640" /></a></div>
<strong style="background-color: white; color: #333333; font-family: 'trebuchet ms', geneva; line-height: 20px;">Docker, makers of container technology that enables speedy deployment of applications, has unveiled new security enhancements to extend the protection of “Dockerized” distributed applications.</strong><br />
<strong style="background-color: white; color: #333333; font-family: 'trebuchet ms', geneva; line-height: 20px;"><br /></strong>
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><a href="https://www.docker.com/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">Docker</a> is an open platform that allows developers and system administrators to build and run distributed applications that run the same, regardless of the environment they are running in.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Similar to virtual machines, containers benefit from resource isolation and allocation, but do not rely on an OS kernel, making them faster and more portable than virtual machines.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Included in the latest security protections unveiled by Docker are hardware signing of container images, content auditing through image scanning and vulnerability detection and granular access control policies with user namespaces.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Hardware signing and scanning of container images directly address the trust and integrity of application content, Docker said, as the new features verify the publisher of the content. Furthermore, the chain of trust is protected and containerized content is verified via image scanning.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“It has been our goal from the beginning to develop a framework that secures Dockerized distributed applications throughout the entire application lifecycle,“ said Solomon Hykes, CTO and Chief Architect of Docker. “With this latest set of capabilities, we continue to drive our users and ecosystem forward with industry-first innovations and best practices that advance the end-to-end security of distributed applications. Furthermore, we’ve enabled developers and IT ops to benefit from a more secure environment, without having to learn a new set of commands or to be trained on a deep set of security principles. Docker security works as part of an integrated component without any disruption to developer productivity while providing IT with the appropriate level of security controls.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The new security enhancement builds on Docker Content Trust, a framework that allows verification of the image publisher. Prior to Docker Content Trust, IT operations had no way to validate content, the company said. Docker Content Trust verifies the publisher and ensures the integrity of the content.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Docker Content Trust’s hardware signing is done under a partnership with Yubico to roll out a “touch-to-sign” code signing system that leverages YubiKeys (hardware key), which enable secure software creation for Docker developers, sysadmin and third-party ISVs. With the YubiKey 4, Docker users can digitally sign code during initial development and through subsequent updates to ensure the integrity of the Dockerized application throughout the application pipeline, Docker said.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">"This is an important milestone for Yubico and our community as we move beyond authentication to address another area in which the YubiKey shines, using our hardware to perform cryptographic sign operations," said Jerrod Chong, VP, Solutions Engineering, Yubico. "Having root keys stored in the secure element of the YubiKey means attackers cannot duplicate the keys and forge sign operations; insecure storage of keys in software modules is often the root cause for many of the vulnerabilities found in software packages."</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">YubiKey 4 works on Microsoft Windows, Mac OS X, Linux operating systems and major Web browsers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Docker also announced a new secure service for its Official Repos that provides direct visibility into the content security of ISV software that is part of this set of images.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Docker image scanning and vulnerability detection provides container-optimized capability for granular auditing of images, presenting the results to ISVs and sharing the final output for Docker users to make decisions on which content to use based on their security policies.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">If the scanning service detects an issue, ISVs can fix vulnerabilities and upgrade the security profile of their content. Because Official Repos is also integrated with Docker Content Trust, users are able to establish the validity of the publisher as well as the integrity of the image content. The end result is that IT organizations can rely on Official Repos as a curated source for secure, high-integrity content.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“This new capability addresses IT operations concerns about getting information regarding what’s inside the container,” Docker explained. “Users for the first time are presented with automated insights that give them the instant visibility they need to determine if they want to use that image or not.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Introduced as part of the 1.9 Experimental release, user namespaces gives users the ability to separate container and Docker daemon-level privileges to assign privileges for each container by user group. With the new levels of control, containers themselves don’t have access to root on the host - only the Docker daemon does. The new functionality also gives IT teams the ability lock down hosts to a restricted group of sysadmins.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Docker says its technology is used by millions of developers across thousands of organizations, including eBay, Baidu, the BBC, Goldman Sachs, Groupon, ING, Yelp, and Spotify.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">While container adoption is likely to surge over the next few years, concerns around security, certification and adequate skills remain, according to the results of a survey released earlier this year by Red Hat. </span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Cyber Crime Latest News Security news Docker Boosts Security for Containerized Applications

Docker, makers of container technology that enables speedy deployment of applications, has unveiled new security enhancements to extend ...

New PoS Malware Delivered via Malicious Docs, Exploit Kit

10:32 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRko6im2Vdzc9n0dmnIYty5Ygi8Gk8U1PD56ye2nkcKsEhQH5Sz5R70Xb0K914RrrHmD7ewwJU8q5c3MVVPkyAudsBi9Fr35Mb4Y7-4Q5tyQWKbaiW18Rx_xd57YDdzbrW4hyMzlVBwOg/s1600/new-point-of-sale-%2528PoS%2529-malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="458" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRko6im2Vdzc9n0dmnIYty5Ygi8Gk8U1PD56ye2nkcKsEhQH5Sz5R70Xb0K914RrrHmD7ewwJU8q5c3MVVPkyAudsBi9Fr35Mb4Y7-4Q5tyQWKbaiW18Rx_xd57YDdzbrW4hyMzlVBwOg/s640/new-point-of-sale-%2528PoS%2529-malware.jpg" width="640" /></a></div>
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></strong>
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></strong>
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">A new point-of-sale (PoS) malware has been widely distributed by cybercriminals alongside ad fraud and information-stealing threats.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The malware, dubbed by Proofpoint “<a href="https://www.proofpoint.com/us/threat-insight/post/AbaddonPOS-A-New-Point-Of-Sale-Threat-Linked-To-Vawtrak" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">AbaddonPOS</a>,” has been spotted on systems infected with the banking Trojan Vawtrak, also known as Neverquest and Snifula.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">PoS malware can help cybercriminals earn a lot of money, but such threats are often used in more targeted attacks. However, researchers have spotted AbaddonPOS in campaigns that appear to be mainly aimed at consumers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Anti-malware company Cyphort <a href="http://www.cyphort.com/psychcental-com-infected-with-angler-ek-installs-bedep-vawtrak-and-pos-malware/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">reported</a> in early November that the psychcentral.com website had been directing users to the Angler exploit kit. Angler had been set up to serve the ad fraud malware Bedep, the Vawtrak banking Trojan, and a new RAM scraping malware designed to scan running processes for payment card information.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Proofpoint observed the same PoS malware, namely AbaddonPOS, being distributed with the aid of weaponized Microsoft Word documents designed to download the information-stealing Trojan Pony (Fareit) and Vawtrak.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">According to researchers, in both the exploit kit and weaponized document attacks, Vawtrak and Bedep download TinyLoader, a downloader designed to fetch executable payloads from a command and control (C&C) server using a custom protocol. In the attacks observed by Proofpoint, TinyLoader transfers a second downloader, TinyDownloader, in the form of a shellcode, which in turn downloads AbaddonPOS.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The threat is small in size (5Kb) and its core functionality is simple, but it includes some noteworthy features. Experts say AbaddonPOS relies on several basic anti-analysis and obfuscation techniques that make it more difficult to investigate via both manual and automated methods.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Once it infects a system, the malware reads the memory of all processes in search of track 1 and track 2 data associated with payment cards. After it finds the targeted financial information, AbaddonPOS sends it back to its C&C server using a custom binary protocol, unlike other PoS malware families that use HTTP for this task. C&C communications and credit card data exfiltration is handled by the shellcode downloaded by TinyLoader.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">TinyLoader was first spotted in January 2015 and it underwent several modifications since, including the addition of anti-analysis and obfuscation/encoding features. Since the code used for anti-analysis and obfuscation is similar in AbaddonPOS and TinyLoader, Proofpoint believes the threats are connected and possibly even developed by the same authors.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“The practice of threat actors to increase their target surfaces by leveraging a single campaign to deliver multiple payloads is by now a well-established practice,” Proofpoint researchers said. “While using this technique to deliver point of sale malware is less common, the approach of the US holiday shopping season gives cybercriminals ample reason to maximize the return on their campaigns by distributing a new, powerful PoS malware that can capture the credit and debit card transactions of holiday shoppers.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">AbaddonPOS is not the only PoS malware analyzed recently by researchers. Trustwave has been monitoring a threat, dubbed “Cherry Picker,” that has managed to stay under the radar since 2011 thanks to its sophisticated functionality and the use of a cleaner that restores the system to a clean state after data is stolen. Unlike AbaddonPOS, Cherry Picker has only been used in highly targeted attacks.</span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Cyber Crime Hacking news Malware Security news New PoS Malware Delivered via Malicious Docs, Exploit Kit

A new point-of-sale (PoS) malware has been widely distributed by cybercriminals alongside ad fraud and information-stealing threats. ...

Tor Project: FBI Paid Researchers $1M to Unmask Users

10:25 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh29wp1BdivhYjbFPIQmurMlAmgBLJsTOG_f6I3A_Bw99ia0WxrKXmm7PNlJMQBH9DPIcVutlnQajTIORWkINBFTZrk8q4uSu_519HFQbOXHRm9-LZAk6sIh_N1MZ4UoLn4XQr3GDr16_4/s1600/Tor.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="392" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh29wp1BdivhYjbFPIQmurMlAmgBLJsTOG_f6I3A_Bw99ia0WxrKXmm7PNlJMQBH9DPIcVutlnQajTIORWkINBFTZrk8q4uSu_519HFQbOXHRm9-LZAk6sIh_N1MZ4UoLn4XQr3GDr16_4/s640/Tor.png" width="640" /></a></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Tor Project, the organization behind the Tor anonymity network, claims the FBI paid Carnegie Mellon University “at least $1 million” to help the agency deanonymize users suspected of conducting criminal activities.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The Tor network helps users maintain their anonymity online by routing traffic through a series of relays operated by individuals and organizations all over the world. In January 2014, more than 100 machines joined the Tor network as relays and attempted to deanonymize people who operated and accessed Tor hidden services.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The offending relays were identified by the Tor Project in July 2014 and removed from the network. The Tor Project also released at the time a new version of its software to close the vulnerability exploited by the attackers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">It’s believed that these attacks were conducted by a group of Carnegie Mellon University researchers who had planned to disclose their findings at the Black Hat USA conference in August 2014. However, the academics had not provided too many details on the methods they used to the Tor Project, and the Black Hat talk was suddenly canceled in July apparently due to the fact that the university had not approved the content of the presentation for public release.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In the <a href="https://web.archive.org/web/20140705114447/http://blackhat.com/us-14/briefings.html#you-dont-have-to-be-the-nsa-to-break-tor-deanonymizing-users-on-a-budget" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">abstract</a> of their Black Hat presentation, researchers said they had found a method to “break Tor anonymity” and deanonymize hundreds of thousands of clients and thousands of hidden services within a couple of months. The experts noted that they had tested their findings in the wild.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Now, Tor Project Director Roger Dingledine claims the <a href="https://blog.torproject.org/blog/did-fbi-pay-university-attack-tor-users" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">FBI paid Carnegie Mellon University</a> at least $1 million to attack hidden services in an effort to find potential criminals.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“There is no indication yet that they had a warrant or any institutional oversight by Carnegie Mellon's Institutional Review Board. We think it's unlikely they could have gotten a valid warrant for CMU's attack as conducted, since it was not narrowly tailored to target criminals or criminal activity, but instead appears to have indiscriminately targeted many users at once,” Dingledine said.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Such action is a violation of our trust and basic guidelines for ethical research. We strongly support independent research on our software and network, but this attack crosses the crucial line between research and endangering innocent users,” he added.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Court documents obtained by <a href="http://motherboard.vice.com/read/court-docs-show-a-university-helped-fbi-bust-silk-road-2-child-porn-suspects" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">Motherboard</a> show that an unnamed source of information (SOI) provided the FBI reliable IP addresses for Tor hidden services between January and July 2014. The information was used to shut down websites on the dark web that sold illegal goods and services, including the Silk Road 2.0 drug bazaar. The operation, announced in November 2014 by law enforcement in Europe and the United States, resulted in the arrests of 17 suspects.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Some have speculated that Carnegie Mellon University might have helped authorities unmask the suspects by launching a sustained attack on the Tor network, and now there is new evidence to support this theory.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A motion filed last week in the case of a Silk Road 2.0 staff member who was arrested in January revealed that the man’s involvement with the drug bazaar was determined based on information from “a 'university-based research institute' that operated its own computers on the anonymous network used by Silk Road 2.0.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Dingledine believes this incident can set a dangerous precedent.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Civil liberties are under attack if law enforcement believes it can circumvent the rules of evidence by outsourcing police work to universities. If academia uses ‘research’ as a stalking horse for privacy invasion, the entire enterprise of security research will fall into disrepute,” Dingledine said. “Legitimate privacy researchers study many online systems, including social networks — If this kind of FBI attack by university proxy is accepted, no one will have meaningful 4th Amendment protections online and everyone is at risk.”</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Latest News Security news Tor Project: FBI Paid Researchers $1M to Unmask Users

The Tor Project, the organization behind the Tor anonymity network, claims the FBI paid Carnegie Mellon University “at least $1 mill...

User Data Compromised in Touchnote Breach

4:14 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0-GRRMzNcxa6i8FD2vaXT6L7MJIuAKLztbZfoioKo3rg6wUF3cMI9kGoTGk5qQtbf6q_ydEUb0OVoC2Egwy1B27wxyNxeoK4HglSp1oirEBdgP_Nvh99lRmz_KocYJTijNp0yvj6f6A4/s1600/User-Data-Compromised-in-Touchnote-Breach.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0-GRRMzNcxa6i8FD2vaXT6L7MJIuAKLztbZfoioKo3rg6wUF3cMI9kGoTGk5qQtbf6q_ydEUb0OVoC2Egwy1B27wxyNxeoK4HglSp1oirEBdgP_Nvh99lRmz_KocYJTijNp0yvj6f6A4/s640/User-Data-Compromised-in-Touchnote-Breach.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">UK-based postcard-sending service Touchnote learned last week that its systems had been breached in an attack that resulted in customer details getting stolen.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The company’s investigation so far revealed that the attackers managed to steal names, email addresses, postal addresses, order histories and, in some cases, dates of birth. Touchnote has pointed out that it only stores the last four digits of customers’ payment card numbers. Full credit and debit card numbers, expiry dates, and security codes are not at risk.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><a href="https://updates.touchnote.com/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">Touchnote says </a>user passwords have not been accessed, but customers have been advised to change them as a precaution. The company has noted that passwords are not stored in clear text, but it’s unclear what type of cryptographic hash function has been used to protect the data.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While the compromised data cannot be used on its own for financial transactions, malicious actors might use it to trick victims into handing over sensitive information. Touchnote has started notifying impacted individuals about the breach, but the company has highlighted that the legitimate emails will not ask recipients to provide any information.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The company has yet to determine who is behind the attack, but an investigation is being conducted in cooperation with the UK’s National Crime Agency (NCA).</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Touchnote was launched in 2008 and so far it has been used to send out more than 4 million cards in over 200 countries. The firm’s Android and iOS mobile applications have been downloaded millions of times from official app stores.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">"Securing customer data obtained by mobile apps is no different that securing other data - with the available technologies today to easily and quickly protect sensitive data, it's a proven, reliable way to also protect customer trust and satisfaction,” Mark Bower, global director of product management for HPE Security - Data Security, told <em>SecurityWeek</em>. “There's simply no excuse today not to follow best practices of encrypting all sensitive personal and financial data as it enters a system, at rest, in use and in motion. The ability to render data useless if lost or stolen, through data-centric encryption, is an essential benefit to ensure data remains secure.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“Cyber criminals today are motivated to steal enterprise data, intellectual property and employee or customer information. Hackers are always looking for a way to exploit a system in a way that they can then turn stolen data into cold, hard cash. There is a definite risk if credit card information is obtained. However businesses need to also think about protecting personal information about their customers like name, full address, phone number and email address. Criminals could then use this information to open bogus accounts or sell it for use in more targeted larger-scale spear-phishing or identity theft attacks,” Bower added.</span></span></div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Latest News Security news User Data Compromised in Touchnote Breach

UK-based postcard-sending service Touchnote learned last week that its systems had been breached in an attack that resulted in custome...

Flaw in SAP Firm's XSS Filter Exposed Many Sites to Attacks

9:55 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc-ABeEfVK9yAbS0gOECavp8dD9pzXk8l7dR728UDDfyYm0bMnSudPQsyVKAvUgUJiHiWalMmc3EyCTVqpMkRn3b9JWPT5TunW8QBGFiTq4w9UD-3B6pGy70a2WvC4L7tioKBVEWGEsvo/s1600/image-59545-panoV9free-pcqg-59545.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="306" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgc-ABeEfVK9yAbS0gOECavp8dD9pzXk8l7dR728UDDfyYm0bMnSudPQsyVKAvUgUJiHiWalMmc3EyCTVqpMkRn3b9JWPT5TunW8QBGFiTq4w9UD-3B6pGy70a2WvC4L7tioKBVEWGEsvo/s640/image-59545-panoV9free-pcqg-59545.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Roughly one hundred websites were exposed to cross-site scripting (XSS) attacks because an XSS filter used on some of their web pages could have been easily bypassed, a researcher reported on Sunday.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Ashar Javed, a security researcher who specializes in finding tricky XSS vulnerabilities,<a href="https://respectxss.blogspot.de/2015/11/a-tale-of-breaking-saps-successfactorss.html" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">identified a reflected XSS flaw</a> on a website used by Germany-based enterprise software maker SAP to list jobs available within the company.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While the affected page was protected by an XSS filter to prevent attacks, the expert discovered that developers had failed to escape certain strings, such as <em><span style="color: red;"></</span></em> and <span style="color: red;"><em>'</em></span>, when sanitizing user input. This oversight could have allowed attackers to inject specially crafted XSS payloads into the website.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After conducting some tests, Javed discovered that <em><span style="color: red;"></</span></em> could not be used for XSS attacks since the "<span style="color: black;"></script><em>"</em></span> string was blocked, but the single quotation mark had been used by developers for “if” conditions, allowing the use of XSS payloads such as <em><span style="color: red;">‘-confirm(1)-’</span></em>.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In this example, the JavaScript “confirm” function is used to display a dialog box containing the message “1” along with OK and Cancel buttons. However, the expert told <em>SecurityWeek</em>that other functions could have been used as well.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">After reporting his findings to SAP at the software giant’s Product Security Expert Summit in March, Javed learned that the flawed XSS filter belongs to SuccessFactors, a SAP-owned company that provides cloud-based human capital management solutions.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The expert identified the buggy XSS filter on roughly 100 websites, many of which belong to high profile companies. Javed believes the filter is part of SuccessFactors’ product, which is also suggested by the fact that the vulnerable component is present on the jobs/careers domains of the impacted sites.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The vulnerability was addressed roughly three months after it was reported to SAP. The company <a href="http://scn.sap.com/docs/DOC-55451" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">acknowledged</a> the security researcher’s work in July.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Javed says he has also identified a series of flaws in SAP Enterprise Portal, which he plans on disclosing after they are resolved by the vendor.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Last month, the researcher reported finding an XSS vulnerability in YouTube Gaming, a gaming-focused video website launched this summer by YouTube. The expert reported his findings to Google and was awarded more than $3,000 for his work.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacker Hacking news Latest News Security news Flaw in SAP Firm's XSS Filter Exposed Many Sites to Attacks

Roughly one hundred websites were exposed to cross-site scripting (XSS) attacks because an XSS filter used on some of their web pages ...

Britain to Unveil New Online Spying Laws

9:14 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi3zjAzFm6XYPGxGC03pM2ZN4unYI5nVWdUMG6rj97NKSZH4QdTcnuEdDotCbE-DsD6GQmnBQkdFZm-kiDVChyphenhyphenGfHqBwjtgiFVIumfTH6Q980wzXeq2-GebbpcAUkKsHMxbhHiixFeQGA/s1600/The-day-I-discovered-the-Harper-Government-is-spying-on-me.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="404" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi3zjAzFm6XYPGxGC03pM2ZN4unYI5nVWdUMG6rj97NKSZH4QdTcnuEdDotCbE-DsD6GQmnBQkdFZm-kiDVChyphenhyphenGfHqBwjtgiFVIumfTH6Q980wzXeq2-GebbpcAUkKsHMxbhHiixFeQGA/s640/The-day-I-discovered-the-Harper-Government-is-spying-on-me.jpg" width="640" /></a></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong>Britain's government gave the first details Sunday of contested plans to update Internet spying laws to keep pace with the digital age.</strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The proposed law comes as intelligence agencies and police grapple with monitoring terrorist activity online amid a debate sparked by Edward Snowden over government access to personal data online.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Home Secretary Theresa May told the BBC that the measures would not ban encryption and "will not be giving powers to go through people's browsing history".</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">However, the authorities will be able to look at Internet and social media activity if they get a special warrant.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Such warrants are currently issued by May but this authority could be handed to judges under the new measures.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Technology companies will reportedly have to keep records of emails and people's use of social media sites like WhatsApp and Facebook for 12 months and authorities will be able to access this with a second warrant.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The disclosures came ahead of Wednesday's release of the draft Investigatory Powers Bill.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">It will be scrutinized by a committee of lawmakers, allowing changes to be made before it is formally debated by parliament.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Britain's intelligence chiefs have issued a string of warnings in recent months about the dangers posed by terrorist organizations recruiting and planning  attacks online.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In a rare public speech last week, the head of domestic spying agency MI5 Andrew Parker said Britain was under threat "on a scale and at a tempo that I have not seen before".</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">He highlighted the Islamic State (IS) group's "sophisticated exploitation of technology" through "the full range of modern communications tools to spread its message of hate and to inspire extremists".</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The previous coalition government led by Prime Minister David Cameron wanted to pass a law covering similar issues, dubbed a "snoopers' charter" by critics, but was blocked by junior coalition partners the Liberal Democrats as too intrusive.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Since winning May's general election outright though with a small majority, Cameron has more room for maneuver but is still likely to face opposition from some in his Conservative party over the measures.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacking news Security news Britain to Unveil New Online Spying Laws

Britain's government gave the first details Sunday of contested plans to update Internet spying laws to keep pace with the dig...

Teen Arrested in Connection With TalkTalk Breach

3:28 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6b-4OTJlHfPXOrkGA4tny1CQlZgHQR3G0AkdD5PUG5-D0aTxTu2Em97mkC060V-8mL8kmjscz-l4L29rumL_9IXILVLtSp0Z1Hs_0Fan5ynSpBMkmJZ10S4BqONpeiT5WVKYQ-lm_sg/s1600/Teen-Arrested-in-Connection-With-TalkTalk-Breach.gif" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="330" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEip6b-4OTJlHfPXOrkGA4tny1CQlZgHQR3G0AkdD5PUG5-D0aTxTu2Em97mkC060V-8mL8kmjscz-l4L29rumL_9IXILVLtSp0Z1Hs_0Fan5ynSpBMkmJZ10S4BqONpeiT5WVKYQ-lm_sg/s640/Teen-Arrested-in-Connection-With-TalkTalk-Breach.gif" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">A 15-year-old boy from Northern Ireland was arrested on Monday in connection to the recent cyberattack on British phone and broadband services provider TalkTalk.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to Scotland Yard, the teen was arrested on suspicion of committing offences under the Computer Misuse Act as part of the investigation into the alleged theft of data from TalkTalk’s website.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Officers from the Police Service of Northern Ireland, working with detectives from the Metropolitan Police’s Cyber Crime Unit, arrested the boy at an address in County Antrim and searched the location. The suspect, whose name has not been made public, was interviewed at the County Antrim police station where he had been taken into custody.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“TalkTalk can confirm that we have been informed by the Metropolitan Police of the arrest of a suspect in connection with the cyber attack on our website on 21st October 2015. We know this has been a worrying time for customers and we are grateful for the swift response and hard work of the Police. We will continue to assist in the ongoing investigation,” TalkTalk stated after news of the arrest broke.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In the meantime, more information has emerged regarding the breach and its impact. In a <a href="http://helpbusiness.talktalk.co.uk/cyberincident" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">notice</a> posted on its TalkTalk Business website, the telecoms firm revealed that the hacker attack also affects current and previous small business customers who conducted online transactions. The company says other business customers are not impacted.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">In an updated statement published over the weekend, TalkTalk attempted to downplay the breach, saying that only the firm’s website was hit and not its core systems. Furthermore, the website does not store complete payment card details and the company expects the amount of exposed financial data to be lower than initially believed.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">TalkTalk CEO Dido Harding said on Monday that while the attackers <a href="http://help2.talktalk.co.uk/oct22incident" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">might have accessed</a> complete bank account numbers and sort codes, this information alone is not enough to steal money from victims’ accounts.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The information possibly accessed by the attackers — names, addresses, dates of birth, email addresses, phone numbers, TalkTalk account details, partial payment card data, and bank details — can be leveraged by malicious actors in social engineering attacks whose goal is to obtain sensitive information. That is why TalkTalk has informed customers that the company will never call or email them to request information or ask them to install software on their computers.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">It’s believed that the attackers leveraged a SQL injection vulnerability to gain access to TalkTalk customer information. Experts say the cybercriminals likely used a distributed denial-of-service (DDoS) attack against the company’s website as a smokescreen that allowed them to hide their other malicious activities.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Someone also attempted to blackmail TalkTalk following the incident, reportedly demanding roughly $122,000 in Bitcoin to prevent the stolen data from being leaked.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white;">
<span style="color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: small; line-height: 20px;"><span style="font-family: 'trebuchet ms', geneva;"><b>See Also:- <span style="font-size: 12px;"><a href="http://www.hackntech.net/2015/10/talktalk-downplays-data-breach.html" rel="nofollow" target="_blank"> </a></span></b></span></span><span style="color: #333333; font-family: trebuchet ms, geneva;"><span style="line-height: 20px;"><b><a href="http://www.hackntech.net/2015/10/talktalk-downplays-data-breach.html" rel="nofollow" target="_blank">talktalk-downplays-data-breach</a></b></span></span></div>
</div>
<br />
<script async="" src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<br />
<ins class="adsbygoogle" data-ad-client="ca-pub-7726750987177406" data-ad-format="auto" data-ad-slot="7596682374" style="display: block;"></ins><script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
</div>

Cyber Crime Google Hacker Hacking news Latest News Security news Teen Arrested in Connection With TalkTalk Breach

A 15-year-old boy from Northern Ireland was arrested on Monday in connection to the recent cyberattack on British phone and broadband...

Intel Announces EoL for McAfee Email Security Products

10:22 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZNDZK28ZzPlprj-YSxFcTwTzW7JZO_zeLjYC9fYhap2wowM7g7WnV5ykJRVJVM61uNHXWri8FZo-dcOyTAfFjk4KbaeKFSc9DkqfH5BAJCecyx4PESqE0AsLpDkznKtcmqSQ5gOhNzlo/s1600/Intel+Announces+EoL+for+McAfee+Email+Security+Products.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZNDZK28ZzPlprj-YSxFcTwTzW7JZO_zeLjYC9fYhap2wowM7g7WnV5ykJRVJVM61uNHXWri8FZo-dcOyTAfFjk4KbaeKFSc9DkqfH5BAJCecyx4PESqE0AsLpDkznKtcmqSQ5gOhNzlo/s640/Intel+Announces+EoL+for+McAfee+Email+Security+Products.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Intel announced last week the end of life (EoL) for McAfee email security products, and advised customers to start transitioning to a different solution.</span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The list of McAfee SaaS Email Protection and Archiving <a href="http://www.mcafee.com/resources/faqs/faq-eol-email-security.pdf" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">products retired</a> by Intel includes Email Archiving, Email Encryption, and Email Protection and Continuity.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">These products will no longer be sold after January 11, 2016. Intel Security noted that Gateway customers will no longer be able to acquire new hardware after this date, but those who need more hardware capacity can use the virtual appliance that can be deployed on their own hardware.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Customers whose existing agreements for an annual service term do not include McAfee Email Gateway can renew them for up to 12 months after the current agreement expires, with the last date of service set for January 11, 2017.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Organizations whose contracts include McAfee Email Gateway can renew support services for up to five years until January 2021. Of the total of five years, three include full support service, through January 2019, while the other two years are for limited service support, which does not include fixes for bugs rated as having “severity 2.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Email Archiving customers will have to extract archived email messages within 6 months after their service expires. Email messages, including historical data and legal holds, will be automatically and permanently removed after this 6-month period.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">“We are working to create an integrated system that delivers faster protection, detection and correction,” Intel Security said. “To create that security system, we are investing in solutions for the endpoint, cloud, threat detection, and management that will ensure the security of the endpoint and cloud and all data traversing in between. Increasing our investments in these critical areas required exiting other product areas such as McAfee email security solutions.”</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The company recommends migrating to products from Proofpoint which, according to Gartner, is a leader in security email gateway and enterprise information archiving solutions.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><a href="http://news.investors.com/technology/102215-776901-proofpoint-q3-beats-stock-jumps.htm" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">Proofpoint stock</a> rose by up to 18 percent last Thursday after the company announced increased Q3 revenue and the partnership with Intel Security.</span></span></div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Latest News Security news Intel Announces EoL for McAfee Email Security Products

Intel announced last week the end of life (EoL) for McAfee email security products, and advised customers to start transitioning to a ...

Germany Probes Suspected New Case of US Spying: Report

10:43 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZEOdINq_dpsYjD4mJuk-gXT9nmDCbhXihyphenhyphenyWz631uuwhTWvn3n3EwygzODhclR2cZMCP__1UYC-jacppjWZXRX6KuQw7GuYwwnrRh8MSN8lty5BFoV7e2vFUZgPfuJNrm62_3wm-XVbA/s1600/5a7d239e157e6fb9be2ad914d6b3d0f11eb216df0f969896e882b7af468e63af.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="380" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZEOdINq_dpsYjD4mJuk-gXT9nmDCbhXihyphenhyphenyWz631uuwhTWvn3n3EwygzODhclR2cZMCP__1UYC-jacppjWZXRX6KuQw7GuYwwnrRh8MSN8lty5BFoV7e2vFUZgPfuJNrm62_3wm-XVbA/s640/5a7d239e157e6fb9be2ad914d6b3d0f11eb216df0f969896e882b7af468e63af.jpg" width="640" /></a></div>
<br />
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong>German authorities have launched a probe into allegations of a new case of suspected spying linked to the US National Security Agency, a media report said Saturday.</strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><strong><br /></strong></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The report by the newsweekly Der Spiegel comes after an investigation into alleged US snooping on Chancellor Angela Merkel's mobile phone was dropped in June due to lack of proof. German-US relations were badly strained after fugitive US intelligence contractor Edward Snowden revealed mass US surveillance around the world in 2013.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The latest probe by Germany's federal prosecutors targets persons unknown for "espionage activities", Der Spiegel said.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">It centeres on the personal laptop of a department chief in the chancellery onto which a spying virus known as "Regin" was allegedly installed, the magazine said.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The "Trojan horse" type virus, which was discovered on the laptop last year, enables surveillance of all data entered onto a computer and transfers it to whoever had the software installed, Der Spiegel added.</span></span></div>
<br /><div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">"We can confirm that there is an inquiry" relating to "malicious software" called Regin, a spokeswoman for the federal prosecution service told AFP, declining to confirm other details from the Spiegel report.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The magazine, citing specialists, said there "is no doubt" that Regin can be linked to the NSA or Britain's GCHQ eavesdropping agency, which was revealed in Snowden's documents to have worked closely with its US equivalent, including in the interception of German phone calls and emails.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">While Snowden alleged US spying on many European governments, his disclosures triggered particular anger in Germany where bitterness lingers over mass state spying on citizens by the Stasi secret police in former communist East Germany where Merkel grew up.</span></span></div>
</div>
<br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Cyber Crime Hacking news Latest News Security news Germany Probes Suspected New Case of US Spying: Report

German authorities have launched a probe into allegations of a new case of suspected spying linked to the US National Security Agency,...

SMS Stealing Library Found in 18,000 Android Applications

10:03 PM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJrlbJPEskX7aeVf5jKaosYuQPymF2gdP0JGBawsCMZSDYmQcYE3vn2VX9rbMAv4uepIQwyCu-KnSy6kuMd6_fT6XvVWsspjyQeh4vw0kX_1IPJvp7-hntukzntk5dlOEWNYxTeLyZ0Ck/s1600/android.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="396" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhJrlbJPEskX7aeVf5jKaosYuQPymF2gdP0JGBawsCMZSDYmQcYE3vn2VX9rbMAv4uepIQwyCu-KnSy6kuMd6_fT6XvVWsspjyQeh4vw0kX_1IPJvp7-hntukzntk5dlOEWNYxTeLyZ0Ck/s640/android.jpg" width="640" /></a></div>
<br />
<br />
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Roughly 18,000 Android applications built using the Taomike SDK, one of the largest mobile advertisement solution platforms in China, have been found to include SMS theft functionality.</span></span></strong></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<strong><span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></strong></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The <strong>Taomike SDK</strong>, which helps developers display advertisements in their mobile apps, has been used in over 63,000 Android apps, but only around 18,000 of them have been observed to exhibit the message stealing functionality, according to Palo Alto Networks, which made the discovery. The security firm also notes that these applications have been grabbing copies of all messages sent to infected devices since  August 1.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The applications are being distributed through third-party mechanisms in China and are not available in the Google Play store, and all of them include specific library that enables the malicious behavior. This is the “zdtpay” SDK library, which is a component of Taomike’s in-app purchases (IAPs) system, and which has been designed to capture all messages from the affected device and send them to the company’s servers.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">According to <a href="http://researchcenter.paloaltonetworks.com/2015/10/chinese-taomike-monetization-library-steals-sms-messages/" style="color: #0076b4; font-weight: bold; text-decoration: none;" target="_blank">Palo Alto Networks</a>, only a newer version of the Taomike SDK appears to include the nefarious library, namely those released around August 2015. Earlier SDK releases should be safe, given that they include the older version of the library, which explains why only some of the applications built with the SDK are compromised.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The SMS stealing functionality has been found inside applications that contain the embedded URL hxxp://112.126.69.51/2c.php, which represents the address to which the stolen messages are uploaded. The IP address in the URL belongs to the Taomike API server, and the company is using the server for other services as well.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The offending library was found to request both network and SMS access permissions, as well as to register receiver name com.zdtpay.Rf2b for SMS_RECEIVED and BOOT_COMPLETED actions with high priority. The receiver Rf2b reads messages as soon as they arrive and collects both the message body and the sender, the security firm said.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Additionally, if the device is rebooted, the MySd2e service is started to register a receiver for the Rf2b. All of the collected SMS information is saved in a hashmap with “other” as the key and is uploaded to the 112.126.69.51 IP address. All of the messages received by the device are collected and uploaded, not only those that are relevant to the advertising platform.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Although only 18,000 applications using the Taomike SDK are known to steal SMS messages at the moment, their number might increase as more developers start using the newer version of the offending library. These applications are not limited to a single developer or third party store, as the advertising platform is highly popular in China.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">The researchers at Palo Alto Networks explain that only users in China are affected at the moment, and that those who install software solely from the Google Play store are safe. Additionally, they note that with Android 4.4 KitKat Google started preventing applications from capturing SMS messages if they are not the default SMS application.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;">Monetization platforms represent a common way of boosting profits, especially since they offer libraries that developers can easily integrate into their applications. However, third-party advertising platforms are not always trustworthy, and developers using such solutions are advised to monitor their programs for abnormal behavior to ensure the safety of their users.</span></span></div>
<div class="MsoNormal" style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; line-height: 20px;">
<span style="font-size: small;"><span style="font-family: 'trebuchet ms', geneva;"><br /></span></span></div>
<div class="MsoNormal" style="background-color: white;">
<span style="color: #333333; font-family: trebuchet ms, geneva;"><span style="line-height: 20px;"><br /></span></span></div>
<div class="MsoNormal" style="background-color: white;">
<span style="color: #333333; font-family: trebuchet ms, geneva;"><span style="line-height: 20px;">Earlier this month, the Kemoge malicious adware campaign was found infecting</span></span></div>
<div class="MsoNormal" style="background-color: white;">
<span style="color: #333333; font-family: 'trebuchet ms', geneva; line-height: 20px;">Android users in 20 countries through popular Android apps, including browsers, calculators, games, device lockers and sharing tools. Last month, a</span></div>
<div class="MsoNormal" style="background-color: white;">
<span style="color: #333333; font-family: 'trebuchet ms', geneva; line-height: 20px;">sophisticated CAPCHA-bypassing Android malware was discovered in games and apps in Google Play, estimated to have caused over $250,000 in loses.</span></div>
<div>
<br /></div>
</div><br>
<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>

<ins class="adsbygoogle"
     style="display:block"
     data-ad-client="ca-pub-7726750987177406"
     data-ad-slot="7596682374"
     data-ad-format="auto"></ins>
<script>
(adsbygoogle = window.adsbygoogle || []).push({});
</script>
<br>

Android Cyber Crime Hacking news Latest News Security news SMS Stealing Library Found in 18,000 Android Applications

Roughly 18,000 Android applications built using the Taomike SDK, one of the largest mobile advertisement solution platforms in China, ...

Synack Hydra Is Designed to Help Security Researchers Find Threats

3:30 AM Unknown 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhixhDS4Mos_beydqJU76JR_C03FjIsmBWIXdTzcOxDJH1nGh1dVmGpHKLnIFKsukbpjTyV6FGsfYIJXKgWpSqMrflyIF5oLeBdFXNJBSTeSCkS7GeWFLRIJA-5y_zl9-nHDqx9T4_dKko/s1600/web-threat-770x513.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhixhDS4Mos_beydqJU76JR_C03FjIsmBWIXdTzcOxDJH1nGh1dVmGpHKLnIFKsukbpjTyV6FGsfYIJXKgWpSqMrflyIF5oLeBdFXNJBSTeSCkS7GeWFLRIJA-5y_zl9-nHDqx9T4_dKko/s640/web-threat-770x513.jpg" width="640" /></a></div>
<br />
<br />
<h2 style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; line-height: 19px; margin: 0px 0px 10px; padding: 0px;">
<div style="margin-bottom: 10px; margin-right: 14px; margin-top: 5px; padding: 0px;">
<span style="font-size: small;">Synack announced Hydra, a new tool designed to enable its researchers to work faster to find new threats.</span></div>
</h2>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">Synack debuted a new tool called Hydra that is designed to make it easier for its researchers to find potential threats.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">"Hydra is a platform that helps researchers to identify potential vulnerabilities that they can then utilize for exploitation purposes," Jay Kaplan, CEO of Synack, told</span><em style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin: 0px; padding: 0px; text-align: justify;">eWEEK</em><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">. "It also gives them better cognizance of our customers from a change detection standpoint."</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">Kaplan </span><a href="http://www.eweek.com/security/former-nsa-analyst-leads-synack-to-secure-enterprise-applications.html" style="background-color: white; color: #19417e; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin: 0px; padding: 0px; text-align: justify; text-decoration: none;">started</a><span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;"> Synack in 2013 after spending nearly four years working as a senior analyst for the National Security Agency. Synack researchers are rewarded for finding vulnerabilities in customer environments and applications. Hydra is now part of the platform that security researchers get access to when they work with Synack, Kaplan said.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">Hydra, written by Synack developers largely in the Python programming language, resides in the Amazon cloud. The back-end data store includes the MongoDB database as well as Hadoop HDFS big data storage technologies. Hydra enables companies and security researchers to see how the externally facing infrastructure of organizations looks over time, Kaplan said.</span><br />
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;"><br /></span>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">As IP addresses are added, services come online and IT infrastructure changes for a given organization, Hydra provides researchers with alerts so they can examine what's going on for potential weaknesses. As an example, Synack has a customer with an online banking application that has lots of back-end infrastructure. "We have ingested their entire IP space into Hydra and are monitoring for changes of state," Kaplan said.</span><br />
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;"><br /></span>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">The issue is not that security researchers working with Synack couldn't have found changes in an organization's infrastructure on their own, but Hydra enables researchers to focus on specific areas and alerts researchers to new elements that the system identifies as a potential risk, Kaplan said.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">A common tool many security researchers use is the open-source nmap scanner, which can help find open ports on a network. According to Kaplan, Hydra in some respects is a next-generation approach for a tool like nmap. "Hydra brings that data back to researchers and provides visualization so researchers know what to focus on," he said.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">By providing Hydra to its researchers, Synack is now making it somewhat easier to find vulnerabilities than before. That said, Kaplan emphasized that Synack isn't reducing the amounts it pays researchers.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">"We're basically enabling researchers to make money faster, and that's a great thing for everyone," Kaplan said. "Researchers get more money as they spend the same amount of time to find more vulnerabilities and customers get information faster so they can close holes quicker."</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">Paying security researchers to help find flaws is not unique to Synack. HackerOne and Bugcrowd are among the competitive offerings currently in the space.</span><br />
<div style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; margin-bottom: 14px; margin-right: 14px; margin-top: 5px; padding: 0px; text-align: justify;">
</div>
<span style="background-color: white; color: #333333; font-family: HelveticaNeue-Light, 'Helvetica Neue Light', 'Helvetica Neue', Helvetica, Arial, 'Lucida Grande', sans-serif; line-height: 19px; text-align: justify;">Synack focuses on quality and not quantity when it comes to security researcher participation, Kaplan said. "We built our business around the enterprise trying to help them adopt the best of the bug-bounty space, without any of the risk," he said.|</span></div>

Cyber Crime Hacking news Latest News Security news Synack Hydra Is Designed to Help Security Researchers Find Threats

Synack announced Hydra, a new tool designed to enable its researchers to work faster to find new threats. Synack debuted a new tool...

Latest Hacking News And Events - dA1337