A team of security researchers from the Ruhr University of Bochum, Germany has revealed a series of vulnerabilities in the popular instant messaging app WhatsApp.
According to a Wired report, the flaws allow a person with the control of WhatsApp’s servers to add anyone to a WhatsApp group without admin permission.
Once added to a group, the respective encryption keys of all the group members get shared automatically with the new user. So, a newly added eavesdropper can easily read all the new end-to-end encrypted messages exchanged between the members. But not the older messages and the ones for which the stranger doesn’t have the end-to-end encryption key.
The report was quick to ring the bell at the house of WhatsApp’s daddy Facebook. Its chief security officer Alex Stamos made multiple tweets as a response to Wired’s report.
“Read the Wired article today about WhatsApp – scary headline! But there is no a secret way into WhatsApp groups chats. The article makes a few key points.”
“Everyone in the group would see a message that a new member had joined,” he argued. But should that be considered as a safety measure, relying on the alertness of the members to make sure some eavesdropper has not entered their WhatsApp group?
“WhatsApp is built so group messages cannot be send to hidden users and provides multiple ways for users to confirm who receives a message prior to it being sent.”
Stamos said that WhatsApp has seen the researchers’ findings. But preventing a possible attack would require to let go of a popular feature called “group invite links” which allows anyone with a link to join a WhatsApp group. “There may be a way to provide this functionality with more protections, but it’s not clear cut.”
Even if such an attack could be performed, how many people would have access to WhatsApp’s servers except their employees and governments wanting to conduct surveillance? An experienced hacker would first have to compromise the servers before adding an eavesdropper to the group.
According to Maxie Marlinspike, who developed the Signal protocol, it’s not possible to suppress the alerts sent when someone joins the group, contrary to the researchers’ claim. It turns out, it’s not possible for someone to snoop into group chats and hacking the servers is not that easy.
Commenting on the report, Mike said that the article is a better example of the problems associated with security industry and how research is done today. “I think the lesson to anyone watching is clear: don’t build security into your products, because that makes you a target for researchers, even if you make the right decisions,” he wrote.
Talking at the DEF CON convention in Las Vegas, the Tor Project co-founder Roger Dingledine said that the dark web doesn’t exist and it’s just a few web pages. He added that media has wrongly labeled it as a heaven for illegal activities. Also, only 3% of Tor users connect to a hidden .onion website.
You might have come across numerous articles outlining the massive size of dark web and how it’s used by criminals to perform illegal activities and trade. However, who’d know the dark web in a better manner than a Tor co-founder?
At the DEF CON convention in Las Vegas, on Friday, Roger Dingledine, one of the three Tor Project founders, said that there are tons of misconceptions about the same. According to The Register, Dingledine bashed the journalists for giving a bad name to the Tor network by calling it a heaven for pedophiles and terrorists.
“There is basically no dark web. It doesn’t exist. It’s only a very few webpages,” he told.
If you’re interested in numbers, only 3% of Tor users connect to a hidden .onion website, said Dingledine. This means that majority of users are using it for simply analyzing their activities on the indexed web. They are, most probably, using it for stopping the website owners from tracking them.
According to his data, surprisingly, Facebook is the most popular website visited by Tor users. Today, more than a million people visit Facebook using Tor browser, thanks to the network’s hidden service launched in 2014.
Dingledine also made attempts to calm down those who feared that different intelligence agencies have already cracked Tor and compromised the integrity. “Intelligence agencies didn’t need to set up their own stepping-stone nodes he said, since they could – if they wanted to – just monitor those who did run them,” as reported by The Register.
Malware and hacking tactics are becoming more advanced, and users need to be prepared against attack
It’s one thing to click the wrong link and accidentally download some annoying adware on your personal 7 Worst Cyberattacks in Recent Historydevice. It’s another thing to watch as hospitals, train stations, nuclear power plants, and private businesses fall victim to a devastating cyber attack that obliterates their networks and decimates their data.
While viruses and worms of the ‘90s and early ‘00s might be memorable, the malware of the past few years have been unbelievably destructive. Because the internet is everywhere these days, hackers are finding it easier than ever to spread malicious software and gain access to highly sensitive information. If you need more proof that recent cyber attacks are some of the worst in history, the following devastating attacks should be evidence enough.
While a spate of similar malware programs has spread in its wake, WannaCry is certainly the most talked-about attack this year. Using a vulnerability developed by none-other than the U.S. National Security Agency, WannaCry was able to infiltrate computer networks running outdated operating systems, taking them and their data hostage. As a result, more than 230,000 machines in more than 150 countries fell victim to the attack, including dozens of hospitals and care centers in the U.K., a train system in Germany, and a telecommunications provider in Spain. Fortunately, most home users can stay safe from WannaCry by updating their software whenever there is an update and by installing strong internet security software.
Shamoon or Disttrack
A computer virus that targeted devices linked to the energy sector, Shamoon was developed in 2012 by a hacker group known as “Cutting Swords of Justice.” The group’s goal was to destabilize Saudi Amarco Company, an energy giant in the Middle East – and it was somewhat successful. More than 30,000 workstations were impacted by the virus, which prevented machines from connecting to the web and communicating with each other. Also affected were Qatari RasGas Company and LNG Company, though it’s unknown whether they were additional targets of the attack.
Operation Olympic Games or Stuxnet
At the end of President Bush’s administration, the U.S. government attempted to disrupt and sabotage Iranian nuclear facilities with a concentrated cyberattack. Working in conjunction with Israel, the U.S. developed a worm, named Stuxnet, that could take command of devices and use them to control machinery connected to them. Stuxnet was ruthless in its attack, incapacitating over 1,000 centrifuges in just one Iranian nuclear plant; it is a powerful digital weapon, and security experts believe it is being traded around black hat hacker circles – which means the most physically damaging cyber attack is likely on the horizon.
Operation Shady RAT
Operation Shady RATAs you read, a cyber attack is being waged. In 2008, a cybersecurity professional uncovered a series of similar attacks, which he dubbed Operation Shady RAT, launched against government institutions and private agencies in 14 different countries. Though investigations have yet to determine the source of the extensive attack, many analysts believe the operation is sponsored by the Chinese government.
In the early 2000s, American computer systems experienced an onslaught of epic proportions. Contractors working with the Department of Defense, to include dozens of private businesses like Lockheed Martin and Redstone Arsenal, lost an inordinate amount of sensitive information to attackers, who most security professionals believe were working for China. The attacks continued for three full years before cybersecurity received enough funding to build proper digital defenses. The British Ministry of Defense endured similar attacks, though on a smaller scale.
Beginning on Holocaust Remembrance Day in 2013, a series of cyber attacks coordinated by anti-Israeli groups and individuals began taking down Israeli websites. The hacks ranged from annoying defacements to disruptive database hijacking and devastating leaks. Unfortunately, the attack debilitated schools, newspapers, small businesses, nonprofit groups, and banks – many of which were not Israeli in origin, effectively working counter to the attackers’ main goal of showing discontent with Israel.
July 2009 Cyberattacks
Though they still lack a flashy name, these attacks propagated against South Korea and the U.S. affected more than 100,000 computers. It seems that attackers targeted governmental websites, including the South Korean National Assembly, the White House, and the Pentagon, as well as a handful of media outlets. To this day, the source and intention of the attacks are unknown, though many experts believe the North Korean telecommunications ministry is to blame..
The word ‘Tab Napping’ comes from the combination of ‘tab’ and ‘kidnapping’ used by clever phishers, scammers, and hackers. Tabnapping is an interesting, tricky, clever, and smart hacking technique for phishing and scamming.
Through this, attackers take advantage and control a victim’s unattended browser tabs by hijacking and redirecting him to malicious URLs where they can perform a phishing attack and execute scripts and data URIS.
You are already logged in to your Facebook account and suddenly you see an interesting post with a web link. After clicking on the link, a new tab opens. Now, you are visiting an interesting post link on the new tab and unknowingly your previous tab will change to a fake Facebook login page. When you go back to the previous tab to log in to Facebook, your login information will be sent to the attacker and your successful login to Facebook because you never logged out.
Protect Yourself From Tab Napping:
Always check the URL in the address bar and ensure that it is using secure protocol HTTPS
Most web developers use target=”_blank” only to open links in new tab. If you use target=”_blank” only to open links in a new tab, then it is vulnerable to an attacker. When you open a link in a new tab ( target=”_blank” ), the page that opens in a new tab can access the initial tab and change its location using the window.opener property.
rel=”nofollow noopener noreferrer”
"Cyber world is hitting by Tabnapping. Many sites like Google and Facebook is affected by Tabnapping. Many of us is unaware about this hacking technique, so hackers are targeting us, using this attack "
It is just for educational purpose only.
To get a job in the cyber security field, or more specifically in cyber security engineering, you’re going to need education, likely a cyber security engineering degree, and experience paired with the right skill set.
This isn’t a field you can just jump into without the right qualifications and skills. So what exactly do you need to get accepted into a master’s program and then consequently work in the field? And how do you know if a career in cyber security engineering is right for you? Read on to find out!
Your Education and Experience
In order to gain the qualifications necessary to land a job as a cyber security engineer, many obtain a master’s degree in the field. A master’s degree is beneficial to those looking to enter or advance in the field of cyber security because it offers a truly specialized approach. But to get accepted into a master’s program it is essential to have a background that has prepared you adequately. That means that you should have an undergraduate degree in engineering or computer science and/or currently work in one of these areas.
It is important for cyber security engineers to have a technical background (including areas such as configuration and testing) and a deep breadth of knowledge around the different concepts and tools used to fight cyber crime. In order to design and innovate new security solutions as well as troubleshoot current systems, this knowledge and understanding is essential.
Your Strengths and Skills
Engineers design, invent and innovate. In order to be successful in the field these are passions you must possess. As Fred Kerby instructor at the SANS Institute and formerly an information assurance manager at the Naval Surface Warfare Center said in an article by The Business of Federal Technology, “You have to have a passion for what you’re doing. You have to have that natural sense of curiosity about how things work. It’s not something you can just get a certificate for and check that box on your resume.”
Most successful cyber security engineers share the following traits and skills:
- A natural curiosity about the way things work
- A desire to break things down, getting to the nuts and bolts of something
- Mathematical and science minded
- Detail oriented
- Ability to handle stress and fluid situations
- Willingness to work on-call 24hrs/day
Does this sound like you? If so, cyber security engineering may be a great career path for you. And your timing couldn’t be any better to enter the field, as cyber security workers are now commanding a 9% salary premium over other IT workers and cyber security job postings have grown 91% from 2010-2014, according to Burning Glass Technologies.
How to Choose a Program
There are a few different paths available to you if you feel that cyber security engineering is a good fit and you meet the above criteria in experience, education and skill strengths. Depending on your specific goals combined with your background and financial situation you can decide which option is best for you.
Most of the time, the best choice for those who know they want to work in the field of cyber security engineering is to obtain a Master’s Degree in Cyber Security Engineering. An advanced degree in this field is highly sought and frequently required. By getting a degree in cyber security engineering you are gaining a holistic and focused education in a specialized field, which is looked upon very favorably by employers.
If you are comparing master’s programs be sure to evaluate the strength of the curriculum, the organization of the program, the faculty make-up and how well the program format lends itself to working professionals. Beware of computer science master degree programs with a specialization in cyber security. Unless you want a broad computer science degree, this option typically only gives you a few classes in cyber security and is not nearly as focused as a degree in cyber security engineering.
If you aren’t yet ready for a master’s degree there are a plethora of certifications you can rack up while you determine if a degree program is right for you. Certifications can really enhance your resume and are a great way to keep current and hone your skills.
There is currently a huge shortage of talent in the cyber security field, which has created an enormous opportunity for those looking to enter or advance their careers in this discipline.
At USD we offer a Master of Science in Cyber Security Engineering that focuses on the engineering aspects of software and hardware security and can be completed in as little as 20 months. To learn more about our nationally accredited program visit the program page.
Recently the internet security software company Bitdefender found that Apple computer systems, Mac OS X, faces a new threat that allows attackers to take full control of the system imperceptibly and collect all the sensitive information from the infected computers.
New Malware Allows Full Access to Mac Systems
Recently Bitdefender found a new malware that installs backdoors into the Mac operating system which grants attackers full access to Mac Systems. The malware has been called “Backdoor.MAC.Elanor” and has been discovered by researchers at Bitdefender security.
As we have already mentioned that we are dedicated to installing backdoors in the operating system so that the attackers may have full access, including user data or can take control of the webcam, execute arbitrary code and much more.
As a means of distribution used a false file conversion application known as EasyDoc Converter.app, which can be found in places widely used by Mac users when seeking applications to install, according to the Bitdefender security.
Initially, the researchers found it difficult to accurately determine the means by which infection occurs. Most likely, the backdoor is distributed via spam messages, but it can also get on the system through applications downloaded from untrusted sources. As explained by the experts, one of the loader components distributed via ZIP-file.
As the ZIP-file contains the executable file in the Mach-O format, which disguised as a text or JPEG-file. However, at the end of the expansion, there is a space, when you double click on the “ZIP-file” the file opens it in the Terminal, and not in TextEdit or Preview as regular files. Since the Finder file manager identifies the icon of the executable file as a JPEG or TXT, the user is unlikely to suspect that something was wrong and are likely to open it.
The backdoor, packed with a modified version of the UPX, seeking persistence on the system, setting PLIST-file in the “/Library/LaunchAgents/(if available superuser) or $ USER” and “/Library/ LaunchAgents/ (without root access)”. The Icloudsyncd executable file is stored in the “Library/Application Support/com.apple.iCloud.sync.daemon directory”.
However, the Mac have an increased security step known as “Gatekeeper”, which is located in the System Preferences under Security & Privacy. By default, it prevents running any unsigned applications from the unidentified sources or developers. So, if you download an unsigned application from any unidentified source then the Mac App Store will try to run it, but, ultimately you will get a message that “stating the application cannot be opened”. Hence, the Gatekeeper would have blocked the malware, if it is enabled.