Connect with us

Cyber Security

Major cyberattack affects 143 million users. Here’s how you can avoid this happening to your company

Avatar

Published

on

WordPress RouletteReading Time: 4 minutes

It seems like every week we hear about the biggest ever cyber-attack or hack. Today the news is full of reports stating that up to 143 million customers of Equifax may have had their personal credentials stolen in a cyber-attack. And while this is wrong, people who are worrying about this are simply worrying about the wrong thing.

cyberattack

When you see a smashed-up car beside the road, there is very little point to worry about it, it’s happened, it’s in the past, and worrying about a crash that has happened will not stop that crash from happening. What you should worry about is can it happen again, and what can you do to stop it happening again.

Hackers are not geniuses, they are criminals with a very basic set of tools, and tenacity. Their basic tool-kit consists of understanding the weakness of people and technology, and while the tools they use may continue to become more sophisticated in terms of their ability to exploit people through social engineering, and to deliver packages of malicious code onto machines using ever more sophisticated delivery mechanisms, that is really it, those are the tools.

The on-going challenge for society is that detection of these tools relies of firstly recognizing these tools as malicious. And the simplest way for a criminal to not get caught is to have never been caught before. It sounds simplistic, but think about it, when a crime happens, what is the first thing the police do? They round up the usual suspects, people who have committed similar crimes before. When you hire someone, what is the first thing you do? You do a background check, and see if they have a criminal record. The hardest criminal to stop is the one who has no criminal record – yet.

And that is the primary issue we have today. So much of the security in place to stop malicious activity from criminals is based on the detection of known malware.

What is needed is a system that goes beyond this, that starts by detection of known malware, but then extends the protection by stopping any file that is not yet known to be malicious from performing any malicious act on your systems.

Imagine the situation – a new piece of malware is created by a criminal and is emailed to you from the email account of a person you have done business with before. You know the person and trust them, but you do not know that their system has been coerced already by a hacker. So you open the file they send you, and unknown to you it installs a key-logger on your system. Now every key stroke you perform is being recorded and sent to a hacker. A month later you log into your work’s customer database to check the payment history of a customer you are about to visit. Now the hacker has the login details for your database. They sell those login credential to other criminals on the dark web and a month later someone logs in using your credentials and downloads the records of all your customers. You have been hacked. It wasn’t complex and it wasn’t fast.

This is exactly how hacks happen every day. So, when you hear about them in the press, it’s often months after the data was stolen.

Now imagine the same scenario, but now you have a malware removal system in place that prevents malware infections by malware. That same email comes from your friend, and you open it. The file is scanned by your detection software, and it’s not recognized as known malware, but now your system see’s it’s an unknown file and so contains it in a virtual environment. The malicious file runs and tries to install key logging code onto your system. Well the containment software knowns not to allow files with an unknown security profile to perform write activities to your hard disk, or write to the com interface or the registry. These are the only methods by which software can execute on your system. Instead when the file tries to install, it is presented with virtual versions of the hard disk, the com interface and the registry. So the malicious code “thinks” it’s installed but it has not.

While this is happening a copy of the unknown file was being analyzed in the cloud using both AI and people, and they would have created a verdict of its intent. The file would have been identified as malicious, and erased from your system. And the detection software would have been updated to stop any other versions of this file from infecting any other systems.

Using this method of detection plus prevention of infection using virtualization stops hackers from gaining the knowledge to attack systems.

So, don’t worry about the Equifax hack, worry about stopping every future hack.

Only one solution does this for you, to find out more visit enterprise.comodo.com

Related Resources:

Best Antivirus

TEST YOUR EMAIL SECURITY GET YOUR INSTANT SECURITY SCORECARD FOR FREE Source: https://blog.comodo.com/comodo-news/how-to-protect-your-company-against-major-cyber-attack/

Cyber Security

Fintechs are ransomware targets. Here are 9 ways to prevent it.

Avatar

Published

on

Cybercriminals are clever, and they often target fintechs for two reasons. They know fintechs handle a lot of sensitive and financial information on a daily basis, and that they probably have the means to meet hackers’ demands and get back to business as usual.

Ransomware attacks are one of the most common fintech cybersecurity risks, and falling victim to one can be devastating — or disruptive at the very least. So, we asked the experts at ESET to explain how to prevent ransomware, and secure your business from the inside out.

Firstly, what is ransomware and how does it work?

With a ransomware attack, a cybercriminal hacks into their victim’s systems and essentially holds their data “hostage” until they pay a ransom. Since hackers know how valuable data is to a business, they tend to set ransoms in the thousands or even millions of dollars.

There are two types of attacks: crypto ransomware encrypts all the files, folders and hard drives on the infected computer, while locker ransomware locks users out of their devices. For cybercriminals, the goal is to get you to pay up so you can retrieve your files and mitigate any damage to your business.

What to do after a ransomware attack

Unfortunately, you don’t have too many options if you fall victim to a ransomware attack. You’ll need to decide to pay the ransom or not, and that involves weighing up how much your data is worth. Just keep in mind that giving in to a cybercriminal’s demands may encourage them to attack you again — and there’s no guarantee that your data will be restored.

Either way, it’s important to go into disaster recovery mode right away. Follow these steps for what to do if you get ransomware:

1. Alert your IT department. If your company has IT professionals or a Chief Information Security Officer, notify them about the attack. Hopefully, they’ll have a plan of actions for situations like these and be able to guide your team through these steps.

2. Trace the source of the attack. Most ransomware attacks have a countdown clock before all your files are deleted forever, so the sooner you find the source, the faster you can act. Typically, ransomware sneaks its way into your system through a malicious link or email attachment. The best-case scenario is the ransomware only attacks that one device, and the worst-case is it infects your entire system. Once you’ve found the culprit, ask the user if they’ve opened other suspicious emails or noticed anything weird about their computer.

3. Remove that device from your network. To stop the ransomware from spreading through your network, you’ll need to unplug the infected device.

4. Let your employees and clients know about the breach. While it’s important not to cause panic, you do need to be transparent. The truth is, most cyber breaches are the result of human error, so your employees need to know what happened and what’s expected of them. As for your clients or customers, contact them if you have proof their data has been compromised. In other words, avoid putting out a statement until you have all the information.

5. Invest in better security systems. When you’ve gotten through the aftermath, look into more sophisticated cybersecurity in fintech practices.

9 ways to prevent ransomware attacks

Ransomware is incredibly common, and as you now know, there are limited ways to deal with an attack. You need to be proactive and prepared, and implement measures to prevent an attack.

As you might have guessed, fintech cybersecurity should be a priority. These are our tips for how to protect against ransomware: 

Set up sophisticated email filters. The majority of ransomware is delivered by spam or phishing emails. To stop ransomware before it has a chance to infect your systems, employ email filters that scan all email content for spam, viruses and other forms of malware.

Run regular security audits. It’s worth assessing your security systems to identify any gaps or weaknesses. If you can, consider outsourcing your cybersecurity, reallocating resources or hiring in-house professionals to give your fintech peace of mind.

Use an up-to-date antivirus and anti-ransomware software. To protect your company devices from ransomware, malware, identity theft and more, install a third-party antivirus software designed for businesses. ESET Digital Security for Business offers the best ransomware protection and defence against a range of advanced cyber threats, and can be tailored to the size and scope of your fintech. Along with blocking persistent threats, it secures your devices with endpoint protection, which is especially handy if you have employees who work remotely.

Accept all software updates. Cybersecurity companies often release new patches to fix bugs and address vulnerabilities, which is why it’s essential to stay on top of any updates. In other words, you could have the most sophisticated antivirus ransomware software in the world, but that won’t do you any good if you ignore every notification that pops up! Updates usually take a few minutes to download and require you to restart your computer, but they make your company much less vulnerable to ransomware.

Implement multi-factor authentication. Two-factor authentication is good, but multi-factor authentication is better. This means employees will need to enter their username, password and one more piece of additional information — usually a code sent to their phone or email — before they can log into the system. It also makes it harder for hackers to break in.

Create a whitelisting program. This is effective in preventing ransomware, and it involves restricting the applications that can run within your company’s system. Think of it as the opposite of blacklisting — only applications that have passed the approval process will work.

Encrypt your company files. Ideally, all of your data should be end-to-end encrypted, and access limited to the people who need that information to do their jobs. The good news is, most computers and phones have built-in operating systems that encrypt stored data and prevent unauthorised users.

Tighten your cloud security. Speaking of the cloud, some cloud services don’t offer secure encryption and can’t distinguish between authorised users and other people trying to access the cloud. ESET Cloud Office Security will configure your cloud security so hackers can’t bypass your company’s policies and tap into sensitive information.

Routinely back up your data and systems. By backing up your data regularly, you’ll be able to recover any lost or corrupted data if your server crashes or if you fall victim to a ransomware attack. We recommend always having two encrypted backups: one on the cloud, and one an external hard drive.

Get in touch with ESET today!

Ready to protect your business from the inside out? With ransomware, prevention is always better than cure, so head to ESET’s site to learn more about their top-rated cybersecurity systems.

Coinsmart. Beste Bitcoin-Börse in Europa
Source: https://australianfintech.com.au/fintechs-are-ransomware-targets-here-are-9-ways-to-prevent-it/

Continue Reading

Cyber Security

What are Insecure Direct Object References (IDOR)?

Avatar

Published

on

HackerOne Hacker Noon profile picture

@hacker0x01HackerOne

HackerOne empowers the world to build a safer internet.

Insecure Direct Object References (or IDOR) is a simple bug that packs a punch. When exploited, it can provide attackers with access to sensitive data or passwords or give them the ability to modify information. On HackerOne, over 200 are found and safely reported to customers every month. 

What is an IDOR?

There are several types of IDOR attacks, including:

  • Body Manipulation, in which attackers modify the value of a checkbox, radio buttons, APIs, and form fields to access information from other users with ease.
  • URL Tampering, in which the URL is modified at the client’s end by tweaking the parameters in the HTTP request. 
  • HTTP Requests in which IDOR vulnerabilities are typically found in GET, POST, PUT, and DELETE verbs.
  • Mass Assignment, where a record pattern can be abused to modify data that the user should not be able to access. While not always a result of IDOR vulnerabilities, there are many powerful examples of this being the result of it. 

In its simplest and most common form, an IDOR vulnerability arises when the only input required to access or replace content is from the user. This vulnerability submitted to Shopify by California-based hacker Rojan Rijal (a.k.a. @rijalrojan) in 2018 is the perfect example.

By observing how file attachments were labeled when sending a query to Shopify’s Exchange Marketplace application, Rojan was able to replace documents by leveraging the same file name from different accounts. 

Figure 1: IDOR vulnerability reported by @rijalrojan to Shopify on the HackerOne platform.

For retail and ecommerce companies, IDOR vulnerabilities represent 15% of what organizations pay bounties for and represent the top vulnerability for programs across government (18%), medical technology (36%), and professional services (31%) industries. 

If they’re so simple, why are they so common? 

In short, IDORs can not be detected by tools alone. 

IDORs require creativity and manual security testing to identify them. They require you to understand the business context of the target application. While some scanners might detect activity, it takes a human eye to analyze, evaluate, and interpret. Understanding the deeper context is an innately human skill that machines cannot replicate. In traditional pentests, unless a pentester tests every possible parameter in every request endpoint, these vulnerabilities can go undetected. 

What are the implications of an IDOR vulnerability? 

Perhaps the most infamous IDOR vulnerability as of late is that found in alt-tech social media platform Parler. The company ordered their posts by number in the URL, a telltale sign of IDOR. If you add a sequential digit to a Parler post URL, you could access the next post on the platform indefinitely. Without authentication or access limits, an attacker could easily build a program to download every post, photo, video, and data from the entire site. While this was just public posts (not necessarily IDs used to verify accounts), geolocation data from posts was also downloaded, which could reveal GPS coordinates of users’ homes.  

How can you prevent IDORs from cropping up?

“Avoiding IDOR is only possible by building a robust access control mechanism, choosing the best fit methodology for your scenario, log all access and if possible do an audit with a post authorization check,” said HackerOne hacker Manoel Abreu Netto, better known online as @manoelt.

“However, if you want to reduce the impact of an IDOR, avoid using a simple pattern to reference objects in the backend, thus not using a sequential integer value but something like uuid or even a MAC (hashed ID) with a salt per user session.

This does not eliminate the IDOR, but reduces the overall impact and the ability to enumerate objects.”

To remediate IDOR vulnerabilities, below are a few best practices. 

  1. Developers should avoid displaying private object references such as keys or file names.
  2. Validation of parameters should be properly implemented.
  3. Verification of all the referenced objects should be checked.
  4. Tokens should be generated in such a way that it can only be mapped to the user and is not public.
  5. Ensure that queries are scoped to the owner of the resource. 
  6. Avoid things like using UUIDs (Universally unique identifier) over Sequential IDs as UUIDs often let IDOR vulnerabilities go undetected.

For more information about reducing risk and getting started with hacker-powered security, check out our CISOs Guide to Deriving Value from Hacker-Powered Security.

Tags

Join Hacker Noon

Create your free account to unlock your custom reading experience.

Coinsmart. Beste Bitcoin-Börse in Europa
Source: https://hackernoon.com/what-are-insecure-direct-object-references-idor-hz1j33e0?source=rss

Continue Reading

Cyber Security

80% of Global Enterprises Report Firmware Cyberattacks

Avatar

Published

on

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Coinsmart. Beste Bitcoin-Börse in Europa
Source: https://threatpost.com/enterprises-firmware-cyberattacks/165174/

Continue Reading

Cyber Security

Legacy QNAP NAS Devices Vulnerable to Zero-Day Attack

Avatar

Published

on

The administrator of your personal data will be Threatpost, Inc., 500 Unicorn Park, Woburn, MA 01801. Detailed information on the processing of personal data can be found in the privacy policy. In addition, you will find them in the message confirming the subscription to the newsletter.

Coinsmart. Beste Bitcoin-Börse in Europa
Source: https://threatpost.com/qnap-nas-devices-zero-day-attack/165165/

Continue Reading
Esports2 hours ago

G2 Esport Rekkles awarded with the 2021 LEC Spring MVP

Esports2 hours ago

Dota 2: Team Nigma Completes Dota 2 Roster With iLTW

Esports2 hours ago

LoL: Rekkles Named 2021 LEC Spring Split MVP

Esports3 hours ago

LoL: LEC 2021 Spring Lower Bracket Finals Recap- G2 Esports vs Rogue

Esports4 hours ago

New lineup shows that Sova can still domi on Split

Esports4 hours ago

Nigma welcome iLTW to the team

Esports6 hours ago

Leading from the Isolated Lane

Esports6 hours ago

Team Singularity bench Scrub Killa for the remainder of the RLCSX season

Blockchain6 hours ago

Ethereum Preis erreicht neues Allzeithoch bei 2200 USD

Esports7 hours ago

DWG KIA sweep GenG in LCK Spring Finals, will represent Korea at MSI

Esports7 hours ago

LoL: Rogue Crowned 2021 LEC Spring Coaching Team Of The Split

Esports7 hours ago

Sources: Sentinels negotiating extended loan deal for TenZ

Esports8 hours ago

LoL: Blaber Named 2021 LCS Spring Split Honda MVP

Esports8 hours ago

LoL: TL’s Santorin Replaced By Armao For LCS MSS Match Against TSM Due To Illness

Blockchain8 hours ago

Bitcoin Kurs durchbricht 60.000 USD-Marke

Esports8 hours ago

Hearthstone Grandmasters 2021: Week 1 Day 1 regional recap

Esports9 hours ago

[ASL11] Ro24 Preview Pt 3:Contenders and Streamers

Esports10 hours ago

ChYuan switches roles to join Fnatic

Esports11 hours ago

How to Fix COD Mobile’s Authorization error on Android

Esports11 hours ago

Elon Musk’s Neuralink lets a Monkey play video game using its thoughts

Esports12 hours ago

Dota 2 Update 7.29 Introduces new hero “Dawnbreaker”

Esports12 hours ago

Xbox Game Studios is having a sale on Steam

Esports14 hours ago

How to Fix COD Mobile Authorization error on Android

Esports15 hours ago

Dota 2 patch 7.29: Impact of Outposts, Water Runes and other major general gameplay changes

Blockchain16 hours ago

Revolut integriert 11 neue Kryptowährungen

Esports16 hours ago

Code S RO16: Maru & Dream advance to RO8

Esports16 hours ago

Dota 2: Patch 7.29 Analysis Of Top Changes

Esports16 hours ago

Dota 2: New Hero Dawnbreaker First Impressions

Esports17 hours ago

Dota 2 Dawnbreaker Hero Guide

Esports18 hours ago

Dota 2: vtFaded’s DPC ban; Does the punishment fit the crime?

Trending