Internet Security | Breaking Cybersecurity News | The Hacker News

A massive Distributed Denial of Service (DDoS) attack against Dyn , a major domain name system (DNS) provider, broke large portions of the Internet on Friday, causing a significant outage to a ton of websites and services, including Twitter, GitHub, PayPal, Amazon, Reddit, Netflix, and Spotify. But how the attack happened? What's the cause behind the attack? Exact details of the attack remain vague, but Dyn reported a huge army of hijacked internet-connected devices could be responsible for the massive attack. Yes, the same method recently employed by hackers to carry out record-breaking DDoS attack of over 1 Tbps against France-based hosting provider OVH. According to security intelligence firm Flashpoint , Mirai bots were detected driving much, but not necessarily all, of the traffic in the DDoS attacks against DynDNS. Mirai is a piece of malware that targets Internet of Things (IoT) devices such as routers, and security cameras, DVRs, and enslaves vast numbers of ...

We have heard a lot about privacy concerns surrounding Windows 10 and accusations on Microsoft of collecting too much data about users without their consent. Now, the French data protection authority has ordered Microsoft to stop it. France's National Data Protection Commission (CNIL) issued a formal notice on Wednesday, asking Microsoft to "stop collecting excessive data" as well as "tracking browsing by users without their consent." The CNIL, Commission Nationale de l'Informatique et des Libertés, ordered Microsoft to comply with the French Data Protection Act within 3 months, and if fails, the commission will issue a sanction against the company. Moreover, the CNIL notified Microsoft that the company must also take "satisfactory measures to ensure the security and confidentiality" of its users' personal data. The notice comes after a series of investigations between April and June 2016 by French authorities, revealing that Mic...

Another blow to the Tor Project : One of the Tor Project's earliest contributors has decided to quit the project and shut down all of the important Tor nodes under his administration. Lucky Green was part of the Tor Project before the anonymity network was known as TOR. He probably ran one of the first 5 nodes in the TOR network at its inception and managed special nodes inside the anonymity network. However, Green announced last weekend that "it is no longer appropriate" for him to be part of the Tor Project, whether it is financially or by providing computing resources. TOR, also known as The Onion Router , is an anonymity network that makes use of a series of nodes and relays to mask its users' traffic and hide their identity by disguising IP addresses and origins. The TOR network is used by privacy-conscious people, activists, journalists and users from countries with strict censorship rules. Crucial and Fast TOR Nodes to be Shut Down Soon Alongs...

Especially after the Snowden revelations of global  mass surveillance by US intelligence agencies at home and abroad, various countries demanded tech companies including Google, Apple, and Microsoft to set-up and maintain their servers in respective countries in order to keep their citizen data within boundaries. The US government has powers to comply US-based tech companies with the court orders to hand over their customers' data stored on servers, even if the data centers are beyond US borders. Now, the recent court decision has proven that the data centers and servers located outside the US boundaries are safe haven. The Second Circuit Court of Appeals in New York ruled Thursday that the United States government cannot force tech companies to give the FBI or other federal authorities access to their non-US customers' data stored on servers located in other countries. US Government Can't go Beyond its Boundaries to Collect Data Yes, the Stored Communicatio...

Two Google engineers have developed a draft version of an API called WebUSB that would allow you to connect your USB devices to the Web safely and securely, bypassing the need for native drivers. WebUSB – developed by Reilly Grant and Ken Rockot – has been introduced to the World Wide Web Consortium's Web Incubator Community Group (W3C WICG), is build to offer a universal platform that could be adopted by browser makers in future versions of their software. Connecting USB Devices to the Web WebUSB API allows USB-connected devices, from keyboards, mice, 3D printers and hard drives to complex Internet of Things (IoTs) appliances, to be addressed by Web pages. The aim is to help hardware manufacturers have their USB devices work on any platform, including Web, without having any need to write native drivers or SDKs for a dedicated platform. Besides controlling the hardware, a Web page could also install firmware updates as well as perform other essential tasks. Howev...

The majority of Internet users are vulnerable to cyber threats because of their own weaknesses in setting up a strong password. But, are end-users completely responsible for choosing weak passwords? Give a thought. Recently we wrote an article revealing the list of Worst Passwords of 2015 that proved most of us are still using bad passwords, like ' 123456 ' or ' password ,' to secure our online accounts that when breached could result in critical information loss. If the end-user is to blame for weak password security, then the solution is to educate each and every Internet user to follow the best password security practice. But is that really possible? Practically, No. Even after being aware of best password security measures, do we really set strong passwords for every website? I mean EVERY. Ask yourself. Who's Responsible for allowing Users to Set a Weak Password? It's the websites and their developers, who didn't enforce a...

Imagine the internet that would offer you to communicate privately with anyone else without censorship, safe from the prying eyes of surveillance authorities…. … Decentralized, Encrypted, Peer-to-Peer Supported and especially a non-IP Address based Internet. Yeah, a New Private Internet that would be harder to get Hacked. This Internet is a dream of all Internet users today and, of course, Kim Dotcom – the Famous Internet entrepreneur who introduced legendary Megaupload and MEGA file sharing services to the World. Kim Dotcom announced plans to start his very own private internet at the beginning of this year and has now revealed more details about MegaNet — a decentralized, non-IP based network that would share data via " Blockchains ," the technology behind Bitcoins. On Thursday, Dotcom remotely addressed a conference in Sydney, Australia, where he explained how MegaNet will utilize the power of mobile phones and laptops to operate. How will M...

Your Headache is not my Problem. If your computer gets hacked and infected with malware that holds your data for ransom, just pay off the criminals to see your valuable data again and do not expect the FBI to save them – it's what the FBI is advising concerning ransomware . Ransomware is a sophisticated malicious software that lets hacker encrypts all the contents of a victim's hard drive or/and server and demands ransom (typically in Bitcoins) for the decrypt key. Also Read:   Free Ransomware Decryption and Malware Removal ToolKit Federal agencies and the FBI have long urged people not to pay ransom to the criminals, as there is no guarantee that they will even receive an unlock key. The FBI – 'Better Pay up the Ransom' However, while speaking at the 2015 Cyber Security Summit on Wednesday, Assistant Special Agent Joseph Bonavolonta , who oversees the FBI's Boston office, advised the companies infected with ransomware to better pay up th...

PRIVACY  – a bit of an Internet buzzword nowadays. Why? Because the business model of the Internet has now become data collection. If you trust Google, Facebook or other Internet giants to be responsible managers of your data, the ongoing Edward Snowden revelations are making it all clear that this type of information can be easily snooped by the intelligence agencies like NSA and GCHQ. In short, the simple truth is that you have no or very little privacy when you are online. So, if you are worried about identity thieves, or your ISP spying on or throttling your traffic, the most efficient way to secure your privacy on the Internet is to use a Virtual Private Network (VPN) service. Though you can take other measures to increase security on your end, like installing a firewall as well as blocking known intrusive IP addresses that might be spying on you — But VPN takes your security to the next level by encrypting all inbound and outbound data. VPN (Virtual ...

It is finally time to say GoodBye to the old and insecure Web security protocols. Citing the long history of weaknesses in the Secure Sockets Layer (SSL) 3.0 cryptographic protocol and the RC4 Cipher Suite, Google plans to disable support for both SSLv3 as well as RC4 stream cipher in its front-end servers. While announcing on its official blog , the Search Engine giant said the company is looking to put away SSLv3 and RC4 in all of its front-end servers, and eventually, in all its software including Chrome, Android, Web crawlers, and email servers. The move by Google came as no surprise, considering the fact that both RC4 and SSLv3 have been deemed unsecure by the Internet Engineering Task Force (IETF). What are the Problems? SSLv3, which was made outdated 16 years ago, has a long history of security problems like BEAST , out of them the most recent one was POODLE ( Padding Oracle On Downgraded Legacy Encryption ) attacks, which lead to the recovery of plaintext communication...

Facebook founder Mark Zuckerberg has a dream to make Internet access available to everyone across the world - Zuckerberg argues Internet should be a service as essential as of 911 in the case of an emergency. In a blog post published Monday in The Wall Street Journal , founder of the social networking giant highlighted the future of universal Internet access, along with the steps he thinks to achieve it. Today 2.7 billion people, just over one-third of the world's population, have access to the Internet, Zuck said, and the adoption has been growing at a very lower rate, by less than 9% each year. The rest of the world's 5 billion people who do not have access to Internet are lacking access due to issues such as high costs or improper infrastructure. One may think that Zuckerberg's vision sounds like a self-interested push to gain more users for its social networking service, Facebook. But its true that the world is currently facing a growing technological divide, ...

Researchers at Mocana, a security technology firm in San Francisco, recently demonstrated the ease with which they could hack into a popular Internet-ready HDTV model. They exploited a vulnerability in the software that displays websites on the TV, allowing them to control the information sent to the television. This flaw enabled them to create fake screens for sites like Amazon.com, prompting users to enter their credit card details. Additionally, they could monitor data sent from the TV to other sites. "Consumer electronics makers seem to be rushing to connect all their products to the Internet," said Adrian Turner, Mocana's CEO. "The design teams at these companies have not put enough thought into security." Mocana, along with similar firms, sells technology to protect devices and often highlights potential threats. This test underscores a warning from security experts: the rise of Internet TVs, smartphones, and other web-ready gadgets creates new opportun...

Spam is arguably the most irritating aspect of the internet and email for people globally. However, there is hope in Canada for those who have been targeted by spammers. A new law, Bill C-28, aims to facilitate government efforts in prosecuting and fining individuals and companies guilty of sending spam. This law allows the government to impose fines of up to $1 million on individuals and up to $10 million on companies. Company directors and owners can also be held personally responsible if they are aware their networks are sending spam. Additionally, the law criminalizes the use of aliases or false information in emails, making it easier for victims to prosecute offenders. However, nearly 70 percent of the world's spam is distributed by botnets, meaning the senders are often as much victims as the receivers. Therefore, these laws might not significantly reduce the volume of spam sent and received. The new legislation closes a loophole in Canadian law, as Canada was previously ...

A federal indictment unsealed earlier today alleges that a 35-year-old Texas man hacked into the computer network of an Eden Prairie business, stealing approximately $274,000. The indictment, filed in Minneapolis on October 13, 2010, charges Jeremy Parker of Houston, Texas, with one count of unauthorized access to a protected computer to further fraud and one count of wire fraud. It was unsealed following Parker's initial appearance in United States District Court. The indictment claims that from December 23, 2008, through October 15, 2009, Parker hacked into the computer network to obtain money belonging to Digital River, Inc., through a subsidiary, SWReg, Inc. SWReg pays independent software developers who write code that can run on Digital River's system. Royalties owed to these developers accumulate at SWReg, allowing developers to view their royalty balances online and cash out those accounts. When a developer cashes out, SWReg electronically transfers the money into the ...

A pro-WikiLeaks hacker has stated that an Internet insurgent group will continue targeting companies that oppose the whistleblowing website.For the first time, the cyber-insurgent "Bass" from the group Anonymous spoke on camera, revealing details about their operations and their expanding membership. "Our pool of targets is actually very limited," the masked spokesman told Sky News. "We are going after the agencies that were directly involved in the censorship of WikiLeaks. "They include PayPal, which cut off services and withheld funds, Visa and MasterCard for similar actions, and Amazon for terminating their service support. "We don't attack the media, even those critical of us. We don't target any news outlets," he emphasized. "Facebook, Twitter, and other social networks, despite some actions against us, are not our targets." In their last attack, the group mobilized 9,000 volunteers as part of a "hive-mind" e...

A lot of people are gawking at Gawker Media this morning, though not for reasons that will bring much cheer to its founder, Nick Denton. Gawker, the parent company of popular blogs like Gizmodo, Lifehacker, Jezebel, and ValleyWag, has suffered a significant breach. A hacker group known as Gnosis has taken over the site. Gnosis accessed Gawker's source code and posted it on torrent sites. They also hacked into Gawker's content management system, posting a fake story on the home page linking to the source code torrents. Additionally, the group infiltrated the site's database, gaining access to the email addresses and passwords of Gawker's staff and over 1 million registered readers. These details have also been released on torrent sites, available for free download. Why is Gnosis targeting Gawker? They believe Gawker was picking on 4chan, a group known for creating the vigilante group Anonymous and various internet memes like lolcats and Rickrolling. Gnosis hacked Gawke...

Microsoft has detailed new security features for Internet Explorer 9 (IE9) that will help users prevent sites from tracking their activity across browsing sessions. The new feature, set to launch with the first release candidate of IE9 early next year, uses a list to control which third-party elements can be blocked from tracking. These elements include advertisements and embedded widgets from specific providers. Dean Hachamovitch, head of Internet Explorer development, explained how this feature works on Microsoft's IE blog: "A Tracking Protection List (TPL) contains Web addresses (like msdn.com) that the browser will visit (or 'call') only if the user visits them directly by clicking on a link or typing their address. By limiting the calls to these websites and resources from other web pages, the TPL limits the information these other sites can collect. You can look at this as a translation of the 'Do Not Call' list from the telephone to the browser and we...

The increasing threats of cyberwar are keeping U.S. officials busy alongside ongoing wars on terror and drugs. Recent incidents highlight the rising cyberwarfare concerns: Google reported espionage attacks originating from China, mysterious Internet traffic activities related to China, the Stuxnet worm targeting Iranian nuclear centrifuges, an attack on the WikiLeaks site following the release of classified U.S. documents, and the significant Internet attack on Estonia a few years ago. To address these cyber threats, the U.S. has adopted military strategies for cybersecurity, establishing Cyber Command and placing national cybersecurity under the Department of Defense. However, relying solely on offensive strategies is not the best defense. Gary McGraw, CTO at Cigital and author, argues that more secure software, rather than cyber warriors, is essential to protect networks and online data. In his article, "Cyber Warmongering and Influence Peddling," McGraw emphasizes the nee...

In a major embarrassment, the website of India's premier investigating agency, the Central Bureau of Investigation (CBI), was hacked tonight by a group identifying themselves as the "Pakistani Cyber Army." The CBI homepage displayed a message from the Pakistani Cyber Army, warning the Indian Cyber Army not to attack their websites. The hackers have exposed a significant vulnerability in India's cybersecurity by infiltrating one of the most secure websites. The CBI is linked to the command center of the world police organization, Interpol, 24/7. The hackers' message also criticized the National Informatics Centre (NIC), responsible for managing computer servers across India, and their filtering controls. Intelligence agencies have repeatedly warned the government that proper cybersecurity measures are lacking in government offices, and that no security audits are being conducted. The Pakistani Cyber Army further threatened to conduct "mass defacement"...