• Posted on April 17, 2017 11:46 am
    Joseph Forbes
    No comments

    A hacker is a tech-savvy user who manipulates and bypasses computer systems to make them do the unintended. Sometimes this manipulation is noble, with the goal to create something beneficial. Other times, hacking is harsh and done with the wicked goal to hurt people through identity theft or other harm. You are likely familiar with the stereotypical 1980's hacker: the evil criminal who is socially isolated. While this stereotype does indeed describe some modern 'black hat' hackers, there exists a subset of hackers who are not criminals. In fact, there are many hackers who use their knowledge for good. This is broken down into three categories Today, 'hacker' is a descriptor that subdivides into 3 categories: 'Black Hat' Hackers: criminals and wrongdoers. 'White Hat' Hackers: ethical hackers who work to protect systems and people. 'Grey Hat' Hackers: dabble in both black hat and white hat tinkering. Classic 'Black Hat' Hackers = Criminals/Lawbreakers 'Black hat hacker' = criminal with evil intent. Gu / Getty This is the classic definition of a hacker: a computer user who willfully vandalizes or commits theft on other people's networks. 'Black hat' is a stylish way to describe their malicious motivations. Black hats are gifted but unethical computer users who are motivated by feelings of power, money and petty revenge. They are electronic thugs in every sense of the word, and they share the same personality traits as emotionally stunted teens who smash bus stop windows for personal satisfaction. Black hat hackers are renowned for the following common cybercrimes: DDoS Distributed, Denial of Service (flood) attacks that impair computer networks. Identity theft, Phishing, scams, social engineering schemes. Vandalism of systems, defacing, disabling, removing access. The creation of destructive programs, like worms, and CryptoLocker! 'White Hat' Ethical Hackers = Network Security Specialists 'White hat' hacker = security professional. Yan / Getty Different from the classic black hat hackers, white hat hackers are either driven by honorable motivations, or they are mercenaries working on honorable agendas. Also known as 'ethical hackers', white hats are talented computer security users often employed to help protect computer networks. Some white hats are reformed black hats, like former convicts who take on work as store security guards. While they themselves may have been unethical in the past, their current vocation is considered a white hat. With experience in what the 'bad guy' can do, these reformed hats, are among the most skilled at protecting their clients. Ethical hackers are motivated by a steady paycheck. It is not surprising to see ethical hackers spending those paychecks on very expensive personal computers in their personal lives, so they can play online games after work. As long as they have a good-paying job to support their personal habits, an ethical hacker is usually not motivated to destroy nor steal from their employer. Special note: some white hat hackers are 'academic hackers'. These are computer artisans who are less interested in protecting systems, and more interested in creating clever programs and beautiful interfaces. Their motivation is to improve a system through alterations and additions. Academic hackers can be casual hobbyists, or they can be serious computer engineers working on their graduate-level degrees. These are the people who create new viruses, as proof of concepts.  No intentions on making the world worse, but to help bright to light problems that need solving. 'Grey Hat Hackers' = Conflicted, Uncertain Which Side of the Law They Stand Grey hat hackers: a mix of good and evil. Peoplemages / Getty Grey hat hackers are often hobbyists with intermediate technical skills. These hobbyists enjoy disassembling and modifying their own computers for hobby pleasure, and they will sometimes dabble in minor white collar crimes like file sharing and cracking software. Indeed, if you are a P2P downloader, you are a type of gray hat hacker.  These are undisciplined members of the profession. Often users with access to tools, and 'kits' that enable their ability to accomplish their goals.  In most cases Grey hats are people who never gained the formal understanding of what they are doing. Gray hat hackers rarely escalate into becoming serious black hat hackers. Often times, Grey hats end up getting caught, or warned into stopping their activities. Subcategories of Hackers: Script Kiddies and Hacktivists Script Kiddies: this is a stylish name for novice hackers who are unskilled. Script kiddies can be white hat, black hat, or grey hat. These are people who feel empowered enough to cause others and themselves damages. Hacktivists: this is the hacker who is also a social activist fighting for a cause. Some people would argue that famous hackers like Lulzsec and Anonymous are hacktivists fighting government corruption and corporate misdeeds. Hacktivists can be white hat, black hat, or grey hat. Only a specified team they support at the time being. More About Computer Hackers Computer hacking is often exaggerated by the media, and very few public narratives give hackers the fair shake that they deserve. While most movies and TV shows of hackers are absurd, you might consider watching Mr. Robot if you want to see what hacktivists do. Every savvy web user should know about the unsavory people on the Web. Understanding common hacker attacks and scams will help you navigate online intelligently and confidently.

    Blog Entry, EDUCATION, Hacking
  • Posted on March 27, 2017 2:45 pm
    Joseph Forbes
    1

    The Cyber Division of the U.S. Federal Bureau of Investigation (FBI) has issued an alert to warn the healthcare industry that malicious actors are actively targeting File Transfer Protocol (FTP) servers that allow anonymous access. According to the law enforcement agency, attackers have targeted the FTP servers of medical and dental facilities in an effort to obtain access to protected health information (PHI) and personally identifiable information (PII), and use it to intimidate, blackmail and harass business owners. “The FBI recommends medical and dental healthcare entities request their respective IT services personnel to check networks for FTP servers running in anonymous mode. If businesses have a legitimate use for operating a FTP server in anonymous mode, administrators should ensure sensitive PHI or PII is not stored on the server,” the FBI said. The agency cited research conducted in 2015 by the University of Michigan, which showed that more than one million FTP servers had been configured for anonymous access. These servers allow users to authenticate with only a username, such as “anonymous” or “ftp,” and either a generic password or no password at all. The FBI pointed out that vulnerable FTP servers can also be abused to store malicious tools or to launch cyberattacks. “In general, any misconfigured or unsecured server operating on a business network on which sensitive data is stored or processed exposes the business to data theft and compromise by cyber criminals who can use the data for criminal purposes such as blackmail, identity theft, or financial fraud,” the FBI warned. In 2015, IBM named healthcare as the most attacked industry, with more than 100 million records compromised, after in the previous year this sector did not even make it to the top five. An IBM report for 2016 showed that the volume of compromised records was smaller, but the number of data breaches increased, causing operational, reputational and financial damage to healthcare organizations. A report published recently by Fortinet showed the top threats targeting healthcare companies in the last quarter of 2016, including malware, ransomware, IPS events, exploit kits and botnets.

    Blog Entry, DATA, Hacking
  • Posted on March 19, 2017 11:16 am
    Joseph Forbes
    No comments

    Websites getting blacklisted is a very extensive problem faced by businesses. When it happens, web masters panic and the vendors face an interruption in their daily business as they struggle to assist their concerned consumers to clean their websites and return online. It can happen due to a variety of reasons. Even Google may blacklist a website, and on an average, it's been estimated that about 10,000+ websites get blacklisted on a daily basis.​ Getting to Know about the Mishap Many businesses cannot afford to install costly monitoring programs or employ security experts and often take time to realize that their site has been blacklisted. Almost 50% of the business owners are warned about the compromised site by a search engine, browser or other alert when they try to visit their own site. Time is the biggest enemy of blacklisted websites as every minute that the site remains blocked is precious and leads to revenue losses due to the bad impact on its marketing activities and eventually sales and loss of the organization’s reputation. Be Prepared to Deal with the Problem It might take several hours or even days to get rid of the malware and protect a website based on the infection’s severity; it also depends on whether or not the website is secured by an effective and frequent backup regimen. The foremost part of the fix is eradication of the malware and restoration of the website. Even after this process, the web masters have to request Google to review the site before getting the block removed. Dealing with Black-listed Websites Web hosts find it to be a nightmare to handle blacklisted client websites, straining their operations and possibly weakening their credibility. Clients generally fail to understand the reason behind the blacklisting of their site and tend to unjustly put the blame on their host. Smart hosting vendors should extend assistance to their customers and help them get over the trouble at the earliest. Hosts that provide robust tools to solve the problem of their clients will finally instil a sense of loyalty and confidence in them. Vendors that lack these tools may waste considerable resources on remediation and in the process, even lose their valuable clients. Blacklist remediation will not be an extensive ordeal if the affected site owners have smart automatic backup regimen in place as they can restore the functionality and files of the affected site easily with the right tools. To help their clients, hosting vendors should be aware of the following remediation steps so that it can be implemented efficiently and quickly as soon as a client finds out that his website has been blacklisted. Look for Malware Check for malware by running efficient antivirus programs on all the computers used by an admin for logging into the website. Also, scrutinize the server logs for any activity by the admin whose computer is infected. Change the logins and passwords for all accounts, including those of database access, FTP, CMS accounts, and system administrator. Ensure that strong passwords are set. A sophisticated hosting provider should let their customers to make these changes easily on a dashboard interface. Let customers know how important it’s to install the latest editions of Operating Systems, apps, blogging platform, CMS, and plug-ins. Delete any new or modified file that has been added to the server after detection of the problem and execute a complete system restore. The restoration can be completed through a single click if you provide a cloud-oriented auto backup and disaster recovery services to your clients. If not, the clients will have to find the latest clean editions of each modified file and manually download them. Request Google to Review the Site and Remove the Blacklist This is the best way for hosting vendors to handle the remediation as soon as possible; just ensure that the tools required for getting a customer’s website back online are ready with you always.

    Blog Entry, DATA, Internet
  • Posted on March 14, 2017 11:45 am
    Joseph Forbes
    No comments

    Several small and midsize businesses are susceptible to Distributed Denial of Service (DDoS) attacks. What would be the best way for such businesses to handle this problem? Plan ahead – this is what security experts suggest based on their experiences in the past! A majority of the small businesses and start-ups have small teams with very little resources to defend DDoS attacks. As indicated by the name of the attack, it stops users from accessing the services and a site by hurling lot of data against the firm’s web and hosting services. If you are wondering if DDoS attacks are really so common that businesses need to be concerned about it, statistics indicate that around 2,000 such attacks happen on a daily basis costing a loss of revenue in the range of $5,000 - $40,000 per hour for businesses. Hackers can be fake vandalists, competitors, hactivists or extortionists. If your company isn’t equipped with professional network security experts, here are few things you can do to stay safe from DDoS attacks. Stay Prepared Every business should have a disaster recovery plan ready for DDoS attacks. Some of the best practices should include identifying the key employees who are given the responsibility. Establish the roles of every team member, their tasks and requirements. Give the team the needed practice on a mock basis so that those involved are aware of how to handle things when a disaster happens inevitably. Work with your internal PR and IT teams, ISP and hosting providers to recognize the susceptible aspects of failure, routes of escape and technical gaps. Understand DDoS Attack  There are many well-tested DDoS prevention programs that run advanced algorithms to identify various kinds of traffic. They try to sniff out, identify and filter different kinds of benign and malevolent bots and allow only legitimate traffic. It’s not easy to judge from just one instance if the hack is just amateurish or professional, though it’s fairly assumed that any network attack that crosses 50 Gbps is likely to be professional. Mostly multiplied under the inoffensive category of 'network security programs,' few of the very common hack devices are called stressors or booters. As implied by the name, these devices intensify and focus the payload of DDoS. Be Ready to Respond with Your Guns As in all cases of disaster reaction, stay calm without panicking. Ensure that your services are up and running; give your customers a brief. Your team can respond readily only if you’ve prepared properly. Co-ordinate with your team members and optimize the tactics for the disaster response. Once the attack is mitigated by your tech team, ensure that the communication team is ready to reveal the details to the press and legal team is prepared to handle the possible regulatory and compliance part. If you are asked to pay the attacker a ransom, don’t do it as this will only mark your organization and they may return for more. Once you are identified this way, other hackers may also sense it and come your way. Learn and Implement Once the attack subsides, try to learn things from the attack. Analyse strongly as to what went right and what went wrong.  Ensure that your legal and IT teams collect the required forensic information. Create a communication protocol to deal with the internal team queries, your clients and the press. Try to detect the network holdups from the attack and select an infrastructure with inherent resiliency. Analysis and communication are the two aspects that will go a long way in preparing for the next attack and enhance your team morale. And, you should be wary of the latest threats emerging in the cyber world such as the latest DDoS Extortion Attack.

    Blog Entry, DATA, Hacking
  • Posted on February 8, 2017 11:55 am
    Joseph Forbes
    No comments

    Do you suspect your email account has been hacked? Can't login to your email account? Are you getting undeliverable and bounce messages for email you never sent? Are friends and family complaining of receiving email you never sent? Is it malware? A hacker? Here's how to tell. Undeliverable and Bounce Messages Spammers frequently spoof the From sender on the email they send. They just substitute their real email address with a random email address found on a mailing list or one just randomly made up. Some poorly configured email gateway products don't distinguish between the manually editable "From" address and the actual sender origin, so they simply send any undeliverable messages to the spoofed From address. To better understand how this works, and help you track down the real origin of an email, see: Reading Email Headers. Best defense: Simply delete the undeliverable/bounce messages. In other cases, email worms will send themselves disguised as an undeliverable/bounce message. The bogus email contains either a link or an attachment. Clicking the link or opening the attachment leads directly to a copy of the worm. Your best course is to learn to overcome curiosity. Best defense: If you receive an undeliverable or bounce message for an email you know you did not send, resist the temptation to open the attachment or click the link. Just delete the email. Unable to login to your email account If you are unable to login to your email account due to an invalid password, it's possible that someone has gained access and changed the password. It's also possible that the email service is experiencing a system outage of some sort. Before you panic, make sure your email provider is functioning normally. Best defense: Prevention is key. Most email providers offer a password recovery option. If you have even a hint of concern that your email password has been compromised, change your password immediately. If you specified an alternate email address as part of the password recovery, make sure that address is active and be sure to monitor the account regularly. In some cases, you may need to call your email provider and request a reset. If you go that route, be sure to change your password from the one provided during the phone call. Be sure to use a strong password. Email appearing in Sent Items folder If copies of the sent email are appearing in your Sent Items folder, then it's likely that some type of email worm might be involved. Most modern-day malware won't leave such tell-tale signs behind, so it, fortunately, would be indicative of an older, more easily removed threat. Best defense: Update your existing antivirus software and run a full system scan. Email is sent to address book, does not appear in the Sent folder, and it's a webmail account The most likely cause is phishing. Chances are at some point in the past, you were tricked into divulging your email username and password. This enables the attacker to login to your webmail account and send spam and malicious email to everyone in your address book. Sometimes they also use the hijacked account to send to strangers. Generally, they remove any copies from the Sent folder to avoid easy detection. Best defense: Change your password. Make sure you've checked the validity of any alternate email addresses included in the password recovery settings first. Symptoms don't match the above Best defense: Make sure you do a thorough check for a malware infection. Fully scan your system with installed up-to-date antivirus software and then get a second opinion with one of these free online scanners. Receiving complaints from friends, family, or strangers One of the problems with spoofed, hijacked or hacked email is that it can also lead to responses from angry recipients. Stay calm - remember, the recipients are just as much a victim as you. Best defense: Explain what happened and use the experience as an educational opportunity to help others avoid the same plight.

    Blog Entry, Data Recovery, Hacking