hacking – Page 1064 – STE WILLIAMS

Cognitive Mindhacks: How Attackers Spread Disinformation Campaigns

library
crime | hacking | security

Researchers investigate the tools and techniques behind cyber propaganda and fake news and how it changes public opinion.

Disinformation campaigns, otherwise known as cyber propaganda, cognitive hacking, information warfare, and the more common “fake news,” have roots in history but are increasingly relevant, and dangerous, as actors manipulate Web tools to sway public opinion.

Content promotion services have been in the “gray market” for a while, but fake news didn’t start to gain widespread attention until the 2016 US Presidential election, explains Vladimir Kropotov, senior researcher for Trend Micro’s Forward-Looking Threat Research (FTR).

In a few weeks, Kropotov will join fellow FTR senior researchers Fyodor Yarochkin and Lion Gu to present tools and techniques used among cyber propaganda perpetrators around the world in a Black Hat Europe presentation titled “Enraptured Minds: Strategic Gaming of Cognitive Mindhacks.”

“Information distributes too fast, and people can make wrong decisions based on information from unreliable sources,” Kropotov explains.

Researchers believe the success of fake news campaigns relies on three distinct components: social networks, motivation, and tools and services. The absence of one of these factors will make the spread of disinformation more difficult, if not impossible, they say.

The Dark Web is full of tools to spread fake news campaigns. Some of these can be used for legitimate purposes, such as content marketing, but their power can also be leveraged to disseminate propaganda and influence public opinion. A few are available on the gray and legitimate markets, but these don’t have the anonymity of the underground.

Today, most fake news campaigns are considered to be politically motivated. However, researchers say, other motives exist and the same tools can be used to achieve them.

“I think people in big companies and enterprises should be aware of the availability of services like this,” says Yarochkin. For example, he explains, these services can be used to promote content intended to make particular companies hot on the stock market. PR agencies can use the same tools as threat actors to spread information in the wake of a crisis.

“It’s not purely underground services,” says Kropotov of the tools used to spread fake news. “The same technologies have been used widely by media agencies and in advertising.”

The researchers learned that Chinese, Russian, Middle Eastern, and English-based underground marketplaces all offer services for anyone who wants to launch disinformation campaigns.

“One of our ideas was to watch how [fake news] looks to the United States, and Russia, and Arabic-speaking countries,” explains Yarochkin. Tools used to spread fake news vary from place to place, and each reflects the social and online culture of its respective region.

Example: The Chinese marketplace

As an example of geography-specific tools, consider the Chinese underground, which researchers also analyzed. Given the difficulty of accessing certain social media platforms outside China, most of these tools are unsurprisingly limited to the Chinese market.

One such service, called Xiezuobang, charges money to create and distribute content. Pricing varies depending on the platform where the article will be published. While it could be used for content marketing, the service could easily be abused to spread propaganda, researchers say.

Several Chinese websites advertise a “public opinion monitoring system” that can allegedly survey and influence opinions in popular social media networks and forums, depending on the customer’s specific area of interest. One of these, the Boryou Public Opinion Influencing System, says it can monitor 3,000 websites and forums, and add automatic posts and replies at a reported rate of 100 posts per minute.

“An administrator could gather feedback from websites and forums, if they want to know what people are saying and thinking,” says Gu.

On the Chinese underground, researchers also found services leveraging social media to sway public opinion. Brokers offer paid posts and reposts to distribute content on Chinese social media networks. Clients pay to have their content posted by influential users; the more popular the user, the more expensive it is to have that user repost your content.

“Buyers will bank on a celebrity’s visibility as a potent means to deliver their desired content to an expansive pool of audience,” researchers say. A famous Weibo user with 78.25 million followers, for example, costs $180,000 for their visibility.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/cloud/cognitive-mindhacks-how-attackers-spread-disinformation-campaigns/d/d-id/1330334?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

It Takes a Buck to Make a Million on the Dark Web

library
crime | hacking | security

The cost for malware tools and services can add up, but the returns from cybercrime campaigns can be enormous, says Recorded Future.

The payoff from cybercrime can be enormous for aspiring criminals everywhere, but as with many lucrative endeavors, sometimes it takes a little investment up front to get you off the ground.

Take a banking botnet operation. A decent credential-stealing Trojan can easily set you back between $3,500 and $5,000 says Recorded Future, which recently compiled a price list for malware and associated services on the Dark Web.

The Web-injects you’ll need to intercept credentials for account holders of each of your target banks can cost between $100 and $1,000; bulletproof hosting another $150 to $200 per month; and payload obfuscation tools can cost up to $50.

Then there’s the 50%- to 60% commission you’ll need to pay from the money you steal from each victim’s account if you want it professionally laundered, and another 5% to 10% to have it delivered via Bitcoin, Western Union, or other direct methods.

Such costs can add up. Still, the paybacks are enormous, says Andrei Barysevich, director of advanced collection at Recorded Future and author of the report. “We estimate the average ROI of a botnet operation to be between 400% to 600%,” he says.

The returns are both direct and indirect. The main income comes from the money you steal from individual bank accounts. Then there’s also the opportunity for residual income from actions like selling the login credentials at $100 to $200 a pop, or doing per-demand malware installation on the devices you have infected, Recorded Future found.

Economics like this are driving enormous interest in malware goods and services on the Dark Web. Over the years, what used to be a space dominated by a motley collection of mostly Eastern European cybercrooks has evolved into a well-organized, slick marketplace with highly specialized products and services. While estimates of the size of the cybercrime market range widely from the low hundreds of billions of dollars to over a trillion dollars, one thing everyone agrees is that it is really big.

The cybercrime underground has pretty much everything that a criminal would need, for a price, Recorded Future’s report says. Like legitimate online marketplaces, goods and services can be sold or purchased pretty openly. The market is organized in a highly vertical manner with threat actors focusing on specific areas of expertise.

Script Kiddies

Often, to launch a campaign, a threat actor will need to interact with a network of service and tool providers rather than a single provider. Contrary to what one might expect, you don’t need to be a jack-of-all-trades to succeed in cybercrime. The underground market is capable of supporting newbies and script kiddies just as efficiently as it can support the needs of the most sophisticated criminal groups and nation state actors.

In fact, it is rare to find individuals operating in isolation launching major criminal campaigns. Success in cybercrime really requires the ability to harness expertise and tools across multiple disciplines and sourced from different places, Recorded Future says.

The cost for these campaigns ultimately depends on what you are after and how sophisticated you want the campaign to be. If all you are looking for is login info to an online account, you can get Paypal account information for as little as $1.

But of you want malware for launching a distributed denial-of-service attack, that can set you back $700, and the infrastructure for a spam or phishing campaign can run into the thousands.

“Historically, banking malware was and remains the most complex and costly criminal product,” Barysevich says. “At the same time, various RAT and ransomware products are among the least expensive malicious software.”

Interestingly, inflation doesn’t appear to be much of thing in the underground market for cyber crimeware and services. Barysevich says Recorded Future doesn’t have reliable metrics to say for sure how prices on the Dark Web have moved in recent years. But “based on experience, we can say a majority of the services and data types have not seen significant price fluctuations,” he says.

But that could change, he says. With financial organizations and others getting generally better at protecting themselves against attacks, malware tools will need to evolve as well. This trend could make things a bit more expensive for the average cybercriminal over the next year.

One area where Barysevich expects prices to rise is malware distribution. The arrest of Russian national Pyotr Levashov earlier this year has removed one of the primary provides of spamming services across Europe and will push up malware distribution costs, he says.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/it-takes-a-buck-to-make-a-million-on-the-dark-web/d/d-id/1330336?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Hole in Tor causes TorMoil, update now

library
crime | hacking | security

Do you use Tor?

If you do, then you probably expect it to provide a basic level of online anonymity – notably, that it stops your own IP number showing up when you browse.

To explain.

Your IP number uniquely identifies your computer (or at least your network) so that it can send packets to the internet, and get replies back.

Every packet coming from your network – whether it’s a login attempt, an email you’re sending, or a website you’re browsing to – includes your IP number, to act as a sort of “return home” beacon.

Without this so-called source address, the other end of any internet conversation wouldn’t know what to do with its replies – you’d be able to speak to anyone, but to hear no one.

At home, your IP number is typically allocated by your internet provider when your router powers up.

Even though you may get a different IP number every time you reboot your network, your ISP keeps a record of which household was allocated which IP number for what periods of time.

In other words, you can be identified fairly reliably via your IP number.

Even though it might take a court warrant in your country to get at the necessary records, those records almost certainly exist.

On a less dramatic footing, your IP number is typically static for days or weeks at a time, so that web servers can use it not only to figure out which town and country you’re in, but also to “join the dots” of your recent browsing habits.

Enter Tor

Tor, short for The Onion Router, is a bundle of network software together with a modified version of the Firefox browser, that sets out to change all that.

Greatly simplified, Tor consists of about 7000 computers around the world [2017-11-06T12:00Z], run by volunteers, that shuffle around users’ traffic to disguise its source.

Every time you start up Tor, your computer picks three of the 7000 computers – known as nodes – randomly, and bounces your browsing traffic through them on the way out and back.

Strictly speaking, not all of Tor’s 7000 nodes are made equal. Only about 2000 of them are considered reliable enough to act as the first node, or entry guard, into the Tor system; and only about 1000 are suitable to act as the last hop, or exit node, in a Tor connection, known colloquially as a circuit. Thanks to the way Tor encrypts the traffic passing through it, only the entry guard knows who you are (but not who you are talking to), and only the exit node in each circuit knows where the traffic is going (but not who sent it). The node in the middle stops the entry and exit nodes from colluding to deanonymise your traffic, making it very difficult to trace Tor packets even though you can never be sure which nodes are truly playing the anonymity game. Some nodes are run by crooks; others are operated by law enforcement and intelligence services. Because they can.

So, your Tor browsing traffic appears to originate from somewhere in the Tor network, meaning that you can’t easily be traced, and that your town and country will not only be disguised but will also appear to bounce around the world every time you start Tor.

Indeed, if you’re using Tor, it’s quite fun to browse to Google or Bing and see where the search engines thinks you’re located, and what they think you’ll be interested in.

The Tormoil bug

One problem with Tor is that it can give you a false sense of security.

After all, if you’re browsing via Tor but end up logging into an account that already knows who you are and where you live, then your anonymity is over.

Also, the anonymity of Tor depends on the browser you’re using communicating only via the Tor network and never directly over the internet.

That’s why the browser built into the Tor package is pre-configured so that it won’t accidentally browse via your regular network connection, thus preventing some of your browsing traffic sneaking out along a directly traceable path.

At the end of October, however, an italian security researcher called Filippo Cavallarin found a way to trick Firefox into browsing directly, even after you’ve told it not to.

In other words, a crook could feed you a web link that would force your browser to send traceable network packets just when you didn’t expect it.

Because this bug affects Tor’s flavour of Firefox as well as the regular versions, it’s just the kind of thing that crooks or inquisitive government officials would love to exploit in order to be able to trace you directly while you’re busy trying to give them the slip.

Cavallarin couldn’t resist turning this into a BWAIN (a Bug With An Impressive Name), as we jokingly call them, dubbing it TorMoil to reflect the anxiety it might cause to some users in the Tor community.

What to do?

Fortunately, there’s an easy fix: update Tor.

The TorMoil bug has been suppressed in Tor 7.0.9, so once you’ve updated, your IP number is back to being shielded by Tor as it should be.

According to the Tor Project, no one yet seems to have exploited this vulnerability in the wild…

…so if you’re a Tor user, you might as well get one step ahead.

(To make sure you have the latest version, go to the menu item About Tor Browser and you should see Checking for updates... followed by an [Update] button if you are out of date.)

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/sz1tysZHMA0/

Paradise Papers were not an inside job, says leaky offshore law firm

library
crime | hacking | security

Revelations from the Paradise Papers, a leaked set of more than 13 million financial documents, have shed light on how the rich and famous channel funds through offshore tax havens.

Among early stories spawned from the leak and published over the weekend are allegations that Russia funded Facebook and Twitter investments through a business associate of Jared Kushner, President Donald Trump’s son-in-law and senior White House adviser. Investments by two Russian state institutions were made via tech magnate Yuri Milner, who also holds a stake in a firm co-owned by Kushner, The Guardian reports.

It has also emerged that Donald Trump’s commerce secretary, Wilbur Ross, had a stake in a shipping company firm transporting oil and gas for a firm whose shareholders include Vladimir Putin’s son-in-law and two men subject to US sanctions, the BBC reports. Most of the coverage so far has focused on how £10m of the Queen’s private money was invested offshore into funds in the Cayman Islands and Bermuda by the Duchy of Lancaster but many more revelations are likely to follow.

The leaked information largely came from a hack against offshore legal firm Appleby. Appleby only admitted it had suffered the breach – which actually happened last year – after the International Consortium of Investigative Journalists (ICIJ) began asking awkward questions based on leaked information, as previously reported.

Like last year’s Panama Papers leak, the documents were first obtained by German newspaper Süddeutsche Zeitung, which enlisted the help of the ICIJ to help diversify and spread a workload no single media organisation could hope to manage. Süddeutsche Zeitung has not revealed the source of the leak.

In a statement, Appleby said the leaked information came from a criminal hack on its computer systems. Subsequent forensic examination has ruled out an insider, according to the law firm.

We wish to reiterate that our firm was not the subject of a leak but of a serious criminal act. This was an illegal computer hack. Our systems were accessed by an intruder who deployed the tactics of a professional hacker and covered his/her tracks to the extent that a forensic investigation by a leading international Cyber Threats team concluded that there was no definitive evidence that any data had left our systems. This was not the work of anybody who works at Appleby.

Appleby criticised “politically driven” media coverage of the leak. “The journalists do not allege, nor could they, that Appleby has done anything unlawful. There is no wrongdoing. It is a patchwork quilt of unrelated allegations with a clear political agenda and movement against offshore,” it said.

The breach raises security and data protection issues, said Thomas Fischer, global security advocate at Digital Guardian. “Putting aside the fact that the leaked financial details appear to include information about the murky world of offshore finance, for the victims, this leak could have life-altering or, at the very least, hugely distressing effects. Ultimately, the breach could trigger serious legal repercussions against Appleby.

“Data protection should be of the utmost importance in these businesses and yet we have seen a growing number of data breaches in law firms in recent times.”

The vast majority of the transactions exposed involve no legal wrongdoing. The release of the information has nonetheless provoked a debate that UK politicians, among others, are keen to explore. Those on the political left, in particular, are keen to curb the use of offshore tax havens. As well as concerns about unfairness, tax havens could be used to cloak wrongdoing.

Meg Hillier MP, chairman of the House of Commons Public Accounts Committee, said: “The government talks tough about clamping down on aggressive tax avoidance but once again we see HM Revenue Customs being out-manoeuvred. HMRC must investigate the very worrying allegations arising from this leak.

“These transactions are taking place behind a veil of secrecy and, whether they are legal or not, we all have a duty to contribute to public services through our taxes.

“Senior HMRC officials are coming before our Committee today [Monday] and we will be expecting frank answers on what it intends to do.”

BBC Panorama and The Guardian are included in a list of more than 100 media organisations investigating the papers. More revelations are promised over the coming days. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/11/06/paradise_papers/

External Attacker Leaked ‘Paradise Papers,’ Law Firm Reports

library
crime | hacking | security

The Paradise Papers contain 13.4m documents allegedly hacked by an outsider, the targeted law firm reports.

The release of the Paradise Papers, a collection of 13.4 million documents, has revealed tax affairs of the ultra-wealthy, reports the BBC. Most of the papers came from offshore legal firm Appleby, which says the leak came from a hack on its network and no insiders were involved.

Similar to last year’s Panama Papers leak, the documents were first procured by German publication Süddeutsche Zeitung, which worked with the International Consortium of Investigative Journalists (ICIJ).

Leaked financial documents surfaced information on how rich and famous people channel funds through offshore tax havens to protect their cash from tax officials. For example, papers indicate about $13M (USD) of the Queen’s private funds were invested offshore. While not illegal, this might prompt questions about the Queen’s finances.

It also came to light that Russia funded Facebook and Twitter investments through a business associate of Jared Kushner, President Trump’s son-in-law and senior White House advisor. Papers indicate Commerce Secretary Wilbur Ross had a stake in a company which transports oil and gas for a Russian energy firm, whose shareholders include Vladimir Putin’s son-in-law and two men sanctioned by the US.

While Appleby says it did not do anything wrong, the disclosure of such sensitive data could have tremendous repercussions for individuals affected.

8 Older Companies Doing New Things in Security

library
crime | hacking | security

These organizations have been around for a while but aren’t slowing down on security releases.

(Image: 4Max via Shutterstock)

The security space is growing with startups building game-changing technologies in identity management, training, privacy, and other niche areas to drive the future of security.

This year is a big one for new companies trying to make a name for themselves in the industry. From a security investment standpoint, the first two quarters of 2017 were the most active in the past five years. Numbers show 2017 will be a record-breaking year for security funding.

It’s easy to see why. Major global cyberattacks, combined with evolving security threats for businesses and consumers, have heightened the demand for new tools and services.

While the up-and-comers are getting their fair share of attention, let’s not forget older security-focused companies have continued to explore new technologies. Many of them have come out with interesting updates in the last few months, a sign we should still keep an eye on them.

Here, we catch up with some players who have been around the industry for a while and see what they’ve been up to. Any companies you’d like to add to the list? Feel free to share your contributions in the comments.

Article source: https://www.darkreading.com/endpoint/8-older-companies-doing-new-things-in-security/d/d-id/1330324?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Virtual Reality Could Serve as a Cybersecurity Recruiting Tool

library
crime | hacking | security

A recent study finds 74% of millennials and post-millennials agree VR use in cybersecurity tools may entice them into an IT security career.

Cybersecurity tools that employ immersive technologies such as virtual reality and augmented reality could attract millennials and post-millennials to IT security careers, a new study shows.

Across the globe, the IT security industry is expected to face a talent shortfall of 1.8 million workers by 2022. But the Immersive Technologies The Future of Cybersecurity report – a survey of 524 US residents between 16-to 24-years old – shows that virtual reality tools could attract security talent: some 74% of the survey respondents say they are likely to pursue an IT security career if cybersecurity tools incorporate virtual reality and augmented reality technologies.

Additionally, 77% of survey respondents say they would enjoy using these tools if that were the case, according to the ESG study commissioned by ProtectWise.

The majority of survey respondents already have extensive exposure to virtual reality and augmented reality technologies through online and video games, the report notes. According to the survey:

40% have been gamers for at least 10 years
76% play online games on a weekly basis, averaging 9 hours of gaming each week
58% have used or regularly use virtual reality technologies in games

“These kids are highly exposed to gaming principles and are aware of spatial familiarity,” says Gene Stevens, co-founder and CTO of ProtectWise. “I was shocked by their positive response to pursuing a career in cybersecurity. I was expecting to see more resistance.”

ProtectWise, which is beta-testing its so-called Immersive Grid SOC service that includes a 3D visual layer for monitoring security alerts, commissioned the report to determine what if any correlation exists between virtual reality and augmented cybersecurity tools and recruiting future infosec professionals. Immersive Grid uses both virtual reality andaugmented reality.

“We did the survey to see if it makes sense to draw millennials and post-millennials to the platform, IT and cybersecurity as a job,” Stevens says.

Some 67% percent of survey respondents haven’t taken a cybersecurity class in school, with 65% of that group saying the reason is that their educational institution didn’t offer such courses. Nearly a quarter of survey respondents say they avoided cybersecurity courses due to a lack of interest, while 15% say they don’t have enough technical knowledge to take these classes.

Takeaway for Employers

Although Stevens estimates few companies are offering virtual reality and augmented reality in their cybersecurity tools, he hopes the numbers will grow because of the potential to attract new hires to the IT security workforce.

Meantime, some 33% of respondents are interested in a video-game development career, while 9% want to pursue a cybersecurity career.

Stevens notes by infusing immersive technologies as seen in video games into cybersecurity tools the IT security industry stands a better chance of winning over more prospective job candidates.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET’s … View Full Bio

Article source: https://www.darkreading.com/endpoint/virtual-reality-could-serve-as-a-cybersecurity-recruiting-tool-/d/d-id/1330326?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

When Ransomware Strikes: 7 Steps You Can Take Now to Prepare

library
crime | hacking | security

Ransomware is still on the rise. These operational tips can help lessen the blow if you’re hit.

If you walked into work tomorrow to find your company had been hit by ransomware, would you know what to do? Who would you call? How would you find their phone numbers if your computer was locked up? How would you notify customers?

There are many aspects to preparing for ransomware, including technical tips such as maintaining a current, offline backup of your data. This article isn’t about those technical steps. It’s about the practical, operational measures you can take now to prepare yourself and your company for the moments after an incident occurs. What’s your emergency plan? Who would you want on your team? How would you communicate?

Few of us are good at preparing for the unexpected, but planning ahead will make life a lot easier if disaster strikes. And when it comes to ransomware, there’s a good possibility it will. After the WannaCry attack in May, which infected some 300,000 computers in the first few days, the head of the FBI’s Cyber Division called ransomware “a prevalent, increasing threat,” and said attacks are likely to rise in future. Other reports also predict an increase.

With that in mind, here are seven steps you can take now to prepare yourself and your company for the moments after ransomware strikes. Some of these can be applied broadly to other critical incidents, while some are ransomware-specific.

1. Plan your initial response. Your team members may not be used to dealing with stressful situations, so make sure they know what to do. This includes where they’ll gather to discuss the problem, where press inquiries should be directed, and what to tell customers and staff. Most of the time, this means planning the who, what, when, and how. Once you have this plan, share it with your team ahead of time, and…

2. Store your response plan in multiple locations. If your plan for incident response is stored on your PC and you’re locked out, you can’t even get started on your recovery. Ransomware can affect your desktop, your servers, or both. Store copies of your plan in multiple locations, including at least three separate cloud services. And set a calendar alert to remind yourself to update them periodically.

3. Pick your team now. Who needs to be in the room in the moments after an incident occurs? Your CEO and CIO are a given, but you may also want your heads of PR, legal, HR, and other department chiefs. Draw up a list now and make sure everyone knows they’re on it. Also, get their contact details for off-work hours, and share them with the rest of your team.

4. Have a communications plan in place. You may find yourself locked out of your primary, preferred method of communication, so know which channels you’ll fall back on. Email might not be an option, so prepare to use other means. If your smartphones are still working, collaboration apps can be a good way to communicate as a group — just make sure everyone has the app installed. But ransomware can also strike mobile devices, so as with all aspects of preparedness, have a backup. Storing phone numbers and personal email addresses in multiple locations is a good place to start.

5. Decide now who’ll take charge. There’s a lot to do in the moments after an attack, including directing employees and contacting law enforcement, customers, and partners. Someone will need to oversee and manage the recovery effort and be ready to answer questions as they arise. It could be your CIO, COO, head of security, or someone else — but it’s best to have a clear, single owner. Decide now who that will be, so the responsibility doesn’t suddenly get dropped in their lap that morning.

6. Have a discussion now about how you’ll respond. Whether you decide to pay the ransom will likely depend on the severity and nature of the incident, but it’s better to begin this conversation now than in the heat of the moment. The FBI has said it doesn’t condone payment because it wants to discourage future attacks, but it also recognizes that every business will need to make its own decision. It can’t hurt to start talking about this now, so your team is at least familiar with the trade-offs when a decision has to be made.

7. Know your appetite for risk. You can’t plan for everything, so figure out how much you risk you can tolerate — and how much potential harm you can deal with — and then make a trade-off. For example, some companies will do a disaster recovery exercise every month, to be sure they’re always prepared. But that’s a big time commitment, and others will opt for once a quarter. It all depends how much “insurance” you want built into the system. These are tough calls, but they need to be made deliberately and in advance.

If you’re lucky, you’ll never have to face a ransomware incident, but luck isn’t how you run a business. Your technical teams will have put in a lot of work guarding against attacks and mitigating damage. But responding operationally, informing customers, and keeping the company moving forward falls to management. It’s often hard to imagine a situation you’ve never been in, but try to picture that morning when your phone rings and you learn your company has been hit. Think about all the things you’ll wish you’d have done — and start doing them now.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Patrick Hill is SRE Solutions Lead at Atlassian, a provider of team collaboration and productivity software that helps teams organize, discuss, and complete shared work. Teams at more than 89,000 organizations use Atlassian products including JIRA, Confluence, HipChat, … View Full Bio

Article source: https://www.darkreading.com/endpoint/when-ransomware-strikes-7-steps-you-can-take-now-to-prepare-/a/d-id/1330313?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

DDoS Flaw Found in Brother Printers

library
crime | hacking | security

All Brother printers with a Debut Web front-end carry a flaw that allows attackers to distribute a single malformed HTTP POST request, researchers revealed today.

A vulnerability discovered in the Debut embedded Web front-end in all Brother printer models could allow attackers to launch a DDoS attack against the printers, according to research released today by Trustwave.

The Debut bug can be exploited via a single malformed HTTP POST request, which then returns a 500 error code. That makes the Web server inaccessible and ceases all printing functions.

There is no apparent patch for the bug, despite Trustwave’s repeated attempts to contact the company, according to Trustwave’s blog post. System administrators are advised to restrict access control using a firewall or similar device to limit Web access only to administrators that need it to mitigate the threat.

The DDoS cybercriminals could potentially leverage the attack to present a faux technician, who would “fix” the problem while also gaining direct physical access to IT resources.

Meet Russian Twitter troll Jenna Abrams and her 2,752 friends

library
crime | hacking | security

As the US Congress continues to investigate Russia’s meddling in the 2017 presidential election, it’s made some findings public. One such finding is a 65-page list (PDF) of 2,752 now-deactivated Twitter accounts, released last week, that Twitter identified as being tied to Russia’s troll farm.

That farm, which also goes by the name of the “Internet Research Agency,” is reportedly based in St. Petersburg.

Fox News picks up the story:

There was the ISIS attack on a chemical plant in southern Louisiana last September. Two months later, an outbreak of the deadly Ebola virus occurred in Atlanta … What all these shocking and disparate stories have in common are two things: they are not true and they all originated from a group of Russian cyber trolls working out of a non-descript office building in St. Petersburg.

Don’t have time to wade through the account names? Recode has done it for you, slicing and dicing the defunct accounts to draw these conclusions:

Some were named to look like local news agencies, such as @DailyNewsDenver and @DallasTopNews. Nineteen include “news” in their handle, 27 “novosti,” Russian for “news.”
Many are meant to look like Western or Russian individuals, such as @_TraceyJohnson_, @CarolineReeeed, @BogdanKravcov and @VladEvlanin.
Seven contain “Trump,” zero contain “Clinton,” five include “GOP.” One is @NewYorkDem.
Others, like@Justice4Jamar_, seem designed to play up racial tensions.

At least one of the trolls, “Jenna Abrams,” had quite the reach. The divisive alt-right blogger, a fabrication of the troll farm whose account was created in 2014, amassed something like 70,000 followers before the account was shut down.

Her account may well be shuttered, but a little digging from The Daily Beast shows that the fake alt-righter argued with celebrities as well-known as Roseanne Barr and was featured in an exhaustive list of articles written by Bustle, U.S. News and World Report, USA Today, several local Fox affiliates, InfoWars, BET, Yahoo Sports, Sky News, IJR, Breitbart, The Washington Post, Mashable, New York Daily News, Quartz, Dallas News, France24, HuffPost, The Daily Caller, The Telegraph, CNN, the BBC, Gizmodo, The Independent, The Daily Dot, The Observer, Business Insider, The National Post, Refinery29, The Times of India, BuzzFeed, The Daily Mail, The New York Times, and, unsurprisingly, Russia Today and Sputnik.

A typically inflammatory tweet, from April 2016, from the @Jenn_Abrams account:

To those people, who hate the Confederate flag. Did you know that the flag and the war wasn’t about slavery, it was all about money.

The account’s gone, but both the outraged responses and the fist-pumping of accounts that agreed with statements like that one live on.

We’re in the habit of warning kids not to trust that mystifyingly lonely, purportedly famous people who reach out to strike up random romances with people they’ve stumbled across online have any credibility whatsoever. But do we ever stop to consider, when we engage with people who spout outrageous statements online, whether we’re arguing with cardboard cutouts?

In the light of Congress’ investigation into Russian election meddling, it seems that we should now bear in mind that we’re potentially arguing not just with fictional characters set up to cause a stir, but with cardboard cutouts who seem to have been well-paid for making up antagonistic fictions.

Have you ever wondered how much money Russia’s army of trolls made when they flamed Hillary Clinton, waged a pro-Trump propaganda war, and turned Americans against their own government in the 2017 presidential election?

You probably already know if you’ve been following the news about the thousands of ads Facebook sold to Russia’s troll factory during the election – each troll made about USD $846 a month.

That’s 50,000 roubles, or £650, to post tens of thousands of comments on Western media sites including the New York Times and the Washington Post. This is according to what a former troll factory employee, identified as “Maksim,” told the independent Russian TV channel TV Rain (interview is in Russian) on 14 October.

The Telegraph quotes a translation of Maksim’s comments:

Our goal wasn’t to turn Americans toward Russia. Our goal was to set Americans against their own government. To provoke unrest, provoke dissatisfaction, lower (Barack) Obama’s rating.

Maksim said that the “document strategy” was for the trolls to familiarize themselves with hot-button topics in the US: tax problems, LGBTQ issues, and gun laws, for example. Toward that end, they were required to watch the US political TV series “House of Cards.” The trolls’ purpose was to influence opinions, he said, and they were measured not only for how many posts they made, but for the quality of the posts:

There was a goal – to influence opinions, to lead to a discussion. Argumentation wasn’t the only goal: ‘Obama is a monkey, and Putin is a fine fellow.’ This was not accepted; management even fined for it.

In the English department, there is another accountability: there, it was necessary to measure the reaction. The reaction is how much you got the likes. The comment was supposed to provoke a discussion.

According to the Russian news site RBC, the troll factory spent about $2.3 million over two years and employed up to 90 people.

RBC says that, according to troll factory insiders, the factory:

Spent about $80,000 on the purchase of virtual SIM cards, proxy servers, IP addresses and other IT support.
Paid expenses for about 100 people located in the US who allegedly didn’t know where the money was coming from, given that all communication took place over the internet and came from fake accounts. The factory paid for their inter-city flights, printing of materials and other expenses.
Spent about $5000 a month on social media – mostly, buying Facebook ads.

We can’t say it often enough: On the internet, nobody can tell you’re a dog, an SJW or alt-righter who truly believes what she’s saying… Or a troll who’s getting paid to make up nonsense just to needle you and foment division.

Ignore trolls as much as possible. It’s the best way to thwart their purposes. And if the reports about Russia’s troll farm turn out to be accurate, it’s also a good way to starve them of the likes and engagement they thrive on.

Follow @LisaVaas
Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/b388g_lrdeg/