Network Security – How To Secure Wi-Fi Networks Effectively From Hackers – A Complete Guide

Wireless security is specifically created to keep unauthorized users from accessing your Wireless Network and stealing sensitive information. The type of Wireless security that an individual uses is identified by its wireless protocol. Today, numerous homes and companies operate and rely on Wireless Networking. Wi-Fi is incredibly efficient in keeping users connected to the internet.

For more details refer https://gbhackers.com/wireless-security/

 

Sudo Flaw Lets Linux Users Run Commands As Root Even When They’re Restricted

linux sudo hacking

Attention Linux Users!

A vulnerability has been discovered in

Sudo

—one of the most important, powerful, and commonly used utilities that comes as a core command installed on almost every UNIX and Linux-based operating system.

The vulnerability in question is a sudo security policy bypass issue that could allow a malicious user or a program to execute arbitrary commands as root on a targeted Linux system even when the “sudoers configuration” explicitly disallows the root access.

Sudo, stands for “superuser do,” is a system command that allows a user to run applications or commands with the privileges of a different user without switching environments—most often, for running commands as the root user.

By default on most Linux distributions, the ALL keyword in RunAs specification in /etc/sudoers file, as shown in the screenshot, allows all users in the admin or sudo groups to run any command as any valid user on the system.

However, since privilege separation is one of the fundamental security paradigms in Linux, administrators can configure a sudoers file to define which users can run what commands as to which users.

So, even if a user has been restricted to run a specific, or any, command as root, the vulnerability could allow the user to bypass this security policy and take complete control over the system.

“This can be used by a user with sufficient sudo privileges to run commands as root even if the Runas specification explicitly disallows root access as long as the ALL keyword is listed first in the Runas specification,” the Sudo developers say.

How to Exploit this Bug? Just Sudo User ID -1 or 4294967295

The vulnerability, tracked as CVE-2019-14287 and discovered by Joe Vennix of Apple Information Security, is more concerning because the sudo utility has been designed to let users use their own login password to execute commands as a different user without requiring their password.

What’s more interesting is that this flaw can be exploited by an attacker to run commands as root just by specifying the user ID “-1” or “4294967295.”

That’s because the

function which converts

user id into its username incorrectly treats -1, or its unsigned equivalent 4294967295, as 0, which is always the user ID of root user.

“Additionally, because the user ID specified via the -u option does not exist in the password database, no PAM session modules will be run.”

The vulnerability affects all Sudo versions prior to the latest released version 1.8.28, which has been released today, a few hours ago and would soon be rolled out as an update by various Linux distributions to their users.

So, if you use Linux, you are highly recommended to update sudo package manually to the latest version as soon as it is available.

Read the Full Article here: >The Hacker News [ THN ]

First look at CCleaner’s Health Check feature

Piriform, maker of the popular temporary file cleaner CCleaner, started to integrate a new Health Check feature in the latest version of the client.

The release notes of CCleaner 5.62.7538 reveal that Health Check is the "next iteration" of the recently introduced Easy Clean feature of the client. The company plans to roll out the feature to all clients in the coming weeks.

Easy Clean’s main purpose was to make CCleaner easier to use for non-technical users. Easy Clean ran automatically for the most part and offered less functionality than the program’s full mode. The mode lacked customization options and focused on trackers and temporary files (called junk) only.

We concluded back then that it had nothing to offer for technical users but could be an option non-technical users.

CCleaner’s Health Check feature

checking pc health

Health Check replaces Easy Clean in the CCleaner interface. The feature is available in all versions of the application but the free version is somewhat limited; that’s one of the differences between Health Check and Easy Clean.

CCleaner displays a number of intro pages on first run that claim that the feature may improve PC security and privacy, free up disk space, and boost performance. Some of these claims may sound like snake oil at first as they may remind of the promise of game boosters to improve PC performance.

Health Check scans analyze the PC in four different areas (two of which are limited to commercial versions):

  1. Privacy — checks for trackers, e.g. cookies.
  2. Space — checks for temporary files that can be removed to free up space.
  3. Speed — checks for startup items and suggests items that you may disable to speed up system start.
  4. Security — checks for application updates.

All Health Check does is combine several of the tools of CCleaner in a new Health Check component. Security seems to use the built-in software updater of the professional version to highlight programs for which updates are available.

health check result

CCleaner displays a health status after the scan, e.g. "your PC feels under the weather". The status is only displayed if the program is allowed to connect to the Internet. Likewise, Speed and Security results are only available if the program is connected to the Internet; an "unavailable when offline" message is displayed otherwise.

Closing Words

CCleaner’s Health Check has not improved all that much for free users as it limits cleaning to trackers and junk files on the system. Pro users benefit from the added startup programs and program version checks. All of these options are also available under custom clean or tools, and experienced users may prefer these over running Health Check.

The new module may be useful to users who want results fasts and without having to dig deeper into program mechanics.

Now You: Would you run something like Health Check? (via Techdows)

Thank you for being a Ghacks reader. The post First look at CCleaner’s Health Check feature appeared first on gHacks Technology News.

Read the Full Article here: >Top 100 Network Security Tools

11 steps organizations should take to improve their incident response strategy

As the year draws to a close, it is time for businesses across all industries and sectors to reflect and prepare for the upcoming new year. With this in mind, FIRST has produced 11 vital steps that organizations should take to improve their incident response strategy.

organizations incident response strategy

It is highly likely that an organization will face a cybersecurity incident of some sort at some point in its lifetime, regardless of the level of cybersecurity defense in place.

According to a global survey undertaken by Marsh in partnership with Microsoft, two-thirds of respondents ranked cybersecurity as a top five risk management priority, but only 19% expressed high confidence in their organization’s ability to manage and respond to a cyber event, and only 30% have developed a plan to do so.

Below are 11 steps that an organization should take to become more resilient against an incident.

Planning for a security incident

Assign a clear incident leader: During a response, coordination is needed across many teams, including Security, IT, Engineering, Operations, Legal, Human Resources and Public Relations. In most cases, technical response work will not all be conducted by a single team.

However, organizations benefit by having one clear authority within the organization who defines the process that will be followed and focuses on planning those interactions ahead of an incident.

Manage the information gap: Plan ahead to have a communications lead, who works closely with the incident leader, and works to satisfy third party information requests from across the organization. During an incident, there will be a large set of requests for information, with a small team actually investigating and developing the deliverables.

An often-overlooked piece is to record details of each decision as it happens. When you look to perform a post-mortem after the event it can be extremely difficult to recall the exact timeline of the incident. Multiply this with the complexity of many of the incidents we see today and it can become almost impossible.

Your team needs to build relationships with the incident response community. Effective cooperation during an incident is about trust. When an incident strikes, it’s too late to build it. Have your team engage with business partners, national Computer Security Incident Response Teams (CSIRTs) and service providers before you need the relationship.

Join relevant organizations in the field, meet their security teams at conferences and industry working groups, or use existing mechanisms such as a vendor review process to determine and track the right points of contact early on.

Retain external legal, PR and technical support: There will be technical skills not available to your team. These may include legal, public relations and technical support, such as crisis management or disk forensics. Find a provider for these services and sign a retainer, before the incident strikes.

Study applicable reporting requirements: You may have made commitments to your customers on how quickly you’ll inform them when data is breached.

Even if you haven’t, various legal reporting regulations are now in effect, such as the GDPR, where organizations typically have up to 72 hours to gather relevant information and report to the appropriate regulator – or the European Union NIS Directive, according to which specific Digital Service Providers must report “with no undue delay”.

Work with your legal team to understand each requirement ahead of time, so your incident response process takes them into account.

Exercise, exercise, exercise: It’s a common misunderstanding that security exercises are only important once you’ve achieved a certain level of maturity. In fact, exercises pay off from the very beginning.

Take a scenario that affected another organization and perform a table-top walkthrough of how your organization would deal with that same incident. At the very least you’ll identify gaps you still have to address.

Exercises should be regular and involve a range of participants. It’s important that the senior members of an organization (right up to senior executive management) as well as the technology and other staff participate. The “muscle memory” this will build is invaluable when a real incident occurs.

Responding effectively and managing risk

Communicate often and early: When a security incident is known to the public, it’s important to acknowledge it early, even if you can only state you are investigating. This helps ensure that affected parties understand you are aware and working on it and will be a source of information in the future.

Providing regular updates helps ensure a cadence, so they will come back at regular intervals and will feel less inclined to go look for information from other sources, which may be inaccurate.

Be truthful and straightforward: End users lose trust when communication isn’t clear and understandable, or if they feel you are not expressing what truly happened. Be clear and write to the technical level of your users, but don’t make things sound better than they truly are. When end users are exposed to risk as a result of your breach, say it.

Don’t lose track of the basics: “What would have happened if this took place on another system?” is valuable information, but you should first focus on the key questions you need your team to pursue early on.

Higher priority questions typically include: “How did the breach take place?” and “What customer data is affected?”. Failing to reach basic agreement on the impact of an incident can cause delays and confusion later.

After the incident

Study and document your response: The most important phase when handling a security incident is the “post-mortem”. It’s almost impossible to prevent all incidents from happening, so this is a chance to review why this one took place and identify ways to improve your program.

Ask the “Five Why’s”: every time you believe you have an answer to why the incident took place, ask for a deeper, underlying cause, until you hit at least five levels of “Why.” Address all levels, and focus on the deeper, underlying ones, as they will lead to other, future incidents if left unaddressed.

Never let a good incident go to waste: There are two positive benefits from an incident: The first is that as it so clearly illustrates both needs and impacts; an incident is often the best time to get additional investment to prevent the next one.

Make sure to clearly communicate what your security program needs to be more effective and create follow up plans to get buy-in from senior leadership in your organization. Secondly, every incident you work helps you learn more about your process and your organization; how your systems interact but more importantly, how your people interact.

Share your learnings: As a community, we can only become better if we actively share information on the cybersecurity issues we experience. Airlines are so safe exactly because every failure is scrutinized and shared in detail with others, and action plans are made by airlines regardless of who was originally affected.

By sharing your learnings, other community members have an opportunity to learn, and the internet becomes a safer place to socialize and do business.

By taking these steps, organizations will be in a better place to effectively respond to a security incident. Finally, think of organizations in the context of a supply chain. Most organizations care about a breach of customer information. But even more persistent and concerning can be the effect of products and deliverables on other organizations.

In this position, for instance as a B2B provider selling hardware and software, or providing a service that when interrupted, would impact critical infrastructure, the narrow definition of a data breach may not be the biggest concern and other risks will need to be addressed and analyzed.

Read the Full Article here: >Help Net Security – News

German banks to stop using SMS to deliver second authentication/verification factor

German banks are moving away from SMS-based customer authentication and transaction verification (called mTAN or SMS-TAN), as the method is deemed to be too insecure.

German banks SMS-TAN

According to German business news outfit Handelsblatt, a number banks – whether private, co-operative or public – have either stopped offering the option or are planning to remove it by the end of the year. Among these are Postbank, Berliner Sparkasse, Consorsbank, and others.

The reasons are mostly due to security and regulation compliance

Since a lot of people do their online banking via their mobile/smart phones, hackers need to compromise only this device to get all the information needed to perform a fraudulent transaction. Users can have also their online banking credentials compromised and be targeted with fake text messages purportedly coming from the bank.

It’s also becoming common for attackers to perform SIM swapping to impersonate the target’s phone and validate the fraudulent transaction. And, finally, there have been instances of criminals exploiting long-known security vulnerabilities in the SS7 protocols to bypass German banks’ two-factor authentication and drain their customers’ bank accounts.

The German Federal Office for Information Security (BSI) has been warning of security risks of using SMS-TAN for years, Handelsblatt noted, and instances of abuse of the mTan process have become more frequent.

Also, banks and other payment services providers must get in line with the EU Payment Services Directive 2 (PSD2), which mandates that remote electronic transactions performed by EU consumers must be authorized using “strong customer authentication” (SCA).

“‘Strong customer authentication’ means an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data,” the Directive states.

Also: “Where the payer’s payment service provider does not require strong customer authentication, the payer shall not bear any financial losses unless the payer has acted fraudulently.”

SMS-TAN falls into the “knowledge” element, and the European Banking Authority (EBA) does not considered it to be SCA-compliant.

With the mTan option gone, users will have to start using:

  • ChipTANs (TAN generator devices provided by banks)
  • Photo-TANs (a special mobile app or reader device that photographs a “barcode” on the computer screen and generates the TAN number)
  • Push-TANs (via a specialized Tan app) or
  • Digital signatures (via smart cards).

Read the Full Article here: >Help Net Security – News

Cash rules the day when Telstra outage cripples ATMs, payment systems across Australia

Australian shoppers were left high and dry for three or more hours on Thursday when ATMs and some Eftpos terminals stopped working, due to a service outage with Telstra, the country’s main telecommunication provider. 

The nation’s big four banks  — Commonwealth Bank of Australia, Westpac Banking Corporation, Australia and New Zealand Banking Group and National Australia Bank — and many retailers, including Woolworths, Caltex Australia and Australian Post, were among those hit by the failure, leaving many shoppers unable to access cash or complete their payments at the checkout counter. 

The outage began around 3 p.m. AEST on Thursday. Just before 6 p.m. AEST, Telstra confirmed the network was back. “Good news. Many of our services are starting to restore. We’re sorry if this issue has messed up your night. We’ll provide another update when we know more.” the company said in a tweet

Still, retailers lost money during the blackout period. Some restaurants had to let meals go unpaid and some petrol stations were also left hanging, when customers had no cash on them and were unable to get cash, because ATMs were also down, according to iTnews

Just how much did retailers lose out on during the outage? Dominique Lamb, CEO at National Retailers Association, Lamb told the Sydney Morning Herald that in July 2018, AUS$837 million (US $585 million) was spent each day on retail purchases in the country. 

“We know that basically, they were finding it very difficult to trade for the second half of that day which is ultimately going to have an impact … we’re predicting it’s going to be up to $100 million [US$70 million],” she said.

The teleco is still investigating the cause of the outage but says early investigations point to “an unusually large volume of traffic” across networks in NSW Australia, according to the Herald.

Read the Full Article here: >ATM Marketplace News

British Airways Fined £183 Million Under GDPR Over 2018 Data Breach

Britain’s Information Commissioner’s Office (ICO) today hit British Airways with a record fine of £183 million for failing to protect the personal information of around half a million of its customers during

last year’s security breach

.

British Airways, who describes itself as “The World’s Favorite Airline,” disclosed a breach last year that exposed personal details and credit-card numbers of up to 380,000 customers and lasted for more than two weeks.

At the time, the company confirmed that customers who booked flights on its official website (ba.com) and British Airways mobile app between August 21 and September 5 had had their details stolen by attackers.

The cyberattack was later attributed to the infamous

Magecart

threat actor, one of the most notorious hacking groups specialized in stealing credit card details from poorly-secured websites, especially online eCommerce platforms.

Magecart hackers have been known for using digital credit card skimmer wherein they secretly insert a few lines of malicious code into the checkout page of a compromised website that captures payment details of customers and then sends it to a remote server.

Besides British Airways, Magecart groups have also been responsible for card breaches on sites belonging to high-profile companies like

TicketMaster

,

Newegg

, as well as sites belonging to other

small online merchants

.

In a statement

released today

, ICO said its extensive investigation found that a variety of information related to British Airways’ customers was compromised by “poor security arrangements” at the company, including their names and addresses, log-ins, payment card data, and travel booking details.

“People’s personal data is just that – personal. When an organization fails to protect it from loss, damage or theft, it is more than an inconvenience,” Information Commissioner Elizabeth Denham said.

“That’s why the law is clear – when you are entrusted with personal data, you must look after it. Those that don’t will face scrutiny from my office to check they have taken appropriate steps to protect fundamental privacy rights.”

However, ICO also said that British Airways has cooperated with its investigation and has made improvements to the security arrangements since the last year data breach came to light.

Since the data breach happened after the EU’s General Data Protection Regulation (GDPR) took effect on May 2018, the fine of £183.39 million has been imposed on British Airways, which is the equivalent of 1.5% of the company’s worldwide turnover for its 2017 financial year but is still less than the possible maximum of 4%.

In response to the ICO announcement, British Airways, owned by IAG, said the company was “surprised and disappointed” by the ICO penalty.

“British Airways responded quickly to a criminal act to steal customers’ data,” said British Airways chairman and chief executive Alex Cruz.

“We have found no evidence of fraud/fraudulent activity on accounts linked to the theft. We apologize to our customers for any inconvenience this event caused.”

The company has 28 days to appeal the penalty.

Until now, the most significant penalty by the UK’s data protection watchdog was £500,000, which was

imposed on Facebook

last year for allowing political consultancy firm Cambridge Analytica to gather and misuse data of 87 million users improperly.

The same penalty of £500,000 was also imposed on

credit reporting agency Equifax

last year for its 2017’s massive data breach that exposed the personal and financial information of hundreds of millions of its customers.

Since both the incidents in Facebook and Equifax occurred before GDPR took effect, £500,000 was the maximum penalty ICO can impose under the UK’s old Data Protection Act.

Read the Full Article here: >The Hacker News [ THN ]

OWASP ZAP’s new version of its ZAP Project now includes a Heads Up Display

OWASP ZAP (Open Web Application Security Project Zed Attack Proxy) has released a new version of its leading ZAP Project which now includes an innovative Heads Up Display (HUD) bringing security information and functionality right into the browser.

Now software developers can interactively test the reliability and security of their applications in real time while controlling a wide variety of features designed to test the quality of their software.

ZAP is a free, easy to use integrated penetration testing tool. With the addition of the Heads Up Display, ZAP can be used by security professionals and developers of all skill levels to quickly and more easily find security vulnerabilities in their applications.

Given the unique and integrated design of the Heads Up Display, developers and functional testers who might be new to security testing will find ZAP an indispensable tool to build secure software.

In addition to being the most popular free and open source security tools available, ZAP is also one of the most active with hundreds of volunteers around the globe continually improving and enhancing its features.

ZAP provides automated scanners as well as a set of tools that allows new users and security professionals to manually identify security vulnerabilities. ZAP has also been translated into over 25 languages including French, Italian, Dutch, Turkish and Chinese.

Simon Bennetts, OWASP ZAP Project Leader, commented: “This is a really important release for the project team and developers who want to build great and secure applications. The HUD is a completely new interface for ZAP, and one that is unique in the industry. It shows that open source projects continue to create high-quality, new and exciting tools that deliver real value to the market – and at no cost to users.”

“ZAP is the Foundation’s most popular software tool,” said Mike McCamon, interim executive director of the OWASP Foundation. McCamon continued, “For nearly two decades OWASP continues to be a great destination for innovators to host, develop, and release software that will secure the web. Simon and the entire ZAP community deserves great recognition for their continued devotion to open source excellence.”

Read the Full Article here: >Help Net Security – News