How Hackers hack/attack

  I was asked this question recently.

 Great question, how to provide a great answer?

 A very large number of hack attacks are like land mines. The attack is planted and the attacker awaits some/anyone to trip the exploit.            Drive-bys and watering holes are some examples. An exploit is placed in an web site that is not hardened or maintained, a web visitor views the HTML code at the site and becomes infected. The infection will probably go unnoticed while credentials are harvested and sent to the attacker.

 Clicking on links in eMails and/or opening malicious attachments can cause malware infections.

 Phishing - eMails designed to lure the recipient to a malicious web site or provide credentials - are yet another method of attack. There are now phishing tool kits and the increasing use of artificial intelligence to craft the better and better lure in phishing eMails. The use of SMS to deliver these attacks (Smishing) are on the increase.

 Thus far, some of the many ways anyone might be attacked/hacked. Most of these methods rely on vulnerabilities that can be exploited. Vulnerabilities in the hardware, software, applications, network, firmware, default and enhanced setup, the list goes on. Plus the user. The vulnerability is the user wanting to see celebrity gossip, dancing monkeys, any and all of the lures put out every day.

 The next level are script kidiots. Someone finds an exploit script or application on the Internet and decides to use it to attack. They don't write the exploit code, just copy and run. 

 A similar avenue, malware as a service. Ransomware as a service. The attacker buys or leases the attack and provides payment and the victim list. This is increasing as well. Someone takes offence at a social media post and pays to have the financial life of that person destroyed.

 The more interesting method of attack involves finding a vulnerability in anything cyber and pairing that vulnerability with an exploit. This used to be difficult. Then metasploit. A framework that does this pairing for anyone. Just pick a vulnerability from column A, an exploit from column B, a victim list and click. Vulnerabilities are published everyday. How to find a vulnerable victim list? Use Shodan. Shodan is a list of results of Internet wide scans that occur 24x7. When you place a new device on the Internet, it is found and published in a few minutes.

 New vulnerability finding is difficult and takes time, trial, and effort. Most vendors provide bug bounties for vulnerabilities. Bad guys also buy these vulnerabilities at a much larger pay out.

 So how do hackers hack/attack? The method, means and techniques are available. Just point and click.

Messaging Applications

  Recent changes in privacy policies from WhatsApp caused users to access their privacy need in messaging apps. This caused Signal to onboard new customers leaving WhatsApp.

 SMS messaging might be fine for messages. Other means might require more care. Options to consider: WhatsApp, Signal, Telegraph, Threema are a few of the choices. Really more secure methods are used by others with special needs. 

 Options that tout end-to-end encryption require that the provider should be unable to read/see your message. They have the meta data but not the encryption key.

 With the change in privacy policy by WhatsApp security and privacy researchers have given most other options a closer look. 

 Apple's iMessage has changed their privacy policy as well. Using Apple's iMessage with iCloud backup stores the encryption key. Thus law enforcement can warrant the key and thus the iMessage store. That may give you pause. Apple's reason - customers who forget their Apple account passphrases/passwords would not be able to recover their data and messages if they and only they held the encryption key. Apple had the policy that only the customer would hold the key but reverted due to passphrase/password reset concerns.

 If you desire full end-to-end encryption for your iMessage data, consider disabling iCloud access/backup for iMessage data

 You will need to investigate your other message applications to ensure their policy and procedures match your requirements.

If you wish to have your iPhone local backup encrypted via iTunes or Finder

Note: The encryption is data in transit. If someone gains access to your device and/or the recipient's device via theft or spyware they will have access to the message data.

Medical devices and iPhone12 and MagSafe

 Apple has issued another warning:

Keep iPhone 12 and MagSafe "safe Distance" from medical devices like pacemakers, defibrillators, implantable cardioverter defibrillators, etc.

For more information consult your physician and Apple.

MAJOR Android system Update 9-Jan-2021

   January 2021 Android update from Google released this week.

 Updates for Android 8, 8.1, 9, 10, and 11.

Not just Android phones but other Android devices. Tablets, TVs, and others.

As each device may have differing update and notification features, check your owner's manual.

Some manufactures will have their updates available after they apply the patches to their distributions.

Old MAC

  With the release if the M1 Apple chip MACs you may have or plan to upgrade your MAC hardware. You have value in your old ro replaced hardware. 

 Before you do gift, recycle, or abandon your older hardware be aware the security of MacOS from Mojave on may prevent use by anyone else. This is the helpful <-> harmful aspect of most cyber security. If your MAC is stolen or misplaced you do NOT want others to access the data stored on that MAC. But you do want to put the hardware to use in an environmental responsible way.

 Step one. Sign out on the old hardware. Sign out of iMessage, iTunes, iCloud, and amy applications where you authenticate with your Apple ID.

BE SURE you are ready, really ready to proceed. After these next steps you will be able to recover. After these next steps others will not.

 Consider unpairing any Bluetooth devices.

To erase and re-install MacOS:

Shutdown and boot the MAC while holding down the Command + R keys                            Select the Disk Utility 

Select the system disk 

Click Erase 

Provide a name for the disk    consider APFS for the format

Erase any other internal disks and any Volume Groups 

Disable Find My if that ability was enabled 

After the format is complete quit the Disk Utility and select Reinstall MacOS from the utilities window.

After the re-install completes:

Next clear parameters you have set that are stored in the MAC hardware. These settings can be used to recover MACs for forensics. 

 Shutdown the MAC   Power on with the Option + Command + P + R                                      Not easily done  On purpose I would imagine                                                                            You will know if this step erased the settings in NVRAM and parameter RAM if your parameters are no longer available.

 Your MAC should boot into a fresh install of MacOS

Adrozek

  A cross browser campaign is currently on the Internet.

Affects all browsers, probably on all platforms.

As more and more is on our networks, there will be more and threats to steal or copy credentials for financial gain for the bad gals/guys and financial ruin for us.

 This one has been named Adrozek by researchers at Microsoft. 

 Is has been found to perform unwanted ad injection for search results. It is capable of much more. Credential stealing or copying as an example. If you have stored credentials in a browser for a digital wallet for digital currency, a financial institution, on-line shopping, etc. you might consider changing the passphrases/passwords and store the credentials in a more secure location. Password managers, password hints in a safe, etc.

 Monitor, monitor, monitor. Recognize all of the browser helper objects, browser extensions, browser add-ons in all of your browsers? Use separate and secured browser instances for financial access?
Keep your software, applications, firmware, alerts, security suite signatures, and other defenses up to date?

 Once discovered Adrozek was infecting 30,000 devices a day.

 Adrozek disables browser updates, establishes a windows service, and other harmful actions. Once a malware tool is released other actors can modify the actions to perform greater harm. 

 Microsoft Defender (formally known as Windows Defender) has had signatures to detect and attempt a clean of infected Windows PCs. Other browser platforms (MacOS, Linus, BSD, etc.) are vulnerable as well.

 To protect your platforms use standard and proven cyber defenses and hygiene.

 A suggestion for Windows: use Windows Update to obtain the most current Defender signature updates. Then perform a full scan of all volumes.

 Then Windows Security -> Virus and threat protection -> Full scan

 Be aware a full scan can take a loooong time on a disk with a lot of files.

Safer Holiday Shopping

 Use Digital wallets

 Apple Pay, Google Pay, etc. Merchants do not see your credit card info. Similar to PayPal without giving your information to PayPal. The technology uses a secure digital token based on cryptography.

Then protect those digital wallets, have a tested backup and recovery plan. Monitor those wallets.

Avoid public Wi-Fi

It is trivial to setup a Wi-Fi hotspot with known merchant or store network names. Once connected to these rogue Wi-Fi networks any and all data provided via Wi-Fi is at risk

Similarly, consider turning OFF your device Wi-Fi while away from your home networks. The network name your device "beacons" can be detected and spoofed.

Use VPN

Virtual Private Networks provide an encrypted tunnel from and to end points. This protects data in transit across the Internet. Choose your VPN provider with care, there are VPNs that steal data and sell your connection history.

A drawback to VPNs, your source IP address may rapidly change. Good for avoiding tracking. Not so good when your bank notices your device changing location.

Avoid storing Credit card info at sites

Convenient - true. Dangerous - also true. Breaches and ransomware are a danger to that information.

Be aware at points of sale

Near Filed Communication (NFC) on debit and credit cards uses radio. Radio. Try to avoid others near you at point of sale terminals. Consider a RFID shields for wallets and purses.

Consider turning credit cards Off

Most banks can and will disable your credit and debit cards, then enable when YOU re-enable them.

Review and Use banking alerts

Use the alert features on all your financial institutions. Once setup, take the time to check the alerts are sent to you, not an identity thief.

Employ virtual credit cards

Some banks, credit unions, etc. provide a one-time card number for on-line use

Prefer Credit over Debit

Credit cards transfer the bank's money to merchants. Debit cards transfer your money to merchants.

PayPal

Hides, to a degree, your credit & financial information. NOT FDIC insured, has fees, subject to insider theft.

Increase financial monitoring

Monitor your finances. Brokers, company IRAs, merchant accounts, ...

Report Identity theft

No matter how small. As each of are safer, we are all safer. The quicker the detection and reporting, the quicker your identity can be restored

Report suspicious activity

FTC site: 

Police:

Credit Reporting Agencies

Your bank

Again, the quicker the better

Beware social media Ads

Tis the season. The pandemic has affected cyber criminals. Bad recommendations, false claims, etc. Stolen social media accounts of friends are used as well. 

Avoid Phishing lures

 A expected and real increase at this time of year. These campaigns appear more real than real.

Be suspicious, be informed, be prepared.

Be very suspicious of unsolicited phone calls & messages

Thieves are using Artificial Intelligence to greatly increase the "pitch". Be wary of any urgency, threats, and other techniques. "To avoid this charge please call back at this number" 

Use your detective skills to investigate.