hackwarenews - Tumblr blog

[hackwarenews]

Master Cryptocurrency Quickly With This Online Course Bundle

  Cryptocurrency and blockchain are poised to become the next big thing, but we know this new world of technology can be foreign and a little overwhelming. If you’re interested in getting involved, The Complete Ethereum Blockchain Mastery Bundle can guide you through blockchain technology and cryptocurrency for just $29.

With four in-depth online courses, this bundle includes a total of 272 lessons by Certified Bitcoin Professionals. Who better to teach you the ins and outs of this new currency?

If you’re worried about getting into this industry late, don’t be! Since Ethereum technology is still in the early stages, now is the perfect time to get started. This bundle includes the most in-depth Ethereum blockchain development course out there, and it was created for those new to the field.

From there, get a grasp on the blockchain ecosystem and the technology around it with simple step-by-step instruction. You can then expand your knowledge even further with two more courses that show you how to build your own blockchain application, launch an initial coin offering, and build a decentralized exchange.

Currently available at an incredibly 95% discount, purchase The Complete Ethereum Blockchain Mastery Bundle here for just $29.

The post Master Cryptocurrency Quickly With This Online Course Bundle appeared first on Hack Ware News.

from WordPress https://ift.tt/2zSqfSc via IFTTT

[hackwarenews]

Chinese Spying Chips Found Hidden on US companies’ servers

Chinese Spying Chips Found Hidden on US companies’ servers

  Business and markets news company Bloomberg reported today that a very small surveillance chip, similar in size to a grain of rice, has been found hidden in servers used by US companies. These servers are being used by nearly 30 American companies, including big names such as Apple and Amazon.

  The servers are designed in the US by an American company called Super Micro, and do not include the chip in their designs. It is thought the chip must have been added in China, during the manufacturing process for the servers. The chip is an example of a “hardware hack” where hardware is modified to perform functions that wasn’t originally intended in the design. It is suspected the purpose of the chip is to spy on American companies and their users.

  The lengthy publication by Bloomberg reports that Apple and Amazon were among those companies affected, but both companies refute the claim. An Apple spokesperson told Bloomberg that they had no history of finding malicious chips or hardware manipulations in any of its servers. Apple no longer used Super Micro servers after ending their contract with them in 2016.

  Amazon also disputes the claims about their servers containing malicious chips and says they have not worked with the FBI to investigate malicious hardware within the company. Super Micro join Apple and Amazon in denying the claims about its servers.

  In response to the allegations, China’s Ministry of Foreign Affairs released a statement saying “China is a resolute defender of cybersecurity. It advocates for the international community to work together on tackling cybersecurity threats through dialogue on the basis of mutual respect, equality and mutual benefit. Supply chain safety in cyberspace is an issue of common concern, and China is also a victim. China, Russia, and other member states of the Shanghai Cooperation Organization proposed an “International code of conduct for information security” to the United Nations as early as 2011. It included a pledge to ensure the supply chain security of information and communications technology products and services, in order to prevent other states from using their advantages in resources and technologies to undermine the interest of other countries. We hope parties make less gratuitous accusations and suspicions but conduct more constructive talk and collaboration so that we can work together in building a peaceful, safe, open, cooperative and orderly cyberspace.

    The post Chinese Spying Chips Found Hidden on US companies’ servers appeared first on Hack Ware News.

from WordPress https://ift.tt/2RrfQ6A via IFTTT

[hackwarenews]

Azure Blob Storage phishing attack impersonates Microsoft

Azure Blob Storage phishing attack impersonates Microsoft

Although phishing attacks can often be quite believable, some more tech savvy users recognise something isn’t right when they see that the login form is unsecured or the SSL certificate doesn’t match the company being impersonated. However, there is a new phishing attack that stores their phishing form on Azure Blob Storage, so that it is secured by a Microsoft SSL certificate, giving an air of legitimacy to its victims. The phishing attack is an Office 365 based attack.

  Azure Blob storage is a service that allows for storing large amounts of unstructured object data, such as text or binary data. This data can then be accessed anywhere in the world using HTTP or HTTPS. When the user connects via HTTP or HTTPS, a SSL certificate will be displayed, making it difficult for even competent users to tell it’s a phishing attack.

  Cloud security provider Nekskope recently discovered this method being used. The attackers have been sending victims emails with a PDF attachment that pretend to be from a law firm in Denver. The attachments are innocently named “Scanned document. Please review” and contains a button to download the PDF. When the target clicks on the button they are brought to a HTML page masquerading as an Office 365 login form. The URL may trigger some savvy users to be suspicious, but the SSL may be enough to convinced them that this is a secured and legitimate Microsoft site.

Once Clicked on the “Download PDF”button, you are presented with message that the document is trying to connect to Azure blob storage

In order to protect yourself from this type of attack Netskope advises that companies would properly educate their users to recognise non-standard URL addresses. If users could easily recognise the legitimate address and be suspicious of any change in the web address then they would be less likely to fall victim to this type of phishing scam.

  The post Azure Blob Storage phishing attack impersonates Microsoft appeared first on Hack Ware News.

from WordPress https://ift.tt/2xXm1aA via IFTTT

[hackwarenews]

How to Secure Your Linux Server

 How to Secure Your Linux Server

It’s important for anyone running a Linux server, or any type of server for that matter, secure. Especially if it communicates with the outside world. Servers are like your houses in the digital realm. They have to be kept secure from intruders. So you have a Linux server, here’s how to secure it.

Keep Your Server Clean and Lean

In other words, keep it simple, but secure. Install the apps and run only the services that you need. Additional apps, introduce vulnerabilities as well as unpatched services that can be exploited by external malicious actors. Keeping the server clean and lean also speeds up its performance. Also, depending on the Linux distro, a number of extra services will be run by default. Keep an eye out for those services. Check if they’re really important and if they are, make sure they’re updated.

A simple netstat –npl command in the terminal will show you all the running services and the ports they use. That’s another thing. These services might be using some ports you want to keep closed. Disable unwanted services with the following command.

Systemctl disable service_name

  Do not Log in as Root

It’s no secret that logging in as Root user gives you unrestricted access to everything in your Linux setup. And for many Linux users, it’s the easiest way to use Linux which is why most newbies log in as Root. Malicious attackers know this too. When users log in as Root, any running apps and services with vulnerabilities also give attackers unlimited access to everything else. The best practice for Linux users, is to create a user with enough sudo access to perform most tasks and only switch to Root when needed.

In Ubuntu for example, you can add a new user with sudo powers by typing in the following at the terminal:

adduser usercansudo

qpasswd –a usercansudo sudo

Afterwards, log out of the system and login as the new user then disable the Root user by editing the sshd_conf file.

Nano /etc/ssh/sshd_conf

Look for this commented item: #PermitRootLogin no

Remove the comment, save the file and restart the ssh service using the following command:

systemctl restart sshd

  Keep the Server to Yourself and others you Trust

Restrict access to your server to just you and others you implicitly trust. In the previous item, create as many users as you can with level access and disable root. The fewer the better though.

Port Change

When logging in remotely, the default port for ssh is 22 which is what most people, including attackers would do to get into a Linux server. This port can be changed and by changing this port, eavesdroppers, attackers and bots will be left guessing how to log in to your system. It’s simple but effective. To change the ssh port, we go back to the sshd_conf file. You can issue the following commands:

sudo nano /etc/ssh/sshd_conf

  Find the commented port line:

#Port 22

  Uncomment it and change the port number to something else. Feel free to change 22 to something between 1024 and 32,767 but make sure that no other service uses your chosen number. Then save the file. Restart the ssh service.

systemctl restart sshd

  You can check  if it works by logging in through ssh with this command:

ssh -p{port_number}@server_IP

Example:

ssh –p1027 192.168.10.11

Always Keep Your Server Patched and Updated

You’ve probably read plenty of articles regarding vulnerabilities that no basic user could probably think of but continuously explored by determined hackers out for a quick buck. No server is secure, not even Linux and the best defense for this, apart from a good firewall and anti-malware programs, is to keep your operating system and its packages updated. Always be on the lookout for core or kernel updates.

  The post How to Secure Your Linux Server appeared first on Hack Ware News.

from WordPress https://ift.tt/2Qq1wKv via IFTTT

[hackwarenews]

200 Million Contact Records Stolen in Apollo Data Breach

200 Million Contact Records Stolen in Apollo Data Breach

Sales engagement company Apollo have announced that hackers have stolen over 200 million data records. They reported the breach was on its contact database. Apollo have informed their customers of the breach via email. The breach was noticed “weeks after system upgrades in July”.

  The database in question contains publicly available data including names, employer details, job titles, social media account names, phone numbers and email addresses. Tim Zheng, Apollo Chief Executive claims he informed customers in line with their values around transparency, however he has declined to answer questions on the topic.

We have confirmed that the majority of exposed information came from our publicly gathered prospect database, which could include name, email address, company names, and other business contact information. Some client-imported data was also accessed without authorization.

Although this a large scale and serious data breach, Apollo have assured customers that financial, social security and other sensitive data has not been stolen and remains unaffected. Investigations have been underway since the breach was noticed. As of now there is little information about the investigation or its findings.

  With the kind of information stolen by the attackers it poses a long terms security threat where they can send personalised phishing emails. However, this attack poses a less immediate security threat than if account names and passwords were stolen, which they were not in this case.

  There are also concerns that Apollo may face action from European authorities under the GDPR ruling that came into law in May this year. The GDPR regulation is aimed at protecting customers data and imposing steep fines on companies who mishandled personal data, Apollo would fall into this category.

    The post 200 Million Contact Records Stolen in Apollo Data Breach appeared first on Hack Ware News.

from WordPress https://ift.tt/2NiUUvq via IFTTT

[hackwarenews]

Facebook logins are being sold on the dark web after 50 million users hacked

Facebook logins are being sold on the dark web after 50 million users hacked

Last Friday (28 Oct) Facebook announced the biggest attack on the company in its 14-year history, after it was discovered 50 million accounts had been exposed. Attackers gained access to the accounts through a vulnerability discovered after the Facebook’s “view as” feature was introduced earlier in the year. The feature allows users greater control of their privacy by letting them view their account as another user. Once attacks gained access to the Facebook accounts, they also gained access to accounts logged in via Facebook such as Tinder, Instagram, Airbnb and Spotify.

  Since Friday’s attack the Facebook logins for the leaked accounts have started appearing for sale on the dark web, for as little as $3.90 each, with some email logins being sold for $2.70. Researchers found that for $970 it was possible to purchase a person’s online footprint, including all usernames, passwords and email addresses. The best way to protect yourself and your accounts is to always opt for a multiple step verification process where possible. For example, a 2-factor authentication any time you log into Facebook from a new device.

  UK Based company Money Guru, who released these findings, said social media account details are frequently targeted by hackers because they give a good insight in targeted advertising. The report found that other accounts were also being offered for sale on the dark web. Reddit accounts came in slightly cheaper at $2.09, and Instagram and Pintrest on the more expensive end at $6.30 and $8.48 respectively.

  Facebook has said that they are working with the FBI in investigating the hack and will inform users when they know more. CEO Mark Zuckerberg has assured users that passwords and credit card information was not accessed.

The post Facebook logins are being sold on the dark web after 50 million users hacked appeared first on Hack Ware News.

from WordPress https://ift.tt/2xV2PdD via IFTTT

[hackwarenews]

Ransom attacks on high profile Instagram accounts

There has been wave of attacks in which hackers demand bitcoin in order for the Instagram user to get their account back, they threaten to delete the account if the ransom isn’t paid.

  There have been several victims of this attack, and they all claim to have received the same message from an attacker named “Pumpam”. The message lets the victim know that the hackers have possession of the account, and to email a particular address in order to start the recovery. It also mentions that the account will be deleted within 3 hours if there is no response.

  Victims of the attack found that they could not recover the account through Instagram, as the account’s email address had been changed. This frustration and desperation to get possession of their accounts lead some users to pay the ransom. However, this wasn’t always successful, with some victims claiming that their account was still deleted.

  Many of the victims feel let down by Instagram after they didn’t play an active role in helping them gain control of their accounts. Victims felt frustrated dealing with Instagram’s customer support when they only received generic responses to the issue, however this changed when vice’s tech arm Motherboard contacted Instagram about the issue and helped the users get possession back.

  At present few details are known about the hacking campaign, including the hacker’s identities and where they are from. We urge Instagram users to be vigilant about their account security, make sure you have a secure password, that you back up your content in the event it is deleted, and don’t click on any nefarious looking links.

Photo by Katka Pavlickova on Unsplash

The post Ransom attacks on high profile Instagram accounts appeared first on Hack Ware News.

from WordPress https://ift.tt/2OufbCW via IFTTT

[hackwarenews]

Learn Game Design From Industry Experts In This Online Course

If you love gaming, designing your own games or working for some of the hottest game companies around is sort of the dream. The School of Game Design was created to help you get started and eventually reach your goals. It lends a hand through a comprehensive selection of videos designed to teach you all of the fundamentals you need to create games you can be proud of. Best of all, right now lifetime access is on sale for only $59—not bad for an entire step by step journey from the basics through the most advanced techniques out there.

This bundle features 120 hours of practical instruction led by experts with 16+ years of industry experience. You’ll learn how to create high-grade 2D and 3D games, and should be ready to produce and publish on your own by courses’ end. You’ll go through modeling, animation, and digital artistry as well as game coding. Plus, the subscription includes access to game art and textures worth many times the price of enrollment. The sky’s the limit on what you can achieve with these resources.

If you dream of making your own games but need a little nudge, this could very well be it. Get access today with this 99% off deal—$59 out the door and you could be well on your way to being the next industry giant.

    The post Learn Game Design From Industry Experts In This Online Course appeared first on Hack Ware News.

from WordPress https://ift.tt/2P5EUPf via IFTTT

[hackwarenews]

An incredible Alternative Movie Poster by @ampposters

2001: A Space Odyssey, an incredible film that made people question the ethical and philosophical ramifications of tech and A.I.

[hackwarenews]

Learn How to Test Network Security with This $39 Ethical Hacking Bundle

Facebook. Equifax. Adidas. These are just a few of dozens of companies who recently experienced data breaches. Cybersecurity is paramount these days, and companies are responding by fighting fire with fire. That’s why there’s no better time to become an ethical hacker—a hacker that identifies network vulnerabilities and patches them—than today.

If you’re interested in hacking security systems (legally, of course), this Ethical Hacking A to Z Bundle will teach you how for $39.

This bundle features eight courses that will introduce you to ethical hacking concepts with entry-level lectures and live demonstrations. The topics covered include identifying vulnerabilities through penetration testing, DARKNET and wireless attacks, cross-site scripting, and other network threats. You’ll also be introduced to tools like Kali Linux, NetHunter, and Burp Suite, which are used to test network security.

The courses in the Ethical Hacking A to Z Training Bundle range from $80 up to $200, but you can buy this entire bundle here for $39, or 96% off

  The post Learn How to Test Network Security with This $39 Ethical Hacking Bundle appeared first on Hack Ware News.

from WordPress https://ift.tt/2Qqz9fe via IFTTT

[hackwarenews]

IOS 12 allows Passcode Bypass

Apple has long been considered a safer option for mobile users, the company designs its products with advanced security in mind and has been known to continually remove and ban apps from the app store that aren’t secure enough. However, with the release of iOS 12 and iOS 12.1 beta, Apple has come under scrutiny after it was discovered that a security flaw allows a user to bypass the passcode to gain access to the photos and contacts of the locked iPhone.

  How does this exploit work?

There is a several step process to get into a locked iPhone running iOS12, and this isn’t something you’re likely to do by accident. Firstly, it’s important that FaceID is disabled. Even so, below is how it works step by step:

  Use Siri to enable voice over.

Call the phone you want to get into so that the call screen appears

Click on the “Message” button on the call screen and select “custom”

Click on the + icon in the corner, and then send a message to the phone to get a notification, before double tapping the + icon. This should cause the screen to go white.

Swipe randomly on the screen until you here a “cancel” option

Double tap on the screen to bring up the message again and select numbers, this will bring up all of the contacts.

The process to get into photos also works through voiceover, and only allows you access to one photo at a time, that you can’t view before you select it as a contact photo. Getting into the phone would allow an attacker to steal contact information, or change contact information within the phone, as well as seeing restricted photos. Apple have not yet responded to the news, but it is expected that they will release a patch to fix the issue shortly.

  The post IOS 12 allows Passcode Bypass appeared first on Hack Ware News.

from WordPress https://ift.tt/2QknJte via IFTTT

[hackwarenews]

Another Facebook hack and how it affects you

The world’s social network was under the radar again for another breach involving almost 50 million accounts.

Unlike the previous data breaches by the Cambridge Analytica, this breach seems unlikely to be political motivated and exposed a smaller percentage of Facebook users.

According to Facebook, the latest hack claimed around 50 million accounts with possibility to 90 million users that were “directly affected”. Later, Facebook described the attack as being used in “fairly large scale”. On the downside, the hackers may take over your account and use it as they are the account holders.

  ‘View As’ feature as the weakest link

Apparently, the hacker made use of a vulnerability in the Facebook’s coding of the ‘View As’ feature that allowed people to see what their own profile looks like to others.

Just by pinpointing this vulnerability, the hackers were able to steal Facebook tokens and later allowed them to hijack other people accounts.

After discovering the breach on 25 Sep 2018, the security team in Facebook had then fixed the system vulnerability and stated that no passwords have been compromised.

  Damage control and mitigation

However, Facebook remained mute on what kind of data has been breached in this latest attack. However, Facebook did confirm that the hackers may have accessed to any third-party apps such as Tinder and Swiggy.

Thus, it will be best for Facebook users to log out of all websites and services were that previously logged in via using Facebook account. It is recommended that user use separate login password for third-party apps, instead of using Facebook, Google or Twitter for access.

In storing these various different passwords, the user may use some password managers like LastPass, Dashlane, KeePass and so on in storing different passwords for third-party apps.

  EU to fine Facebook for $1.63 billion over latest hack

In addition, Facebook may face a fine of $1.63 billion after this major breach of data from the European Union’s (EU) recently enacted General Data Privacy Regulation (GDPR).

The regulation stated that the company has a role in safeguard their users’ data risk and if they did not provide adequate protection, the company faced a maximum fine of €20 million ($23 million), or 4% of a firm’s global annual revenue for the prior year, whichever is higher.

Moreover, the company is required to notify regulators of breaches within 72 hours, under threat of a maximum fine of 2% of world-wide revenue.

Thus, Facebook might face a fine of 1.63 billion under the EU GDPR by using a larger calculation.

The post Another Facebook hack and how it affects you appeared first on Hack Ware News.

from WordPress https://ift.tt/2OvfOwc via IFTTT

[hackwarenews]

Grey Hack Game Review

Grey Hack is a massively multiplayer hacking simulator game that is designed to give you the experience of being a hacker. Grey Hack, created by the company Loading home, allows for a single player or multiplayer experience. The game’s interface is based on a desktop operating system and a command terminal and text editor, which are available at the start of the game. As your hacker skills develop, you will unlock more utilities to install and use.

You have the ability to hack a vast network of computers within the game that are procedurally created. When the game begins you are given a desktop screen view with a readme file, explaining that you have access to this server and are free to do what you want, but if you’re caught everything is reset. The game provides users with some hints on how to get started, as well as a help section with a list of commands that can be used. This makes the game accessible to players across a range of skill levels since users more experienced in networks can jump straight in, and players still getting to grips with the concepts get a helping hand. We think this is a major strength of the game.

  Where Grey Hack differs from a lot of other hacking games is that it is more technical in a lot of ways, with more emphasis on navigating through the file systems. This makes the game a good choice for aspiring ethical hackers and penetration testers, who want a more real experience. However, it is worth noting the game is a more simplified hacking experience than most real-world hacking. One criticism that has been shared about the game is that is can be too technical or confusing for non-tech savvy players, however there has been suggestions for tutorials that may help bridge this gap.

credit to iMissTooMuch

The game retails at $9.99 on Steam.

The post Grey Hack Game Review appeared first on Hack Ware News.

from WordPress https://ift.tt/2OoeElN via IFTTT

[hackwarenews]

Secure Messenger app, Telegram, leaking users IP addresses

Telegram Messenger is an internet-based messaging app that sells itself as being the most secure messaging platform on the market. They came under scrutiny in May this year after it was dubbed the “terrorists messenger service of choice”. The service launched in 2013 and has more than 200 million monthly active users.

  Telegram Messenger’s main selling point is security, allowing users to create encrypted chats and phone calls. However, it was revealed on Friday 29 September that a default configuration within the app allows it to leak a user’s IP address when making a call. The default setting causes the IP address of the person you are calling to appear in the console logs when Peer-to-Peer (P2P) calling. Not all versions of the app have a console log, for example researchers didn’t find the console log included in tests with Windows but did for the Linux version.

  Users on mobile can disable Peer-To-Peer calling, in turn disabling the sharing of their IP address, doing this causes the user’s calls to be routed instead through Telegram’s servers, providing anonymity. The drawback of this is that users will experience a small decrease in audio quality when making calls.

  The security flaw is more significant for desktop users. Security researcher Dhiraj that the desktop Telegram app doesn’t offer the ability to disable P2P calls, meaning their IP would be leaked whenever they use Telegram to make a call.  Dhirai alerted the flaw to Telegram, highlighting it was a security concern that desktop users were not able to disable P2P calling. Telegram awarded him €2000 for his efforts. Telegram also released a fix in response to the issue, and users on versions 1.3.17 and 1.4.0 can now disable P2P calls on Desktop.

  As to why Telegram allowed P2P calls in the first place when they knew it could leak the IP addresses of their security conscious user base, we don’t know.

  Photo by Christian Wiediger on Unsplash

  The post Secure Messenger app, Telegram, leaking users IP addresses appeared first on Hack Ware News.

from WordPress https://ift.tt/2IrzADj via IFTTT

[hackwarenews]

Land a Career in IT With This Online CompTIA Certification Training

These days business is pretty much synonymous with technology, and having a professional knowledge of IT becomes more and more of an asset in any position. Whether you’re already an IT specialist and want to get a new certification, or you’re in a seemingly unrelated field but could stand to benefit from branching out, there’s a track in The Complete 2018 CompTIA Certification Training Bundle for you.

CompTIA is one of the most respected IT certification providers in the industry. The training starts with the foundational CompTIA certifications and a broad overview of IT literacy. If you’re interested in cloud environments, the bundle offers courses in Cloud Essentials and Cloud+, which train you to deliver and maintain enterprise-level cloud infrastructures, as well as pursue careers in the field.

Interested in security? CompTIA Advanced Security Professional teaches you how to design and implement solutions for enterprises at a high level. Beyond that, CSA+ teaches you how to defend against hackers using the new behavioral-analytical method.

If your focus is on entering project management, Project+ gives future project managers a guide on how to enter the super-lucrative field. Plus, additional courses include even more specialized areas like system administration in Linux, overall network administration, as well as healthcare-specific IT systems.

No matter your background, Complete 2018 CompTIA Bundle will give you the tools necessary to realize your IT goals. Grab it now for 98% off at $59 out the door.

  The post Land a Career in IT With This Online CompTIA Certification Training appeared first on Hack Ware News.

from WordPress https://ift.tt/2Irm16D via IFTTT

[hackwarenews]

50 Million accounts exposed after Facebook security breach

Facebook has revealed that almost 50 million of its users accounts were left exposed due to a security flaw. Facebook has more than two billion active monthly users, making security a high priority concern. The security breach has caused Facebook’s shares to drop by 3% on Friday, 28 September.

  The breach was discovered this week, and is the latest controversy surrounding Facebook after British company Cambridge Analytica gained access to information of 87 million users, and the controversy surrounding disinformation in elections. However, this breach has been the largest in the company’s 14-year history.

  Facebook has said the attackers exploited two bugs in the site’s “View as” feature. The feature, which was designed to give users a clearer view of their presence and more control over their privacy, allows users to check what information other people can see about them. The flaw allowed users to gain “access tokens” which allow access to accounts, through Facebook’s video-uploading program for birthday celebrations. Although it’s not yet known when the attack happened, it seems to occurred after the video-uploading program was introduced. Attacked attempted to harvest user’s personal identifiable information (PII). After the attack was discovered, Facebook forced 90 million users to log out. Facebook has not announced where in the world the 50 million users are.

  There have been some major changes in Facebook’s security teams after its Chief Security Officer, Alex Stamos left in August this year for a teaching position at Stanford University. Facebook decided to split the team members so that security employees work within different teams across the company, in order to make security an innate part of Facebook.

  Facebook’s data breach was a trending topic on Friday with users posting the breaking story as news outlets released it. User’s found that some of their posts were removed because Facebook’s algorithm saw them as suspicious activity or spam.

  The post 50 Million accounts exposed after Facebook security breach appeared first on Hack Ware News.

from WordPress https://ift.tt/2xL7oXA via IFTTT