Hackers Hacking Hackers - When you use someone else's code , you should know that it could be a trojan.

Vulnerability Scanning script found with Backdoor
Remember, Nothing is free in this world.

1. First, it scans a set of IP addresses to find GoAhead servers vulnerable to a previously disclosed Authentication bypass vulnerability (CVE-2017-8225) in Wireless IP Camera (P2P) WIFI CAM devices.
2. In the background, it secretly creates a backdoor user account (username: VM | password: Meme123) on the wannabe hacker's system, giving the attacker same privilege as root.
3. Script also extracts the IP address of the wannabe hacker, allowing script author to access the compromised systems remotely.
4. Moreover, it also runs another payload on the script kiddie’s system, eventually installing a well-known botnet, dubbed Kaiten.

For More
https://thehackernews.com/2017/11/iot-vulnerability-scanner.html

Did you know that Equifax might have your salary info and selling it for $20

Every payroll period, Facebook, Amazon, Microsoft, and Oracle also provide an electronic feed of their employees’ hourly work and wage information to Equifax. So do Wal-Mart, Twitter, AT&T, Harvard Law School, and the Commonwealth of Pennsylvania. Even Edward Snowden’s former employer, the sometimes secretive N.S.A. contractor Booz Allen Hamilton, sends salary and other personal data about its employees to Equifax Workplace Solutions.

If his new prospective employer is among the 70,000 approved entities in Equifax’s verifier network with a “permissible purpose,” that company can purchase his employment and income information for about $20.

That individual has no control over who picks up the phone, whether the right information is actually given out, or if his or her privacy will be respected.”

In May 2017, Equifax informed some of its customers that unauthorized access to their employee tax records continued, undetected, for nearly a year, between April 17, 2016, and March 29, 2017. These Equifax security lapses occurred in another of TALX’s databases, the Tax Form Management platform, after “crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering personal questions about those employees,”

For More:
https://www.fastcompany.com/40485634/equifax-salary-data-and-the-work-number-database

Netflix users beware - This is not something that is happening to others. I, had also received this hoax email (a few days back)

According to security firm Mailguard, if recipients click the link in the email, they are directed to a fake Netflix page asking them to login and provide their personal information, including credit card details.


Mailguard offers these tips to help users detect the real source and purpose of an email:

• Always hover your mouse over links within emails and check the domain they're pointing to. If they look suspicious or unfamiliar don't open them
• Cybersecurity threats take many different forms from simple spyware downloads to sophisticated ransomware attacks. Your business can be exposed to a wide variety of different vectors: through peripherals; USB devices; networks; attachments; etc. Security best practice recommends a layered defence strategy to protect users against web threats and malware
• 9 out of 10 cyber-attacks are delivered via email, so it's essential to have the best email filtering in place to protect your systems
• Keep up to date on the latest scams.

For More:
https://finance.yahoo.com/news/hackers-launch-identity-theft-attack-151546094.html

FREE - SANS Cheat Sheet for Incident Response

Get it Here

https://digital-forensics.sans.org/media/EricZimmermanCommandLineToolsCheatSheet-v1.0.pdf

what is SOAR? - Security Orchestration, Automation and Response

Another buzzword to sell new products but, will they really do anything useful?
Probably so, here is an interesting essay from Bruce on the "Orchestration" and "incident response" to understand it better

Data does not equal information, and information does not equal understanding



Data does not equal information, and information does not equal understanding

Uncertainty demands initiative, while certainty demands synchronization

When things are uncertain, you want your systems to be decentralized. When things are certain, centralization is more important. Good incident response teams know that decentralization goes hand in hand with initiative.


Automation has its place. If you think about the product categories where it has worked, they’re all areas where we have pretty strong certainty. Automation works in antivirus, firewalls, patch management and authentication systems

For More info:
https://securityintelligence.com/security-orchestration-for-an-uncertain-world/

Just in Time - Shopping(Holiday) Season advise from SANS Security Awareness team.

Get the PDF here:
https://securingthehuman.sans.org/newsletters/ouch/issues/OUCH-201711_en.pdf

Did you know - AV could be tricked to trust a invalid Cert

Simply copying an authenticode signature from a legitimate file to a known malware sample —  results in an invalid signature — can cause antivirus products to stop detecting it.

"This flaw affects 34 antivirus products, to varying degrees, and malware samples taking advantage of this are also common in the wild,"


More Here
https://www.theregister.co.uk/2017/11/01/digital_cert_abuse/