Tag Archives: Security

Yahoo’s hack warning comes from a third breach, Yahoo says

How many times does this have to happen??
Three strikes and your out

Yahoo’s newly issued warning to users about malicious hacks is related to a third data breach that the company disclosed in December 2016.

A warning sent to some Yahoo users Wednesday read: “Based on the ongoing investigation, we believe a forged cookie may have been used in 2015 or 2016 to access your account.”

This breach was quietly revealed in a December 2016 statement from Yahoo that provided information on a separate hack that occurred in August 2013 involving more than 1 billion accounts. Some of 2015 and 2016 incidents have been tied to a “state-sponsored actor” that was involved in another 2014 breach that affected up to 500 million accounts.

“Forged cookies” are digital keys that allow access to information without re-entering passwords. The leaked data included email addresses, birth dates and answers to security questions. Yahoo declined to say how many people were affected.

“As we have previously disclosed, our outside forensic experts have been investigating the creation of forged cookies that could have enabled an intruder to access our users’ accounts without a password,” a Yahoo spokesperson said in an emailed statement. “The investigation has identified user accounts for which we believe forged cookies were taken or used. Yahoo is in the process of notifying all potentially affected account holders.”

A source familiar with the matter said the investigations for these breaches are nearing an end.

The earlier, catastrophic breaches that impacted over 1.5 billion accounts raised questions about Yahoo’s security, and called into question the company’s deal to sell itself to Verizon Communications.

Both SunTrust and CFRA retained their hold opinion on Yahoo shares, mostly tied to the fact that Verizon will likely still purchase the internet company and has renegotiated the purchase price. Bloomberg reported that the telecommunications company was able to reduce the initial $4.8 billion price by $250 million due to the data breaches.

I really think it time to delete that Yahoo account and put the matter to bed.

What is blockchain?


Blockchain is a term you see fairly much when browsing tech—and non-tech—sites these days. It is widely known as the technology that constitutes the infrastructure of Bitcoin (what’s bitcoin BTW?), a mysterious cryptocurrency created by a mysterious scientist in 2009. Some even confuse it as a synonym for bitcoin. But the reality is that blockchain is a disruptive technology that has the potential to transform a wide variety of business processes.

In this article, we will clarify what the blockchain is—and what it isn’t—what’s it’s relation to bitcoin, and what are its applications beyond the realm of cryptocurrencies.

What is blockchain anyway?

At its essence, the blockchain is a distributed ledger—or list—of all transactions across a peer-to-peer network. Put simply, you can think of blockchain as a data structure containing transactions that is shared and synced among nodes in a network (but in fact it gets much more complicated than that). Each node has a copy of the entire ledger and works with others to maintain its consistency.

Changes to the ledger are made through consensus among the participants. When someone wants to add a new record to the blockchain ledger, it has to be verified by the participants in the network, all of whom have a copy of the ledger. If a majority of the nodes agree that the transaction looks valid, it will be approved and will be inserted in a new “block” which will be appended to the ledger at all the locations where it is stored.

Along with the use of cryptography and digital signatures, this approach addresses the issue of security while obviating the need for a central authority.

Each new block can store one or more transactions and is tied to previous ones through digital signatures or hashes. Transactions are indefinitely stored and can’t be modified after they’ve been validated and committed to the ledger.

What makes blockchain unique?

Blockchain’s approach to dealing with transactions is a break from the usual centralized and broker-based model, in which a central server is responsible for processing and storing all transactions. And this is one of the key features that makes blockchain attractive. This creates fault tolerance, so there’s no single point of failure in the blockchain, while also providing security that is on par with what is being offered in the centralized paradigm.

This enables companies, entities and individuals to make and verify transactions instantaneously without relying on a central authority. This is especially useful in the finance industry where the transfer of money is usually tied to and controlled by clearing houses that maintain ledgers and take days to verify and execute a transaction, and collect considerable fees. The blockchain can verify and apply changes within milliseconds, and the costs are next to nothing. In the blockchain model, each bank in a network would have its own copy of the ledger and transactions would be verified and carried out through communications between banks, and within seconds. This will cut costs and increase efficiency.

Another unique feature of the blockchain is its immutability, i.e. it is nearly impossible to tamper with records previously stored in a blockchain. Each new block being tied to previous ones through cryptographic algorithms and calculations, which means slightest alteration in the blockchain will immediately disrupt and invalidate the entire chain. And with the ledger being replicated across many nodes, it becomes even harder to falsify transactions and the ledger’s history.

What are the applications of blockchain

Bitcoin was the first concrete application of blockchain. It was proposed in 2008 in a paper presented by a person—or a group of people, some say—called Satoshi Nakamato. Bitcoin uses blockchain to digitally send bitcoins—its namesake currency—between parties without the need for the interference of a third-party broker.

But bitcoin isn’t the only application of blockchain. The distributed ledger makes it easier to create cost-efficient business networks where virtually anything of value can be tracked and traded—without requiring a central point of control.

For instance, blockchain can be used to keep track of assets and goods as they move down the supply chain. Other industries such as stock exchange can make use of the blockchain mechanism to transfer ownership in a secure, peer-to-peer mechanism.

In the IoT industry, blockchain can help connect billions of devices in a secure way that won’t require centralized cloud servers. It can also be the backbone that will enable autonomous machines that will pay for buy and sell services from each other in the future.  (There has to be standards in place before they can be totally secured).

Other industries include retail, healthcare, gaming and many others.

Smart contracts will take the blockchain to the next level, enabling it to do more than just exchange information and get involved in more complex operations.

Different flavors of blockchain

Based on the specific needs of the application making use of blockchain, several of its characteristics might change. In fact, the different implementations of blockchain and different cryptocurrencies that are using it vary in different sectors.


Blockchains can be public or “permissionless,” such as the bitcoin blockchain, in which everyone can participate and add transactions. This is the model used by bitcoin. Other organizations are exploring the implementation of “permissioned” blockchains, in which the network is made up of known participants only. Security and authentication mechanisms vary in these different blockchains.


With ledgers being distributed among nodes, the level of anonymity is also a matter of importance. For instance, bitcoin does not require any personally identifiable information to send or receive payments on the blockchain. However, all transactions are recorded online for everyone to see, which lends a certain amount of transparency and makes total anonymity quite complicated. That’s why it’s known as pseudonymous.

Other implementations of blockchain, such as ZeroCoin, use other mechanisms (zero-knowledge proof) to enable verification without publishing transaction data.


Consensus is the mechanism used by nodes in a blockchain to securely verify and validate transactions while maintaining the consistency and integrity of the ledger. The topic is a bit complicated, but the most prevalent form used is the “proof of work” consensus model used by bitcoin, in which nodes—called “miners”—spend computation cycles to run intensive hashing algorithms and prove the authenticity of the block they’re proposing to add. The PoW mechanism prevents DoS attacks and spam.

“Proof of stake” is another popular consensus model, in which nodes are required to prove ownership of certain amount of currency (their “stake”) to validate transactions.

This is just the beginning

Blockchain is a new way of communicating and transferring data. We still don’t know quite how it will evolve in the future, but what we do know is that it is bound to change quite a few things. A look at the figures presented in this Business Insider article proves why we can call it a disruptive technology.

I don’t know about you, but I’m excited about what blockchain surprises are waiting to be discovered down the horizon and will be exploring its uses more in the coming months.


“Don’t Click” for Black Friday/Cyber Monday

Some civilized thoughts:

1. “Don’t click stuff from unknown sources!”

2. Don’t scan (QR codes) from unknown sources.

3. ANY time you scan, you click OR hand over your E-Mail your expectations of privacy have evaporated.

4. Your E-Mail and your Phone number are worth a LOT more than a 10% coupon.

5. Always worth being careful of “cheap” electronics or bargains that just seem too good to be true….

6. Online coupons and online sites, PLEASE validate, check and then DOUBLE check the site, the security, the SSL Certificate AND the spelling before putting in a credit card.

7. Links embedded in emails AND sites AND anything you are looking at CAN and SHOULD be examined very carefully before being clicked!

8. Shopping at the Mall, be careful of the “free web access” people like me are sitting there VERY happy to give you a Chase, Wells Fargo or AMEX login.

9. Need to sign up for something in a hurry? USE A UNIQUE PASSWORD!

And remember if it looks to good to be true…..then it probably is!

Ok, hope that helps

Oh, and DON’T CLICK !

Hackers take Remote Control of Tesla’s Brakes and Door locks from 12 Miles Away


Next time when you find yourself hooked up behind the wheel, make sure your car is actually in your control.

Hackers can remotely hijack your car and even control its brakes from 12 miles away.

Today many automobiles companies have been offering vehicles with the majority of functions electronically controlled, from instrument cluster to steering, brakes, and accelerator.

These auto-control electronic systems not only improve your driving experience but at the same time also increase the risk of getting hacked.

The most recent car hacking has been performed on Tesla Model S by a team of security researchers from Keen Security Lab, demonstrating how they were able to hijack the Tesla car by exploiting multiple flaws in the latest models running the most recent software.

The team said the hacks worked on multiple models of Tesla and believed they would work across all marques.

“We have discovered multiple security vulnerabilities and successfully implemented remote, aka none physical contact, control on Tesla Model S in both Parking and Driving Mode,” Keen writes in a blog post. “We used an unmodified car with the latest firmware to demonstrate the attack.”
“As far as we know, this is the first case of remote attack which compromises CAN Bus to achieve remote controls on Tesla cars.”

In a YouTube video, the team of Chinese researchers Sen Nie, Ling Liu, and Wen Lu, along with director Samuel Lv, demonstrated how it could remotely take control of a Tesla’s brakes and apply the brakes from 12 miles away by compromising the CAN bus that controls many vehicle systems in the car.

The researchers were also able to remotely unlock the door of the car, take over control of the dashboard computer screen, open the boot, move the seats and activate the indicators and windscreen wipers, as well as fold in the wing mirrors while the vehicle was in motion.

The hack requires the car to be connected to a malicious WiFi hotspot and is only triggered when the car’s web browser is used.

The team demonstrated the hacks against a Tesla Model S P85 and Model 75D and said its attacks would work on multiple Tesla models. It was able to compromise the Tesla cars in both parking and driving modes at slow speed in a car park.

Tesla Releases Firmware v7.1 (2.36.31) To Patch It

“Within just 10 days of receiving this report, Tesla has already deployed an over-the-air software update (v7.1, 2.36.31) that addresses the potential security issues. The issue demonstrated is only triggered when the web browser is used, and also required the car to be physically near to and connected to a malicious Wi-Fi hotspot. Our realistic estimate is that the risk to our customers was very low, but this did not stop us from responding quickly.”

Thankfully, the vulnerabilities were privately disclosed to Tesla and the company addressed the issues worldwide with an over-the-air software update.

The Keen team said it is Tesla’s “proactive attitude” towards its vulnerability report that made the fix available to its customers within ten days when other automakers required much time and more complex procedures to update vehicles following the major bug exposures.

The team has planned to release details of its hacks in coming days, Keen said on Twitter.



Federal Judge: Hacking Someone’s Computer Is Definitely a ‘Search’

Courts across the country can’t seem to agree on whether the FBI’s recent hacking activities ran afoul of the law—and the confusion has led to some fairly alarming theories about law enforcement’s ability to remotely compromise computers.

In numerous cases spawned from the FBI takeover of a darkweb site that hosted child abuse images, courts have been split on the legality of an FBI campaign that used a single warrant to hack thousands of computers accessing the site from unknown locations, using malware called a Network Investigative Technique, or NIT.  Some have gone even further, arguing that hacking a computer doesn’t constitute a “search,” and therefore doesn’t require a warrant at all.

But a federal judge in Texas ruled this week that actually, yes, sending malware to someone’s computer to secretly retrieve information from it—as the FBI did with the NIT—is a “search” under the Fourth Amendment.

“[T]he NIT placed code on Mr. Torres’ computer without his permission, causing it to transmit his IP address and other identifying data to the government,” Judge David Alan Ezra of wrote Friday, in a ruling for one of the NIT cases, in San Antonio, Texas.  “That Mr. Torres did not have a reasonable expectation of privacy in his IP address is of no import.  This was unquestionably a “search” for Fourth Amendment purposes.”

As obvious as that sounds, not everyone agrees.  Previously, another judge in Virginia stunningly ruled that a warrant for hacking isn’t required at all,because a defendant infected with government malware “has no reasonable expectation of privacy in his computer.”

That judgment was a leap from several other rulings, in which judges claimed that users of the Tor anonymity network, where the illegal site was hidden, have  no expectation of privacy in their IP address—even though hiding your IP is the entire point of using Tor. The argument—which the Department of Justice apparently agrees with—states this is because Tor users technically “reveal” their true IP address to another computer when they first enter the Tor network, through an entry point called a “guard node.” (That computer can not determine what sites the user visits, however)

But while the FBI’s use of malware was definitely a search, Judge Ezra of Texas nevertheless denied the defendant’s motion to suppress evidence obtained by the NIT.

That’s because it can’t be proven that the FBI “willfully” violated Rule 41(b), a procedural rule that’s meant to stop judges from authorizing searches outside of their districts. The FBI is now controversially seeking to expand that rule, which would grant them the power to hack computers anywhere—not just within the jurisdictions where the hacking was authorized.

Instead, Judge Ezra wrote that the NIT warrant “has brought to light the need for Congressional clarification regarding a magistrate’s authority to issue a warrant in the internet age, where the location of criminal activity is obscured through the use of sophisticated systems of servers designed to mask a user’s identity.”

Scary iPhone malware that steals your data is a reminder no platform is ever safe.


If you haven’t done so already, go and update your iPhone, iPad or iPod touch to iOS 9.3.5 right now. To update, go to Settings > General > Software Update.

It may not seem urgent because it’s only a “point release,” but the update is crucial or you risk having all of your data secretly stolen by invisible malware that can install itself on your device and even uninstall itself without leaving any traces behind.

Two reports from the New York Times and Motherboard published on Thursday detail how three major security holes, patched via the update, could be exploited by hackers to track and steal practically all of the private data on your iOS device.

According to both reports, Ahmed Mansoor, a human rights activist from the United Arab Emirates, discovered the vulnerabilities when he received a suspicious text message with a link that would have provided “new secrets about torture of Emiratis in state prisons.”

Had Mansoor clicked on the link, he would have been directed to a website that would have exploited all three security holes and installed malware onto his iPhone, giving remote hackers full access to his device.

Thankfully, Mansoor didn’t click the link. Instead, he alerted Citizen Lab, an interdisciplinary lab based at the Munk School of Global Affairs at the University of Toronto that focuses its research on the intersection of human rights and security.

Citizen Lab identified the link as belonging to NSO Group, an Israel-based “cyberwar” company reportedly owned by American venture capital firm Francisco Partners Management, which sells spyware solutions to government agencies.

Along with additional research from cybersecurity firm Lookout, it has been revealed the three exploits (dubbed “Trident”) are “zero-day” level, meaning the malware kicks in immediately as soon as it’s activated (in this case, once the link is opened, the malware automatically installs itself and starts tracking everything).

“Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his iPhone’s camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements,” writes Bill Marczak and John Scott-Railton, two Citizen Lab senior researchers.

According to Lookout, the software is highly flexible and can be configured in a number of ways to target different countries and apps:

The spyware capabilities include accessing messages, calls, emails, logs, and more from apps including Gmail, Facebook, Skype, WhatsApp, Viber, FaceTime, Calendar, Line, Mail.Ru, WeChat, SS, Tango, and others. The kit appears to persist even when the device software is updated and can update itself to easily replace exploits if they become obsolete.

Upon discovery, the two organizations immediately notified Apple and the iPhone maker immediately got to work on iOS 9.3.5, which was released on Thursday.

Though Trident and the type of malware NSO sells (called “Pegasus”) is mainly used by governments to target dissidents, activists and journalists in volatile countries like United Arab Emirates, Mexico, Kenya, Mozambique, Yemen and Turkey, it can be used to target any iOS device.

The very idea of having all your data stolen without any real effort should scare everyone into updating their iOS devices.

As we’ve entrusted our smartphones and tablets with more and more of our personal data, it’s more important than ever to always be running the latest software with the most up-to-date security patches to prevent digital spying and theft.

Quicker to protect iOS than Android

It took 10 days for Apple to release an update to close the holes after Citizen Lab and Lookout alerted the company.

Ten days may seem like a long time, but when you compare it to how long it would take for Android devices to get updated for such a critical patch, it’s like hyper speed.

One of the benefits of iOS is its tightly-integrated software and hardware. Because there are fewer devices and they all run the same core software, Apple can test and deploy security updates quickly and easily with fewer chances of something going wrong.

Android, on the hand, is fragmented into tens of thousands of distinct devices, and customized in too many versions for even the most diehard Android fan to remember. This makes it extremely challenging for phone makers to test and release updates to plug up dangerous security holes quickly.

Google’s Nexus devices are quicker to get software updates because they all run stock Android and Google can push them out in a similar way to Apple. Same goes for Samsung and its Galaxy phones.

But there’s often little incentive for Android phone makers to update their devices. Software maintenance is costly and that’s why you’ll see many Android devices from lesser-known brands either update their phones months or years later or never at all.

No platforms are ever truly secure

The publishing of the security flaws and how serious it could be if you were to fall victim invites another conversation: media portrayal.

Android bears the brunt when it comes to being portrayed as the less secure platform, but as this revelation has revealed, no matter which platform is really more secure, all platforms are susceptible to hackers.

Security is an ongoing and never-ending battle between phone makers like Apple and Google and hackers. It’s a constant cat-and-mouse game where each side is always one step ahead or behind the other.

Had Mansoor not alerted Citizen Lab, the Trident exploit would have continued to exist without anyone knowing. Lookout believes the malware has existed since iOS 7. NSO Group’s Pegasus malware can also be used to target Android and BlackBerry devices, too.

While no platform will ever be truly secure, updating to the latest version of your phone’s software is the best way to remain safe.


Banner Health nailed by huge cyberattack that compromised personal data of 3.7 million people

Individuals’ data may have been compromised by hackers that cracked in via food and beverage payment systems and infiltrated patient healthcare data.


Banner Health revealed that hackers may have accessed the healthcare, payment and health plan information of up to 3.7 million individuals.

Attackers reportedly gained access through payment processing systems for food and beverage purchases at the Phoenix-based health system.

“On July 13, 2016, we discovered that cyber attackers may have gained unauthorized access to information stored on a limited number of Banner Health computer servers,” Banner Health said in a statement. “We immediately launched an investigation, hired a leading forensics firm, took steps to block the cyber attackers, and contacted law enforcement. The investigation revealed that the attack was initiated on June 17, 2016.”

Stolen information may have included names, birthdates, social security numbers, addresses, dates of service and claims information, as well as health insurance information as a current or former member of one of Banner’s health plans or as a beneficiary of a Banner Health employee benefits plan.

“Most of the time these healthcare organizations have no systems in place to alert them when lots of data is being sucked out using some privileged account,” said Mansur Hasib, program chair, cybersecurity technology, at the graduate school of the University of Maryland University College, and author of the book “Cybersecurity Leadership.”

Mansur added that Anthem, for instance, did not originally have such protections but after its massive breach installed such systems.

“As a precaution, we have secured the services of Kroll to provide credit and identity monitoring at no cost to the affected members for one year,” Banner Health said. “Kroll is a global leader in risk mitigation and response, and their team has extensive experience helping people who have sustained an unintentional exposure of confidential data.”

Further, Banner Health is enhancing the security of its systems to help prevent another such attack in the future, and has established a call center for individuals to call with any questions, the health system said.

“Banner is committed to maintaining the privacy and security of information of our patients, employees, plan members and beneficiaries, customers at our food and beverage outlets, as well as our providers,” said Peter S. Fine, president and CEO of Banner Health.

Affected members have been mailed; but if an individual believes he or she may have been affected and does not receive a letter before September 9, 2016, they can call (855) 223-4412.

Bluehost.com Web Hosting $3.95

The attack looks very similar to the infamous breach of Target Corp., said Adrian Sanabria, senior analyst, information security, at 451 Research LLC.

“Attackers allegedly were able to access hospital networks through successful attacks against food services systems,” Sanabria said. “I don’t know if Banner Health used a third-party to run its in-hospital cafes and cafeterias, but like Target’s breach, which began with a third-party HVAC vendor, there should have been no way to access payment data from food services systems. These should have been entirely segregated from one another – I can’t imagine any reason why a cafeteria point-of-sale system would need access to systems storing medical records.”

Another issue that mirrors the Target breach is a lack of visibility into what’s happening to systems and data,” Sanabria added. “One of the new technologies I’m very excited about that can help with this issue is the emergence of inexpensive attack simulation products,” he said. “By safely simulating the events of a breach, companies can more easily determine how they would fare in an actual attack and adjust as necessary.”


Six Things Your Business Has That Cybercriminals Want


The following article is excerpted from Under Attack: How To Protect Your Business and Your Bank Account From Fast-Growing, Ultra-Motivated and Highly Dangerous Cybercrime Rings, which was published by CelebrityPress on January 14th, 2016.


Belief and opinion are the biggest hurdles in implementing effective security that can help prevent an attack by cybercriminals.

I remember growing up and hearing people say, “One man’s junk is another man’s treasure.” For businesses, what they perceive as something of “no value” can be extremely valuable to a criminal. They will maximize it and expose it, giving themselves a pretty sweet deal while the business and its customers suffer. This likely disturbs you to your very core, but it doesn’t disturb the perpetrator at all.

There are six specific areas of data that are considered the jackpot for cybercriminals. If you know what the gold is, you’ll know how to protect it better.

1. Banking credentials

Think about your payroll accounts and the abundance of information that is in them. A thief will not hesitate to figure out your banking credentials and piece them together, which will give them the ability to impersonate an authorized user on the account. Then—in a matter of a minute—the payroll account is drained. What would you do if your payroll account was suddenly emptied the night before payroll processing?

2. Sensitive data from customers, vendors, and staff

Credit card numbers, Social Security numbers, and other data that help a thief take over someone else’s identity are valuable pieces of information. In the cyber underground, they can go for anywhere from $10 to $300 per record, depending on its value. Does your business have any of this type of information stored on technology of any sort?

Related article — Cybersecurity Fails: 5 Times Businesses Put Their Customers at Risk

3. Trade secrets

Entrepreneurs and innovators work hard, many creating products and services that become a part of all our futures. Along with these exciting innovations come valuable information and data such as: secret formulas, design specs, and well-defined processes. There is a market out there for this information, because some people want to shortcut the path to success by copying those who paved the way. Are your ideas and processes safeguarded from thieves?

4. Email

under attack cybersecurity book cover kris fentonIt’s hard to imagine that an email account could be of real value, but there is information on there that cybercriminals love. Here are some numbers that a prominent credential seller in the cyber underground can get:
1. $8 for an iTunes account
2. $6 for accounts from Fedex.com, Continental.com, and United.com
3. $5 for a Groupon.com account
4. $4 for hacked credentials to hosting provider Godaddy.com, as well as the wireless providers ATT.com, Sprint.com, Verizonwireless.com, and Tmobile.com
5. $2.50 for active Facebook and Twitter accounts

If your inbox was held for ransom, would you pay to get it back? If your Webmail account got hacked and was used as the backup account to receive password reset emails for another Webmail account, do you know what would happen? The result would be that an attacker could now seize both your accounts!

And here’s a startling fact: If you have corresponded with your financial institution via email, the chances are decent that your account will eventually be used in an impersonation attempt to siphon funds from your bank account. Have you ever conducted any personal business on your email that you don’t want criminals to have access to?

5. Virtual hiding places

Using your unprotected network to launch attacks against others—perhaps one of your top clients or vendors—is a favorite technique for cyber attackers. They will expose the weakest link to their end target and literally “work their way up.”

They start with a smaller company that does business with a larger firm and may have access to some of its passwords and accounts due to the type of working relationship. Then the cybercriminal finds their way into that system and starts to extract the data that they desire. They may also infect the small business’ site with malware.

When larger corporate clients and vendors visit the infected site, the malware secretly attacks that person’s computer and infects the organization. This is known as a watering hole attack. If you were attacked and it impacted your clients, would they understand?

6. Your reputation

The higher up the scale of success you go compared to your peers, the more likely it is that some of them may desire to see you come back down a bit and “make room for someone else.” There are unscrupulous competitors out there, and also disgruntled employees.

Today, targeted reputation damage is a serious concern for small to mid-size businesses. In fact, damaging attacks, whether it be data theft or destruction by rogue employees, has moved up to the third leading cause of loss according to NetDiligence® 2013 Cyber Liability & Data Breach Insurance Claims — A Study of Actual Claim Payouts. Do you rely on your reputation to help drive your business?

Most everything that a business has access to using technology, whether it is to either retrieve or store information, is of value to someone who has made a career out of attacking businesses for their own malicious gain. It may be hard to accept this, because most of us do not think like a cybercriminal—we think about our futures, our reputations, and conducting the best business we can. However, in order to know what you’re up against, you really need to start understanding what criminals may see in your business through an honest and thoughtful perspective. It’s a conversation best had with someone who understands the full scope of cybersecurity.


Buy Under Attack at Amazon right here.

Here’s How Hackers Stole $80 Million from Bangladesh Bank


The recent cyber attack on Bangladesh’s central bank that let hackers stole over $80 Million from the institutes’ Federal Reserve bank account was reportedly caused due to the Malware installed on the Bank’s computer systems.
Few days ago, reports emerged of a group of unknown hackers that broke into Bangladesh’s central bank, obtained credentials needed for payment transfers from Federal Reserve Bank of New York and then transferred large sums to fraudulent accounts based in the Philippines and Sri Lanka.
The criminal group was able to steal a total value of about $81 Million from the Federal Reserve’s Bangladesh account through a series of fraudulent transactions, but a typo in some transaction prevented a further $850 Million Heist.
However, the question was still there:
How the Hackers managed to transfer $80 Million without leaving any Trace?
Security researchers from FireEye’s Mandiant forensics are helping the Dhaka investigators to investigate the cyber heist.
Investigators believe unknown hackers installed some type of malware in the Bangladesh central bank’s computer systems few weeks before the heist and watched how to withdraw money from its United States account, Reuters reports.
Although the malware type has not been identified, the malicious software likely included spying programs that let the group learn how money was processed, sent and received.
The malware in question could be a potential Remote Access Trojan (RAT) or a similar form of spyware that gave attackers the ability to gain remote control of the bank’s computer.
The investigators suspect the hack could have exploited a “zero-day” flaw as they are unknown to vendors as well.
After this, the hackers were able to steal the Bangladesh Bank’s credentials for the SWIFT messaging system, a highly secure financial messaging system utilized by banks worldwide to communicate with each other.

“SWIFT and the Central Bank of Bangladesh are working together to resolve an internal operational issue at the central bank,” Belgium-based SWIFT said in a statement Friday. “SWIFT’s core messaging services were not impacted by the issue and continued to work as normal.”

Security experts hope that the malware sample will be made available to the security researchers soon so that they can determine whether the sample was truly advanced, or if Bangladesh Central Bank’s security protection was not robust enough to prevent the hack.
The Bangladesh Bank discovered weaknesses in its systems, which could take years to repair the issues though the Federal bank has denied any system compromise.


Security Concerns That Entrepreneurs Should Address

db6056bb-94d8-44e3-8369-de8ce117d89f-mediumWhen it comes to running your own business, there is no end to the number of obstacles and obligations that today’s busy entrepreneurs need to take care of. However, one of the most important things that every entrepreneur needs to remember has to do with security. In today’s market, security has become a major challenge for all types of entrepreneurs, in all different industries and from all different walks of life. Understanding what these security threats are and why they are important is essential information for every entrepreneur to know. After all, the more you understand, the better equipped you will be to ward off these security threats moving forward.

Cyber Security
There is perhaps no more dangerous type of security threat present in our market today than cyber security. There are so many entrepreneurs who simply don’t have enough of a tech background to really understand cyber security, what it is, what it entails and why it is so risky. Hackers from anywhere in the world can easily hack into your computer system and steal important information from you and from your clients and customers, without you ever knowing. This is why it is so important to hire a cyber security professional to make sure your networks and your systems are safe.

Security Personnel
You can never put too much emphasis on security within your business. If you want to make sure that your customers and your employees are always safe, particularly if you live in a busy area, then you need to have security guards on staff. You would be surprised by how many threats and issues that can be resolved by simply having security personnel on the grounds. Many business owners underestimate their need for security personnel at their place of business; however, Dave Ngo of AlertSecurityandPatrol.com says, “People have a sense of security when a security officer is present.  They are an extra set of eyes for personal, property, and asset protection.  Customer’s would feel more comfortable with security present which will enhance their work, entertainment, or shopping experience.”

Surveillance Systems
Surveillance systems are some of the most important features to have in your business. Whether you are looking to find out who broke into your business or if an employee is jeopardizing your company or your money, there is no better way to do it than with live video footage. Installing a surveillance system in a building is actually easier and more cost effective than many people think. Make sure to have a sign somewhere in your business letting people know that you have cameras on the premises, many times, the sign alone can do a great deal of good in preventing incidents from happening.

Implement Mobile Security Systems
Today, it seems as though people use their mobile phones more than they use virtually any other piece of technology. Yet, very few entrepreneurs take the time to make sure that their mobile devices, and the mobile devices of their entire staff are safe from mobile apps. A recent study found that most organizations allow their employees to download apps to their work devices without vetting them first, this means that there could be a number of viruses coming through to your work devices. Mobile security is about more than just devices though. Mobile content, apps and sharing data through mobile devices can all put your company at risk.

While most entrepreneurs likely feel that they already have more than enough on their plates with running their own business, it is important that they also take the time to take additional security measures to keep their business, their money and their employees as safe as possible.