Zimbabwe blocks Facebook, WhatsApp and Twitter amid crackdown

/in ,

Zimbabwe has blocked Facebook, Twitter and WhatsApp messaging app amid a crackdown on days of violent protests, BBC reported on Friday.

A coalition of local human rights groups says at least 12 people have been killed and many more beaten and tortured by security forces this week.

The Zimbabwe Human Rights NGO Forum accused the authorities of cutting off the internet “to mask the massive human rights violations”.

The protests were sparked on Monday by a sharp rise in the price of fuel.

The government has blamed the opposition and political rights groups for the protests, which has seen riot police clashing with protesters in the capital, Harare, and the southern city of Bulawayo after they lit fires and blocked roads using rocks.

There has been looting and some businesses and schools in the two cities have been forced to close. Soldiers are guarding petrol stations, where there are still long queues of motorists looking for petrol.

The UN has called on the government to halt the “excessive use of force” by security forces including firing live ammunition, and allegations of night-time door-to-door searches and beatings.

“Doctors’ associations say more than 60 people were treated in hospital for gunshot wounds, this is not way to react to the expression of economic grievances by the population,” Reuters news agency quotes UN human rights spokesperson Ravina Shamdasani as saying.

The Zimbabwe Human Rights NGO Forum said it had recorded at least 844 human rights violations in all.

On Thursday, prominent activist Evan Mawarire, who called for a stay-at-home protest on social media, was charged with subverting the government, a crime which carries up to 20 years in jail. He gained fame as a figurehead of the #ThisFlag protests against the former president, Robert Mugabe, in 2016.

President Emmerson Mnangagwa said the rise was aimed at tackling shortages caused by an increase in fuel use and “rampant” illegal trading.

But many Zimbabweans – worn down by years of economic hardship – suddenly found they could not even afford the bus fare to work.

Roads were barricaded by protesters earlier this week

They feel that the president, who is on a tour of Russia and Asian countries this week, is failing to live up to his promises following his election last year in disputed polls.

He is struggling to revive the economy, which is experiencing high inflation while wages have stagnated.

The southern African nation faces a severe shortage of US dollar cash and confidence in its bond notes, currency that can only be traded in Zimbabwe, is low.

The bond notes, or “bollars”, are supposed to be worth the same as the dollar but have lost value because of a lack of foreign currency backing the note, and are now worth much less than a dollar.

The fuel hike means petrol prices rose from $1.24 (₦445.16) a litre to $3.31(₦1,188.29) , with diesel up from $1.36(₦488.24) a litre to $3.11(₦1,116.49).

The new prices mean Zimbabwe now has the most expensive fuel in the world, according to GlobalPetrolPrices.com.

What Data Big Tech Companies Admit To Have On You

/in

Have you ever asked yourself, “What does the Data big companies such as Google know about me?” The answer is uncomfortable. What Google knows about you includes everything from your clicks on ads to your birthday to the device you’re using right now and the Wi-Fi network it’s connected to. But Google pales in comparison to some of the other big companies that sell your data or collect it out there.

This is what the big six tech companies have officially admitted to collecting as far as personal data about you, according to their official privacy policies.

The Data Big Tech Companies Have On You

5 new cyberthreats pop up every second, here’s how to protect yourself

/in , ,

The start of 2018 has seen a massive rise in cryptocurrency mining and cryptojacking attacks, along with steady numbers of familiar malware and ransomware attacks, according to a Wednesday report from McAfee. On average, five new threat samples arose every second of Q1 2018, with several notable campaigns demonstrating just how sophisticated hackers have become.

“There were new revelations this quarter concerning complex nation-state cyber-attack campaigns targeting users and enterprise systems worldwide,” Raj Samani, chief scientist at McAfee, said in a press release. “Bad actors demonstrated a remarkable level of technical agility and innovation in tools and tactics. Criminals continued to adopt cryptocurrency mining to easily monetize their criminal activity.”

Of particular note was the rapid expansion of cryptojacking and other cryptocurrency mining attacks, in which criminals hijack victim’s browsers or infect their systems to mine for cryptocurrencies like Bitcoin—often without their knowledge. Coin miner malware grew a whopping 629% this year, growing from about 400,000 total known samples in Q4 2017 to more than 2.9 million in Q1 2018.

The rapid growth suggests that cybercriminals are drawn to the ease of infecting a user’s system and collecting the payments themselves, without having to rely on another party to monetize their attack, the report said.

“Cybercriminals will gravitate to criminal activity that maximizes their profit,” Steve Grobman, CTO at McAfee, said in the release. “In recent quarters we have seen a shift to ransomware from data-theft, as ransomware is a more efficient crime. With the rise in value of cryptocurrencies, the market forces are driving criminals to crypto-jacking and the theft of cryptocurrency. Cybercrime is a business, and market forces will continue to shape where adversaries focus their efforts.”

However, cryptomining is far from the only cyberthreat that businesses need to keep on their radar and protect against. Here are five campaigns the report identified as wreaking major havoc in Q1.

1. Bitcoin-stealing campaigns

A cybercrime ring called Lazarus launched a sophisticated Bitcoin-stealing phishing campaign called HaoBao this year, targeting global financial institutions and Bitcoin users, the report found. The attack came via malicious email attachments to victims, which, when opened, would implant a tool that scanned for Bitcoin activity and established a connection for ongoing data gathering and cryptomining.

2. Gold Dragon attacks

In January, the Gold Dragon attack targeted organizers of the Pyeongchang Winter Olympics in South Korea. The fileless malware attack—executed via a malicious Microsoft Word attachment that contained a hidden PowerShell implant script—encrypted stolen data and sent it to the attackers.

3. GhostSecret and Bankshot attacks

The international cybercrime group known as Hidden Cobra is believed to be associated with Operation GhostSecret, an attack targeting the healthcare, finance, entertainment, and telecommunications sectors and stealing data. The latest variation of the attack, called Bankshot, uses an embedded Adobe Flash exploit to allow hackers to get into victims’ systems.

4. LNK exploits

The amount of malware that exploits LNK capabilities grew 59% from Q4 2017 to Q1 2018, the report found. Meanwhile, PowerShell attacks have slowed.

5. Gandcrab ransomware

Growth in new ransomware slowed by 32% in Q1. However, the Gandcrab strain infected some 50,000 systems in the first three weeks of the quarter alone, taking Locky’s place as the ransomware leader. Gandcrab uses advanced methodologies, such as requesting ransom payments through the Dash cryptocurrency rather than through Bitcoin, to extract more value from their targets.

Tips to protect your business

Despite the rise of new attack types, business leaders can take a number of steps to protect employees and data.

In terms of cryptojacking, the attack is blocked by default in the browser Opera. Mozilla’s Firefox 63, due out in October, will block the attacks as well. Users can also download the minerBlock extension for Chrome and Firefox, as noted by TechRepublic contributor James Sanders.

Businesses can avoid the impact of ransomware by backing up files every day, and by taking other preventative steps.

Employee education remains paramount to any cybersecurity policy. Top ways to train employees to avoid cyberattacks include offering customised examples of threats that are relevant to an employee’s department and role (and particularly what phishing attacks look like), running unscheduling simulations of typical attacks, providing training models that employees can complete at their convenience, and rewarding those who take the proper actions.

Development Standards Technologies Tech Republic

Cyber attack claims player details from World Rugby

/in ,

World Rugby has been forced to suspend one of its websites after the governing body was the target of a cyber attack that saw hackers obtain personal data from thousands of subscribers to one of their databases, The Sunday Telegraph can reveal.

It is understood that the hackers were able to access the first name, email address and encrypted passwords of thousands of users, including players, coaches and parents from across the world after the security breach on May 3.

It is not yet clear if it was a random attack to steal data or if World Rugby was deliberately targeted by one of the cyber espionage groups that has previously leaked confidential information from the websites of sporting bodies such as WADA and the IAAF.

The hackers targeted World Rugby’s training and education website, which is a platform for the grass-roots game to keep up to date with the latest drills to improve technique and offer advice for the prevention of injuries such as ­concussion.

World Rugby’s main website, including Rugby World Cup ticketing and fan data plus sensitive information around players’ disciplinary hearings, was not at risk from the attack.

World Rugby immediately took down the affected sites and denied access to databases when it detected the breach and brought in data and technology ­security experts to investigate the nature and scope of the incident and put in steps to prevent a similar attack.

As of yesterday, the training and education portal remained offline.

World Rugby also sent emails to the subscribers to warn them of the breach and reassure them that as the passwords were encrypted, there was no danger of them being breached.

Subscribers, however, were recommended to change their passwords when the site comes back online.

As World Rugby is based in Dublin, the governing body also informed the Irish Data Protection Commissioner’s office of the breach. The details of the attack emerged just days before the EU’s general data protection regulation comes into effect on May 25.

World Rugby could have faced a sanction from the Association of Data Protection Officers (ADPO) if the breach had occurred after that date. The ADPO will have the power to fine organisations up to €10 million (₦4,250,000,000) for data security breaches, depending on mitigating factors.

Sean Burnard, one of the subscribers who received the email alert, said he was alarmed by the breach. Burnard uses the portal to access the training drills and technique tips to help his sons improve their skills.

“At first my concern was that it was a spoof email but then it was confirmed that there had been a security breach,” he said.

The Telegraph

Microsoft Publishes PDF With Every Windows Terminal Command

/in ,

Download Windows Commands Reference

If you wanted an exhaustive reference for all the windows terminal command line tools and utilities available in Windows, “/h” was as good as it got. Well, that was until last month, when Microsoft published a whopping big PDF with information on every single terminal command the operating system has to offer.

The document, released on April 18, comes in at 4.6MB and 948 pages and covers the following platforms:

  • Windows Server (Semi-Annual Channel)
  • Windows Server 2016
  • Windows Server 2012 R2
  • Windows Server 2012
  • Windows Server 2008 R2
  • Windows Server 2008
  • Windows 10
  • Windows 8.1

Even though Windows 7 is absent, it’s fair to say a lot of the commands should work on the older OS.

The reference isn’t just limited to commands — it also contains tips for configuring the command prompt window, as well as changes you can make to the Registry to enable and disable features, such as filename / directory completion.

Best of all, hyperlinks embedded in the file for each command jump directly to online documentation, so you can always check out the most up-to-date content.

This does however raise the question: why have a gigantic reference PDF in the age of online documentation?

Download Windows Commands Reference

lifehacker

First-Ever Ransomware Found Using ‘Process Doppelgänging’ Attack to Evade Detection

/in , ,

Security researchers have spotted the first-ever ransomware exploiting Process Doppelgänging, a new fileless code injection technique that could help malware evade detection.

The Process Doppelgänging attack takes advantage of a built-in Windows function, i.e., NTFS Transactions, and an outdated implementation of Windows process loader, and works on all modern versions of Microsoft Windows OS, including Windows 10.

Process Doppelgänging attack works by using NTFS transactions to launch a malicious process by replacing the memory of a legitimate process, tricking process monitoring tools and antivirus into believing that the legitimate process is running.

If you want to know more about how Process Doppelgänging attack works in detail, you should read this article published late last year on thehackernews.com.

Shortly after the Process Doppelgänging attack details went public, several threat actors were found abusing it in an attempt to bypass modern security solutions.

Security researchers at Kaspersky Lab have now found the first ransomware, a new variant of SynAck, employing this technique to evade its malicious actions and targeting users in the United States, Kuwait, Germany, and Iran.

Synack Ransomware process - Doppelganging

Initially discovered in September 2017, the SynAck ransomware uses complex obfuscation techniques to prevent reverse engineering, but researchers managed to unpack it and shared their analysis in a blog post.

An interesting thing about SynAck is that this ransomware does not infect people from specific countries, including Russia, Belarus, Ukraine, Georgia, Tajikistan, Kazakhstan, and Uzbekistan.

To identify the country of a specific user, the SynAck ransomware matches keyboard layouts installed on the user’s PC against a hardcoded list stored in the malware. If a match is found, the ransomware sleeps for 30 seconds and then calls ExitProcess to prevent encryption of files.

SynAck ransomware also prevents automatic sandbox analysis by checking the directory from where it executes. If it found an attempt to launch the malicious executable from an ‘incorrect’ directory, SynAck won’t proceed further and will instead terminate itself.

Once infected, just like any other ransomware, SynAck encrypts the content of each infected file with the AES-256-ECB algorithm and provides victims a decryption key until they contact the attackers and fulfil their demands.

Synack Ransomware

SynAck is also capable of displaying a ransomware note to the Windows login screen by modifying the LegalNoticeCaption and LegalNoticeText keys in the registry. The ransomware even clears the event logs stored by the system to avoid forensic analysis of an infected machine.

Although the researchers did not say how SynAck lands on the PC, most ransomware spread through phishing emails, malicious adverts on websites, and third-party apps and programs.

Therefore, you should always exercise caution when opening uninvited documents sent over an email and clicking on links inside those documents unless verifying the source in an attempt to safeguard against such ransomware infection.

Although, in this case, only a few security and antivirus software can defend or alert you against the threat, it is always a good practice to have an effective antivirus security suite on your system and keep it up-to-date.

Last but not the least: to have a tight grip on your valuable data, always have a backup routine in place that makes copies of all your important files to an external storage device that isn’t always connected to your PC.

the hacker news

Android P to stop apps from monitoring network activity

/in ,

In the future, it looks like Android apps will no longer be able to detect when other apps on your device are connecting to the internet.

It’s about time Google patches this nasty privacy flaw. Any app can monitor your network activity without your knowledge to see when you connect with a competing app, or perhaps worse.

XDA Developers first noticed the new changes coming to Android’s SELinux rules for apps targeting API level 28 running on Android P:

A new commit has appeared in the Android Open Source Project to “start the process of locking down proc/net.” /proc/net contains a bunch of output from the kernel related to network activity. There’s currently no restriction on apps accessing /proc/net, which means they can read from here (especially the TCP and UDP files) to parse your device’s network activity.

The SELinux changes only enable designated VPN apps to access some networking information, according to the code. As XDA Developers points out, Android apps won’t have to target API level 28 until 2019 — meaning the flaw could still be accessed for some time.

We’ll be looking for changes in the next release of the Android Open Source Project. Hopefully Google will jump in and patch things before Android P’s future release.

zdnet

Sophisticated Android malware ZooPark tracks all your phone activities

/in

An advanced type of malware can spy on nearly every Android smartphone function and steal passwords, photos, video, screenshots and data from WhatsApp, Telegram and other apps. “ZooPark” targets subjects in the Middle East and was likely developed by a state actor, according to Kaspersky Lab, which first spotted and identified it.

ZooPark has evolved over four generations, having started as simple malware that could “only” steal device account details and address book contacts. The last generation, however, can monitor and exfiltrate keylogs, clipboard data, browser data including searching history, photos and video from the memory card, call records and audio, and data from secure apps like Telegram. It can also capture photos, video, audio and screenshots on its own, without the subject knowing. To get the data out, it can silently make calls, send texts and execute shell commands.

Kaspersky — a company with its own spotty security history that has been banned by the US government — said that it has seen less than 100 targets in the wild. “This and other clues indicates that the targets are specifically selected,” Kasperky Lab’s Alexey Firsh told ZDNet. It also implies that the campaign is backed by a nation state, though the security firm didn’t say which.

How the Malware works

At the same time, Kaspersky suggested that the malware might not have been built in-house. “The latest version may have been bought from vendors of surveillance tools,” it wrote. “That wouldn’t be surprising, as the market for those espionage tools is growing, becoming popular among governments, with several known cases in the Middle East.”

As is now known, a lot of those tools came from the US government itself. A group called Shadow Brokers famously stole exploits from the NSA — some of the zero day, unpatched variety — and eventually released them to the public. In other words, a hacking group was able to obtain malware from what should be the most secure agency in the world. That’s one of the reasons that security experts and companies like Apple don’t trust the US government with device backdoors.

Engadget

Samsung rolling out update to fix Galaxy S9 and S9+ call stability issues

/in

Reliably making phone calls on your smartphone is easy to take for granted, but there’s nothing like disrupted and dropped calls to help you appreciate that simple function again. Some Samsung Galaxy S9 and S9+ owners are having their voices muted or distorted during calls, or having their calls dropped altogether. Now Samsung is starting to roll out a software update in some countries to fix these issues.

These problems have been reported by more than a few users around the world, and late last month Samsung said a fix would roll out soon. It seems some S9 and S9+ owners in parts of Europe, the Middle East, Africa, and Australia are now receiving the promised update. The build numbers are G960FXXU1ARD4 for the S9 and G965FXXU1ARD4 for the S9+, with slight region-based variations. The size of the update appears to weigh in around 150MB, though the exact size will vary depending on the build number.

The “What’s New” section of the software update includes two items:

  • Call stability has been improved.
  • The quality of Wallpaper has been improved.

It’s worth noting that this update does not include a security patch, which isn’t surprising since Samsung started rolling out updates for the S9 and S9+ that included the April security patch a couple weeks ago.

These call stability issues are reminiscent of some S8 and Note8 units having muted mics, which had to be blown on in order to be fixed. And this isn’t the only issue owners of Samsung’s latest flagships are reporting: Some users have dead zones on their touchscreens.

If you own an S9 or S9+ that has these annoying call issues and get the update, let us know if the fix works. You can manually check for it by going to Settings > Software update.

android police

CBN limits USSD transactions to N100,000 per day

/in

EFFECTIVE from June this year bank customers will not be able to use Unstructured Supplementary Service Data (USSD) channel to conduct transactions more than N100, 000 per day.

Also they will have to use both their PIN and a soft token to authenticate transactions above N20, 000. The USSD is a technology platform for online payments.

In addition, banks must allow their customers the option to opt out of USSD channel for financial transactions.

These were highlights of the ‘Regulatory Framework for the use of Unstructured Supplementary Service Data (USSD) for Financial Services in Nigeria’, issued by the Central Bank of Nigeria, CBN, yesterday.

In a circular announcing the framework, Director, Banking System and Payments Department, CBN, stated: “The vast applications of the USSD technology, in terms of available services have raised the issue of the risks inherent in the channel. In this regard, concerns have been expressed on the likely exposure of CBN approved entities to the possible breaching of the USSD accessed financial services in view of likely vulnerabilities in the technology and the ever growing threats.

‘‘Furthermore, the implementation in Nigeria has created multiple USSD channels to customers, thereby increasing their exposure to risk, without a common standard for all. ‘‘This framework therefore, seeks to establish the rules and risk mitigation considerations when implementing USSD for financial services offering in Nigeria.”

Among other things, the framework stated: “USSD based financial transaction requires encryption to protect the integrity of the financial information. To this end, Financial Institutions providing use of the USSD channel shall: Ensure that the customer receives notification on the status of every transaction conducted through the channel; Not use the USSD service to relay details of other electronic banking channels (in case of banks), to their customers, to prevent compromise of other electronic banking channels through the USSD channel; Avail the customers the option to opt in/out of the USSD channel for financial Transactions.’’

vanguard