Last November, the UK’s Security Service alerted members of Parliament about a foreign intelligence-gathering scheme: two LinkedIn profiles were contacting people working in British politics to request “insider information.” The MI5 revelations triggered a £170 million ($230 million) government initiative to address espionage threats against Parliament. While this is a high-profile case, ESET, a leading company in proactive threat detection, states that it is far from the first or only one. The site could also be a veritable treasure trove of corporate data that could be maliciously used to support fraud or threat campaigns.

Therefore, it is important to learn from this analysis and valuable professional opinion provided by ESET.

LinkedIn has amassed over one billion members worldwide since its founding in 2003. This represents a vast pool of potential targets for state-backed or financially motivated threat actors. Firstly, it is an extraordinary source of information where malicious actors can discover the roles and responsibilities of key individuals within a target company and reconstruct or reshape the relationships between individuals and projects they might be working on. Furthermore, it provides credibility and cover because, as a professional network, it is frequented by both high-level executives and lower-level employees, and it is a context in which a victim is more likely to open a direct message or InMail from someone on the platform than an unsolicited email.

On the other hand, it bypasses “traditional” security because there is no guarantee that phishing messages, malware, or spam won’t get through; and due to the site’s perceived credibility, target users may be more likely to click on malicious content. Finally, it’s easy to start operating; anyone can create a profile and begin lurking on the site to gather intelligence or send phishing messages and Business Enforcement (BEC) scams. Furthermore, attackers can hijack existing accounts or create fake identities before posing as candidates and recruiters for positions and jobs. The large number of compromised credentials circulating on cybercrime forums (due in part to infostealers) makes this relatively easy.

There are several ways threat actors can operationalize their malicious campaigns:

• Phishing and spearphishing: By using the information users share in their profiles, attackers can customize phishing campaigns (fake emails) to increase their success rate.
• Direct attacks: Contact can be made directly through malicious links designed to deploy malware, such as infostealers, or promote fake job offers intended to steal credentials.
• BEC: Similar to phishing, LinkedIn provides a wealth of intelligence that can be used to make Business Email Compromise attacks appear more convincing. It can help scammers identify who reports to whom, what projects they are working on, and the names of partners or suppliers.
• Deepfakes: LinkedIn can also host videos of targeted individuals, which can be used to create deepfakes and employ them in subsequent phishing, BEC, or social media scams.
• Account hijacking: Fake LinkedIn pages (phishing), infostealers, credential stuffing, and other techniques can help attackers take control of user accounts. These hijacked accounts can then be used in subsequent attacks targeting their contacts.
• Attacks on suppliers: LinkedIn can also be tracked for information about partners of a target company, who would also be targeted with phishing as part of a malicious “domino effect” strategy.

“The challenge posed by threats on LinkedIn is that IT departments find it difficult to obtain accurate information about the extent of the risk their employees face, and the tactics used to attack them. However, it makes sense to include LinkedIn threat scenarios like those described above in security awareness training courses. Employees should also be warned about the risk of oversharing information on the platform and given guidance on how to detect fake accounts and typical phishing lures,” says Mario Micucci, Cybersecurity Researcher at ESET Latin America.

ESET provides information on various threat groups that have used some of these tactics

• The Lazarus Group (North Korea) has posed as recruiters on LinkedIn to install malware on the computers of people working at an aerospace company, according to ESET Research. In fact, the research team also recently described the “Wagemole” campaigns, in which individuals aligned with North Korea attempt to obtain employment at foreign companies.
• ScatteredSpider contacted MGM’s help desk, impersonating an employee whose identity they obtained from LinkedIn, in order to gain access to the organization. The subsequent ransomware attack resulted in losses of $100 million.
• A spearphishing campaign called “Ducktail” targeted marketing and human resources professionals on LinkedIn, delivering malware and stealing information through links sent via direct message. The malware was hosted in the cloud.

Prevention

“To prevent account hijacking, a policy of regularly updating patches should be followed, security software should be installed on all devices (from a trusted vendor), and multifactor authentication should be enabled. Additionally, in corporate environments, it may be worthwhile to organize specific training sessions for executives, who are often the most frequent targets of attacks. Above all, ensure that the team is aware that, even on a network considered trustworthy like LinkedIn, not everyone acts in good faith or in their best interest,” recommends the ESET researcher.

ESET invites you to learn more about cybersecurity by visiting:  https://www.welivesecurity.com/es/.

For other useful preventative information, also available in Venezuela at: https://www.eset.com/ve/, and on their social media channels @eset_ve. Also on Instagram (@esetla)  and Facebook (ESET).

Information and image provided by ESET

Follow our news on Google! For current, interesting, and accurate information, click here to see all the content on Bitfinance.news. You can also find us on X/Twitter and Instagram

La entrada Malicious actors hunt and manipulate on the important LinkedIn network; we must protect ourselves apareció primero en Bitfinance.

Apple’s control over its ecosystem of devices and apps has historically been strict. Additionally, several built-in security features, such as strong encryption and containerization, help prevent data leakage and limit the spread of malware. However, in addition to all this, ESET, a leading company in proactive threat detection, warns in this extensive analysis that risks are not completely eliminated, as everyday scams and other threats also bombard iOS users… and while some are more common than others, they all demand attention.

“The fact that iOS apps typically originate from Apple’s official App Store and must pass strict testing for approval has avoided security and privacy headaches over the years. However, the recent EU antitrust law, known as the Digital Markets Act (DMA), seeks to give iOS users the option of using third-party app marketplaces. This will present new challenges for Apple in protecting iOS users from potential harm and for those who use its products, as they will need to be more aware of threats. This change in the rules of the game will undoubtedly be exploited by cybercrime,” comments Camilo Gutiérrez Amaya, Head of the ESET Latin America IT Security Lab.

ESET has also studied and offers its opinion on other, possibly more immediate, threats targeting iOS users worldwide:

Jailbroken devices: Deliberately jailbreaking a device to allow what Apple calls “unauthorized modifications” could violate the Software License Agreement and disable some built-in security features, such as Secure Boot and Data Execution Prevention. The device will no longer receive automatic updates. And being able to download apps from outside the App Store exposes you to malicious and/or buggy software.

Malicious apps: While Apple does a good job of vetting apps, it isn’t 100 % accurate. Malicious apps recently detected on the App Store include: A fake version of the LastPass password manager designed to harvest credentials; a screenshot-reading malware dubbed “SparkCat,” disguised as artificial intelligence and food delivery apps; as well as a fake crypto wallet app called “Rabby Wallet & Crypto Solution.”

Downloading apps from websites: As detailed in the latest ESET Threat Report, progressive web apps (PWAs) allow direct installation without requiring users to grant explicit permissions, meaning downloads could go unnoticed. ESET discovered this technique used to disguise banking malware as legitimate mobile banking apps.

Phishing/Social Engineering: Phishing attacks via email, text (or iMessage), and even voice are common. They impersonate legitimate brands and trick users into providing their credentials, clicking on malicious links, or opening attachments to trigger malware downloads. Apple IDs are among the most valuable logins, as they can provide access to all data stored in an iCloud account and/or allow attackers to make iTunes/App Store purchases. ESET advises caution with:

• Fake pop-ups claiming the device has a security issue
• Fraudulent phone calls and FaceTime calls impersonating Apple Support or partner organizations
• Fake promotions offering freebies and sweepstakes
• Calendar invitation spam with phishing links

As an example, in a highly sophisticated campaign, threat actors and attack planners used social engineering techniques to trick users into downloading a mobile device management (MDM) profile that would allow them to control the victims’ devices. They then deployed the GoldPickaxe malware, designed to collect facial biometric data and use it to bypass banking logins.

Risks of public Wi-Fi networks: A public Wi-Fi hotspot can be a fake access point created by threat actors to monitor web traffic and steal sensitive information, such as banking passwords. Even if the access point is legitimate, many don’t encrypt data in transit, meaning hackers with the right tools could see the websites you visit and the credentials you enter. That’s why ESET recommends using a VPN, which creates an encrypted tunnel between your device and the internet.

Vulnerabilities: While Apple puts a lot of time and effort into ensuring its code is free of vulnerabilities, sometimes flaws occur in production. In these cases, hackers can take advantage if users haven’t updated their device, for example by sending malicious links in messages that trigger an exploit if clicked.

• Last year, Apple was forced to patch a vulnerability that could allow attackers to steal information from a locked device using Siri voice commands.
• Sometimes, threat actors and commercial companies themselves research new (zero-day) vulnerabilities to exploit. Although rare and highly targeted, attacks that exploit these vulnerabilities are often used to covertly install spyware to spy on victims’ devices.

Prevention and protection are necessary and wise

While malware lurks on iOS devices, it is also possible to minimize exposure to threats. ESET shares the following key tactics:

• Keep iOS and all apps updated. This will reduce the window of opportunity for threat actors to exploit any vulnerabilities in older versions to achieve their goals.
• Always use strong, unique passwords for all accounts, perhaps using the ESET Password Manager for iOS, and enable multi-factor authentication if offered. This is easy on iPhones, as it will require a simple Face ID scan. This will ensure that even if attackers obtain the passwords, they won’t be able to access the apps without scanning the user’s face.
• Enable Face ID or Touch ID to access the device, backed up with a strong password. This will keep the iPhone secure in case of loss or theft.
• Do not jailbreak the device, for the reasons mentioned above. Your iPhone would be less secure.
• Be wary of phishing. This means treating unsolicited calls, texts, emails, and social media messages with extreme caution. Do not click on links or open attachments. If you really need to do so, verify separately with the sender that the message is legitimate (i.e., not responding to the information contained in the message). Look for signs of social engineering, such as grammatical and spelling errors, an urgency to act, gifts and offers that are too good to be true, or domains (from the sender) that don’t match the supposed sender.
• Avoid public Wi-Fi networks. If you must use them, do so with a VPN. At the very least, don’t log into any valuable accounts or enter sensitive information on public Wi-Fi.
• Try to limit any downloads to the App Store to minimize the risk of downloading something malicious or risky.
• If you think you might be a target of spyware (often used against journalists, activists, and dissidents), activate blocking mode.
• Pay attention to the telltale signs of a malware infection, which could include slow performance, unwanted ad pop-ups, an overheating device, new apps appearing on the home screen, or increased data usage.

“While the Apple iPhone remains one of the most secure devices available, this doesn’t mean it’s free from threats. Staying alert, knowing the potential risks, and taking the necessary protective measures help keep your information and devices safe,” concludes Gutiérrez Amaya of ESET Latin America.

For more preventive information on cybersecurity, you can visit the ESET website: https://www.eset.com/ve/ and its social media channels @eset_ve. Also visit Instagram (@esetla) and Facebook (ESET). Or visit https://www.eset.com/latam.

With information and reference image provided by ESET and Comstat Rowland.

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on X/Twitter and Instagram

La entrada How secure is your iPhone?: ESET analyzes, explains, and makes recommendations apareció primero en Bitfinance.

In the field of cybersecurity, threat actors have flourished amidst economic and geopolitical uncertainty, deploying cunning and tools to circumvent corporate defenses. According to Verizon’s Data Breach Investigations Report (DBIR), 83% of leaks are the work of external agents, while economic profit is responsible for 95%. ESET, a leader in proactive threat detection, details the top 10 incidents of 2023.

1. MOVEit: Zero-Day Vulnerability Exposes More than 2,600 Organizations

The modus operandi of this attack was to exploit a zero-day vulnerability in popular software, compromising data on more than 83 million people. The magnitude of the impact was compounded by affecting suppliers and service providers in the affected organizations.

2. UK Election Commission: Cybercriminals Expose Data on 40 Million Voters

In August, a complex cyberattack revealed the personal information of 40 million voters. The weak security of the Electoral Commission, coupled with the late notification to the public, raises questions about the effectiveness of its security measures.

3. Police Service of Northern Ireland: Sensitive Data Leak Raises Concern

The accidental posting of sensitive internal data on a public website exposed the information of 10,000 officers and civilian personnel. Although he was available for a short time, he caused concern and led to arrests for terrorist offences.

4. DarkBeam: Biggest Data Leak of the Year with 3.800 Million Records Exposes Vulnerabilities

The DarkBeam digital risk platform disfigured a data visualization interface, exposing 3.8 billion records. Although quickly corrected, uncertainty persists as to whether the data was accessed maliciously.

5. Indian Council for Medical Research (ICMR): Mega Breach Exposes Information of 815 Million Residents

Data extracted from the ICMR’s COVID test base, including crucial information such as names, addresses and Aadhaar numbers, were put up for sale. The seriousness of the incident opens the door to possible identity fraud attacks.

6. 23andMe: Threat Actor Steals Up to 20 Million Genetic Data

Using credential filling techniques, 23andMe user data, including genetic information and family data, was accessed. The incident highlights the importance of maintaining vigilance in the configuration of systems.

7. Rapid Recovery DDoS Attacks: Vulnerability in HTTP/2 Causes Mass Attacks

A zero-day vulnerability in the HTTP/2 protocol allowed unprecedented DDoS attacks, reaching 398 million requests per second. Although Internet giants have patched the bug, other companies are urged to follow suit.

8. T-Mobile: Security Breaches Impact 37 Million Customers

In January, T-Mobile suffered one of the biggest breaches, affecting 37 million customers with sensitive data theft. Despite subsequent action, the company revealed another breach in April, raising concerns about the security of its systems.

9. MGM International/Cesars: Ransomware Attacks Paralyze Operations in Las Vegas

Both Las Vegas giants were attacked with ransomware, causing significant disruptions and substantial economic costs. Infiltration methods, such as the use of LinkedIn, highlight the urgent need for more robust security measures.

10. Pentagon Leaks: Young National Guard Member Leaks Sensitive Military Documents

Young Jack Teixeira leaked sensitive military documents, providing military intelligence to Russia. This incident underscores the importance of safeguarding information in large organizations from malicious intruders.

K. Tovar

Source: Descifrado

(Reference image source: Unsplash+)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada These were the most important threats of 2023 apareció primero en Bitfinance.

Android seeks to prevent cyberattacks on its users. In this sense, it is testing a function that analyzes smartphone applications in search of threats, particularly phishing attacks.

This type of cyberattack is based on the use of the “social engineering” technique to impersonate the identity of a company, website or public body and, thus, trick the user into obtaining personal information or confidential data.

Usually, these attacks are spread through the sending of fake emails, since they impersonate the legitimate entity. But cybercriminals also use social networks or fake applications to steal user data, credit cards, among others.

The new Android feature that allows you to analyze applications and detect potential threats can be found as “search for misleading applications and has been detected by Android Police after analyzing the second beta version of Android 14 QPR2. Thus, this feature is found as an option within the device settings, in the Security and privacy section and, later, in the More security and privacy tab.

The feature will scan the applications in a private process. In case of a detected threat, the user is notified, in addition to sending a notification to Google Play Protect. In order to warn other users about the potential threat and prevent them from downloading the application.

Through the source code of this beta version of Android 14, a new system called ContentProtection has also been identified, to “detect the moment in which an application tries to show a password or asks the user for information related to their name, email or phone number.”

M.Pino

Source: news.euro

(Reference image source: Denny Müller, Unsplash)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Android tests feature that identifies phishing attacks apareció primero en Bitfinance.

Thousands of migrants without money, or people who lost their jobs due to the Covid-19 pandemic in Southeast Asia, are victims of forced recruitment by cybercriminal mafias under threats.

According to a report by the UN Human Rights Office, thousands of people are recruited by online criminal gangs who, taking advantage of their need for money, threaten families and drag them into perpetuating cybercrime.

It has been estimated, according to a reliable source, about 120,000 people in this situation in Burma, as well as about 100,000 in Cambodia. More cases are not ruled out in Laos, the Philippines and Thailand.

Migrants who do not have money for their subsistence and to attend to the needs of their families are the ones who are normally captured by these mafias and forced, under threats and inhumane treatment, to commit crimes on the Internet, particularly in illegal games, cryptocurrencies scams, fraudulent dating apps, among others.

In this sense, the UN High Commissioner, Volker Turk, considers that these people are victims, not criminals. He pleads for them to be treated that way, given that they are coerced into carrying out these jobs.

The mafias take great advantage of the people they hire by force, since they usually have a university education, speak other languages ​​or have knowledge of the Internet.

Beyond the policies of Southeast Asian countries to combat cybercrime, there are always vulnerabilities and sometimes international standards are not met. Therefore, the victims of this type of abuse can go unnoticed, in addition to being the ones who are normally arrested for online crimes.

M.Pino

With information from international media and agencies

(Reference image source: Unsplash, in collaboration with Getty Images)

Visit our news channel on Google News and follow us to get accurate, interesting information and stay up to date with everything. You can also see our daily content on Twitter and Instagram

La entrada Cybercrime mafias capture innocent people in Southeast Asia apareció primero en Bitfinance.

MaliBot was discovered last June, a banking malware that has become one of the most terrible threats for Android smartphone users, because it can steal passwords, bank details and even the contents of users’ cryptocurrency wallets.

The malware is capable of accessing text messages, stealing web browser cookies and taking screenshots on infected Android devices. MaliBot is also capable of spreading “through hijacking SMS capabilities to send malicious messages to other users.”

But the trickiest part is that malvare can spread by bypassing all “multi-factor authentication” protections. According to Check Point cyber security researchers it has become the third most frequent malvare for Android users.

Check Point Research Vice President Maya Horowitz noted that “While it’s always good to see law enforcement succeed in taking down cybercrime groups or malware like FluBot, it unfortunately wasn’t long before new mobile malware took its place”.

In addition to MaliBot, the most common Android malware in the month of June is AlienBot, a virus that allows remote attackers to inject malicious code into legitimate financial applications, access sensitive information in accounts and gain control of the device.

The other most prevalent Android malware in June was Anubis, which is a banking Trojan dating back to 2016 and continues to be an active threat.

Protection measures for users

It is very important that users are alert to any strange messages, which is why consumers should be aware of:

• Any text message that asks you to click on a link, as this is one of the most common ways of delivering mobile malware.
• It is important that application downloads are made from trusted sources such as the Google Play Store.
• It is recommended not to install applications from developers that only offer basic information, it could be a sign that the application could be a burning profile to distribute malware.

M. Rodríguez

Click the link to subscribe free to our news and media group on Telegram: https://t.me/G_ELSUMARIO_News

Source: tekcrispy.com 

La entrada MaliBot: the latest malware that threatens Android smartphones apareció primero en Bitfinance.

The leading company in early detection of threats, will be presenting today its ESET Security Days, the eleventh edition dedicated to Venezuela, in order to bring companies closer to the most important cybersecurity challenges and the information necessary to face them, protect them and boost their businesses.

The event will be held virtually, with live transmission, free of charge and open to the entire community and as the only requirement, those interested must pre-register on the website: https://www.esetlive.com/securitydays-venezuela.

In this edition, a series of speakers participate, whit topics related to information security. Among them, Tony Anscombe, Security Evangelist at ESET, stands out. He will talk about “Ransomware: an evolving business model”, where the interest of this type of threat in Latin America will be explored.

Miguel Ángel Mendoza, Security Researcher of the company, and Franco Fabricatore, Product Marketing Analyst, will speak on “How to evolve in cybersecurity in your company”, guiding organizations on the various security strategies and the importance of cyber intelligence and adversary simulation.

For his part, Leandro González, Product Manager of ESET Latin America, will talk about the “New normality, new paradigms: Homeworking and the cloud” and the need to establish security mechanisms in these environments, which are being adopted by companies as a result of the pandemic.

Carlos López Rodríguez, Logintel Support and Training Manager, will close with the presentation “How to design the security strategy in your company?” to highlights the importance of learning from cybercriminals and the need to create a “collaborative ecosystem” to deal with these organized groups.

M. Rodríguez

Source: analitica.com

La entrada Esset Security Days arrives in Venezuela apareció primero en Bitfinance.

Encouraging intelligence plans that allow the prevention of crimes or any type of irregularity in the largest and most prestigious companies, is the objective set out by the expert in the execution of security strategies, Héctor Fuenmayor in his books entitled: “Intelligence in the face of occupational deviations” and “Theft in oil installations.”

Both are publications that portray much of the reality that exists in the business environment in which there are high rates of theft and crime that do not allow the vertiginous growth of large industries, which, on occasions, are discredited due to the lack of of investigation in the parameters of the administrative process, as well as in the coherent follow-up of its preventive and security plans.

Showing a clear, objective and applicable look for business development is the premise of this corporate security professional, an expert in crime control in companies who during the last 20 years has held management positions for important national and international companies, among which stand out: the Scientific and Criminal Investigations (CICPC in Spanish), Petróleos de Venezuela, SA (PDVSA), Grupo Financiero BOD and currently at Proagro where he serves as Vice President of Environment and Corporate Risk.

His experience and concern to organize and work according to the rules imposed in the business environment, have allowed him to create awareness in the high performance management field and therefore he has received important recognitions such as the Mara de Oro in the Best Bank Security Manager category in 2001 and the Mara de Platino for Best Security Manager with international projection in 2021.

Counteract electronic banking fraud

It has also led him to be a reference in recognized Miami magazines such as “Security Sales” in which he made a masterful explanation with his article entitled: “The transactional risk engine that raises how you can build a synergy of teamwork to in order to counteract electronic banking fraud .”

With this, Fuenmayor shows that its academic training inside and outside the country is an endorsement that gives credibility to its knowledge and the implementation of efficient plans that allow it to create an activity free of crime and other incidents that disturb the stability of companies. He even works as teacher in the Postgraduate Course in Criminalistics at the National Experimental Security University (UNES) through which he reinforces and perfects the knowledge acquired by teaching professionals in this area.

This professional has the profile and knowledge to deter, contain, detect, delay and neutralize threats, thus avoiding potential losses. These and other premises are present in its publications that have served as endorsement to reinforce security measures and take the necessary precautions. More in these times, in which the digitization of personal and professional life has become one of the most current and susceptible risks that are being generated in the industrial sector.

This new scenario is also set out in this material, which was coordinated by Roger Michelena editorial and is available in international markets through the Amazon platform. They provide a detailed explanation of how the incursion of organized crime can be reduced or prevented through these measures, which have become increasingly dangerous. Hence, Fuenmayor shows a showcase of possibilities for obtaining tranquility in society and strengthening the economies of the countries that are so necessary. Especially in the current times of pandemic in which the ways of working and rethinking organizational structures have changed.

With this material that also serves as a guide for small, medium and large companies, they will obtain a learning that will be vital for their consolidation in the market in which security and managerial stability must be prioritized.

With information from national media and social networks

La entrada Héctor Fuenmayor promotes security and prevention of business crimes through his two books apareció primero en Bitfinance.

Microsoft continues to work on solving the vulnerabilities that have recently affected the operating system for Microsoft Exchange Server servers. The company has ensured that 92 % of the vulnerable IP addresses have already been updated, although it has warned about the different types of threats.

After discovering four vulnerabilities in Microsoft Exchange, affecting the 2016 and 2019 versions in particular, the company has released several update patches.

Among its latest efforts, last week the American company launched a new tool that solves problems with a single click, aimed at companies without an IT department, as well as the incorporation of these mechanisms in Windows’ standard antivirus, Microsoft Defender.

These solutions are spreading more and more and currently 92% of IP addresses considered vulnerable have already solved the problem, as reported by Microsoft in a statement.

Exchange security flaws, exploited by cybercriminals such as the Chinese Hafnium hackers, have been used to carry out different types of attacks, among which Microsoft has highlighted cryptocurrency miners and ransomware.

Source: dpa

La entrada Microsoft protects 92 % of vulnerable Exchange servers apareció primero en Bitfinance.