The Ransomware That Knows Where You Live

Ransomware - Scam Email Quoting People’s Postal Addresses -

As per security researcher, an extensively distributed scam email quoting people’s postal addresses tends to link to a dangerous kind of ransomware. After getting to know of an episode of BBC Radio 4’s You and Yours that discuss about the phishing scam, Andrew Brandt, of US firm Blue Coat had got in touch with BBC. He found that the emails seemed to be linked to ransomware known as Maktub.

The malware tends to encrypt the files of the victims, demanding a ransom to be paid before they can be unlocked. The recipients were told by the phishing emails that they owed hundreds of pounds to UK businesses and that they could print an invoice by clicking a link. However, according to Mr Brandt that leads to malware. One of the said emails had been received by You and Yours reporter, Shari Vahl. Mr Brandt had informed BBC that `it was incredibly fast and by the time the warning message had appeared on the screen, it had already encrypted everything of value on the hard drive, it happened in seconds’. Maktub does not only demand a ransom but it tends to increase the fee which needs to be paid in bitcoin, as time passes.

Addresses Highly Precise

One of the website connected with the malware had explained that during the first three days, the fee is at 1.4 bitcoins or around $580 and rises to 1.9 bitcoins or $799 after the third day. The recipients are told by the phishing emails that they owe money to British business and charities when they do not owe them anything. One of the organisations named was Koestler Trust, a charity that tends to help ex-offenders and prisoners produce artwork.

Chief executive Sally Taylor told You and Yours that they rely on generous members of the public and was very distressed when they discovered that people felt they had received emails from them asking for money when they had not been generated by them at all. A remarkable feature of the scam was that they included not only the victim’s name but the postal address as well. Several of them including the BBC staff had noticed that the addresses were generally highly precise.

Data Derived from Leaked/Stolen Databases

As per cybersecurity expert at the University of London, Dr Steven Murdoch, it is yet not clear how scammers were able to gather people’s addresses and link them to names and emails. The data could have been derived from a number of leaked or stolen databases for instance making it difficult in tracking down the source.

Many of the people had got in touch with You and Yours team to inform that they were concerned that the data could have been taken from their eBay account since their postal addresses had been stored in the same format there as they seemed to appear in the phishing emails.

The firm had mentioned in a statement that eBay tends to work aggressively in protecting customer data and privacy which is their highest priority and they are not aware of any link between this new phishing scam and the data of eBay. In an effort of creating the safest, environment possible for their customers, they tend to constantly update their approach to customer data security.

John McAfee offers to Unlock Killer's iPhone for FBI

John McAfee to Break the Encryption on iPhone of Killer Syed Farook

John McAfee the creator of anti-virus software has stated that he would break the encryption on iPhone which tends to belong to San Bernardino killer Syed Farook. He made the offer in an article to FBI which was published by Business Insider. Apple had declined to abide with the court order asking it to unlock the device in-between opinion on whether the firm should be compelled in doing so.

Mr McAfee stated that he together with his team would undertake the task `with no charge’. The offer came up while Mr McAfee continued his campaign as a US presidential candidate for the Libertarian Party. He had claimed in his article that it would take them around three weeks. Graham Cluley, security expert had informed BBC that he was doubtful about Mr McAfee’s claim.

He stated that the iPhone is notoriously difficult to hack when compared to the other devices. Mr Cluley, for instance, had doubts on Mr McAfee’s idea that he could use `social engineering’ to work out the pass-code on the locked iPhone of Farook. It is a procedure wherein the hackers attempt to find out login identifications by deceiving people in disclosing them.

Back Door – iPhones Susceptible to Hacking

Mr Cluley said that `in a nutshell, dead men tell no tales. Good luck to Mr AcAfee trying to socially engineer a corpse in revealing its pass-code’ He added that the FBI is not interested anyway, they want to set a pattern that there should not be locks, they cannot break’. Mr McAfee, in his article had said that he was keen in unlocking the device since he did not want Apple to be forced in implementing a `back door’, a method wherein security services could access data on encrypted devices.

Tim Cook, chief executive of Apple had earlier commented in a statement that the firm did not want to co-operate. He discussed that introducing a back door would make all the iPhones susceptible to hacking by the criminals. Mr McAfee is of the belief that there would be a possibility of retrieving data from the phone by other means, but did not give much details regarding the same.

Tech Firms Support Apple

Those comprising of the Australian Children’s eSafety Commissioners, who had spoken to tech website ZDNet had stated that Apple would not essentially need to introduce a back door. However, the firm is only being asked to provide access to a single device. Other tech firms have supported Apple’s following a few days of debate on how it ought to respond to the request of FBI.

Sundar Pichai, Google boss had expressed his support for Mr Cook and recently chief executive of Twitter Jack Dorsey had added his approval through a tweet. Facebook had mentioned in a statement that it condemned terrorism and had solidarity with the victims of terror, though would tend to continue its policy of opposing requests of diminishing security.

It stated that they would continue to fight aggressively against the necessities for companies in weakening the security of their systems and these demands would develop chilling pattern as well as obstruct the efforts of the company in securing their products.

Hack' on DoJ and DHS downplayed

Data Breach – DoJ/DHS

The US authorities had approved a data breach disturbing the Department of Justice, DoJ as well as the Department of Homeland Security – DHS, though restrained its severity. As per technology news site, Motherboard, the hacker has stated that they would soon share personal information of around 20,000 DoJ employees comprising of staff at the FBI.

It was informed by the news site that it had verified small parts of the breach, but had also observed that some of the details listed seemed to be improper or probably out-dated. The Department of Justice too restrained the significance of the breach. DoJ spokesman, Peter Carr had informed Guardian that `the department has been looking into the unauthorized access of a system which was operated by one of its components comprising of employee contact information and this unauthorized access is under investigation.

However, there is no indication at this time that there is any breach of sensitive personally identifiable information. The department has taken this very seriously and is continuing to arrange protection as well as defensive measure in safeguarding information. Any activity which is determined to be criminal in nature would be referred to law enforcement for investigation’

Hacked Data Posted on Encrypted Website

Hacked data which had been anonymously posted on encrypted website and reviewed by the Guardian comprise of a DHS personnel directory and the information listed included phone numbers together with email addresses. These were for individuals who have not worked for DHS for years. Besides this, some of the listings also had out-dated titles.

The encrypted DHS directory had appeared online prior to 7 pm EDT on Sunday and the password seemed to be `lol’. A source demanding responsibility had informed Motherboard who had revealed the story of the hack, that they had compromised the employee account of DHS and had then used the information from it to convince an FBI phone operator to provide access to the computer system of DoJ.

 The hackers had promised to release the information from the DoJ on Monday. At 4 pm EDT, an identical list had been posted on the same site with a DoJ staff directory which had also appeared to be out-dated. In order to assess the hack, during a government wide-meeting, an official compared it to stealing a years old AT&T phone book after the telecom had digitized most of its data already.

Disruption Regularly in Government Data Security

However, experienced officials state that it should be less simple in obtaining access token by imitating an official from a different department over the phone to a help desk.Things tend to be disrupted regularly in government data security and the OPM hack, exposed in June, revealed the deeply researched security clearance of 21.5m present and former government employees together with contractors from phone numbers to fingerprints.

 But the DHS breach seems to be far less severe and it is especially embarrassing considering that the department has been selected the point of entry for all corporate data shared with government agencies in the debated information sharing program between government and industry developed last year, by the Cybersecurity Information Sharing Act. The program wherein private companies tend to share user information with the government in exchange for immunity from regulation had not been accepted from its start at the DHS, which is left holding the bag in the incident of a breach.

Alejandro Mayorkas, DHS deputy secretary cited troubling provision from the bill to Senator Al Franken in a letter sent in July, wrote that `the authorization to share cyber threat indicators and defensive measures with any other entity or the Federal Government, notwithstanding any other provision of law, could sweep away important privacy protection’

Java Plugin Malware Alert to be issued by Oracle

Oracle is widely known for being behind the popular programming language called Java. Java is used for variety of purposes by the developer from making apps, games to even other robust programs. Oracle has issued an advisory where it has warned millions of Java users could get exposed to a malware threat which results due to the flaw in the software update tool. This particular plug-in is installed on a large number of PCS’s which allows them to run small programs written in the Java language.

Oracle has issued an alert for this malware threat on the social media as well as on its official website. US’s Federal Trade Commission is currently investigating the Oracle for any wrongdoing which isn’t a good time for the malware to emerge.

The threat of the Malware target

The reason for launching an investigation on Oracle can be summarized from the FTC’s complaint which states that Oracle was aware of number of security issues in the Java SE (standard edition) plug-in when it bought Java technology from its creator Sun in 2010. FTC has highlighted the flaws in the security system of the Java will can easily allow hackers to craft malware providing access to consumer’s usernames and passwords for the financial accounts. Apart from this malware can even be designed to feed of other vital and sensitive information which results in the attack on the user’s privacy. FTC has alleged that Oracle has been fooling its customers by asking them to install its updates which would ensure that their PC’s remain safe and secure. But Oracle had the firm knowledge that the Java has existing security issues.

Reasons for security issues in Java

The presence of security issues in the Java language is mainly attributed to Sun as it didn’t deleted the original update process in the earlier versions of the software before passing it on to Oracle. FTC states that it offers a great way for the hackers to exploit and launch their attacks on the PCs running Java.

Oracle has tried to address this issue but its update tools were only able remove the issues in latest version of Java but it left the earlier editions behind. Oracle only managed to rectify the problem in August 2014. In the current investigation being carried out by the FTC Oracle is not liable to plead ignorance as internal documents dating 2011 has stated that Java update mechanism is not aggressive enough or simply not working.

Trouble days for Java

Java is currently used to power a wide number of web browser base games, hat tools, and calculator and performs some other essential functions. Java also happens to be one of the top three applications which are targeted by the criminals. Most of the people don’t even know that it comes pre-installed on a large number of machines. FTC is recommending the business to stop using the java application or to remove them from their systems in order to remain safe secure from cyber threats. FTC is basically corned about the update procedures which are followed by the Oracle and it will not simply settle the problem by imposing a financial penalty.

Moonfruit takes Websites Offline after Cyber-Attack Threat

Cyber attacks have been increased rapidly throughout the globe. Sony was hacked just a few months which caused leakage of emails, movies details and other. Snapchat has also been hit in the past and now every website is playing cautious when it comes to imminent cyber attacks. Recently Moonfruit took thousands of its hosted business and personal websites offline after being threatened by a cyber-attack.

What is Moonfruit and why it took websites offline? 

Moonfruit is a UK company which helps its consumers and small business to create websites and online stores. Moonfruit is highly popular among the users in UK for its affordable pricing and efficient website builder which makes it simpler and easier to create demanding websites with less coding. Moonfruit has taken thousand of its customer’s website offline after receiving threats about a cyber attack.

Moonfruit had stated that it has kept thousands of its customer websites offline for up to 12 hours in order to make necessary changes in its infrastructure and to safeguard its consumers. Moonfruit has also perceived problems last Thursday when it suffered from a 45 minute of distributed denial-of-service attack. In this attack Moonfruit computer were overwhelmed by unwanted traffic and it made the use of its legitimate services non-functional.

Moonfruit consumers suffers from being offline

Moonfruit has informed its consumers about the decision of taking down the websites for up to 12 hours from Monday and it has generated some angst among the consumers. One such consumer Reece de Ville, a filmmaker, has complained that Moonfruit has been slow in communicating this decision which has the potential to disrupt the website performance and reach.

Moonfruits users had complained that this is bad time for taking down the websites as the holiday season is in full swings which brings higher web traffic and increases the sales volume. Apart from losing money through sales another problem faced by the users is the loss of potential clients or new clients within a day. Online stores will sells items especially for the holiday season like gifts and greeting cards store will take a severe hit in this Christmas week.

Armanda Collective behind the cyber attack threat

Moonfruit has sent emails to its customers where it explained that a notorious cyber hack group called Armanda Collective is attempting to extort money out of the company. Armanda Collective had previously successfully attacked the websites of web mail companies which included Hushmail, ProtonMail, RunBox and quite a number of Greek banking institutions.

The customers have been furious and quite unhappy with the loss of sales and potential clients. But it should also be understood that Moonfruit is a victim too of unpleasant criminal act where cyber criminals are threatening its business for extorting money. Moonfruit is working with the law enforcement authorities regarding this matter and hopes to dissolve this threat at the earliest. In the mean time customers have to bear with the Moonfruit decision of keeping the hosted websites offline.