Cyber Security News - December 2021

December 1, 2021

23/12/2021

UK donates 225 million stolen passwords to hack-checking site


UK law enforcement has donatedf 225 million unique passwords to a cyber-security project helping to protect users from hacking. The National Crime Agency (NCA) recovered the database from cyber-criminals who had collected real users' email addresses and passwords.

That list has been added to free online service Have I Been Pwned (HIBP).

It lets anyone search through hundreds of millions of passwords to see if theirs is in the hands of criminals.

Troy Hunt, the security researcher who runs the site, announced on Friday that it now has a "pipeline" function for law enforcement to add passwords they have recovered to the service.


If your password appears in the database, then it is in the hands of cyber-criminals and you should change it.

Chris Lewis-Evans, from the NCA's National Cyber Crime Unit, said that the huge list of compromised passwords came from the largest set the NCA had ever recovered - more than two billion email and password pairs.


Read more...

13/12/2021

Omicron Phishing Scam Already Spotted in UK


U.K. consumer watchdog “Which?” has raised the alarm that a new phishing scam, doctored up to look like official communications from the National Health Service (NHS), is targeting people with fraud offers for free PCR tests for the COVID-19 Omicron variant.


Sent by text, email and even offered over the phone, threat actors are contacting people across the U.K. offering them what they say are new test kits specifically designed to detect the Omicron variant.


Phishing attacks and other scams often exploit emotions to get people to react quickly and without thinking things through,” Erich Kron, security awareness advocate at KnowBe4, told Threatpost.


Last year, when COVID-19 vaccines began rolling out, one analysis from Barracuda Networks found between October 2020 and last January, the average number of vaccine-themed spear phishing attacks grew by 26 percent.


If you recieve a message, email or call you are not sure about, make sure you don't perform any action (such as clicking on a link, entering personal information or payment details) unless you are sure that the source is trusted. For instance, if you are looking to book a PCR test, use the NHS website directly, for more details.


Read more...

01/12/2021

Twitter Bans Users From Posting 'Private Media' Without a Person's Consent


Twitter on Tuesday announced an expansion to its private information policy to include private media, effectively prohibiting the sharing of photos and videos without express permission from the individuals depicted in them with an aim to curb doxxing and harassment.

"Beginning today, we will not allow the sharing of private media, such as images or videos of private individuals without their consent. Publishing people's private info is also prohibited under the policy, as is threatening or incentivizing others to do so," the company's Safety team said in a tweet.


As part of the revised policy, the social media platform will allow individuals to request takedowns of pictures or videos featuring them with a clearly abusive intent, and violators found sharing private information and media will be prompted to remove the offending content and have their accounts temporarily locked out. Users contravening the private information policy twice will risk permanent suspension of their accounts.


Read more...

Follow Us

Be the first to know

You might also like

DAST in DevOps: Why It Matters

October 14, 2024
DevOps is a popular practice, especially among large organizations. However, while it comes with numerous benefits, it presents numerous risks as well. One notable challenge is the increased velocity of deployment, which often complicates how developers implement and ensure application security throughout the development and deployment process. DevOps is a popular practice, especially among large organizations. However, while it comes with numerous benefits, it presents numerous risks as well. One notable challenge is the increased velocity of deployment, which often complicates how developers implement and ensure application security throughout the development and deployment process. According to a recent survey, almost 80% of CIOs expressed concerns about the difficulty of discerning trusted elements from untrusted ones within DevOps environments. In particular, the pressure to deliver services at a faster pace sometimes prompts DevOps teams to take security shortcuts, resulting in potentially costly repercussions. These include data breaches, application downtime, and compliance violations.  So, how can you strike a balance between the demand for agile DevOps practices and the need to maintain robust security measures?

Why DAST Testing is Important

October 4, 2024
Testing applications for security flaws during production is a vital process of the development lifecycle, and this is where Dynamic Application Security Testing (DAST) comes in. DAST is a security testing approach in application security (AppSec), in which testers assess an application in real-time, while it’s actively running. This process can be conducted even without testers knowing the application’s internal interactions or system-level designs. Applications fuel the engine of the world’s economy, but enterprises can encounter substantial hurdles when striving to retain a competitive advantage in a rapidly changing digital landscape. Businesses must continuously pursue inventive solutions, even as they contend with sophisticated adversaries looking to exploit opportunities to disrupt operations, compromise vital information, and inflict harm. According to recent research, approximately 17% of cyberattacks aim to exploit vulnerable web applications. Yet, 98% of web applications are susceptible to attacks that can lead to malware infection or redirect users to malicious websites. All the while, 72% of these vulnerabilities result from coding errors. Testing applications for security flaws during production is a vital process of the development lifecycle, and this is where Dynamic Application Security Testing (DAST) comes in. DAST is a security testing approach in application security (AppSec), in which testers assess an application in real-time, while it’s actively running. This process can be conducted even without testers knowing the application’s internal interactions or system-level designs.  This is because DAST tools operate without access to the application’s source code. Instead, they emulate genuine attacks, akin to those carried out by real hackers, to identify security weaknesses. This “black box” testing method examines the application from an external perspective, scrutinises its runtime behaviour, and observes how it reacts to simulated attacks. These simulations help evaluate whether the application exhibits vulnerabilities and if it is potentially susceptible to malicious attacks.

The Evolution of Hacking

September 25, 2024
In this blog post we look back at the origin of the term “hacking”, as well as how activities that might be described as hacking have existed throughout history, even prior to the advent of computer systems – and what if anything these can teach us today. Hacking is attacking and breaking into computer systems illegally… isn’t it? The meaning of the term “hacking” has in fact changed substantially over time, morphing from describing essentially benign (or at worst mildly disruptive) activities into its modern attribution to largely criminal and illegal activities. What’s more, in its original usage, “hacking” doesn’t necessarily even need to involve computer systems at all.  In this blog post we look back at the origin of the term “hacking”, as well as how activities that might be described as hacking have existed throughout history, even prior to the advent of computer systems – and what if anything these can teach us today.
More Posts
Share by: