Posted on

Hackers Can Steal Your ATM PIN from Your Smartwatch Or Fitness Tracker

As your day-to-day apparel and accessories are turning into networked mobile electronic devices that attach to your body like smartwatch or fitness band, the threat to our personal data these devices collect has risen exponentially.

A recent study from Binghamton University also suggests your smartwatch or fitness tracker is not as secure as you think – and it could be used to steal your ATM PIN code.

The risk lies in the motion sensors used by these wearable devices. The sensors also collect information about your hand movements among other data, making it possible for

“attackers to reproduce the trajectories”

of your hand and

“recover secret key entries.”

In the paper,

titled

“

Friend or Foe?: Your Wearable Devices Reveal Your Personal PIN,”

computer scientists from the Stevens Institute of Technology and Binghamton University used a computer algorithm that can guess your password and PIN with about 80% success rate on the first attempt, and over 90% of the time with 3 tries.

Retrieving Passwords and PINs Using this Algorithm

Researchers say their “

Backward PIN-Sequence Inference

” algorithm can be used to capture anything a person type on any keyboard – from automatic teller machine or ATM keypads to mobile keypads – through infected smartwatches, even if the person makes the slight hand movements while entering PINs.

“The team was able to record millimeter-level information of fine-grained hand movements from accelerometers, gyroscopes and magnetometers inside the wearable technologies regardless of a hand’s pose,” reports Phys.org.

Although the researchers do not name specific wearable devices that are vulnerable, they note that attackers can record information about your hand movements…

…either directly by infecting your wearable device with malware or remotely by intercepting the Bluetooth connection that links your wearable device to your phone.

The bottom Line:

The team says it doesn’t have any robust solution to prevent this attack but recommends manufacturers and developers to confuse attackers by inserting

“a certain type of noise data”

that would allow the device to be still used for fitness tracking, but not for guessing keystrokes.

Another way is to take a low-tech approach – Always enter your passwords or PINs with the hand that is not having a wearable device with the highly sophisticated motion tracker.

via https://ift.tt/29zohdi

Posted on

SWIFT Hackers Steal $10 Million From Ukrainian Bank

A Ukrainian bank has become the latest victim of the widespread cyber attack on global banking and financial sector by hackers who target the backbone of the world financial system, SWIFT.

Hackers have reportedly

stolen $10 Million

from an unnamed bank in Ukraine by exploiting the SWIFT international banking system, according to an independent IT monitoring organization called the Information Systems Audit and Control Association (ISACA).

Swift or the Society for Worldwide Interbank Financial Telecommunication is the global banking messaging system responsible for managing Billions of dollars in money transfers each day between financial institutions worldwide.

The ISACA branch in Ukraine, who has been hired by the targeted bank to investigate the heist, disclosed that some unknown hackers were able to compromise the bank’s security in similar way they

hacked Bangladesh central bank

and stole $81m (£56m), the Kyiv Post reports.

"At the current moment, dozens of banks (mostly in Ukraine and Russia) have been compromised, from which has been stolen hundreds of millions of dollars," ISACA reportedly said in a release.

The Swift hackers have already made a number of victims, including Bangladesh central bank, the Banco del Austro (BDA) bank in Ecuador and an unnamed commercial bank.

Also Read: How did Bank Hackers Go Undetected?

In February, Swift hackers managed to

steal $81 Million cyberheist

at the Bangladesh central bank’s account in the New York Federal Reserve through by hacking into SWIFT network using a piece of

malware that manipulated logs

and erased the fraudulent transactions history, and even prevented printers from printing those transactions.

The second incident

targeted an unnamed commercial bank

where malware installed on SWIFT was used against the banks’ PDF reader which was being used by the bank to check statement messages.

An Ecuadorian bank called Banco del Austro (BDA) also

lost about $12 million

in the cyber heist carried out at the beginning of last year by attacking the Swift global network.

In all incidents, the hackers have exploited flaws in banks funds’ transfer initiation environments, before messages being sent over SWIFT.

Here’s how Swift hackers target banks:

  • Uses malware to circumvent local security systems of a target bank.
  • Gains access to the SWIFT international messaging network.
  • Sends fraudulent messages via SWIFT to initiate money transfers from accounts at larger banks.

The recently attacked bank in question had not yet been named, as investigators are restricted by strict non-disclosure agreements until the Ukrainian bank itself agrees to go public with information.

via https://ift.tt/297pHgn

Posted on

Hacking Cars Getting Easier and More Dangerous

If your car is in any way connected to the Internet, it can get hacked into. You know it’s only a matter of time before hackers begin infiltrating motor vehicles in droves, being that vehicles are plagued with hundreds to thousands of security vulnerabilities.

via https://ift.tt/28TFrzL

Posted on

(IN)SECURE Magazine issue 50 released

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Issue 50 has been released today.

(IN)SECURE Magazine issue 50

Table of contents

  • Securing the future: Best practices for keeping corporate information safe during an M&A
  • Executive hot seat: Ron Green, Executive VP, CISO at MasterCard
  • 7 tips to get the absolute best price from security vendors
  • How CISOs can bridge the gap between their organizations’ IT and security needs
  • Risk management: Risks are lurking everywhere
  • Report: Infosecurity 2016
  • Internet of Fail: How modern devices expose our lives
  • Executive hot seat: Sumedh Thakar, Chief Product Officer at Qualys
  • Security: Missing from DevOps thinking?
  • The life of a social engineer: Hacking the human
  • What 17 years as an infosec trainer have taught me.

via https://ift.tt/28Z4wdk

Posted on

Tenable Supports ISO/IEC 27001/27002 and CIS Critical Security Controls

According to the Trends in Security Framework Adoption Survey, research conducted by Dimensional Research on behalf of Tenable, adoption of security frameworks is at an all-time high. Your organization might adopt a security framework for many good reasons, including:

  • Identifying security gaps requiring additional investment. Comparing existing security controls to those recommended by an established security framework can highlight weaknesses that require additional controls.
  • Communicating business risk to executives and board members. Business leaders are often familiar with financial controls and will quickly grasp the concept of security controls. They will understand budget requests to implement controls needed to mitigate cyber risk.
  • Building a foundation to efficiently meet multiple compliance requirements. Rather than tackling each compliance requirement with ad hoc controls, a security framework can provide a single, extensible foundation to meet multiple compliance requirements.
  • Discussing security with external stakeholders. Major customers, cyber insurance suppliers and other business partners may have questions about an organization’s security program, and security frameworks provide a structured format for discussion.
  • Meeting due care/due diligence standards to limit liability. Many organizations have a legal obligation to understand the cybersecurity risks they face and then to implement appropriate controls that manage that risk. Failure to adequately manage risk may expose the organization, its executives and board members to legal action. For example, a U.S. appeals court recently ruled that the Federal Trade Commission has authority to pursue lawsuits accusing organizations of failing to properly safeguard consumers’ information.

Using multiple frameworks

Many organizations—44% according to the above mentioned survey—are using more than one framework. Some organizations are using a different framework in different parts of their businesses. However, many organizations are using multiple frameworks in a single business area. They are creating their own composite framework based on multiple published frameworks. This makes sense because the Center for Internet Security Critical Security Controls (CSC), ISO/IEC 27001/27002 (ISO 27K) and NIST Framework for Improving Critical Infrastructure Cybersecurity (CSF) frameworks are just that—frameworks. They are not strict standards designed to be adopted without at least some tailoring. The following snippets taken from each standard substantiate this:

  • CSF: “The Framework will help the organization align its cybersecurity activities with its business requirements, risk tolerances, and resources,” and “The Framework is adaptive to provide a flexible and risk-based implementation that can be used with a broad array of cybersecurity risk management processes.”
  • ISO 27002: “This International Standard may be regarded as a starting point for developing organization-specific guidelines. Not all of the controls and guidance in this code of practice may be applicable.”
  • CSC: “But this is not a one-size-fits-all solution, in either content or priority. You must still understand what is critical to your business, data, systems, networks, and infrastructures… ”

Tenable solutions

Recognizing the flexibility of these frameworks, Tenable has just released a comprehensive set of report, dashboard and Assurance Report Card (ARC) templates that support ISO 27K and CSC (formerly referred to as the SANS Top 20). You can easily tailor them to meet your specific needs. For example, you can mix and match components designed to support various frameworks, as the dashboard below shows. It includes components initially created for CSF, ISO 27K and CSC frameworks, which you could rename as desired to match your internal language. Additionally, you could easily design your own dashboards leveraging a template or by starting from scratch.

Tailored hardware asset management dashboard
Create a composite dashboard using components designed to support different frameworks

In addition to customizing reports, dashboards and ARCs, you can apply dynamic asset lists to reuse a single template with assets for different business systems. This is especially useful with ARCs because you can set different pass/fail thresholds for different business systems as needed to mitigate different risk levels. The following example displays the status of three different business systems relative to the CSC Foundational Cyber Hygiene controls. Notice the different thresholds for the CRM system and the financial reporting system.

CRM financial SCM top 5 ARC
Set specific pass/fail criteria for different business systems

More information

If your organization is using one or more security frameworks, Tenable can help you automate your technical controls and help you assess and communicate their status. Please visit the following pages for additional information:

Keep up with the latest from Tenable! Subscribe to the Tenable Blog by clicking Blog email updates on the Blog Home Page.

via https://ift.tt/28Mrs1b

Posted on

Google makes 2-Factor Authentication a lot Easier and Faster

When it comes to data breaches of major online services like

LinkedIn

,

MySpace

,

Twitter

and

VK.com

, it’s two-factor authentication that could save you from being hacked.

Two-factor authentication or 2-step verification is an effective way to secure online accounts, but many users avoid enabling the feature just to save themselves from irritation of receiving and typing a six-digit code that takes their 10 to 15 extra seconds.

Now, Google has made the 2-Step Verification (2FV) process much easier for its users, allowing you to login with just a single tap instead of typing codes.

Previously, you have had to manually enter a six-digit code received via an SMS or from an authenticator app, but now…

Google has

introduced

a new method called “

Google Prompt

” that uses a simple push notification where you just have to tap on your mobile phone to approve login requests.

Also Read: Google Plans to Kill your Passwords

.

In other words, while signing in to your account, just enter your password, and you will get a pop-up message on your mobile phone asking you if you want to sign in. If you want, then press “Yes” and you’re in.

How to Set Up Google Prompt

Here’s how you can enable Google Prompt for your Google accounts:

Before enabling Google Prompt, first enable two-step verification for your Google account and you have already enabled two-step verification, you can skip this part.

  • Go to myaccount.google.com and sign in to your Google account.
  • Select ‘Signing in to Google,’ using 2-Step Verification.
  • Click on ‘Get started’ and enter your password once again.
  • Now provide your phone number you want to use for authenticating, and choose either an SMS or phone call for verification, and click on ‘Try it.’
  • Enter the 6-digit code from the SMS or phone call and select ‘Next.’
  • For setting up two-step verification, click ‘Turn ON.’

Now, once you have enabled

two-step verification

, follow these simple steps that will just take a few second. All you need is an Android or iOS device nearby.

  • Under ‘Set up alternative second step,’ click on the Google prompt option
  • Add phone and click Get started.

Then just follow the on-screen instructions and you’re all set to go.

If you have an iPhone, you are required to download the

Google Search

app first and sign in before using Google Prompt. But, if you are an Android user, just update your Google Play Service.

Two-step verification has become so easier to use, so what are you now waiting for?

via https://ift.tt/28NkTbx

Posted on

One Million IP Addresses Used In Brute-Force Attack On A Bank

Cisco says in just one week in February they detected 1,127,818 different IP addresses being used to launch 744,361,093 login attempts on 220,758,340 different email addresses — and that 93% of those attacks were directed at two financial institutions in a massive Account Takeover (ATO) campaign.

 

Crooks used 993,547 distinct IPs to check login credentials for 427,444,261 accounts. For most of these attacks, the crooks used proxy servers, but also two botnets, one of compromised Arris cable modems, and one of ZyXel routers/modems. Most of these credentials have been acquired from public breaches or underground hacking forums.

 

For more information, read the full article here.

Posted on

Corporate Email Phishing Scams Result in $3.1B Loss, Near 1300% Increase in 18 Months

Total number of Business Email Compromise (BEC) related crimes have reached epidemic levels, at nearly $3.1 billion in losses and involving 22,143 victims worldwide since January 2015, according to a new FBI report.

 

BEC or Business Email Compromise is defined by FBI as "a sophisticated scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments. The scam is carried out by compromising legitimate business email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds."

 

Most victims, according to reports to FBI, "use wire transfers as a common method of transferring funds for business purposes; however, some victims report using checks as a common method of payment. The fraudsters will use the method most commonly associated with their victim’s normal business practices."

 

The BEC scam continues to grow, evolve, and target businesses of all sizes the FBI reports. Since January 2015, there has been a 1,300% increase in identified exposed losses (i.e. Exposed dollar loss which includes actual and attempted loss in United States dollars.) The scam has been reported by victims in all 50 states and in 100 countries. Reports to FBI indicate fraudulent transfers have been sent to 79 countries with the majority going to Asian banks located within China and Hong Kong.

 

Characteristics of BEC Complaints

The IC3 has noted the following characteristics of BEC complaints

•  Businesses and associated personnel using open source email accounts are predominantly targeted.

•  Individuals responsible for handling wire transfers within a specific business are targeted.

•  Spoofed emails very closely mimic a legitimate email request.

•  Hacked emails often occur with a personal email account.

•  Fraudulent email requests for a wire transfer are well-worded, specific to the business being victimized, and do not raise suspicions to the legitimacy of the request.

•  The phrases “code to admin expenses” or “urgent wire transfer” were reported by victims in some of the fraudulent email requests.

•  The amount of the fraudulent wire transfer request is business-specific; therefore, dollar amounts requested are similar to normal business transaction amounts so as to not raise doubt.

•  Fraudulent emails received have coincided with business travel dates for executives whose emails were spoofed.

•  Victims report that IP addresses frequently trace back to free domain registrars.

The FBI recommends victims to always file a complaint regardless of dollar loss or timing of incident at www.IC3.gov.

Read the full article here.

Posted on

How to Hack Someones Facebook Account Just by Knowing their Phone Numbers

Hacking Facebook account is one of the major queries on the Internet today. It’s hard to find — how to hack Facebook account, but researchers have just proven by taking control of a Facebook account with only the target’s phone number and some hacking skills.

 

Hackers with skills to exploit the SS7 network can hack your Facebook account. All they need is your phone number.

 

The weaknesses in the part of global telecom network SS7 not only let hackers and spy agencies listen to personal phone calls and intercept SMSes on a potentially massive scale but also let them hijack social media accounts to which you have provided your phone number.

 

SS7 or Signalling System Number 7 is a telephony signaling protocol that is being used by more than 800 telecommunication operators worldwide to exchange information with one another, cross-carrier billing, enabling roaming, and other features.

 

However, an issue with the SS7 network is that it trusts text messages sent over it regardless of their origin. So, malicious hackers could trick SS7 into diverting text messages as well as calls to their own devices.

 

All they need is the target’s phone number and some details of the target’s device to initiate the silent snooping.

 

The researchers from Positive Technologies, who recently showed how they could hijack WhatsApp and Telegram accounts, now gave the demonstration of the Facebook hack using similar tricks, Forbes reported.

 

Read the full article here.