Posts

Cyber News Rundown: Amazon DNS Service Hijacked

The Cyber News Rundown brings you the latest happenings in cybersecurity news weekly. Who am I? I’m Connor Madsen, a Webroot Threat Research Analyst and a guy with a passion for all things security. Any questions? Just ask. Amazon IPs Rerouted for Several Hours  Early Tuesday morning attackers compromised an ISP that allowed them to reroute 1,300 IP addresses belonging to Amazon’s Route 53 DNS service. Amazon quickly released a statement on the issue and clarified that it was a specific vendor’s domain that was sharing the traffic across multiple peer networks. In doing so, the attackers were able to masquerade as MyEtherWallet.com, which netted them over $150,000 in cryptocurrency. Middle East Ride-Hailing App Compromised In an announcement at the beginning of this week, the ride-hailing app Careem addressed a data breach that occurred in mid-January. The breach could affect nearly 14 million customers, though officials have stated that no payment information was
Post a Comment
Read more

‘Smishing’: An Emerging Trend of Phishing Scams via Text Messages

Image
Text messages are now a common way for people to engage with brands and services, with many now preferring texts over email. But today’s scammers have taken a liking to text messages or smishing, too, and are now targeting victims with text message scams sent via shortcodes instead of traditional email-based phishing attacks. What do we mean by shortcodes Businesses typically use shortcodes to send and receive text messages with customers. You’ve probably used them before—for instance, you may have received shipping information from FedEx via the shortcode ‘46339’. Other shortcode uses include airline flight confirmations, identity verification, and routine account alerts. Shortcodes are typically four to six digits in the United States, but different countries have different formats and number designations. The benefits of shortcodes are fairly obvious. Texts can be more immediate and convenient, making it easier for customers to access links and interact with their
Post a Comment
Read more

14 digital security tips for World Password Day

 May 3 is World Password Day. Check out these 14 tips to keep your digital accounts safe from intrusion. 1. Two-factor authentication Consider activating two-factor or multi-factor authentication, a feature that adds an extra step, such as putting in a number sent to your phone, to login. 2. Don’t save passwords on public computers Don’t activate any “remember my password” features on a computer that isn’t yours. 3. Be careful answering security questions Answers to common security questions, such as your mom’s maiden name or the street you grew up on, can often be found on social media. Consider this when choosing questions and how you answer them. 4. Change your password often You might not know if your password has been compromised, so change it often. 5. Use a USB token Services such as Google, Facebook and Dropbox support the use of a USB key that you plug in to your computer before typing in your password as a form of two factor-authentication. This means that
Post a Comment
Read more

Facebook is using billions of Instagram images to train AI algorithms

Image
  Your Instagram photo of a perfectly composed plate of pancakes or an exquisitely framed sunset is helping Facebook train its artificial intelligence algorithms to better understand objects in images, the company announced today at its annual F8 developer conference. Facebook says the approach, which culls images from publicly available hashtags, is a way to amass and train software with billions of images without the need for human workers to laboriously analyze the data and annotate it. The end result is a training system that created algorithms Facebook says beat top-of-the-line industry benchmarks.  “We rely almost entirely on hand-curated, human-labeled data sets. If a person hasn’t spend the time to label something specific in an image, even the most advanced computer vision systems won’t be able to identity it,” Mike Schroepfer, Facebook’s chief technology officer, said onstage at F8. But using Instagram images that are already labeled by way of hashtags, Facebook was ab
Post a Comment
Read more

Amazon Alexa Can Be Used for Snooping, Researchers Say

Amazon's Alexa cloud-based virtual assistant for Amazon Echo can be abused to eavesdrop on users, Checkmarx security researchers have discovered. Present on more than 31 million devices around the world, Alexa enables user interaction after a wake-up word (specifically, “Alexa”) activates it. Next, the Intelligent Personal Assistant (IPA) launches the requested capability or application – called skill, it either comes built-in or is installed from the Alexa Skills Store. Checkmarx researchers built a malicious skill application capable of recording user’s speech in the background and then exfiltrating the recording, all without alerting the user. Because of the required wake-up word, the recording would have to be performed after the activation. However, the listening session would normally end after a response is delivered to the user, to protect privacy, yet the researchers found a way to keep the session alive and to hide that from the user. A shouldEndSession flag
Post a Comment
Read more

Ethereum cryptocurrency wallets raided after Amazon’s internet domain service hijacked

Image
Approximately US $150,000 worth of Ethereum-based cryptocurrency stolen. Online cryptocurrency website MyEtherWallet.com has confirmed that for a period of time yesterday some visitors could have been redirected to a phishing site designed to steal users’ credentials and – ultimately – empty their cryptocurrency wallets. According to reports , whoever was behind the attack may have successfully stolen approximately US $152,000 worth of Ethereum-based cryptocurrency.  However, assuming that MyEtherWallet itself was at fault may be a mistake, as the website explained in its statement: “This is not due to a lack of security on the [MyEtherWallet] platform. It is due to hackers finding vulnerabilities in public facing DNS servers.” This explanation is confirmed by British security researcher Kevin Beaumont, who described in a blog post that some of MyEtherWallet’s traffic had been redirected to a server based in Russia after traffic intended for Amazon’s DNS resolvers
Post a Comment
Read more

St. Jude Medical Recalls 465,000 Pacemakers Over Security Vulnerabilities

Image
Pacemaker Patients Must Visit Healthcare Provider for Firmware Update That Addresses Security Vulnerabilities A firmware update to address security vulnerabilities has been approved and is now available for radio frequency (RF)-enabled St. Jude Medical (now Abbott) implantable pacemakers, the U.S. Food and Drug Administration (FDA) announced this week. Vulnerabilities in St. Jude Medical's devices were made public last year by MedSec and Muddy Waters, as investment strategy to short sell shares of St. Jude's stock. The report claimed that attackers could, among other things, crash implantable cardiac devices and drain their battery at a fast rate. St. Jude rushed to refute the allegations and even sued the two companies , while University of Michigan researchers analyzed the MedSec/Muddy Waters report and discovered that their proof-of-concept (PoC) exploit did not actually crash the implanted cardiac device. Muddy Waters and MedSec responded to t
Post a Comment
Read more