Ransomware Attacks are not problem for us

 

If there is one characteristic that defines cybercrime today, it is the capacity to evolve and adapt to new environments and the ability to find ways of evading the cybersecurity measures taken by victims. 

Ransomware is no exception. One of the main features of ransomware as a threat, in addition to kidnapping data, is that it is constantly reinventing itself to persist over time and ineffectiveness.

This type of malicious software has evolved greatly since it began, and today there is a wide variety of families in existence, giving rise to new, more sophisticated strains.

Did you know that?

• 65% of ransomware infections are delivered via phishing 
• A ransomware attack will take place every 11 seconds by 2021 
• 85% of ransomware attacks target Windows systems. 
• The average cost of a ransomware attack in 2019 was $133,000 
• 50% of IT professionals don’t believe that their organization is ready to defend against a ransomware attack.  
• Hackers attack  every 39 seconds or an average of 2,244 times a day 
• Between January 1st and June 30th, 2020, ID Ransomware received 100,001 submissions relating to attacks that targeted companies and public sector organizations. 
• 90 % of IT pros had clients that suffered ransomware attacks in the past year 
• Ransomware costs will reach $20 billion by 2021 
• 51% of businesses have been impacted by ransomware in the last year
• 0 affected Scicane customers

Don't be a victim - Contact us for further information @ info@scicane.com (no obligation)

Zoom: It appears to have more problems than it solves

Zoom admits meetings don't use end-to-end encryption

Video conferencing app Zoom does not use end-to-end encryption, according to reports, despite specifically stating that it does on its website.

Though Zoom offers users the option to “enable an end-to-end (E2E) encrypted meeting,” and provides a green padlock that claims “Zoom is using an end to end encrypted connection,” the company this week admitted that offers no such thing.

A spokesperson for the company told The Intercept that, despite its claims, it was "currently not possible" to enable end-to-end encryption for its video meetings.

Instead, the spokesperson revealed, the service uses Transport Layer Security (TLS) which encrypts data between user's meetings and Zoom's servers. End-to-end refers to data encrypted between calls, blocking out third parties - which includes the service provider. As a result, the company can see and use the data for things like targeted ads. 

"When we use the phrase ‘End to End’ in our other literature, it is in reference to the connection being encrypted from Zoom end point to Zoom end point,” the spokesperson added.

Part of Zoom's appeal to organisations is its simplicity and the fact it can be used for free, albeit without any premium features, which lets businesses try it out before forking out any money. "Video conferencing is a fantastic necessity in times like these but it is vitally important to understand the security and privacy concerns that go in parallel with this increasingly popular form of communication," said Jake Moore, a cyber security specialist for ESET. "For social and light business meetings they are fine as long as users realise what data is being shared by Zoom to third parties. I certainly wouldn't recommend using free software for sensitive or private meetings."

Unpatched Zoom App Bug Lets Hackers Steal Your Windows Password

According to the latest finding by cybersecurity expert @_g0dmode, which was also confirmed by researcher Matthew Hickey and Mohamed A. Baset, the Zoom client for Windows is vulnerable to the 'UNC path injection' vulnerability that could let remote attackers steal login credentials for victims' Windows systems.


The attack involves the SMBRelay technique wherein Windows automatically exposes a user's login username and NTLM password hashes to a remote SMB server when attempting to connect and download a file hosted on it.

The attack is possible only because Zoom for Windows supports remote UNC paths, which converts such potentially insecure URLs into hyperlinks for recipients in a personal or group chat.


To steal the login credential of user running zoom for Windows, all an attacker needs to do is sent a crafted URL (i.e. \\x.x.x.x\abc_file) to the victim over its chat interface, as shown, and wait for the victim to click it once.

To be noted, the captured passwords are not plaintext, but a weak one can easily be cracked in seconds using password cracking tools like HashCat or John the Ripper.

In a shared environment, like office space, stolen login details can be reused immediately to compromise other users or IT resources and launch further attacks.

Besides stealing Windows credentials, the flaw can also be exploited to launch any program already present on a targeted computer or downloaded as part of the attacker's social engineering campaign.


Zoom has already been notified of this bug, but since the flaw has not yet been patched, users are advised to either use an alternative video conferencing software or Zoom in your web browser instead of the dedicated client app.

Source(s) & more info: Hacker News, ITPro

Installing veracrypt on Ubuntu/Mint (Linux)

Open a console (terminal) and run the following commands to add the repository for veracrypt:

sudo add-apt-repository ppa:unit193/encryption sudo apt update sudo apt install veracrypt

Malware vs Viruses: What’s the Difference?

Understanding the difference between malware and viruses is very important. A virus is just one type of malware, but the term is more widely used by the public. The term malware refers to any malicious software, including a computer virus. For example, between 2000 and 2005, spyware and adware emerged as types of malware that protection systems had to deal with.

Malware is infecting computers and mobile devices at an increasingly greater pace.

What is a Malware?

Malware is software written specifically to harm and infect the host system. Malware includes viruses along with other types of software such as trojan horses, worms, spyware, and adware. Advanced malware such as ransomware are used to commit financial fraud and extort money from computer users.

Common types of malware:

    Virus: As discussed, Virus is a specific type of malware by itself. It is a contagious piece of code that infects the other software on the host system and spreads itself once it is run. It is mostly known to spread when software is shared between computers. This acts more like a parasite.

    Adware: Adware is also known as advertising-supported software. It is software which renders advertisements for the purpose of generating revenue for its author. The advertisements are published on the screen presented to the user at the time of installation. Adware is programmed to examine which Internet sites, the user visits frequently and to present and feature related advertisements. Not all adware has malicious intent, but it becomes a problem anyway because it harms computer performance and can be annoying.

    Spyware: This type of malicious software, spies on you, tracks your internet activities. It helps the hacker in gathering information about the victim’s system, without the consent of the victim. This spyware’s presence is typically hidden from the host and it is very difficult to detect. Some spyware like keyloggers may be installed intentionally in a organization to monitor activities of employees.

    Worms: This type of malware will replicate itself  and destroys information and files saved on the host PC. It works to eat up all the system operating files and data files on a drive.

    Trojan:  Trojans are a type of virus that are designed to make a user think they are a safe program and run them. They may be  programmed to steal personal and  financial information, and later take over the resources of the host computer’s system files.  In large systems it may attempt to make a host system or network resource unavailable to those attempting to reach it. Example: you business network becoming unavailable.

    Ransomware: Ransomware is an advanced type of malware that restricts access to the computer system until the user pays a fee.  Your screen might show a pop up warning that your have been locked out of your computer and  that you can access only after paying the cyber criminal. The cyber criminal demands a ransom to be paid in order for the restriction to be removed. The infamous Cryptolocker is one type of ransomware.

It is very difficult to live without computers or mobile devices and we have come to depend on them for many activities – communication, online purchases and payments, etc.., In order to protect our devices and data against the different types of malware mentioned above, an effective anti-malware solution is required.

How the NSA identified Bitcoin 'creator'

The ‘creator’ of Bitcoin, Satoshi Nakamoto, is the world’s most elusive billionaire. Very few people outside of the Department of Homeland Security know Satoshi’s real name. In fact, DHS will not publicly confirm that even THEY know the billionaire’s identity. Satoshi has taken great care to keep his identity secret employing the latest encryption and obfuscation methods in his communications. Despite these efforts (according to my source at the DHS) Satoshi Nakamoto gave investigators the only tool they needed to find him — his own words.
  Using stylometry one is able to compare texts to determine authorship of a particular work. Throughout the years Satoshi wrote thousands of posts and emails and most of which are publicly available. The NSA was able to the use the ‘writer invariant’ method of stylometry to compare Satoshi’s ‘known’ writings with trillions of writing samples from people across the globe. By taking Satoshi’s texts and finding the 50 most common words, the NSA was able to break down his text into 5,000 word chunks and analyse each to find the frequency of those 50 words. This would result in a unique 50-number identifier for each chunk. The NSA then placed each of these numbers into a 50-dimensional space and flatten them into a plane using principal components analysis. The result is a ‘fingerprint’ for anything written by Satoshi that could easily be compared to any other writing.

But why? Why go to so much trouble to identify Satoshi? The source says that the Obama administration was concerned that Satoshi was an agent of Russia or China — that Bitcoin might be weaponized against us in the future. Knowing the source would help the administration understand their motives. As far as I can tell Satoshi hasn’t violated any laws and I have no idea if the NSA determined he was an agent of Russia or China or just a Japanese crypto hacker.
 The moral of the story? You can’t hide on the internet any more. Your sentence structure and word use is MORE unique than your own fingerprint. If an organization, like the NSA, wants to find you they will.

For more information and source: Medium
Author of complete article: Alexander Muse

installing Ubuntu 17.04 with encrypted home makes boot delays

the problem is when installing Ubuntu with encrypted home, 17.04 creates a swapfile instead of a swap partition like previous versions, then the installer writes a faulty config file.

In particular, ecryptfs-setup-swap puts in /etc/crypttab a line like this:

cryptswap1 UID=XXXXXXXX /dev/urandom swap,offset=1024,cipher=aes-xts-plain64


(like there were a swap partition with UID=XXXXXXXX) while with a swapfile it should put the following line:

cryptswap1 /swapfile /dev/urandom swap,offset=1024,cipher=aes-xts-plain64

If you manually change that line and reboot, you get rid of the problem - before rebooting, check also that your /etc/fstab file ends with:

/swapfile               none  swap  sw  0  0
/dev/mapper/cryptswap1  none  swap  sw  0  0

---

Because of this error Ubuntu spends a long time waiting for the swap.

Keep your DATA PRIVATE - Encfs Manager in Ubuntu, Windows or Mac

Features of EncFSMP:

• Mounts EncFS folders on Windows and OS X

• Can create, edit, export and change the password of EncFS folders

• Is 100% compatible with EncFS 1.7.4 on Linux

• Completely free, no nags, no additional downloads like toolbars etc.

With EncFS MP, you can store your data in an encrypted folder (works for usb memory sticks as well). This is especially important if you store your sensitive data in a cloud service like Dropbox or Google Drive.Since EncFS exists on many platforms, you can access your data from a Windows PC, from an Apple computer, from Linux (using the built-in EncFS), or even from an Android device (using Cryptonite).Although EncFSMP is an open source project and its source code is released under the MIT license, it contains a closed-source component. The file system component that allows EncFSMP volumes to be mounted is called Pismo File Mount and is developed by Pismo Technic Inc.. Other than that, EncFSMP is 100% open source.

Windows or Mac

Download the (open source) software from Encfs official site

Ubuntu Linux

To add the official GNOME Encfs Manager PPA and install the application in Ubuntu, use the following commands in terminal:

sudo add-apt-repository ppa:gencfsm/ppasudo apt-get updatesudo apt-get install gnome-encfs-manager