FreshRSS

🔒
❌ About FreshRSS
There are new available articles, click to refresh the page.
Before yesterdaySecurity

#WSPD Creating hope through action with The Jordan Legacy

By Life at McAfee

*TW: Mentions Suicide

Our passion for protecting people doesn’t stop with online safety. We deeply care for our people, their families and friends, and our communities.

To recognize World Suicide Prevention on Sept. 10 and help normalize and encourage conversations about mental health year-round, we recently hosted a discussion with McAfee colleagues and suicide prevention activist and owner of The Jordan Legacy, Steve Phillip. During this session Steve discussed his own personal lived experience of suicide and what he’s learned since establishing The Jordan Legacy when it comes to creating an open and safe environment for all.

Tell us a bit about The Jordan Legacy?

“I established The Jordan Legacy in 2020, following the suicide of my 34-year-old son, Jordan, in December 2019. It’s a registered not-for-profit Community Interest Company (CIC), whose mission is to raise awareness about suicide, open the conversation, help remove the stigma surrounding this topic and importantly, engage with communities and workplaces to discuss and identify practical solutions which will help prevent suicide.”

Why is World Suicide Prevention Day (WSPD) important?

“#WSPD is important in highlighting the biggest killer of men and women under the age of 35. According to the W.H.O, we lose 700,000 people globally to suicide every year – that’s one person every 45 seconds. On average, each suicide will impact 135 other people. This means that more than 95 million people are impacted by suicide annually! And while #WSPD is an important day to highlight, it’s fundamental that we recognize that suicide awareness needs to happen 365 days a year.”

Why are there stigmas surrounding mental health and suicide?

“There are several reasons why stigmas surrounding mental health and suicide exist. Generally, it’s due to a lack of understanding and people making assumptions – such as those with a mental health illness could be dangerous, unreliable or unemployable. Cultural backgrounds also play a part in creating stigma – certain cultures see mental illness and suicide as a taboo subject. The language used around mental health and suicide can also create stigma. In the UK, the act of attempting suicide was decriminalized in 1961 and yet the term ‘committed suicide’ is still frequently used, in the same way as commit murder or commit assault.”

How can we open-up a conversation and support someone who might be struggling with their mental health?

“It’s important to ask people how they are with a genuine intent to listen to and understand their reply. Most people who are struggling with their mental health don’t necessarily want you to fix them, but they do want to feel that they’re being listened to. Ask open-ended questions, such as ‘tell me how are you really feeling?’, ‘explain to me how this is impacting on you?’, ‘describe to me, how this is making you feel?”

How can we create hope through action – as family members, friends, and colleagues?

“We need to become a kinder and more compassionate society by recognizing that everyone can, at some point in their lives, struggle with poor mental health. Understanding this, would hopefully cause people to be less frustrated with others who don’t behave as they expect they might. We also need to check-in with family members, friends and colleagues more frequently and ask them ‘how are you really doing?”

How can we look after our own well-being?

“I am one of those individuals who probably works too hard and for too long! However, road cycling is a big escape for me and getting out in the fresh air in the countryside is a huge help. As is my part-time hobby of playing the drums – you can lose a lot of pent-up stress whilst playing along to Nirvana!! It’s so important that you make sure to look after yourself. So, my advice is to find out what works for you – whether that’s going for a walk, talking to a friend, speaking to a counsellor, joining a local group or seeing what resources are available to you through your company’s EAP. And remember most importantly to be kind to yourself.”

If you or someone you know is struggling, please call or text 988 to get support. And remember, you are not alone.

Together we can prevent suicide 💛

The post #WSPD Creating hope through action with The Jordan Legacy appeared first on McAfee Blog.

Rockstar Games Confirms Hacker Stole Early Grand Theft Auto VI Footage

By Ravie Lakshmanan
American video game publisher Rockstar Games on Monday revealed it was a victim of a "network intrusion" that allowed an unauthorized party to illegally download early footage for the Grand Theft Auto VI. "At this time, we do not anticipate any disruption to our live game services nor any long-term effect on the development of our ongoing projects," the company said in a notice shared on its
  • September 19th 2022 at 17:33

Grand Theft Auto 6 maker confirms source code, vids stolen in cyber-heist

So is that three or four stars?

Take-Two Interactive confirmed on Monday that its Rockstar Games subsidiary has been compromised and confidential data for Grand Theft Auto 6 has been stolen.…

  • September 19th 2022 at 17:12

5 Ways to Improve Fraud Detection and User Experience

By Joshua Goldfarb, Fraud Solutions Architect - EMEA and APCJ, F5
If we know a user is legitimate, then why would we want to make their user experience more challenging?

  • September 19th 2022 at 16:59

TPx Introduces Penetration Scanning, Expands Security Advisory Services

TPx, a leading nationwide managed services provider (MSP) delivering cybersecurity, managed networks, and cloud communications, today announced the addition of penetration scanning to its Security Advisory Services portfolio.
  • September 19th 2022 at 16:58

ICANN’s Accountability and Transparency – a Retrospective on the IANA Transition

By Keith Drazek
Verisign Logo

As we passed five years since the Internet Assigned Numbers Authority transition took place, my co-authors and I paused to look back on this pivotal moment; to take stock of what we’ve learned and to re-examine some of the key events leading up to the transition and how careful planning ensured a successful transfer of IANA responsibilities from the United States Government to the Internet Corporation for Assigned Names and Numbers. I’ve excerpted the main themes from our work, which can be found in full on the Internet Governance Project blog.

In March 2014, the National Telecommunications and Information Administration, a division of the U.S. Department of Commerce, announced its intent to “transition key Internet domain name functions to the global multi-stakeholder community” and asked ICANN to “convene global stakeholders to develop a proposal to transition the current role played by NTIA in the coordination of the Internet’s domain name system.” This transition, as announced by NTIA, was a natural progression of ICANN’s multi-stakeholder evolution, and an outcome that was envisioned by its founders.

While there was general support for a transition to the global multi-stakeholder community, many in the ICANN community raised concerns about ICANN’s accountability, transparency and organizational readiness to “stand alone” without NTIA’s legacy supervision. In response, the ICANN community began a phase of intense engagement to ensure a successful transition with all necessary accountability and transparency structures and mechanisms in place.

As a result of this meticulous planning, we believe the IANA functions have been well-served by the transition and the new accountability structures designed and developed by the ICANN community to ensure the security, stability and resiliency of the internet’s unique identifiers.

But what does the future hold? While ICANN’s multi-stakeholder processes and accountability structures are functioning, even in the face of a global pandemic that interrupted our ability to gather and engage in person, they will require ongoing care to ensure they deliver on the original vision of private-sector-led management of the DNS.

The post ICANN’s Accountability and Transparency – a Retrospective on the IANA Transition appeared first on Verisign Blog.

Cyberattack Costs for US Businesses up by 80%

By Marc Wilczek, Digital Strategist & COO, Link11
Cyberattacks keep inflicting more expensive damage, but firms are responding decisively to the challenge.

  • September 19th 2022 at 14:00

GPT-3 'prompt injection' attack causes bad bot manners

Also, EA goes kernel-deep to stop cheaters, PuTTY gets hijacked by North Korea, and more.

In Brief OpenAI's popular natural language model GPT-3 has a problem: It can be tricked into behaving badly by doing little more than telling it to ignore its previous orders.…

  • September 19th 2022 at 13:37

Emotet Botnet Started Distributing Quantum and BlackCat Ransomware

By Ravie Lakshmanan
The Emotet malware is now being leveraged by ransomware-as-a-service (RaaS) groups, including Quantum and BlackCat, after Conti's official retirement from the threat landscape this year. Emotet started off as a banking trojan in 2014, but updates added to it over time have transformed the malware into a highly potent threat that's capable of downloading other payloads onto the victim's machine,
  • September 19th 2022 at 12:42

Microsoft Teams' GIFShell Attack: What Is It and How You Can Protect Yourself from It

By The Hacker News
Organizations and security teams work to protect themselves from any vulnerability, and often don't realize that risk is also brought on by configurations in their SaaS apps that have not been hardened. The newly published GIFShell attack method, which occurs through Microsoft Teams, is a perfect example of how threat actors can exploit legitimate features and configurations that haven't been
  • September 19th 2022 at 12:00

The Deep Roots of Nigeria’s Cybersecurity Problem

By Olatunji Olaigbe
Despite having one of the strongest data-protection policies in Africa, the country’s enforcement and disclosure practices remain dangerously broken.

Can your iPhone be hacked? What to know about iOS security

By André Lameiras

Here are some of the most common ways that an iPhone can be compromised with malware, how to tell it’s happened to you, and how to remove a hacker from your device

The post Can your iPhone be hacked? What to know about iOS security appeared first on WeLiveSecurity

Deadly Digital Dares: The Blackout Challenge on TikTok

By Toni Birdsong

The social network TikTok is chockfull of interesting, fun, laugh-out-loud videos shared by creators worldwide. Kids, as well as parents, can easily spend hours glued to the platform. But as with most popular platforms, the fun can eventually turn dark, even deadly, when viral challenges make their rounds.  

The latest viral challenge, the “blackout challenge,” first became popular online in 2008 and made its unfortunate comeback in 2021. Before this second round, the CDC attributed nearly 80 deaths to the dangerous online game. In the past month, authorities are attributing the tragic, high-profile deaths of Archie Battersbee, 12, and Leon Brown, 14 to the challenge. 

What is it? 

The blackout challenge is a choking game that involves intentionally trying to choke oneself or another to obtain a brief euphoric state or “high.” Death or serious injury can result if strangulation is prolonged. Those doing the challenge do it privately or broadcast their attempt to friends or followers. The CDC also found that most deaths occurred when a child engaged in the choking game alone and that most parents were unaware of the game before their child’s death.

What’s the appeal? 

It’s easy to look at a challenge like this and dismiss it thinking your child would never be involved in such a dangerous game. However, in a recent post from HealthyChildren.org on why kids participate in online dares, pediatricians point to the reality that the teen brain is still developing. The part of the brain that processes rational thought, the prefrontal cortex, is not fully developed until a person’s mid-20s. This physiological reality means teens are naturally impulsive and can do things without stopping to consider the consequences.  

Another lure that entices teens is that social media’s fast-moving, impulsive environment rewards outrageous behavior—the more outrageous the content, the bigger the bragging rights. The fear of losing out (FOMO is natural for teens. 

Signs to look for 

According to the CDC, signs that a child may be engaging in the blackout challenge include: 

  • They may talk about the game or use alternate terms such as “pass–out
    game” “choking game,” or “space monkey.” 
  • They may have bloodshot eyes 
  • You may see marks on their neck 
  • They might have severe headaches 
  • They could show signs of disorientation after spending time alone 
  • You might notice the presence of ropes, scarves, or belts tied to furniture or doorknobs 
  • They may have unexplained items like dog leashes, choke collars, or bungee cords in their room. 

5 talking points for families

  1. Dig in and discuss hard stuff. Set time aside to talk about the viral challenges your child may or may not notice online. Discuss the dangers, the physiology of being impulsive, and how social network communities inherently reward reckless behavior with likes and shares.  
  2. Make the consequences personal. Do your homework. Pull up the relevant headlines and discuss the implications of the blackout challenge (and others), such as lack of oxygen to the brain, seizures, long-term complications, and death.  
  3. Talk about digital peer pressure. Coach your kids through the dangers they encounter online they may take for granted. Ask them how they feel when they see someone doing dangerous things online and ways to avoid or discourage it. Are your kids rallying around the challenges or sharing the content? Do they try to be funny to get attention online?  
  4. Establish ground rules. As tragic as these challenges are, they allow parents to pause and refresh family ground rules for online behavior and media use. Your kids have changed over time, as have their online communities, and interests. Design ground rules and media use expectations to help shape a safe, balanced digital life that reflects their current online activity. 
  5. Add extra protection. We add security systems to our homes for additional protection from outside threats, so too, it’s wise to add security to our family devices to encourage content filtering, monitoring, and time limits.  

Viral challenges will continue to emerge and shock us. There’s no way to anticipate them or control them. However, staying informed about dangerous online trends and keeping the lines of communication with your child open and honest is a big step toward equipping them to live a safe, balanced digital life.  

The post Deadly Digital Dares: The Blackout Challenge on TikTok appeared first on McAfee Blog.

Rising to the challenges of secure coding – Week in security with Tony Anscombe

By Editor

The news seems awash this week with reports of both Microsoft and Apple scrambling to patch security flaws in their products

The post Rising to the challenges of secure coding – Week in security with Tony Anscombe appeared first on WeLiveSecurity

  • September 16th 2022 at 14:45

Europol and Bitdefender Release Free Decryptor for LockerGoga Ransomware

By Ravie Lakshmanan
A decryptor for the LockerGoga ransomware has been made available by Romanian cybersecurity firm Bitdefender in collaboration with Europol, the No More Ransom project, and Zurich law enforcement authorities. Identified in January 2019, LockerGoga drew headlines for its attacks against the Norwegian aluminum giant Norsk Hydro. It's said to have infected more than 1,800 victims in 71 countries,
  • September 19th 2022 at 09:45

Microsoft Warns of Large-Scale Click Fraud Campaign Targeting Gamers

By Ravie Lakshmanan
Microsoft said it's tracking an ongoing large-scale click fraud campaign targeting gamers by means of stealthily deployed browser extensions on compromised systems. "[The] attackers monetize clicks generated by a browser node-webkit or malicious browser extension secretly installed on devices," Microsoft Security Intelligence said in a sequence of tweets over the weekend. The tech giant's
  • September 19th 2022 at 08:50

Indonesia accuses Google of abusing monopoly

PLUS: Qualys CEO says APAC has infosec advantages; Singapore's Sea ebbs in Americas; Toshiba's tepid takeover update; and more

Asia In Brief Indonesia's competition regulator, the Komisi Pengawas Persaingan Usaha (KPPU) has alleged that Google has violated local anti-monopoly laws by abusing its dominant position for the distribution of apps and its requirement that developers must use its payment systems.…

  • September 19th 2022 at 00:58

How to Use DuckDuckGo’s Privacy-First Email Service

By David Nield
Tired of advertisers spying on your private communications? This beta promises to kick tracking technology to the curb.

The Queen’s Funeral Sets Off the Biggest UK Police Operation Ever

By Matt Burgess
Snipers on buildings. Drone no-fly zones. Temporary CCTV. The security plan is even more complex than it was for the London 2012 Olympics.

S3 Ep100.5: Uber breach – an expert speaks [Audio + Text]

By Paul Ducklin
Chester Wisniewski on what we can learn from Uber: "Just because a big company didn't have the security they should doesn't mean you can't."

US Border Agents May Have a Copy of Your Text Messages

By Andrew Couts
Plus: An AI artist exposes surveillance of Instagram users, the US charges Iranians over a ransomware campaign, and more.

Uber Claims No Sensitive Data Exposed in Latest Breach… But There's More to This

By Ravie Lakshmanan
Uber, in an update, said there is "no evidence" that users' private information was compromised in a breach of its internal computer systems that was discovered late Thursday. "We have no evidence that the incident involved access to sensitive user data (like trip history)," the company said. "All of our services including Uber, Uber Eats, Uber Freight, and the Uber Driver app are operational."
  • September 17th 2022 at 08:53

Can reflections in eyeglasses actually leak info from Zoom calls? Here's a study into it

About time someone shone some light onto this

Boffins at the University of Michigan in the US and Zhejiang University in China want to highlight how bespectacled video conferencing participants are inadvertently revealing sensitive on-screen information via reflections in their eyeglasses.…

  • September 17th 2022 at 07:32

Hackers Had Access to LastPass's Development Systems for Four Days

By Ravie Lakshmanan
Password management solution LastPass shared more details pertaining to the security incident last month, disclosing that the threat actor had access to its systems for a four-day period in August 2022. "There is no evidence of any threat actor activity beyond the established timeline," LastPass CEO Karim Toubba said in an update shared on September 15, adding, "there is no evidence that this
  • September 17th 2022 at 02:47

School chat app Seesaw abused to send 'inappropriate image' to parents, teachers

This is why we don't reuse passwords, kids

Parents and teachers received a link to an "inappropriate image" this week via Seesaw after miscreants hijacked accounts in a credential stuffing attack against the popular school messaging app.…

  • September 16th 2022 at 21:45

The Uber Hack’s Devastation Is Just Starting to Reveal Itself

By Lily Hay Newman
An alleged teen hacker claims to have gained deep access to the company’s systems, but the full picture of the breach is still coming into focus.

Attacker Apparently Didn't Have to Breach a Single System to Pwn Uber

By Jai Vijayan, Contributing Writer, Dark Reading
Alleged teen hacker claims he found an admin password in a network share inside Uber that allowed complete access to ride-sharing giant's AWS, Windows, Google Cloud, VMware, and other environments.

  • September 16th 2022 at 20:37

Tackling Financial Fraud With Machine Learning

By Tatiana Walk-Morris, Contributing Writer
Financial services firms need to learn how — and when — to put machine learning to use.

  • September 16th 2022 at 20:00

UBER HAS BEEN HACKED, boasts hacker – how to stop it happening to you

By Paul Ducklin
Uber is all over the news for a widely-publicised data breach. We help you answer the question, "How do I stop this happening to me?"

Real Estate Phish Swallows 1,000s of Microsoft 365 Credentials

By Tara Seals, Managing Editor, News, Dark Reading
The attacks showcase broader security concerns as phishing grows in volume and sophistication, especially given that Windows Defender's Safe Links feature for identifying malicious links in emails completely failed in the campaign.

  • September 16th 2022 at 18:30

Keep Today's Encrypted Data From Becoming Tomorrow's Treasure

By Vikram Sharma, CEO & Founder, QuintessenceLabs
Building quantum resilience requires C-suite commitment, but it doesn't have to mean tearing out existing infrastructure.

  • September 16th 2022 at 18:00

Botched Crypto Mugging Lands Three U.K. Men in Jail

By BrianKrebs

Three men in the United Kingdom were arrested this month for attempting to assault a local man and steal his virtual currencies. The incident is the latest example of how certain cybercriminal communities are increasingly turning to physical violence to settle scores and disputes.

Shortly after 11 p.m. on September 6, a resident in the Spalding Common area in the district of Lincolnshire, U.K. phoned police to say three men were acting suspiciously, and had jumped a nearby fence.

“The three men made off in a VW Golf and were shortly stopped nearby,” reads a statement by the Lincolnshire Police. “The car was searched by officers who found an imitation firearm, taser, a baseball bat and police uniform in the boot.”

Thomas Green, 23, Rayhan Miah, 23, and Leonardo Sapiano, 24 were all charged with possession of the weapons, and “with intent to cause loss to another to make an unwarranted demand of Crypto Currency from a person.”

KrebsOnSecurity has learned that the defendants were in Spalding Common to pay a surprise visit to a 19-year-old hacker known by the handles “Discoli,” “Disco Dog,” and “Chinese.” In December 2020, Discoli took credit for hacking and leaking the user database for OGUsers, a forum overrun with people looking to buy, sell and trade access to compromised social media accounts.

Reached via Telegram, Discoli confirmed that police believe the trio was trying to force their way into his home in Spalding Common, and that one of them was wearing a police uniform when they approached his residence.

“They were obvious about being fake police, so much so that one of our neighbours called,” Discoli said in an instant message chat. “That call led to the arrests. Their intent was for robbery/blackmail of crypto, I just happened to not be home at the time.”

The Lincolnshire Police declined to comment for this story, citing an ongoing investigation.

Discoli said he didn’t know any of the men charged, but believes they were hired by one of his enemies. And he said his would-be assailants didn’t just target him specifically.

“They had a list of people they wanted to hit consecutively as far as I know,” he said.

The foiled robbery is the latest drama tied to members of certain criminal hacking communities who are targeting one another with physical violence, by making a standing offer to pay thousands of dollars to anyone in the target’s region who agrees to carry out the assaults.

Last month, a 21-year-old New Jersey man was arrested and charged with stalking in connection with a federal investigation into groups of cybercriminals who are settling scores by hiring people to carry out physical attacks on their rivals.

Prosecutors say Patrick McGovern-Allen recently participated in several of these schemes — including firing a handgun into a Pennsylvania home and torching a residence in another part of the state with a Molotov Cocktail.

McGovern-Allen and the three U.K. defendants are part of an online community that is at the forefront of a dangerous escalation in coercion and intimidation tactics increasingly used by competing cybercriminal groups to steal cryptocurrency from one another and to keep their rivals in check.

The Telegram chat channels where these young men transact have hundreds to thousands of members each, and some of the more interesting solicitations on these communities are job offers for in-person assignments and tasks that can be found if one searches for posts titled, “If you live near,” or “IRL job” — short for “in real life” job.

A number of these classified ads are in service of performing “brickings,” where someone is hired to visit a specific address and toss a brick through the target’s window. Indeed, prior to McGovern-Allen’s arrest, his alleged Telegram persona bragged that he’d carried out several brickings for hire.

Many of the individuals involved in paying others to commit these physical attacks are also frequent participants in Telegram chat channels focused singularly on SIM swapping, a crime in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s various online accounts and identities.

Unsurprisingly, the vast majority of people currently being targeted for brickings and other real-life physical assaults via Telegram tend to be other cybercriminals involved in SIM swapping crimes (or individuals on the periphery of that scene).

The United Kingdom is home to a number of young men accused of stealing millions of dollars worth of cryptocurrencies via SIM swapping. Joseph James O’Connor, a.k.a. “Plugwalk Joe”, was arrested in Spain in July 2021 under an FBI warrant on 10 counts of offenses related to unauthorized computer access and cyber bullying. U.S. investigators say O’Connor also played a central role in the 2020 intrusion at Twitter, wherein Twitter accounts for top celebrities and public figures were forced to tweet out links to cryptocurrency scams. O’Connor is currently fighting extradition to the United States.

Robert Lewis Barr, a 25-year-old Scottish man who allegedly stole more than $8 million worth of crypto, was arrested on an FBI warrant last year and is also fighting his extradition. U.S. investigators say Barr SIM swapped a U.S. bitcoin broker in 2017, and that he spent much of the stolen funds throwing lavish parties at rented luxury apartments in central Glasgow.

In many ways, these violence-as-a-service incidents are a natural extension of “swatting,” wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address. According to prosecutors, both Barr and O’Connor have a history of swatting their enemies and their SIM swapping victims.

DDoS Attack Against Eastern Europe Target Sets New Record

By Dark Reading Staff, Dark Reading
The target has been under relentless DDoS attack, which ultimately set a new packets-per-second record for Europe.

  • September 16th 2022 at 17:24

Hacker Pwns Uber Via Compromised VPN Account

By Tara Seals, Managing Editor, News, Dark Reading
A teen hacker reportedly social-engineered an Uber employee to hand over an MFA code to unlock the corporate VPN, before burrowing deep into Uber's cloud and code repositories.

  • September 16th 2022 at 14:21

Highlights of the 2022 Pwnie Awards

By Karen Spiegelman, Features Editor
Since 2007, the Pwnies have celebrated the good, the bad, and the wacky in cybersecurity. Enjoy some of the best moments of this year's ceremony.

  • September 16th 2022 at 14:08

Business Application Compromise & the Evolving Art of Social Engineering

By Jonathan Hencinski, Vice President of Security Operations, Expel
Be wary of being pestered into making a bad decision. As digital applications proliferate, educating users against social engineering attempts is a key part of a strong defense.

  • September 16th 2022 at 14:00

Turbo boost your career in cyber security

Access free SANS course demos to find out just how much you can learn

Sponsored Post Few segments of the IT industry change as quickly, or as often, as cyber security. But the perpetual, fast evolving battle to outwit the hackers presents a real challenge for security professionals tasked with protecting mission critical data, applications and services from disruption and theft.…

  • September 16th 2022 at 09:30

Researchers Find Link b/w PrivateLoader and Ruzki Pay-Per-Install Services

By Ravie Lakshmanan
Cybersecurity researchers have exposed new connections between a widely used pay-per-install (PPI) malware service known as PrivateLoader and another PPI platform offered by a cybercriminal actor dubbed ruzki. "The threat actor ruzki (aka les0k, zhigalsz) advertises their PPI service on underground Russian-speaking forums and their Telegram channels under the name ruzki or zhigalsz since at
  • September 16th 2022 at 14:17

North Korean Hackers Spreading Trojanized Versions of PuTTY Client Application

By Ravie Lakshmanan
A threat with a North Korea nexus has been found leveraging a "novel spear phish methodology" that involves making use of trojanized versions of the PuTTY SSH and Telnet client. Google-owned threat intelligence firm Mandiant attributed the new campaign to an emerging threat cluster it tracks under the name UNC4034. "UNC4034 established communication with the victim over WhatsApp and lured them
  • September 16th 2022 at 13:47
❌