Archive for the ‘cybercrime/malcode’ category: Page 96
Apr 22, 2022
Quasiparticles used to generate millions of truly random numbers a second
Posted by Quinn Sena in categories: cybercrime/malcode, information science, quantum physics
This could lead to a truly random number generator making things much more secure.
Random numbers are crucial for computing, but our current algorithms aren’t truly random. Researchers at Brown University have now found a way to tap into the fluctuations of quasiparticles to generate millions of truly random numbers per second.
Random number generators are key parts of computer software, but technically they don’t quite live up to their name. Algorithms that generate these numbers are still deterministic, meaning that anyone with enough information about how it works could potentially find patterns and predict the numbers produced. These pseudo-random numbers suffice for low stakes uses like gaming, but for scientific simulations or cybersecurity, truly random numbers are important.
Continue reading “Quasiparticles used to generate millions of truly random numbers a second” »
Apr 21, 2022
Researchers break world record for quantum-encrypted communications
Posted by Genevieve Klien in categories: cybercrime/malcode, encryption, internet, quantum physics
Researchers in Beijing have set a new quantum secure direct communication (QSDC) world record of 102.2 km (64 miles), smashing the previous mark of 18 km (11 miles), The Eurasian Times reported. Transmission speeds were extremely slow at 0.54 bits per second, but still good enough for text message and phone call encryption over a distance of 30 km (19 miles), wrote research lead Long Guilu in Nature. The work could eventually lead to hack-proof communication, as any eavesdropping attempt on a quantum line can be instantly detected.
QSDC uses the principal of entanglement to secure networks. Quantum physics dictates that entangled particles are linked, so that if you change the property of one by measuring it, the other will instantly change, too — effectively making hacking impossible. In theory, the particles stay linked even if they’re light-years apart, so such systems should work over great distances.
The same research team set the previous fiber record, and devised a “novel design of physical system with a new protocol” to achieve the longer distance. They simplified it by eliminating the “complicated active compensation subsystem” used in the previous model. “This enables an ultra-low quantum bit error rate (QBER) and the long-term stability against environmental noises.”
Apr 20, 2022
FBI warning: These hackers are targeting developers and DevOps teams to break into crypto firms
Posted by Genevieve Klien in categories: blockchains, business, cryptocurrencies, cybercrime/malcode, government
The US government has detailed how North Korean state-sponsored attackers have been hacking cryptocurrency firms using phishing, malware and exploits to steal funds and initiate fraudulent blockchain transactions.
The Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Treasury Department (Treasury) have issued a joint cybersecurity advisory to warn all businesses in cryptocurrency to watch out for attacks from North Korean state-sponsored hackers.
Apr 19, 2022
A model that can help inexperienced users identify phishing emails
Posted by Saúl Morales Rodriguéz in categories: cybercrime/malcode, robotics/AI
Phishing attacks are cyber-attacks through which criminals trick users into sending them money and sensitive information, or into installing malware on their computer, by sending them deceptive emails or messages. As these attacks have become increasingly widespread, developers have been trying to develop more advanced tools to detect them and protect potential victims.
Researchers at Monash University and CSIRO’s Data61 in Australia have recently developed a machine learning-based approach that could help users to identify phishing emails, so that they don’t inadvertently install malware or send sensitive data to cyber-criminals. This model was introduced in a paper pre-published on arXiv and set to be presented at AsiaCCS 2022, a cyber-security conference.
“We have identified a gap in current phishing research, namely realizing that existing literature focuses on rigorous ‘black and white’ methods to classify whether something is a phishing email or not,” Tingmin (Tina) Wu, one of the researchers who carried out the study, told TechXplore.
Apr 17, 2022
What does Ukraine’s success in defending itself against cyberattacks mean for the US?
Posted by Gemechu Taye in category: cybercrime/malcode
Apr 17, 2022
An old satellite was hacked to broadcast signals across North America
Posted by Shubham Ghosh Roy in categories: cybercrime/malcode, satellites
Apr 17, 2022
Drones, hackers and mercenaries — The future of war | DW Documentary
Posted by Shubham Ghosh Roy in categories: business, cybercrime/malcode, drones, internet, military, surveillance
A shadow war is a war that, officially, does not exist. As mercenaries, hackers and drones take over the role armies once played, shadow wars are on the rise.
States are evading their responsibilities and driving the privatization of violence. War in the grey-zone is a booming business: Mercenaries and digital weaponry regularly carry out attacks, while those giving orders remain in the shadows.
Continue reading “Drones, hackers and mercenaries — The future of war | DW Documentary” »
Apr 16, 2022
CISA orders agencies to fix actively exploited VMware, Chrome bugs
Posted by Genevieve Klien in category: cybercrime/malcode
The Cybersecurity and Infrastructure Security Agency (CISA) has added nine more security flaws to its list of actively exploited bugs, including a VMware privilege escalation flaw and a Google Chrome zero-day that could be used for remote code execution.
The VMware vulnerability (CVE-2022–22960) was patched on April 6th, and it allows attackers to escalate privileges to root on vulnerable servers due to improper permissions in support scripts.
A Chrome zero-day was also included in CISA’s Known Exploited Vulnerabilities (KEV) catalog, a bug tracked as CVE-2022–1364 and allowing remote code execution due to a V8 type confusion weakness.
Apr 14, 2022
Feds Uncover a ‘Swiss Army Knife’ for Hacking Industrial Systems
Posted by Shubham Ghosh Roy in categories: cybercrime/malcode, government
“This is the most expansive industrial control system attack tool that anyone has ever documented,” says Sergio Caltagirone, the vice president of threat intelligence at industrial-focused cybersecurity firm Dragos, which contributed research to the advisory and published its own report about the malware. Researchers at Mandiant, Palo Alto Networks, Microsoft, and Schneider Electric also contributed to the advisory. “It’s like a Swiss Army knife with a huge number of pieces to it.”
Dragos says the malware has the ability to hijack target devices, disrupt or prevent operators from accessing them, permanently brick them, or even use them as a foothold to give hackers access to other parts of an industrial control system network. He notes that while the toolkit, which Dragos calls “Pipedream,” appears to specifically target Schneider Electric and OMRON PLCs, it does so by exploiting underlying software in those PLCs known as Codesys, which is used far more broadly across hundreds of other types of PLCs. This means that the malware could easily be adapted to work in almost any industrial environment. “This toolset is so big that it’s basically a free-for-all,” Caltagirone says. “There’s enough in here for everyone to worry about.”
The CISA advisory refers to an unnamed “APT actor” that developed the malware toolkit, using the common acronym APT to mean advanced persistent threat, a term for state-sponsored hacker groups. It’s far from clear where the government agencies found the malware, or which country’s hackers created it—though the timing of the advisory follows warnings from the Biden administration about the Russian government making preparatory moves to carry out disruptive cyberattacks in the midst of its invasion of Ukraine.
