From the Ground Up - Learning About Computer Security

 The Internet Archive (IA), most notably the "Wayback Machine", has been the victim of several hacks this past year. Starting back in May they suffered their first legitimate service interruption since the site's founding. They suffered a DDoS attack and eventually were victim to a data breach after that too. The group that took responsibility for the attack strangely enough didn't seem to really be trying to achieve a whole lot. They almost seemed to do it just a prove a point that it could be done. The group in question was able to deface part of the website and leave a message in-place saying:  "Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach? It just happened. See 31 million of you on HIBP!" Considering the level that they were able to compromise the system to, it is interesting that they didn't (at least that we know of) do more with the compromised data. They wer...

 In this article it talked about the effect cybersecurity spending is having on the industry and whether CISO's felt that they were protecting the companies as well as they could be. Despite a projected spending of upwards of $215 billion globally, companies are still finding that they haven't gotten the protection that they feel they need. This comes down to a belief that that "data-in-motion" is not being monitored as much as it could be. The article also cited that "93% of malware" is hidden in this data too.  It seems that some of the focus going forward will be more on the nitty-gritty packet level analysis to help root out potential problems or hidden malware before it can get into the networks. Source:  CISOs: Throwing Cash at Tools Isn't Helping Detect Breaches

 Hello, I came across this article in my google feed this past week and it caught my eye. It was about a tool that was used to hack "air-gapped" devices. Granted I wasn't familiar with that term until I read this article and then proceeded to look it up in more detail. The tools have been attributed to a group being called "GoldenJackle". The tools involved in the hack included a backdoor under the name "JackalControl", a file collector and exfiltrator, and then a worm facilitates other parts of the attack on the external drive. The attack is described by article as: "The basic flow of the attack is, first, infecting an Internet-connected device through a means ESET and Kaspersky have been unable to determine. Next, the infected computer infects any external drives that get inserted. When the infected drive is plugged into an air-gapped system, it collects and stores data of interest. Last, when the drive is inserted into the Internet-connected de...

 Hello, When reading over articles for a topic this week I can across one that talked about trading apps being used to "lock" people money once deposited, effectively stealing it once deposits are made. I found this fairly interesting as I had first assumed these were apps downloaded from third-party websites. As it turns out though, these apps can come from the Google Play Store (not a huge surprise there) but they can also be on the Apple App Store. I'm not much of an IOS person but I had always believed that their app store was supposed to be fairly secure. The apps appear to be using somewhat legitimate means to get users in but then "lock" them in with withdrawal limitations later on.  From the article:    " Unlike traditional banking trojans (GoldPickaxe, which was discovered in  February 2024), these apps don’t contain explicit malicious code but rather serve as sophisticated deceptions, reads the Group-IB   report . They do so by using “TermsFeed” f...

 Hello, This article was pretty interesting to read as I felt it relates a lot to "common sense" almost. The changes themselves are more focused on a change in wording to illicit specific behaviors from credential service providers (CSP) but they also had several methodology shifts too. Some of the most notable highlights were: Stop requiring users to periodically change passwords (unless a known credential leak occurs) Stop using "knowledge-based" authentication or security questions The actual rational for these changes was probably my favorite part, citing the fact that people tend to use more comfortable (repeated) passwords when they have to frequently change them. I highly recommend going to the article to see the rest of what was suggested/updated.  Original article:  NIST Drops Password Complexity, Mandatory Reset Rules

 Hello, I have a bit more of a fun post this week versus anything too compelling, but I found this great all the same. As a frequent user of Discord there was a part of me that had assumed some of the safety features that were probably already implemented on the platform, encrypted conversations for example. Apparently, I would have been sorely mistaken to assume that though.  Discord has just announced (as of September 18, 2024) that it is rolling out End-To-End encryption for video and voice calls on their platform. Since I probably sit in a Discord call at least a few times a week, I'm very excited to know that we're just a little bit safer now that we were even just last week. The article also highlights (at a high level) some of the methods that they are implementing to make these changes possible. Great update Discord, keep it coming! Source: Discord Launches End-To-End Encryption For Audio & Video Chats

I found this article really interesting as I've always considered 2FA (in all it's forms) to be extremely safe. I do a lot with authenticators myself and almost nothing via text/email codes when it comes to my 2FA preferences. I wouldn't really have considered how threating a Malware that could intercept SMS messages would be though, if not for this article highlighting it. This really helped to open my eyes to the additional possibility of our preferred security options not always being as safe as we imagine. Article:  New Android Malware Ajina.Banker Steals 2FA Codes, Spreads via Telegram This has gotten me wondering though, what else isn't as safe as I think it is? I'll likely have to go do some research on other types of 2FA now and see what else I can find on the topic. I have a feeling this kind of realization is going to happen a lot as I continue to learn more on the subject of computer security. On that front, I'm both concerned and excited!