Category: Cybersecurity
How to disable SMB to stop WannaCry Ransomware. Also links to Microsoft Patches for Windows to stop WannaCry Ransomware
UPDATE May 14 at 3:00pm – added more ways to disable SMB
Some Cyber Weapons which were apparently developed by a National Spy Service to break into enemy computers, were supposedly stolen. Then some of the code for the Cyber Weapons was released to the public, on 14 April, through a dump by a group called Shadow Brokers.
On May 12 2017, a new Ransomware was released on the Internet. It utilized some of the code found in the Cyber Weapons and also a Malware called WannaCry. Hundreds of thousands of computers around the globe got hit. Then a kill switch was set off which dramatically slowed and possibly will stop the Ransomware from spreading further.
Stop the presses. A new version 2 of the WannaCry Malware is now out, which no longer has the Kill Switch code. That will make it difficult to stop.
The Hacker News facebook page posted a solution. Essentially their posts stated to disable the SMB service within Windows. It is not needed and is enabled for backwards compatibility.
Ok, but how do you disable SMB in Windows?
In Windows go to Control Panel. In Control Panel go to the icon labeled “Programs”. Click on it. Then under Programs and Features click on Turn Windows Features on and off. Once there, just scroll down till you find SMB 1.0/CIFS File Sharing Support. Make sure the checkbox to the left of SMB 1.0 is “NOT” checked off. Then click OK and then close control Panel. Reboot the computer.
In my Windows 10 it was already off (unchecked).
Video is courtesy of the Andr.oid Eric YouTube channel
Video is courtesy of the HatimTech YouTube channel
Another way to disable SMB is by using the Registry Editor. The following Video shows how to do it in Windows 7.
Video is courtesy of the Brxtt Tech YouTube channel
Another way to do it is to key in a Powershell command. That is like a super DOS Prompt. Open a Powershell Window and key in the following (but not the Quotes):
“Disable-WindowsOptionalFeature -Online -FeatureName SMB1protocol“
Press Enter and you should be good to go after you reboot the computer. I would double check in ControlPanel. Better safe than sorry.
Windows 8 and Windows Server 2012 introduce the new Set-SMBServerConfiguration Windows PowerShell cmdlet. The cmdlet enables you to enable or disable the SMBv1, SMBv2, and SMBv3 protocols on the server component.
- To obtain the current state of the SMB server protocol configuration, run the following cmdlet:
Get-SmbServerConfiguration | Select EnableSMB1Protocol, EnableSMB2Protocol
- To disable SMBv1 on the SMB server, run the following cmdlet:
- You do not have to restart the computer after you run the Set-SMBServerConfiguration cmdlet. But I would restart the computer.
To enable or disable SMB protocols on an SMB Server that is running Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008, use Windows PowerShell or Registry Editor.
Windows PowerShell 2.0 or a later version of PowerShell
- To disable SMBv1 on the SMB server, run the following cmdlet:
Set-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters” SMB1 -Type DWORD -Value 0 -Force
- Note you must restart the computer after you make these changes.
REGISTRY. To enable or disable SMBv1 on the SMB server, configure the following registry key:
Registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\ParametersRegistry entry: SMB1
REG_DWORD: 0 = Disabled
Default: 1 = Enabled
How to enable or disable SMB protocols on the SMB client
Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, and Windows Server 2012
To disable SMBv1 on the SMB client, run the following commands:
sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi
If that is the hole inside all Windows Versions that existed prior to the Mar 2017 Microsoft Patch, then it has been around for ages.
Click on this link to visit The Hackers News Facebook page.
Click on this link to visit The Hackers News website.
The following are LINKS to Official Microsoft Patches for assorted versions of Windows (including Windows XP). Download English language security updates:
To download localized versions for the security update for Windows XP, Windows 8 or Windows Server: http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012598
General information on ransomware: https://www.microsoft.com/en-us/security/portal/mmpc/shared/ransomware.aspx
MS17-010 Security Update: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
Click on this link to visit Microsoft’s site to read their post titled: “Customer Guidance for WannaCrypt attacks”.
One final note which is bugging me. People are saying that this Ransomware is a “VIRUS“. WannaCry Ransomware is “NOT” a Virus. The WannaCry Ransomware is a vastly more complex computer “WORM“, hence it’s ability to find Windows computers connected to a network.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by Vincent Banial
Disclaimer: Everything in the post above is subject to change without notice. There could be unintentional errors. Please confirm all info via the linked to websites and web pages. The WannaCry Malware has already been changed (minus the Kill Switch). Disabling SMB may not prevent future versions from affecting your computer. Best Practice is to always create daily backups
“Hack the Air Force” is a new White Hat Hacking contest. The United States Air Force is inviting vetted computer security specialists from across the U.S. and select partner nations to do their best to hack some of its key public websites.
Posted by Vincent Banial
The recent DOD ‘Hack the Pentagon’ contest was a success. That contest was limited to US based Cyber Security enthusiasts. The United States Air Force “Hack the Air Force” contest, will be expanding the opportunity to join in the contest by allowing individuals and groups from the following countries to also participate (in addition to US Citizens): United Kingdom, Canada, Australia and New Zealand.
The Hack the Air Force contest is being run with the help of CyberSeurity Firm HackerOne. The HackerOne platform will help allows White Hat Hackers to submit their Security Holes in a safe and secure manner.
Video is courtesy of the HackerOne YouTube channel
On the HackerOne main website page they state :
“77% of Programs Find Security Vulnerabilities within 24 Hours.”.
This sounds like a great move by the Department of Defence and the US Air Force. The prior “hack the Pentagon” contest was a great success. This new Hack the Air Force contest will allow non-US based CyberSecurity Talent to participate. The more people joining the contest the more Security Vulnerabilities I suspect will be found.
This should be a win-win for bothe the Air Force and for the White Hat Hackers. The HackerOne facebook page states that $16 Million in bounties have been paid out in prior HackerOne coordinated White Hat Hacking events.
Registration for the ‘Hack the Air Force’ event opens May 15 on the HackerOne website. The contest opens May 30 and ends June 23. Military members and government civilians are not eligible for compensation but can participate on-duty with supervisor approval. Mark your calendars and make sure that you register starting on May
Mark your calendars and make sure that you register starting on May 15 2017.
Click on this link to visit the official US Air Force site to read their news Release about this new “Hack the Air Foce” White Hat Hacking contest.
Click on this link to view other Cyber Security posts on Uniquely Toronto.
“SysAdmin’s Essential Guide to Linux Workstation Security” free eBook from The Linux Foundation
Photo courtesy of Gerd Altmann – CC0 License. Vincent Banial modified the look & feel.
The Linux Foundation is offering a free download eBook titled: “SysAdmin’s Essential Guide to Linux Workstation Security“.
The suggestions offered in their eBook, are based on 3 level levels of security which one would want. These are:
(ESSENTIAL) items, if “not implemented” could introduce high risks to your workstation security.
(NICE) to have items will increase the overall security, but may require learning new habits or unlearning old ones.
(PARANOID) items could significantly improve your workstation security but may require time to learn new ways of doing things.
Click on this link to visit The Linux Foundation website and download your own copy of their eBook titled: “SysAdmin’s Essential Guide to Linux Workstation Security“.
Click on this link to view other Cyber Security posts on Uniquely Toronto.
Demo of FuzzBunch breaking into a virtual Windows 2008 Server. FuzzBunch is NSA created Malware which had been leaked by Shadow Brokers
Posted by Vincent Banial
It has been a while since I posted about Cyber Security. Last year’s round of posts were very well received. We even had a major Cyber Security firm linking to our posts.
What a “coincidence“, back in March of this year Microsoft patched a whole bunch of security holes in assorted Windows Operating Systems. On Friday, April the 14th 2017, a Hacker group called the Shadow Brokers released a ton of NSA developed weaponized software Exploits and Malware which allowed the NSA to break into computers around the globe. Not just break in, but potentially to also take control of computers running Windows Operating Systems prior to Windows 10. The Friday, April 14th Easter Egg contained over 200 megabytes of code which was dropped on GitHub.
Yes, Microsoft released a Security Update (patches) In March 2017 for their Windows Operating Systems which plugged the Security Holes used by the code which Shadow Brokers made available to the whole wide world on April 14th 2017. The key question is, will users and Network Admins apply those patches? If the March 2017 release of Microsoft patches are not installed, the computers remain vulnerable, as the Exploit and Malware code is available to everyone from Newbie Wannabe to Elite Hacker. Just wait till modified versions start being used.
One of the most powerful NSA coded Malware released is called FuzzBunch. The video below is a demo (in a controlled test environment) of FuzzBunch breaking into a virtual install of Windows 2008 Server.
Spiceworks did a survey of Network Server Operating systems being used. Windows 2008 Server was installed on over 40% of the Windows Server installations. People are even still using Windows 2003 Server. Hey, if it works and ain’t broke, why upgrade.
Click on this link to visit the Spiceworks website to read their 2016 post.
FUZZBUNCH from The Intercept on Vimeo.
Click on this link to visit the ARS Technica website to read their informative article about the Shadow Brokers April 14th Easter Egg NSA created weaponized software Exploits and Malware dump.
Click on this link to view other Cyber Security posts on Uniquely Toronto.
Robots can be Hacked – new findings from IOActive
Posted by Vincent Banial
IOActive published some major findings this week, that Robots can be hacked and rather easily.
Click on this link to read the IOActive post titled: “Hacking Robots Before Skynet“.
Video is courtesy of the Humanoid Robot YouTube channel
In the following video an Artificial Intelligence clearly states that it will “Destroy Humans”.
Video is courtesy of the CNBC YouTube channel
Humans have already been killed by Robots. Click on the following link to read a post on Gizmodo.com titled: “Robot Cannon Goes Berserk, Kills 9”.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Cisco Talos Security Webinar
Participated in the Cisco Talos Security Webinar on Wednesday.
Last year I had posted about Kaspersky Lab reporting about a Bank exploit, where Russian Banks were targeted. Basically the Hackers were able to get Bank Accounting Staff to connect to a site where a keylogger and other Trojan Remote Control software was secretly uploaded and installed into “system RAM“, but not onto the Hard Disk or Network Storage. That allowed their remote control software (called Lurk) to be overlooked by Security Software, because Security Software usually scans stored files and not RAM. Once installed, the hackers could monitor the employees. When the employee went for lunch, they took over the PC and started to transfer funds around the world.
Video is courtesy of the DewClarke YouTube Channel
Earlier this year, Russian Authorities had arrested over 50 alleged Hackers who were alleged to be part of the group which targeted and Hacked into the Banks. The investigation into this group’s activities had been ongoing for years (at least since 2013). The Cisco Talos Security Webinar discussed the arrests and the aftermath. Cisco’s research seems to indicate that the same group was involved in other Internet Exploits. One of which was the Angler Ransomware.
Since the Russian arrests, certain malware has disappeared, along with certain DarkNet sites and BotNets. The Russian Authorities made the Internet a tad safer, at least for a short while.
Click on this Link to visit The Hackers News website to read about the Russian sting operation and arrest of 50+ alleged hackers involved in the Banking Exploit.
Click on this Link to view other Uniquely Toronto posts related to Cyber-Security issues.
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
Dropbox Mega-Breach confirmed.
Over 60 million email addresses and passwords were hacked from Dropbox years ago. That data is floating around the folks on DarkNet. It is older and apparently not being marketed, yet some hacker have it. Even though the breach happened years back, the data still has value. People often rarely change their password. Similar Mega Breach data from prior breaches at LinkdIn and Tumblr, was being bought, sold and traded on DarkNet markets.
Click on this Link to visit the Motherboard site to read their post about Hackers stealing account data on tens of millions Dropbox users.
Click on this Link to visit Troy Hunt’s site. He was sent the hacked data from a supporter of “Have I Been Pwned?” site. Troy then found his own account data and also his wife’s account data and proceeded to confirm that the Dropbox Mega-Breach was real.
Video courtesy of the Fox Business YouTube channel
Click on this Link to visit theguardian newspaper website to read their post titled “Dropbox hack leads to leaking of 68m user passwords on the internet”
Change your passwords often.
Use random numbers, letters and special characters,
for greater security.
Click on this link to view other CyberSecuirty related posts found on Uniquely Toronto.
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
Norton Security Premium – 10 Devices [Download Code] Amazon Deal of the Day Jun 20 2016
UPDATE June 21 2016 – This Amazon Deal of the Day has expired. Was valid only on June 20 2016
For our American USA based visitors, the Amazon Deal of the Day for June 20 is:
Norton Security Premium – 10 Devices [Download Code] priced at $27.99 or 69% discount on June 20 2016 only
Deal only valid on June 20 2016. Deal only valid for residents of the US. Sorry Canadians. Click on this link to visit the amazon.com site for this their Deal of the Day
Norton make decent Security Software. The Norton deal is for 10 devices, that includes laptops and Desktop PC (MAC and Windows based), Cell Phones, Tablets.
Installing a security package on your Cell phone or internet connected Tablet is a smart move, especially for Windows users. Mac Operating systems are a growing target, but no where near how much Windows is targeted.
The deal ends today June 20 and is only valid for US residents.
Uniquely Toronto saves you money…
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official http://www.amazon.com website to confirm details and any ongoing changes or updates. This post is subject to change without notice. Any offers mentioned in this post are also subject to change without notice.
Malware infected Android Apps discovered by Cybersecurity Researchers
Click on this line to read the article on the Softpedia website titled “
190 Android Apps Infected with Malware Discovered on the Google Play Store“
Click on this line read the article on the AVAST Security Software website Blog titled “
“
Click on this line to read the article on the McAfee Labs Blog titled “
Android Malware Clicker.G!Gen Found on Google Play“
Click on this line to read the article on the Dr. Web Anti-Virus website titled “
Android.Click.95“
Click on this line to read the article on the Softpedia website titled “
Android Trojan Pesters Users for Administrator Rights Non-Stop“.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Be careful out there. Stay Safe
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice. Any offers mentioned in this post are also subject to change without notice.
Warning for Android based Cell Phone Users. Cybersecurity Experts have found a Fake Google Chrome Update which instals Malware
The Cybersecurity Researchers at Zscaler Inc have posted a new finding of a Fake Google Chrome Update which installs Malware. The only way to get rid of the Android Infostealer Malware is to reset the Android Phone to factory settings (thus wiping claen).
Click on this line to be taken to the Zscaler website to read their Blog post ttiled: “Android infostealer posing as a fake Google Chrome update“.
Their post was written by Viral Gandhi
Click on this line to visit the Zscaler YouTube channel
Click on this line to visit the Zscaler website.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
HORNET, the alternative to Tor Network
When we think about surfing the Internet, most people are looking at just the top of the network iceberg. When in fact, the web actually holds a “Deep Web,” hidden from everyday users and ordinary browsers. This is due to the Deep Web continuously encrypting …
Source: HORNET, the alternative to Tor Network
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Major Bank Heist using SWIFT. Hackers tranferred over $950 Million and got away with $81 Million
The link above is to a Financial Post article on Cyber Security by Martin Arnold
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
New Apple OS X Ransomware discovered by “Unit 42” of Palo Alto Networks
A new Ransomware targeting Apple OS X based computers has been found and reported by Palo Alto Networks. Their Unit 42 Security Group have named this new ransomware as “KeRanger”.
Two installers of the Transmission BitTorrent ailient installer for OS X were found by Palo Alto Networks to be infected with KeRanger Ransomware.
The following is a quote from the Palo Alto Networks Reseaarch Center blog:
“Palo Alto Networks reported the ransomware issue to the Transmission Project and to Apple on March 4. Apple has since revoked the abused certificate and updated XProtect antivirus signature, and Transmission Project has removed the malicious installers from its website.
The Transmissionbt.com home page features the following security notice:
Read Immediately!!!!
Everyone running 2.90 on OS X should immediately upgrade to and run 2.92, as they may have downloaded a malware-infected file. This new version will make sure that the “OSX.KeRanger.A” ransomware (more information available here) is correctly removed from your computer.
Users of 2.91 should also immediately upgrade to and run 2.92. Even though 2.91 was never infected, it did not automatically remove the malware-infected file.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice. Any offers mentioned in this post are also subject to change without notice.
“Hack The Pentagon”. The Department of Defense, in the USA, announced Cybersecurity Initiative.
Statement by Pentagon Press Secretary Peter Cook on DoD’s “Hack the Pentagon” Cybersecurity Initiative
Press Operations
Release No: NR-070-16
March 2, 2016
The Department of Defense announced today that it will invite vetted hackers to test the department’s cybersecurity under a unique pilot program. The “Hack the Pentagon” initiative is the first cyber bug bounty program in the history of the federal government.
Under the pilot program, the department will use commercial sector crowdsourcing to allow qualified participants to conduct vulnerability identification and analysis on the department’s public webpages. The bug bounty program is modeled after similar competitions conducted by some of the nation’s biggest companies to improve the security and delivery of networks, products, and digital services. The pilot marks the first in a series of programs designed to test and find vulnerabilities in the department’s applications, websites, and networks.
Participants in the bug bounty will be required to register and submit to a background check prior to any involvement with the pilot program. Once vetted, these hackers will participate in a controlled, limited duration program that will allow them to identify vulnerabilities on a predetermined department system. Other networks, including the department’s critical, mission-facing systems will not be part of the bug bounty pilot program. Participants in the competition could be eligible for monetary awards and other recognition.
This innovative project is a demonstration of Secretary Carter’s continued commitment to drive the Pentagon to identify new ways to improve the department’s security measures as our interests in cyberspace evolve.
“I am always challenging our people to think outside the five-sided box that is the Pentagon,” said Secretary of Defense Ash Carter. “Inviting responsible hackers to test our cybersecurity certainly meets that test. I am confident this innovative initiative will strengthen our digital defenses and ultimately enhance our national security.”
The “Hack the Pentagon” initiative is being led by the department’s Defense Digital Service (DDS), launched by Secretary Carter last November. The DDS, an arm of the White House’s dynamic cadre of technology experts at the U.S. Digital Service, includes a small team of engineers and data experts meant to improve the department’s technological agility.
“Bringing in the best talent, technology and processes from the private sector not only helps us deliver comprehensive, more secure solutions to the DoD, but it also helps us better protect our country,” said DDS Director and technology entrepreneur Chris Lynch.
This initiative is consistent with the administration’s Cyber National Action Plan announced on Feb. 9, which prioritizes near-term actions to improve our cyber defences and codifies a long-term strategy to enhance cybersecurity across the U.S. government.
The pilot program will launch in April and the department will provide more details on requirements for participation and other ground rules in the coming weeks.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice. Any offers mentioned in this post are also subject to change without notice.
Apple withdraws China Apps for the Apple App Store, after XcodeGhost Malware infected IOS Apps were found by CyberSecurity firm Palo Alto Networks.
Ryan Olson, Intelligence Director, with Cyber Security Firm Palo Alto Networks discusses the finding of Apps on Apple’s App Store which were infected by XcodeGhost Malware.
Ryan Olson states that this is an important issue for every Apple IOS user.
If you had downloaded an infected app, one solution might be to then download an “updated” version as it becomes available on Apple’s App Store.
Video is courtesy of the Associated Press YouTube Channel
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
CryptoLocker ransomware variant hits Police departments in midcoast and northern Maine
CryptoLocker gained fame and fortune for the people behind it. It also spawned a growing number of variants, which can supposedly be found on the DarkNet via the Tor Onion network.
Talk Security Podcast: discusses “Dark Hotel” and “WireLurker” which targeted Apple IOS and OSX based products
Superfish, was preinstalled (starting Sept 2014) by Lenovo on a number of their consumer laptops, is detected as being Adware, Trojan, and Riskware by at least 23 AntiVirus & AntiMalware scanners
Superfish visual discovery software was preloaded onto Lenovo consumer level notebooks beginning in September 2014. Per the Lenovo News Release: “The goal was to improve the shopping experience using their visual discovery techniques.”
The preinstall of Superfish on consumer level laptops, was terminated by Lenovo in January 2015.
Cybersecurity For Dummies available for legal download, at no charge from cybersecurity firm Palo Alto Networks
Chinese authorities had arrested a number of individuals and shut down the WireLurker Command and Control Server just ten days after Palo Alto Networks released their findings.
Last weekend we focused on Cybersecurity issues. Many visitors to this site may not be fully versed in Cybersecurity issues. In that vein, I wanted to let you all know that Palo Alto Networks is allowing the legal download of Cybersecurity for Dummies. It discuss APTs (Advanced Persistent Threats) to the Enterprise Network. Old solutions no longer work. A layered approach of new solution is detailed.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice. Any offers mentioned in this post are also subject to change without notice.
Next Suits and Spooks event to be held in London England on May 06 and 07 2015
Suits and Spooks Events are a bit like TED Talks, but focused on Cyber Security issues. From the Suites and Spooks webpage: “Each event draws thought leaders and decision makers from the public, private, defense, law enforcement and intelligence sectors who come to learn about and discuss some of the key security challenges which face our digitally connected nation and world“
One unique aspect of the presentations made at Suits and Spooks is that after the first 10 minutes, the Audience can join in by asking questions or directly challenging the presenter. Audience participation resulting in Debate and Discussion is the cornerstone of these events.
The next Suits and Spooks Event will be held in London England on May 6th and 7th 2015.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial for Uniquely Toronto
http://www.uniquelytoronto.com
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice. Any offers mentioned in this post are also subject to change without notice.
Just wanted to say Hello to our visitors from the American NSA agency , Canadian CSIS agency, Russian SVR agency and German BND agency. Sorry if I left out one or two others…
Thanks for dropping by and checking out this past weekend’s Cybersecurity related posts….
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Kaspersky Lab publishes details about the Equation Hacker group’s arsenal, including “nls_933w.dll” which can reprogram the hard drive firmware of over a dozen different hard drive brands
Kaspersky Lab presented at their Security Analysts Summit something even more scary than the details about the Carbanak Bank Cyber Heist. Per Karspersky the Carbanak group ripped off about 100 banks around the globe of about $1 Billion Dollars (and in my opinion very likely still counting).
Kaspersky Lab Experts referred to the Equation group as the “God” or the “Death Star” of Malware. Part of the huge arsenal of code which the Equation group has been developing over what looks like decades is “nls_933w.dll“. “It allows them to reprogram the hard drive firmware of over a dozen different hard drive brands“.
Once “nls_933w.dll“ installs the Malware into the Hard Disk’s firmware, there is no way to remove it. Repartitioning will not affect it. Reformatting has no effect. The only way to get rid of this Malware from the targeted computer, is to physically destroy the Hard Disk.
Kaspersky Lab goes on to report that the Equation group seems to have existed long before the Stuxnet group.
The word “Elite” is part of the lexicon of Hackers. The Equation group therefore can be called the Elite of the Elite of the Elite of the Elite of the Elite and so on of Uber Hackers. To be able to hack and modify a Hard Drive’s firmware is unheard of. To be able to do so for Hard Drives of over a dozen different brands is insanely impossible. Yet the Equation group did it and very likely much more, that has yet to come to light. In comparison, this makes things like the REGIN Malware group’s incredible capabilities seem like no big deal.
Ok, enough of my rambling.
Click on this line to view the Kaspersky Lab report about the Equation group and their arsenal of jaw dropping Malware. On that page you will find a link to a downloadable PDF of the Question and Answer session from their presentation at the Security Analysts Summit.
Wow, this has turned into a CyberSecurity long weekend. Very impressive and rather scary stuff has been revealed by Kaspersky Lab.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
Kaspersky Lab report: The Great Bank Robbery: Carbanak cybergang steals $1 Billion Dollars from 100 financial institutions worldwide
Video is courtesy of the Kaspersky Lab YouTube channel
The Kasperskpy Lab report which was presented at the Security Analyst Summit (on Feb 16 2015) is now available online.
Click on this line to visit the Kaspersky Lab SecureList page which discusses the report : The Great Bank Robbery: Carbanak cybergang steals $1bn from 100 financial institutions worldwide. You can also download a PDF of the “Full” Report via a link on that webpage.
Click on this link to view other CyberSecurity related posts found on Uniquely Toronto.
Posted by: Vincent Banial
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
Hackers supposedly were able to steal up to $1 Billion Dollars from Banks around the globe
This is a further update to our prior post about the breaking news of a major Cyber Bank Heist.
The amount supposedly stolen from assorted banks around the globe is now being published to be around $1 Billion Dollars.
Racks filled with Cisco Networking gear. Photo Credit Vincent Banial
Hackers supposedly infiltrated Banks via Malware, allowing them to steal hundred of millions of dollars. Detailed report by cybersecurity firm Kaspersky Lab to be made public on Monday Feb 16
Photo of racks filled with Cisco Networking Gear. Photo Credit Vincent Banial
I have had many arguments about security software. One group especially got me going because to them Norton Security was the end all and be all. I finally got their so-called Tech to admit that to him Norton Security was the best because it had the largest market share. That’s like saying that GM automobiles are better than Rolls Royce automobiles because GM has a larger market share.
Of course Norton Security is very good. I believe that the security software created by Kaspersky Lab is better (your mileage may differ). Testing done by the Security Software testing site AV TEST http://av-test.org also top rates Kaspersky Lab security software. But I digress…our coverage of this major Cybersecurity Breach continues below.
The report on what Kasperky Lab had determined about the Cyber Bank Heist will be made public on Monday Feb 16.
Supposedly ATMs were instructed by the Hackers to dispense money at specific times.
Account balances were supposedly inflated and then the inflated amounts were transferred to Bank Accounts setup by the Hackers.
In the New York Times article it seems that Kaspersky Lab had supposedly seen evidence of hundreds of millions of dollars in supposed theft. The article implied that the Cyber Security Experts at Kaspersky Lab think that the sums stolen could possibly be multiple times more.
I will keep watching for the official Kaspersky Lab report on Monday. Till then you can learn more about this by visiting some of the links below.
The New York Times post which looks to be the main post which brought this to public light.
CNet’s post about the supposed Cyber Bank Heists.
ARS Techinca coverage of the Cyber Attack on Banks around the globe.
The Citizen post about this Hacker worldwide Bank Heist.
New York Times sub post about how Hackers infiltrated Banks.
I will continue to post about this as more is learned – most likely when that Kaspersky Lab report is released on Monday Feb 16 2015.
Posted by: Vincent Banial
Disclaimer: Any Trademarks mentioned in this post are owned by the respective Trademark owner. There could be unintentional errors or omissions in this post. Always refer to the official sites to confirm details and any ongoing changes or updates. This post is subject to change without notice.
Uniquely Toronto 