Subscribe to our newsletters
Sign Up

The Hacker News — Cyber Security, Hacking, Technology News

Sunday, May 11, 2014 Swati Khandelwal

Cyber Criminals Using New Malware to Make Money with Click Fraud
Before Ransomware, Click fraud was one of the popular and efficient ways for cybercriminals to make money and with the explosive growth in the size of the online threats it is still making its way on the Internet.

“Click-Fraud” is the practice of deceptively clicking on search ads with the intention of either increasing third-party website revenues or exhausting an advertiser’s budget. Besides the search results, we all have seen advertisements placed in the search engine’s WebPage. If the visitor clicks the Ad, the advertiser has to pay a fee to the search engine.

A problem that has arisen with pay-per-click is results in Click-Fraud. The term “fraud” is used because in either case, the advertiser is paying for a click without receiving any true value. Of course, the number of clicks has to be large enough in order to gain a considerable amount of money, and in order to do that an attacker can use an automated script or malicious program to simulate multiple clicks by a browser on an ad.

Such a malicious software infection used by cybercriminals to carry out Click Fraud operations has been spotted by the researchers of Symantec. Last month, the researchers noticed a recent surge of infections which they dubbed as Trojan.Viknok.

Trojan.Viknok was first observed by the security researchers in April 2013. The researchers considered the malware as a sophisticated threat because it has the ability to turn victims’ computer into a botnet. To do this, the malware is capable of gaining the elevated operating system privilege in order to infect system files on multiple Windows operating systems, including the 32 and 64-bit versions of Windows XP, Vista and 7.

Then these Viknok-infected computer botnet zombies are allegedly used by cybercriminals to carry out Ad-Click Fraud and to pull more money the scammers are trying to add more victims’ computers to their botnet.

“The scammers behind the current Viknok campaign have gone to a lot of effort to add more victims to their Adclick botnet, helping them make more money in the process,” states the blog post.

In the last six months, there has been an increase in the use of this threat by cyber criminals and in many cases, the victims infected with the Trojan report hearing audio clips through their computers’ speakers.

HOW THE VIKNOK INFECTS COMPUTERS
Cyber Criminals Spreading New Click Fraud Trojan to Making Money
Viknok infects the victims’ computers by injecting its payload into DLL files, but modifying the DLL files in the latest operating systems is not an easy task. In this case, cyber criminals make use of a number of methods to infect files, such as rpcss.dll, a library that runs every time the Windows is started. So, if an attacker is able to infect the rpcss.dll file, the malicious code is executed every time Windows starts.

There are a number of methods to infect the rpcss.dll file, including:
  • Using SeTakeOwnershipPrivilege function to take ownership of system files.
  • Taking advantage of Windows’ “Dynamic-Link Library Search Order” to run a malicious DLL inside the System Preparation Tool process.
  • Using the Run a legacy CPL elevated tool to run a DLL with elevated privileges.
  • The most powerful technique is by exploiting the Microsoft Windows Kernel 'Win32k.sys' local Privilege Escalation Vulnerability, CVE-2013-3660 that allows to run the malicious code in kernel mode.
Once installed on the computer, the Viknok uses one or more of the above techniques to inject the rpcss.dll file in victims’ computers that allow the malicious code to execute every time the operating system starts. Once rpscc.dll file is infected, it loads the core of the malware, which is usually stored in the %System% folder in an encrypted file.
“In many cases, the infection process is completely stealthy; the threat does not show any warning to the user. The malware is also difficult to detect since it does not show any suspicious running process, nor does it infect any of the standard load points,” Symantec researchers note in their blog post.
The malware shows the User Account Control (UAC) prompt to the victim in order to gain the elevated privileges, and if user doesn’t grant the permission, the infection will fail. But, the UAC prompt masquerade itself as a part of normal system activity, so users might give the Trojan permission without giving it too much thought.

Once the permission is granted, the attacker can remotely send the infected systems commands to load various websites. The websites offer car insurance, travel tickets, domain name registration, and many other services.

The count of Viknok infections has increased over the past few months. From January to April, the number of unique infections has increased from over 10,000 to 22,000 and over 16,500 unique Viknok infections have been noticed in the first week of May alone. The majority of the victims are located in the United States.

Stopping click-fraud is proving as difficult as stopping e-mail spam; and click-fraud artists may be more highly motivated. It is a good idea for users to practice safe email habits, such deleting any suspicious mail received without opening or viewing them, as well as refraining from opening any suspicious attachments or Links.

Sunday, December 12, 2010 Mohit Kumar


In Simple way we can say that cyber crime is unlawful acts wherein the computer is either a tool or a target or both

Cyber crimes can involve criminal activities that are traditional in nature, such as theft, fraud, forgery, defamation and mischief, all of which are subject to the Indian Penal Code. The abuse of computers has also given birth to a gamut of new age crimes that are addressed by the Information Technology Act, 2000.


We can categorize Cyber crimes in two ways

The Computer as a Target :- Using a computer to attack other computers.
e.g. Hacking, Virus/Worm attacks, DOS attack etc.


The computer as a weapon :- Using a computer to commit real world crimes.
e.g. Cyber Terrorism, IPR violations, Credit card frauds, EFT frauds, Pornography etc.

Cyber Crime regulated by Cyber Laws or Internet Laws
Technical Aspects
Technological advancements have created new possibilities for criminal activity, in particular the criminal misuse of information technologies such as


a. Unauthorized access & Hacking:-
Access means gaining entry into, instructing or communicating with the logical, arithmetical, or memory function resources of a computer, computer system or computer network.
Unauthorized access would therefore mean any kind of access without the permission of either the rightful owner or the person in charge of a computer, computer system or computer network.
Every act committed towards breaking into a computer and/or network is hacking. Hackers write or use ready-made computer programs to attack the target computer. They possess the desire to destruct and they get the kick out of such destruction. Some hackers hack for personal monetary gains, such as to stealing the credit card information, transferring money from various bank accounts to their own account followed by withdrawal of money.
By hacking web server taking control on another persons website called as web hijacking
b. Trojan Attack:-
The program that act like something useful but do the things that are quiet damping. The programs of this kind are called as Trojans.
The name Trojan Horse is popular.
Trojans come in two parts, a Client part and a Server part. When the victim (unknowingly) runs the server on its machine, the attacker will then use the Client to connect to the Server and start using the trojan.
TCP/IP protocol is the usual protocol type used for communications, but some functions of the trojans use the UDP protocol as well.
c. Virus and Worm attack:-
A program that has capability to infect other programs and make copies of itself and spread into other programs is called virus.
Programs that multiply like viruses but spread from computer to computer are called as worms.
d. E-mail & IRC related crimes:-
1. Email spoofing
Email spoofing refers to email that appears to have been originated from one source when it was actually sent from another source. Please Read 
2. Email Spamming
Email "spamming" refers to sending email to thousands and thousands of users - similar to a chain letter.
3 Sending malicious codes through email
E-mails are used to send viruses, Trojans etc through emails as an attachment or by sending a link of website which on visiting downloads malicious code.
4. Email bombing
E-mail "bombing" is characterized by abusers repeatedly sending an identical email message to a particular address.
5. Sending threatening emails
6. Defamatory emails
7. Email frauds
8. IRC related
Three main ways to attack IRC are: "verbalâ⦣8218;?Ŧ#8220; attacks, clone attacks, and flood attacks.
e. Denial of Service attacks:-
Flooding a computer resource with more requests than it can handle. This causes the resource to crash thereby denying access of service to authorized users.
Examples include
attempts to "flood" a network, thereby preventing legitimate network traffic
attempts to disrupt connections between two machines, thereby preventing access to a service
attempts to prevent a particular individual from accessing a service
attempts to disrupt service to a specific system or person.



Distributed DOS
A distributed denial of service (DoS) attack is accomplished by using the Internet to break into computers and using them to attack a network.
Hundreds or thousands of computer systems across the Internet can be turned into “zombies” and used to attack another system or website.
Types of DOS
There are three basic types of attack:
a. Consumption of scarce, limited, or non-renewable resources like NW bandwith, RAM, CPU time. Even power, cool air, or water can affect.
b. Destruction or Alteration of Configuration Information
c. Physical Destruction or Alteration of Network Components
e. Pornography:-
The literal mining of the term 'Pornography' is “describing or showing sexual acts in order to cause sexual excitement through books, films, etc.”
This would include pornographic websites; pornographic material produced using computers and use of internet to download and transmit pornographic videos, pictures, photos, writings etc.
Adult entertainment is largest industry on internet.There are more than 420 million individual pornographic webpages today.
Research shows that 50% of the web-sites containing potentially illegal contents relating to child abuse were ‘Pay-Per-View’. This indicates that abusive images of children over Internet have been highly commercialized.
Pornography delivered over mobile phones is now a burgeoning business, “driven by the increase in sophisticated services that deliver video clips and streaming video, in addition to text and images.”
Effects of Pornography
Research has shown that pornography and its messages are involved in shaping attitudes and encouraging behavior that can harm individual users and their families.
Pornography is often viewed in secret, which creates deception within marriages that can lead to divorce in some cases.
In addition, pornography promotes the allure of adultery, prostitution and unreal expectations that can result in dangerous promiscuous behavior.
Some of the common, but false messages sent by sexualized culture.
Sex with anyone, under any circumstances, any way it is desired, is beneficial and does not have negative consequences.
Women have one value - to meet the sexual demands of men.
Marriage and children are obstacles to sexual fulfillment.
Everyone is involved in promiscuous sexual activity, infidelity and premarital sex.
Pornography Addiction
Dr. Victor Cline, an expert on Sexual Addiction, found that there is a four-step progression among many who consume pornography.
1.Addiction: Pornography provides a powerful sexual stimulant or aphrodisiac effect, followed by sexual release, most often through
masturbation.
2.Escalation: Over time addicts require more explicit and deviant material to meet their sexual "needs."
3.Desensitization: What was first perceived as gross, shocking and disturbing, in time becomes common and acceptable.
4.Acting out sexually: There is an increasing tendency to act out behaviors viewed in pornography.
g. Forgery:-
Counterfeit currency notes, postage and revenue stamps, mark sheets etc can be forged using sophisticated computers, printers and scanners.
Also impersonate another person is considered forgery.
h. IPR Violations:-
These include software piracy, copyright infringement, trademarks violations, theft of computer source code, patent violations. etc.
Cyber Squatting- Domain names are also trademarks and protected by ICANN’s domain dispute resolution policy and also under trademark laws.
Cyber Squatters registers domain name identical to popular service provider’s domain so as to attract their users and get benefit from it.

i. Cyber Terrorism:-
Targeted attacks on military installations, power plants, air traffic control, banks, trail traffic control, telecommunication networks are the most likely targets. Others like police, medical, fire and rescue systems etc.
Cyberterrorism is an attractive option for modern terrorists for several reasons.
1.It is cheaper than traditional terrorist methods.
2.Cyberterrorism is more anonymous than traditional terrorist methods.
3.The variety and number of targets are enormous.
4.Cyberterrorism can be conducted remotely, a feature that isespecially appealing to terrorists.
5.Cyberterrorism has the potential to affect directly a larger number of people.

j. Banking/Credit card Related crimes:-
In the corporate world, Internet hackers are continually looking for opportunities to compromise a company’s security in order to gain access to confidential banking and financial information.
Use of stolen card information or fake credit/debit cards are common.
Bank employee can grab money using programs to deduce small amount of money from all customer accounts and adding it to own account also called as salami.

k. E-commerce/ Investment Frauds:-
Sales and Investment frauds. An offering that uses false or fraudulent claims to solicit investments or loans, or that provides for the purchase, use, or trade of forged or counterfeit securities.
Merchandise or services that were purchased or contracted by individuals online are never delivered.
The fraud attributable to the misrepresentation of a product advertised for sale through an Internet auction site or the non-delivery of products purchased through an Internet auction site.
Investors are enticed to invest in this fraudulent scheme by the promises of abnormally high profits.

l. Sale of illegal articles:-
This would include trade of narcotics, weapons and wildlife etc., by posting information on websites, auction websites, and bulletin boards or simply by using email communication.
Research shows that number of people employed in this criminal area. Daily peoples receiving so many emails with offer of banned or illegal products for sale.

m. Online gambling:-
There are millions of websites hosted on servers abroad, that offer online gambling. In fact, it is believed that many of these websites are actually fronts for money laundering.

n. Defamation: -
Defamation can be understood as the intentional infringement of another person's right to his good name.
Cyber Defamation occurs when defamation takes place with the help of computers and / or the Internet. E.g. someone publishes defamatory matter about someone on a website or sends e-mails containing defamatory information to all of that person's friends. Information posted to a bulletin board can be accessed by anyone. This means that anyone can place
Cyber defamation is also called as Cyber smearing.

Cyber Stacking:-
Cyber stalking involves following a persons movements across the Internet by posting messages (sometimes threatening) on the bulletin boards frequented by the victim, entering the chat-rooms frequented by the victim, constantly bombarding the victim with emails etc.
In general, the harasser intends to cause emotional distress and has no legitimate purpose to his communications.
p. Pedophiles:-
Also there are persons who intentionally prey upon children. Specially with a teen they will let the teen know that fully understand the feelings towards adult and in particular teen parents.
They earns teens trust and gradually seduce them into sexual or indecent acts.
Pedophiles lure the children by distributing pornographic material, then they try to meet them for sex or to take their nude photographs including their engagement in sexual positions.
q. Identity Theft :- 

Identity theft is the fastest growing crime in countries like America.
Identity theft occurs when someone appropriates another's personal information without their knowledge to commit theft or fraud.
Identity theft is a vehicle for perpetrating other types of fraud schemes.
r. Data diddling:-
Data diddling involves changing data prior or during input into a computer.
In other words, information is changed from the way it should be entered by a person typing in the data, a virus that changes data, the programmer of the database or application, or anyone else involved in the process of having information stored in a computer file.
It also include automatic changing the financial information for some time before processing and then restoring original information.
s. Theft of Internet Hours:-
Unauthorized use of Internet hours paid for by another person.
By gaining access to an organisation's telephone switchboard (PBX) individuals or criminal organizations can obtain access to dial-in/dial-out circuits and then make their own calls or sell call time to third parties.
Additional forms of service theft include capturing 'calling card' details and on-selling calls charged to the calling card account, and counterfeiting or illicit reprogramming of stored value telephone cards.
t. Theft of computer system (Hardware):-
This type of offence involves the theft of a computer, some part(s) of a computer or a peripheral attached to the computer.
u. Physically damaging a computer system:-
Physically damaging a computer or its peripheralseither by shock, fire or excess electric supply etc.
v. Breach of Privacy and Confidentiality
Privacy
Privacy refers to the right of an individual/s to determine when, how and to what extent his or her personal data will be shared with others.
Breach of privacy means unauthorized use or distribution or disclosure of personal information like medical records, sexual preferences, financial status etc.

Confidentiality
It means non disclosure of information to unauthorized or unwanted persons.
In addition to Personal information some other type of information which useful for business and leakage of such information to other persons may cause damage to business or person, such information should be protected.
Generally for protecting secrecy of such information, parties while sharing information forms an agreement about he procedure of handling of information and to not to disclose such information to third parties or use it in such a way that it will be disclosed to third parties.
Many times party or their employees leak such valuable information for monitory gains and causes breach of contract of confidentiality.
Special techniques such as Social Engineering are commonly used to obtain confidential information.

For more info Visit : http://www.cyberlawsindia.net/

Thursday, January 26, 2012 Mohit Kumar

Fake CNBC's Website for Internet Fraud



The beauty of the Internet is that you can make a truckload of money out here. Yes, you really could quit your full time job if you work hard.The bad news is most people either don't want to work at it, or they buy into some scam that causes them to waste money they could have used to invest in a real, legitimate venture.

Today I got a mail from some random Email ID and with Subject Wow ! thehackernews.com :
My family sees the money I'm bringing in every week and they're simply proud of me. http://tinyurl.com/7lmetym

I just Click the link provided in Email body and Here we notice a website with subdomain www.cnbc.com-exclusive.us , which having same mirror look like original CNBC website. In first sight the site seems to be legit because of Domain resemblance. Actually, the top level domain of this fraud site is com-exclusive.us and Admin create another subdomain in it with name cnbc . Now complete URL look similar to CNBC.com.
The Fake site , Redirecting users to Another domain http://www.keyinternetjobs.com/ , These sites Promising Users with "Real and Fast Money Making Ideas".
Here above we are showing the basic form they are offering users to Fill in order to get money making Idea's. But these Cyber criminals simply use your submitted contact email address and send tremendous amounts of spam offering a part time job, Money or some such bogus titles in future.

Friday, February 18, 2011 Mohit Kumar


THE internet was never meant to do sensitive banking transactions, cyber criminals are winning the war against online security and Australia's easy going nature is making us vulnerable targets to ever-more sophisticated internet thugs.

That was San Francisco-based internet security watcher and author Joseph Menn's assessment of the current state of the internet before he spoke to the Internet Industry Association's gala dinner in Sydney last night.
The only glimmer of hope was that people were becoming more aware of the risks involved with the internet - which he described as a "loaded gun" - but we have to be even more savvy if we are not to be become a cyber crime victim.
Mr Menn said when he interviewed the former head of the US Department of Justice's Cyber Crime Unit she said half of all credit cards were in the hands of criminals.
"And if your credit card details weren't in criminals' hands it was only because they hadn't got around to it yet," he said yesterday.
"That's a big problem."
Although more than 90 per cent of consumers' money lost to fraud is reimbursed by the banks.
"The banks then pass that cost back to the merchants," Mr Mann explained.
"And the merchants raise everybody's prices just a little bit.
"There aren't a lot of horror stories - there are some where a person wasn't able to buy a house because their credit record was ruined by a criminal somewhere.
"Instead there is a drain on the economy because all the prices go up.
"The pain on the economy is so gradual that no one really takes notice."
Mr Menn said he believed the internet had inherent structural flaws which made it incredibly difficult to make the network secure.
"The internet was never designed for financial transactions or the cloud services that companies keep their crown jewels," he said.
"It's a mess - it's the most open network in the history of the universe and we are defending it against some of the worst and best financed criminal groups.
"And we are losing."
However, he did say that individuals who - like it or not, have to be their own network administrators - have to make more of an effort to secure their personal computers.
"More than half of PCs have malware," Mr Menn said.
"The percentage of the really bad stuff that can capture credit card details is small but it is the fast-growing segment of malware.
"More than 90 per cent of operating systems are not running fully patched systems and fully up to date applications.
"That's not good."
And Australians, more than many others seem to take their easy-going nature online which could leave them vulnerable, he said.
The security watcher said governments would take more steps to protect citizens and some of those steps would not be popular before singling out the Federal Government's internet filter and saying that it was clearly not popular and would not stop cyber criminals in any way.

News Source : Google

Monday, November 15, 2010 Mohit Kumar


Posing as IT support staff, criminals are picking up the phone in order to push Rogue anti-Virus software onto the system’s of unsuspecting U.K. Internet users. The news comes from GetSafeOnline.org, who is using it to kickoff a week of events supporting Internet safety.
These fly-by-night boiler room operations sometimes employ up to 400 people, who use a mix of sales and social engineering to scam their victims into believing that their system is in desperate need of repair. The end goal is to walk away with credit card information, verified when the Rogue anti-Virus is purchased, or remote access to the victim’s system for future use.
A typical call likely comes out of the blue. On the other end of the line, a person claiming to be an IT Helpdesk technician begins the process of forming a rapport with the mark. Like any other cold calling scam, the idea is to form an instant bond.
The caller starts by representing themselves to the mark in a position of authority and trust, by first collecting, and then using various bits of personal information that someone in IT might know. This information is easily discovered thanks to bulk marketing lists available online, and the power of social networking.
From there the mark is most likely quizzed on virus related issues and other computer problems, such as slow email and Internet browsing, or slow system startups. All the mark needs to do is admit to having one of those symptoms, or something close, and the caller can press the pain by explaining what will happen if this problem isn’t fixed. Then, just as the pain clearly present, the caller offers a solution.
“For a small fee,” they might say, “we can install something to fix your system and clean it completely. No more slow startups, your Web surfing will speed up, and email will arrive nearly instantly.”
If the mark falls for it, game over. The caller collects their credit card details, with as much other information as they can, and charges the card anywhere form $50-79.00 USD to prove it works. Next, the Rogue anti-Virus software is installed. After that, the caller hangs up and moves on.
If the mark doesn’t fall for the scam in the first few minutes of the call, then the caller hangs up and moves on. With cold calling, the clock is ticking. If the mark isn’t your buddy in the first 90 seconds; you end the call and find a new friend.
It may seem like a stretch, but cold calling scams have worked for a long time in the commodities market (currency and precious metal trading), as well as real-estate and general stock-based scams.
The thing is, cold calling itself isn’t an illegal act. It’s a legit marketing and sales tool. However, there is a right way and wrong way to go about it. Selling fraudulent items, such as the Rogue anti-Virus is illegal, using cold calling to set sales appointments isn’t.
The trick is to hear the word no enough times; even legit cold calling operations and salespeople will tell you that. If you hear no ten times, then the eleventh person is going to say yes. It’s only a matter of time so keep dialing.
Again, this tactic is nothing new, but with 1-in-4 U.K. Internet users admitting to having talked to an IT Helpdesk person out of the blue offering such services, the numbers can equal a hefty payday for the criminals running scam.
Baroness Neville-Jones, the Minister of State for Security, commented, “Given that our latest research indicates 80% of UK internet users have never heard of these ‘IT helpdesk’ scams, yet almost a quarter have been approached by them, it is vital that we make people aware of this threat.”

Webmasters aren’t left out in the cold either. The criminals doing the cold calling are also adding legitimate webmasters to an affiliate system that will pay them for each successful installation of the Rogue anti-Virus software.
This is an ironic twist as the criminals themselves are paid on a per install basis via an affiliate program themselves. However, there is plenty of money to be earned by the shady PPI programs, so cutting someone into a small percentage for a massive take is worth the investment.
The figures listed by GetSafeOnline.org say that criminals are investing up to $150,000 USD per month in the payouts.
Although the last few years have seen some steady improvements in installing computer security software and detecting common scams, the GetSafeOnline.org report noted, over a third of U.K. internet users (34%) still report being the victim of a Malware attack, 22% have experienced a Phishing scam, and over 1 in 5 (21%) have been a victim of identity fraud.
These cold calling scams are easily avoided. They use human emotion to work, and the people on the other end are expert button pushers. They will use fear, greed, and guilt to get what they want, but all you have to do is trust your gut.
If it sounds too good to be true, then it is. Never agree to anything sales related over the phone, especially if it is random contact and you need to pay now. Ask for time to think or simply stall by flooding the caller with random questions. They’re on a clock, so stalling them will make them press harder or end the call.

If they press harder, hang up. Don’t be the eleventh caller who will tell them yes.

Thursday, February 24, 2011 Mohit Kumar

The U.S. agency that tracks complaints of criminal activity on the Internet reported Thursday that fewer people complained about Internet fraud in 2010 than in the previous year.



The Internet Crime Complaint Center (IC3) runs a Web site where victims can report details of any cyberfraud. It shares the data with law enforcement agencies to help them hunt down criminals. Last year it received 303,809 complaints, almost 10 percent fewer than the previous year's total of 336,655.
The IC3 is run by the U.S. Federal Bureau of Investigation and the National White Collar Crime Center. It released its annual report Thursday, based on data submitted in 2010.
The largest single source of complaints was from people who had been duped by criminals posing as buyers and sellers. International scammers, preying on eBay and Craigslist users, have made millions over the past decade. Just last week, a Romanian national, Adrian Ghighina, pleaded guilty to his role in a scam that took in $2.7 million by tricking eBay, Craigslist and AutoTrader.com users into paying for vehicles that were never delivered.
Even without factoring in the fraud at online auction sites, which the IC3 counts separately, this type of activity accounted for 14.4 percent of complaints, the IC3 said. That's a noticeable jump from 2009, when the total was 11.9 percent.
Complaints about 2009's most-reported scam -- malware-laden emails that purported to come from the FBI itself -- dropped in 2010. In 2009 these fake FBI emails were a big problem, totaling nearly 17 percent of all complaints. In 2010, they totalled 13.2 percent.
There was also a drop in complaints about "advance fee scams," where the victim is promised a big lottery payout or inheritance as soon as they pay a phoney administrative fees. These dropped from 9.8 percent in 2009 to 7.6 percent last year.
It's not surprising if scammers are looking for new activities because consumers may be getting wise about some of these crimes, said Adam Chernichaw, a partner with the law firm White & Case in New York, who consults with financial services companies. "After a number of years in the spotlight you get your consumer base educated and they search for an easier route," he said.
Chernichaw believes the overall number of complaints may be down because companies are getting better at dealing with fraud. Online merchants are getting better about refusing suspicious transactions and automated fraud detection tools are picking up scams earlier, he said.

Wednesday, July 22, 2015 Mohit Kumar

​Google, Yahoo, Facebook Collaborate to Blacklist Bad Bots
The major tech companies including Google, Facebook, and Yahoo! have joined their hands to launch a new program meant to block fake web traffic by blacklisting flagged IP addresses.

Today, majority of data center traffic is non-human or illegitimate, so to fight against this issue the Trustworthy Accountability Group (TAG) has announced a program that will tap into Google's internal data-center blacklist to filter bots.

The new pilot program will reject traffic from web robots or bots by making use of a blacklist, cutting a significant portion of web traffic from within data centers, said Google Ad Manager Vegard Johnsen.

Google or any other big tech firm maintains a Blacklist that lists suspicious IP addresses of computer systems in data centers that may be trying to trick the human into clicking on advertisements. Google's DoubleClick blacklist alone blocked some 8.9% of data-center traffic back in May.

Facebook and Yahoo to Contribute


Apart from Google, TAG's new program will take help from other industry leaders, including Facebook, Yahoo, Dstillery, MediaMath, Quantcast, Rubicon Project and TubeMogul, to share their own internal data-center blacklists.
"By pooling our collective efforts and working with industry bodies, we can create strong defenses against those looking to take advantage of our ecosystem," Johnsen said in a blog post. "We look forward to working with the TAG Anti-fraud working group to turn this pilot program into an industry-wide tool."
Click fraud have become a major issue for big companies as it steals money from advertisers and reduces faith in online campaigns.

Fraudsters are making Millions


Some publishers even run specialized tools in data centers that generate fraudulent ad impressions to inflate user clicks.Two such tools are listed below:
  • UrlSpirit
  • HitLeap
UrlSpirit is a software that serves as a form of botnet. Named URLs are distributed among Internet Explorer (IE) instances running on most of the data center boxes that operate UrlSpirit.

The search engine giant discovered nearly 6,500 installations of UrlSpirit generating 500 Million fake ad requests or an average of 2,500 ad requests per installation per day.

On the other hand, HitLeap is another software that uses the Chromium Embedded Framework, instead of Internet Explorer.

HitLeap is larger with 4,800 installations network of which 16% are operating in data centers.

Mike Zaneis, Trustworthy Accountability Group's chief executive, declared its new pilot program would also tackle fraudulent advertisements.
"This program is another piece of the interlocking set of solutions TAG is building to fight fraud across the entire ecosystem," says Zaneis. "The industry is galvanizing its efforts and we will win the war against fraud."
TAG will soon release a set of principles for online users comments that will be then incorporated into the final pilot program. The ad fraud detection tool will be available to the public by the end of 2015.

Wednesday, April 12, 2017 Swati Khandelwal

computer-in-prison
Can you imagine your world without the Internet?

I know it's hard to imagine your life without the Internet, and the same was the case of two Ohio prisoners who built personal computers from parts from e-waste, hid them in the ceiling, and connected those PCs to the Internet via the prison's network.

The incident occurred in 2015 but has now been made public by the State of Ohio's Office of the Inspector General, which published a 50-page report [PDF] on Tuesday, following almost a year-long investigation.

According to the report, a prison work program has backfired two inmates of Marion Correctional Institution in Ohio, Florida, who smuggled computer parts from an e-waste recycling workshop and built two clandestine computers out of them.

The unsupervised inmates later hid the computers behind a plywood board in the ceiling of a training room, and then connected those working PCs to the Ohio Department of Rehabilitation and Correction (ODRC) network to access the Internet.

But once the inmates got online, unsurprisingly, they used their skills to break the law.

The prisoners accessed the internal records of other inmates, created inmate passes for restricted areas, accessed websites with information about manufacturing drugs, weapons, and explosives, and apply for credit cards under another prisoner's name for a planned tax fraud scheme, Ohio's government watchdog said.

Besides this, the forensics team also found "self-signed certificates, Pidgin chat accounts, Tor sites, Tor geo exit nodes, ether soft, pornography, videos, VideoLan, virtual phone, and other various software."

The scheme was discovered after prison technology employee Gene Brady alerted about unusual levels of internet activity on a contractor's account on days when the employee was not scheduled to work.

Ultimately, a total of five inmates were identified as being involved with the hidden computers during the investigation:
  • Stanislov Transkiy – Executive committee chairman of Recycling.
  • Leeshan McCullough – Chairman of aquaculture.
  • Robert Cooper – Chairman of horticulture.
  • Matthew Brown – Chairman of environmental education.
  • Adam Johnston – Executive committee treasurer.
All the five inmates have now been separated and moved to other correctional facilities.
"We will thoroughly review the reports and take any additional steps necessary to prevent these types of things from happening again," the ODRC said in a statement. 

"It's of critical importance that we provide necessary safeguards in regards to the use of technology while still providing opportunities for offenders to participate in meaningful and rehabilitative programming."
The Marion Correctional Institution (MCI), which houses nearly 2,500 inmates, operates many programs to educate or provide services to the community, including the MCI Green Initiative to revamp the institution's trash and recycling processes.

Wednesday, June 29, 2016 Swati Khandelwal

china-track-users
China has long been known for its strict censorship which makes it difficult for foreign technology companies to do business in the world’s most populous country of over 1.35 billion people.

Now, the new law issued by the Chinese government will expand its strict Internet monitoring efforts into mobile apps, targeting operators including Apple. However, Google currently doesn’t operate its app store in China.

The Cyberspace Administration of China (CAC) has imposed new regulation on distributors of mobile apps that requires both app stores and app developers keep a close eye on users and maintain a record of their activities for at least 60 days.

The Chinese internet regulator has introduced the new legislation with the intent to fight issues like terrorism, pornography, violence, money fraud and distribution of malicious contents.

However, this new move by the Chinese government will tighten its control over the Internet, especially the mobile apps used for private encrypted communications.

App stores and developers, both domestic as well as foreign, will now have to verify their users’ identities with real-name registration and must keep their activity logs for at least 60 days.

The proposed legislation, which will come into effect on August 1, also requires developers closely monitor their users to help identify individuals who distribute banned content.

However, the law would also prevent mobile apps from requesting unnecessary app permission to access user's camera, microphone, contacts and other fake installation requests.

Conditions for App Providers When Operating in China


Here's the list of criteria that the app stores and developers must meet when operating in China:
  • App providers must verify users' identities by requiring their mobile numbers or other information.
  • Providers should protect their users' information and cannot use the information without their consent.
  • Providers should improve censorship and punish anyone releasing illegal information through warnings, shutting down accounts or suspension of service.
  • Providers are forbidden from collecting user's location data and reading their contacts stealthily.
  • Providers are also banned from pirating their rivals' products.
  • Providers must record user logs and keep the information for at least 60 days.
"The regulation was enacted after substantial field research and soliciting public opinions... and is also aimed at regulating app services and promoting the industry's healthy development," the CAC said in a statement.
The draft regulation has already been submitted to China's top legislature.

More than 610 Million people in China are using the Internet on their mobile phone at the end of 2015, and China-based app stores host over 4 Million apps, which is growing at an exponential rate.

So, if passed, the law will threaten the privacy of hundreds of Millions of Internet users in China and will increase the Chinese government’s control over the Web.

Sunday, September 06, 2015 Wang Wei

China Police Arrest 15,000 Suspects for Alleged Cyber Crimes
China Police has arrested nearly 15,000 people on suspicion of cyber crimes as part of an operation dubbed "Cleaning the Internet," according to reports.

According to the Chinese Ministry of Public Security (MPS), the suspects have been arrested for their involvement in cyber crimes that "jeopardized Internet security."

In July, China launched a six-month campaign codenamed "Cleaning the Internet" to fight online criminal activities.

Under the program, the police investigated 7,400 cases, including hacking, online fraud and the illegal sale of personal information, spread over 66,000 websites, the official website of the ministry stated.
"For the next step, the public security organs will continue to increase their investigation and crackdown on cyber crimes," according to the Chinese Ministry of Public Security.
The MPS did not clear exactly when the arrests took place but said the program also took down major online criminal cases as well as eliminated online gangs.

Police suspended more than 190,000 illegal online websites featuring vulgar contents including advertisements for pornography, firearms, explosives, and gambling.

China is considered to be a country that took the Internet as their virtual territory; a territory that must be ruled by government's laws and regulations. It's also the country that runs one of the world’s most sophisticated Internet censorship systems called The Great Firewall.

Monday, May 05, 2014 Swati Khandelwal

Critical Vulnerability in BIND Software Puts DNS Protocol At Risk
After the Heartbleed bug that exposed half of the Internet vulnerable to hackers thereby marking as one of the largest Internet vulnerability in recent history, the critical flaw in the implementation of the DNS protocol could also represent a serious menace to the Internet security.

A Serious security vulnerability has been discovered in the algorithms of DNS software – BIND by the two Israeli students 'Roee Hay' and 'Jonathan Kalechstein', who are working under a project out at the Laboratory of Computer Communication & Networking in the Faculty of Computer Science at the Technion, which was led by Dr. Gabi Nakibly from Rafael (Rafael Advanced Defense Systems Ltd.).

Although, Technion students have not provided any detail explanation about the vulnerability, but indicated that by exploiting the DNS protocol flaw an attacker could redirect the users who are trying to visit a legitimate website to a fake and bogus website which the attacker controls. The fake website could reflect the same name and look completely identical to the original one.

VULNERABILITY IN DNS PROTOCOL 
The students have found a way to compel DNS servers to connect with a specific server controlled by the attacker that could respond with a false IP address. “This type of cyber attack gives hackers an advantage, by causing computers to ‘talk’ with network stations that they alone control without being able to detect the occurrence of the fraud,” explains Dr. Gabi Nakibly.

The Domain Name System (DNS) is an essential component of the functionality of the Internet and the most common internet protocol which is responsible for navigating between global servers based on website addresses. It translates easily memorized domain names to the numerical IP addresses needed for the purpose of locating computer services and devices worldwide.

“The DNS protocol has been around for several years and has been investigated by researchers from all over the world. We knew in advance that the chances of finding a loophole in the software would be very small, but we like challenges,” Roee Hay stated.

Since DNS is the leading protocol that is responsible to take users to the site they wanted to see, any weakness in its implementation could lead users to a bogus site controlled by the attackers or steal users’ credentials by a classic phishing schema.

PATCHED VERSION COMING SOON
Fortunately the weakness discovered in the protocol is the result of a research conducted by the Students at Technion and till now security experts haven’t noticed any such attacks exploiting the flaw. But, the impact of the vulnerability could be more terrific if exploited by the cyber criminals.

“We were very surprised to find a loophole in the protocol,” said Kalechstein. “We reported it to the authorities responsible for its implementation, they responded that they were unaware of this problem, and added that they will replace the algorithms in the next software version release.”

The discovery of the critical flaw has been reported to the authorities responsible for its implementation and they responded by saying that they were totally unaware of this loophole and that the algorithms will be replaced in the next software version release.

Monday, April 22, 2013 Mohit Kumar

Tor is a web service that allows users to surf the Internet, use IM, and other services while keeping themselves completely anonymous, but Japan's National Police Agency wants ISPs to block access to Tor if users are found to have abused it.

The push by Japanese authorities is because they’re worried about an inability to tackle cyber crime enabled in part by anonymizing services such as Tor. Japanese police is having a hard time when it comes to crimes in the cyberspace. Just last year a hacker, going by the name Demon Killer, took remote control of systems across the country and posted death threats on public message boards.

The panel claimed it has been used in the past to commit internet fraud, help paedophiles groom kids online and, tellingly, enabled leaks from Tokyo's Metropolitan Police Department.

Tor has proven to be an invaluable tool for pro-democracy campaigners in the Middle East while censorious regimes such as the Chinese authorities have attempted to block users from using the system. Japanese ISPs have not welcomed the recommendation.

The Tor system was utilized by citizens in pro-democracy movements in the Middle East to escape government suppression, while Wikileaks also recommends Tor to information providers.

Activists on the Internet or those living in countries with oppressive regimes use Tor to carry out their online whistle blowing activities anonymously.

One can understand the zeal of the Japanese police to stamp out cyber crime,  but someone might have to tell them that they’re going about it the wrong way. Tor is not all the web evil that it is painted to be democratic activists under repressive governments have used it to achieve good effects.

Monday, May 07, 2012 Mohit Kumar

ISPA to launch cyber security code of practice in SA

South Africa’s Internet Service Providers’ Association (ISPA) has teamed with Australia’s Internet Industry Association to develop a new voluntary industry code of practice to improve cybersecurity for end users. Known as the ‘icode’, and developed in conjunction with Australia’s Internet Industry Association, the code will provide a consistent approach for South African ISPs to help inform, educate and protect their customers in relation to cyber security.

"The increasing threat of zombied computers - computers which have been essentially hijacked and are under the control of criminals or other third parties - presents a real risk to users. Identity theft, fraud, and increases in spam are all possible consequences of compromised computers."

By following the code, ISPs will contribute to reducing the number of compromised computers in South Africa and enhance the overall security of the South African and international Internet.

The security code initiative was welcomed by the banking sector, which is intrinsically affected by malware and security breaches.South African Banking Risk Information Centre (Sabric) CEO Kalyani Pillay says the country's banks constantly review security measures to offer Internet users as safe an online banking experience as possible.

The icode is expected to contain four main elements:
- A notification/management system for compromised computers
- A standardised information resource for end users
- A comprehensive resource for ISPs to access the latest threat
information
- A reporting mechanism in cases of extreme threat back to national
security agencies to facilitate a national high level view of attack
status.

Thursday, January 09, 2014 Swati Khandelwal

Government modifying 'Personal Data Privacy and Security Act' to strict Sentencing for Hackers
The Senate Judiciary Committee Chairman 'Patrick Leahy' reintroduced a revamped version of the "Personal Data Privacy and Security Act" for tough criminal penalties for hackers, that he originally authored in 2005.

During last Christmas Holidays, a massive data breach had occurred at the shopping giant Target, involving hack of 40 million credit & debit cards, used to pay for purchases at its 1500 stores nationwide in the U.S.
Reason: "Target Data Breach? Seriously"? In a statement, as published below, the Senator wrote:
"The recent data breach at Target involving the debit and credit card data of as many as 40 million customers during the Christmas holidays is a reminder that developing a comprehensive national strategy to protect data privacy and cybersecurity remains one of the most challenging and important issues facing our Nation"
It seems that the TARGET Breach was scheduled, as the best opportunity to ramp up the cyber security laws against all kinds of Hackers.

Finally, on Wednesday he has re-introduced a more strict version of the "Personal Data Privacy and Security Act" bill that aims to protect Americans’ data from cyber criminals. He wrote in a statement,
"The Personal Data Privacy and Security Act will help to meet this challenge, by better protecting Americans from the growing threats of data breaches and identity theft."
In his proposal, the companies with databases containing sensitive customer information will have to adopt a 'nationwide standard' of internal policies to defend against cyber attacks. It will also provide an alert notice to all Americans users, when they have been victims of such data breach.

No Doubt, I am also in favor to give strict sentences to the Cyber criminals who are involved in Malware related crimes,  financial hacks, cyber bullying, espionage or spying, but this Bill now also covers strict sentencing for hactivists and hackers who have nothing to do with financial data. I have explained these facts about the bill as follow:
Government modifying 'Personal Data Privacy and Security Act' to strict Sentencing for Hackers
Obviously, I smell a Rat here!
New Penalty - 20 Years, rather than 10: Another most important modification is proposed to increase the maximum sentence for a first-time offender from 10 years to 20.

Cyber Criminal = Hacktivist = Anonymous = Cyber Fraud ≠ NSA: Unfortunately, this Bill will also apply to all types of hackers, who is involved in Data Breaches, Cyber Fraud activities, Identity theft, Malware developers as well as on the other hackers including Anonymous, Hacktivist etc. who is not hacking for financial benefits.
“The bill also includes the Obama administration’s proposal to update the Computer Fraud and Abuse Act, so that attempted computer hacking and conspiracy to commit computer hacking offenses are subject to the same criminal penalties, as the underlying offenses."
Government modifying 'Personal Data Privacy and Security Act' to strict Sentencing for Hackers
If you haven’t forgotten the news of the Hactivist Jeremy Hammond, who was sentenced 10 years in prison under the same Computer Fraud and Abuse Act (CFAA) for hacking into private intelligence contractor Stratfor and attempting to highlight Stratfor’s work as a private intelligence firm.

He exposed Surveillance operation done by Stratfor on the political protesters at the behest of both private companies and the government. His attack was for political purpose, rather than financial.

Attempt to Hack = Successfully Hacked: If you are even planning to hack someone, then, according to this updated Bill, you are also considered as a Criminal. The Senator also proposed that the hackers who are unsuccessful in their actions are punished as severely as more accomplished ones regardless.

 Considering the NSA's unethical Hacking operation? Now that’s interesting! Whistle-blowing comes under a massive crime, but spying on the whole world by the their own NSA comes under nothing from any above??
NSA unethical Hacking operation
Recently, The Security researcher Jacob Appelbaum accused the NSA of illegally hacking the massive amounts of private data of users under the guise of counterterrorism. “NSA gets to do something like intercepting 7 billion people all day long with no problems. And the rest of us are not even allowed to experiment with improving the security of our own lives without being put in prison or under threat of serious indictment.” he said.

Making Laws more strict for hackers with criminal or Fraud activities is OKAY, but what about the team of hackers who are unethically hacking into world's telecommunication companies, devices or the database of Big Internet companies?

Now, this is something on what U.S Government won't give a damn look!

Newsletter Subscription

Subscribe to our newsletter and get all latest hacking news, free eBooks delivered to your inbox.

Join Over 450,000 Subscribers!