Home - h4ckers-news

Amazon Music: Everything You Need To Know

Android

andreasc

-

August 20, 2023

Amazon Music: Everything You Need To Know

[ad_1]

Amazon Music isn’t one of the most popular streaming services out there, but it is a good competitor to Spotify, YouTube Music and Apple Music. Especially since you can use it for free – much like Spotify. Amazon actually has three versions of this service, there’s Amazon Music, Amazon Music Prime and Amazon Music Unlimited. Which range from free to $10.99 per month. There are also various versions of the Unlimited plans for Prime and non-Prime members, a family plan, a single device plan and a student plan. The Echo device plan is actually no longer available, and replaced by the single device plan.

So here, we’re going to tell you everything you need to know about Amazon Music and whether it’s worth using over the other streaming music services out there.

What is Amazon Music?

Surprisingly, Amazon Music has been around since 2008. It originally started as Amazon MP3, which was a streaming platform and online music store. It was later rebranded as Amazon Music, and in 2019 it launched Music HD. Which was set to be a competitor to Tidal. Offering lossless quality and 4K quality music for you to stream for a few bucks more per month. Though Music HD was later rolled into Amazon Music in 2021, and available to all customers at the regular Amazon Music price.

Amazon last reported the number of users it had in 2020, which was around 55 million subscribers. Meanwhile Apple Music had 98 million subscribers as of 2021, YouTube Music had 50 million subscribers in late 2020, and Spotify has over 422 million subscribers as reported in 2021. But Spotify’s numbers are a bit skewed, since there is a free plan, and many likely have been on that plan for many years.

Amazon Music Free vs Music Prime vs Music Unlimited

As mentioned before, there are three versions of the music streaming service from Amazon. There’s the free version, a version for Prime members and then unlimited which offers everything.

Amazon Music Free is the most basic music service from the ecommerce giant. At this tier, you will get access to thousands of playlists and radio stations. But you do not get individual songs. You will also get advertisements playing during your listening experience. Amazon also does not offer offline playback on this level. Finally, it only works on one device. It’s really great for those that want to check out the service, and not pay for it yet.

Amazon Music Prime is the next level up, and if you’re a Prime member, it is included in your yearly cost. You’ll get over five million songs plus playlists and stations. There’s no advertisements on this tier, but there is offline playback. Music HD and UHD is not available here, that is saved for Unlimited.

Then there is Amazon Music Unlimited. This is $10.99 for the standard plan (or $9.99 if you’re a Prime member), and offers basically everything. You can use it with or without a Prime account too. It offers everything from the Free and Prime tiers, along with HD, Ultra HD and Spatial Audio playback. It’s also available in a family account, which lets you use it on up to six devices at the same time. Below is a table breaking down these three services, so you can choose what’s right for you.

Update: Amazon has announced that starting on September 19, 2023, pricing for Music Unlimited will go up by a buck per month. So that’s $10 for Prime members now and $11 for non-Prime members.

What devices can I listen on?

Amazon Music is available virtually everywhere. Here’s what devices it is available on right now:

Desktop browsers
iPhone
iPad
Android (smartphones and tablets)
Amazon Fire TV
Amazon Echo (and other Alexa-enabled speakers)

You’ll notice that things like Apple TV and Android TV, and even the Google Assistant speakers are not available. That’s not a big surprise, considering they have competitors. And Amazon doesn’t put its products on Google products other than smartphones and tablets, for the most part. And its vice versa for Google.

The Amazon Music Family Plan

The Amazon Music Family Plan is pretty similar to other streaming music services out there. It offers six devices that you can use at the same time to stream music. It’s also competitively priced at $14.99 per month. So you can share it with up to six people, and pay a little more than $2 per month, if you split the cost.

Amazon also says that each family member on this plan will get all of their own personalized stations, playlists and such. So when you login, you’ll see your own music, library, playlists and other recommendations. Pretty similar to Spotify, YouTube Music and Apple Music actually.

The Single Device Plan

The Single Device Plan from Amazon is actually very intriguing. Since you can get Amazon Music Unlimited for just $3.99 per month. Now it is only on one device, period. Not simultaneously. So if you’re one that works from home and only really listens to music at your desk, you can use this plan on your Echo Dot or another Echo device and never worry about using it on another device.

Keep in mind that the Single Device Plan does not include HD, Ultra HD or Spatial Audio. Which might be a letdown for some.

The Student Plan

Like most other streaming music services out there, Amazon Music Unlimited has a student plan too. It’s available for $4.99 per month, which is about half the price of the usual price. Of course, if you get Prime Student, you can get Music Prime included in that $69/year service.

So how do you get this plan? Well, you’ll need to prove that you are indeed a student. Amazon will use the third-party vendor SheerID to confirm you are indeed a student. If your student status can’t be automatically verified, you’ll need to manually upload your enrollment documentation. You’ll need to provide one of the following:

Official Enrollment Letter from your academic institution (acceptance letters will not be approved)
Class schedule for the current academic term
Registration receipt or tuition receipt
Transcript that shows classes currently in progress
Other school issued document that displays your first/last name, an issue date from the current term or within the last three months

It’s important to note that even if you have proven your eligibility for Prime Student, you’ll still need to do it for Amazon Music Unlimited. Amazon says that this is because Music Unlimited uses a different student screening process than what Prime Student uses.

Can I use Alexa for Amazon Music Unlimited?

Of course you can. You can use your voice to start or change music with Amazon Alexa. It works on any Alexa-enabled speaker, not just first-party speakers from Amazon. You can say things like “Alexa, play Lizzo” or something like “Alexa, play some pop music”. Here are a number of other Alexa voice commands you can use with Music Unlimited.

Want to hear the latest song or album by your favorite artist but don’t know the title? Try, “Alexa, play the new song by Bruno Mars,” or, “Alexa, play the latest album by Norah Jones.”
Have words to a song stuck in your head but can’t remember the name of the song? Just say a few words and Alexa will play it for you. Try, “Alexa, play the song that goes ‘I’ll Be Your Lifeline Tonight.’”
Want to re-live the music from your college days? Try, “Alexa, play the most popular rock from the ’90s.”
Feeling down and need a pick-me-up? Try, “Alexa play happy R&B music.”
Want to listen to early catalog from a favorite artist? Try, “Alexa, play Van Halen from the ’70s.”
Having friends over? Try, “Alexa, play music for a dinner party.”
Want to be surprised? Try, “Alexa, play the Song of the Day.”

How many songs does Amazon Music have?

So how large is the Amazon Music catalog? Well, it currently boasts 90 million songs. Now how does that compare to the competition? Apple Music has over 50 million songs, Spotify has over 35 million songs, and YouTube Music has over 80 million songs available. So it’s quite large, compared to the competition, with more than twice as many songs as Spotify. When Amazon Music first launched, its library was pretty small. But it has grown considerably over the years. Keep in mind that these numbers don’t get updated often, so they could be closer together than you think.

However, keep in mind that the Free and Prime versions of Amazon Music do have far fewer songs, only about 5 million.

Should I switch to Amazon Music?

If you are already heavily invested in the Amazon ecosystem – with Echo, Alexa, Ring, etc – then Amazon Music is a really good option for you to check out. Especially if you’re a Prime member, since you can get it for free. It is also the only one, other than Apple Music to offer lossless music at the regular $9.99 price (on the unlimited plan at least). Which is something you should definitely consider. As it does make the music sound a whole lot better.

Amazon Music doesn’t have as many features as some of the other streaming music services out there, so you may want to check that out first. And if you want to use it on literally every platform (Nest Hub, Echo Dot, Android, iOS, etc) then you will likely want to stick with Spotify. Out of the four major streaming music services, they are all very similar, so it really depends on your needs and what you listen to, as far as which is going to be best for you.

[ad_2]
Source link

Ransomware targeted SCADA systems of 3 US water facilities

Cyber Attacks

andreasc

-

August 20, 2023

0

Ransomware targeted SCADA systems of 3 US water facilities

[ad_1]

United States has warned of more ransomware attacks on information technology (IT) and operational technology (OT) networks of the country’s Water and Wastewater Systems (WWS) Sector facilities.

On Thursday, multiple US government agencies, including the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Agency (CISA), the Environmental Protection Agency (EPA), and the National Security Agency (NSA), issued a joint alert, warning organizations in the Water and Wastewater Systems (WWS) Sector regarding an upsurge in cyberattacks against these facilities.

SEE: Employee PC hacked via TeamViewer in attempted water supply poisoning

The alert revealed that three industrial control systems (ICS) at water facilities in the US had been impacted by ransomware attacks in the past two years.

“The ransomware variant had been in the system for about a month and was discovered when three supervisory control and data acquisition (SCADA) servers displayed a ransomware message,” the agencies noted in the alert.

WWS Facilities Under Threat

As per the alert from the FBI, CISA, EPA, and NSA, the WWS sector is currently under the radar of cybercriminals. Threat actors can launch phishing campaigns and target outdated software to exploit control systems.

The agencies claim that they are aware of the emerging threat against water facilities’ OT and IT networks. The agencies revealed that threat actors are explicitly targeting critical infrastructure sectors; however, this doesn’t mean that the threat isn’t restricted to the WWS sector only.

The Executive Assistant Director for Cybersecurity, Eric Goldstein, stated that the recent ransomware incidents make cybersecurity a top priority of critical infrastructure owners and operators.

“While vulnerabilities within the Water Sector are comparable to vulnerabilities observed across many other sectors, the criticality of water and wastewater infrastructure and recent intrusions impacting the sector reflect the need for continued focus and investment,” Goldstein said.

Potable Water Facilities The Prime Target

The advisory noted that malicious activities targeting WWS facilities might launch ransomware attacks affecting the potable water generating facilities by gaining control of wastewater processes.

Since these facilities are part of the sixteen US critical infrastructure sectors, spearphishing or other kinds of attacks that cause their compromise or incapacitation would directly impact national and economic security and jeopardize public health and safety.

Multiple Malware Strains Discovered

The agencies further revealed that they had identified multiple ransomware strains against the WWS sector in the incidents. The threat actors are trying to encrypt water treatment facilities systems using Ghost used in August 2021 against a WWS facility in California.

SEE: DoJ charges man for hacking, tampering with public water facility

The ransomware variant persisted in the system for a month. Authorities later discovered it in three supervisory control and data acquisition (SCADA) servers that displayed a ransomware message

In September 2021, threat actors used the Makop ransomware variant against a New Jersey-based WWS facility. In March 2021, a Nevada-based WWS facility was also targeted with an unknown malware strain that affected the SCADA system.

Moreover, a ransomware strain called ZuCaNo was launched against a Maine-based WWS facility’s SCADA wastewater computer in July 2021, and the system had to be run manually until the computer was restored.

Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.

[ad_2]
Source link

Chinese VPN app Quickfox caught exposing 1 million users’ data

Hacking

andreasc

-

August 20, 2023

0

Chinese VPN app Quickfox caught exposing 1 million users’ data

[ad_1]

The Quickfox VPN is mainly used by Chinese citizens living abroad who need to access Chinese websites as most of these sites are geo-restricted.

Wizcase’s team of ethical researchers, led by Ata Hakcil, discovered a “critical leak” that the researchers found to be exposing personally identifiable information of at least one million users of a Chinese VPN service.

The team revealed that the VPN leaking data is Quickfox, produced by Fuzhou Zixun Network Technology Co., Ltd.

The VPN is mainly used by Chinese citizens living abroad who need to access Chinese websites as most of these sites are geo-restricted. The VPN connects to servers in China and lets users avoid those restrictions.

What Happened?

Reportedly, the leak was caused by a misconfiguration in the VPN. The product had insufficient ELK (Elasticsearch, Logstash, and Kibana) stack security, which refers to the three open-source programs responsible for streamlining searchers via large files, in this case, the logs of Quickfox.

SEE: Almost Every Major Free VPN Service is a Glorified Data Farm

Researchers identified that Quickfox had set up access restrictions from Kibana but hadn’t set up security measures for the Elasticsearch server. Hence, anyone with an internet connection and a browser could access Quickfox and retrieve sensitive PII information on the service’s users.

What’s worse is that there wasn’t any password protection in place or login credentials required to access the data, but the data wasn’t encrypted.

What Information was Leaked?

The 100GB database contained around 500 million records, including PII of nearly one million Quickfox users. PII data included:

Names
Device data
Device type
phone numbers
email addresses
MD5 hashed passwords
Software installed on the device and installation date.

The data is enough for scammers to launch phishing attacks, vishing phone calls, and other schemes to obtain banking data. The server was yet not secured until the time of this writing.

“All the documents found were dated between June 2021 and September 2021,” Wizcase researchers wrote in their report. “The leaked information about device type and installed software could make this con very convincing. It’s unclear why the VPN was collecting this data, as it is unnecessary for its process and it is not standard practice seen with other VPN services.”

SEE: 7 VPN with no-logs policy exposing 1.2 TB of user data

Impacted users were mainly located in the following countries:

USA
China
Japan
Indonesia
Kazakhstan

Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.

[ad_2]
Source link

Amnesty Intl. accuses Indian cyber security firm of spyware attacks

Malware

andreasc

-

August 20, 2023

0

Amnesty Intl. accuses Indian cyber security firm of spyware attacks

[ad_1]

According to Amnesty International, it found evidence that attackers testing the spyware were using the IP address of Indian cyber security firm Innefu Labs.

Amnesty International has accused an Indian cyber security company of developing Android spyware that has been used in targeted attacks against Togolese activists. The company, Innefu Labs, has denied the allegations.

According to Amnesty International, the spyware is distributed via email messages and the Facebook-owned messaging app WhatsApp. The campaign’s modus operandi involves phishing and social engineering techniques such as luring the victim into downloading the spyware through email or installing it on their device through WhatsApp chat.

Once installed, the spyware allows attackers to have full control over the device including the camera, microphone, read WhatsApp messages, steal files and photos remotely – all that without raising any alarm.

One Togolese activist who would like to keep their identity hidden shared WhatsApp screenshots showing an Indian WhatsApp number trying to lure them into downloading and installing ‘ChatLite,’ supposedly secure chat app.

In reality, it was actually a custom-developed Android spyware tool that, when successfully deployed, allows the attackers to collect sensitive data from victims’ mobile devices and install additional spyware tools.

In another attempt, the attacker used a Gmail account to send a malicious MS Word file to trick the activist into installing the spyware.

Amnesty accuses Indian security company of developing Android spyware — WhatsApp chat leading to the installation of ChatLite app that is spyware

The spyware was initially attributed to a “hacker group” called Donot Team. It is worth noting that last year, the DoNot APT group was seen abusing Google Firebase cloud messaging to distribute Firestarter Android to exploit the Kashmir issue between India and Pakistan. Though, its prime target in the campaign was the Pakistani government.

However, Amnesty says it has found evidence that the Indian cyber security company Innefu Labs is behind the spyware. The spyware and Innefu Labs use the same infrastructure.

In addition, Amnesty found evidence that an attacker testing the spyware was using Innefu Labs’ IP address. Among other things, the spyware was used against an activist in Togo.

While discussing the connection between Innefu Labs and the spyware campaign in its report [PDF], Amnesty International went on to state that,

Amnesty International initially found the Innefu Labs IP address, 122.160.158.3, exposed in Android screenshots on the Android spyware test server. While this IP address is not registered directly to Innefu Labs, it is being used by the company, Amnesty claimed.

A subdomain for authshieldserver (dot) com has pointed to the Innefu Labs IP address since 2016. AuthShield is an Innefu Labs product. Additionally, the PassiveTotal service has also recorded TLS certificates containing the innefu.com domain on the same IP address.

The same Innefu Labs IP address also appeared in the SQL databases Amnesty International discovered on the URL shortener and Android spyware distribution servers. These SQL databases also contain records from previous spyware distribution servers which were no longer active at the time of discovery, added Amnesty.

Amnesty approached Innefu Labs, but it denies the allegations. According to the security company, there is no evidence that it is involved in spyware. Moreover, in a letter to the human rights movement, the company threatens legal action.

However, Amnesty sticks to the conclusion. “Based on the evidence gathered in this study, Amnesty believes Innefu Labs is involved in the development and/or distribution of a number of spyware tools previously linked to Donot Team,” maintains Amnesty.

The human rights movement is calling on the Indian government to launch an investigation into the security company, curb the use of surveillance technology and strictly regulate the export of spyware technology.

Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.

[ad_2]
Source link

Next Vivo flagship to offer variable aperture & 200MP telephoto camera

Android

andreasc

-

August 20, 2023

0

Next Vivo flagship to offer variable aperture & 200MP telephoto camera

[ad_1]

Vivo is planning some major camera improvements with its next flagship. The next Vivo flagship, likely called the Vivo X100 Pro+, will support variable aperture, and feature a 200MP telephoto camera.

The upcoming Vivo flagship will offer variable aperture & 200MP telephoto camera

The Vivo X90 Pro offered great camera performance, as did the Vivo X90 Pro+. Well, VIvo is looking to up the ante. Neither of those two phones offered variable aperture, nor did it have a 200MP telephoto camera, not even close.

They did have a 1-inch camera sensor, and chances are the Vivo X100 Pro+ will too. Variable aperture will only make that sensor more useful, as Xiaomi showed us with the Xiaomi 13 Ultra. Let’s hope that Vivo will do things differently, though.

The Xiaomi 13 Ultra has a two-stop variable aperture, while Huawei offers far more on its Mate 50 Pro and P60 Pro devices. Granted, Huawei did not utilize a 1-inch camera sensor, but still, it provides outstanding results. Variable aperture definitely has something to do with that.

Variable aperture can make quite a difference if implemented properly

If utilized properly, it can help provide far more balanced shots, and improve image quality in all lighting conditions. Unfortunately, we still don’t have the exact info on it, so we don’t know how many levels will Vivo offer.

The tipster also mentioned a 200MP telephoto camera, which is quite surprising. We still don’t have the details regarding that camera, but pixel binning will be the name of the game.

In addition to these two details, the tipster shared some additional specs we’ll get with the Vivo X100 Pro+. The Snapdragon 8 Gen 3 is said to fuel the phone, while the device will include a 6.78-inch display with a 120Hz refresh rate.

LPDDR5X RAM and UFS 4.0 storage will be supported, while a 50-megapixel portrait camera (Sony’s IMX758 sensor) was also mentioned. An ultrasonic fingerprint scanner will be included under the display, while the phone will be IP68 certified for water and dust resistance.

[ad_2]
Source link

Breach Forums to Remain Offline Permanently

Cyber Attacks

andreasc

-

August 20, 2023

0

Breach Forums to Remain Offline Permanently

[ad_1]

The decision to shut down the Breach Forums came after the admin noticed someone had logged into an old forum CDN server on March 19th, 1:34 EST, 2023, indicating that federal authorities had access to Fitzpatrick’s devices.

Hackread.com has learned that the infamous hacker and cybercrime forum Breach Forums has been permanently shut down. On March 18th, 2023, it was reported that Conor Brian Fitzpatrick (aka Pompompurin, aka Pom), the owner, founder, and administrator of Breach Forums, was arrested in New York.

The question regarding the forum’s future after Fitzpatrick’s arrest was echoed across different forums, with speculations about whether the forum would be seized by authorities, like its predecessor forum Raid Forums.

The day the news of Fitzpatrick’s arrest surfaced, one of its administrators, who goes by the alias Baphomet, claimed responsibility for taking over the forum to keep it running and protect it from being seized. They also claimed to have cut all of Fitzpatrick’s access to the forum.

However, in a statement made on the official Telegram channel of Breach Forums earlier today, Baphomet has announced the permanent shutdown of the forum. In a statement, Baphomet apologized to forum users for any inconvenience and emphasized that their decision was made for the betterment and safety of everyone.

It is worth noting that Baphomet plans to start a new Breach Forums-like community in the near future. However, for now, all forum domains will be redirected to a website owned by Baphomet.

Reason for Sudden Shutdown

The initial plan of administrator Baphomet was to keep Breach Forums online, but what changed their mind? In a statement, the administrator explained that the decision to shut down the forum came after they noticed someone had logged into an old forum CDN server on March 19th at 1:34 EST, 2023, which indicated that federal authorities had access to Fitzpatrick’s devices.

Baphomet stated that running a forum with the fear of law enforcement access would be risky, and the best solution for everyone’s safety was to permanently shut it down. Here’s what Baphomet had to say:

This will be my final update on Breached, as I've decided to shut it down. I'm aware this news will not please anyone, but it's the only safe decision now that I've confirmed that the glowies likely have access to Pom's machine.

As I said early on in all of this, anything related to production Breached infrastructure was locked down immediately - however I was kind enough to leave a few old, non-essential servers completely unchanged. One of those servers I left unchanged is an old CDN from months ago that no longer hosts any CDN files or configs but rather was used to just download large files from time to time.

Throughout the migration I checked to see if anything was going on that would cause concern during the migration. One of the servers checked was the old CDN server described above. It seems someone logged in on Mar 19, 1:34 EST prior to me logging into the server. 

Unfortunately this likely leads to the conclusion that someone has access to Poms machine. Any servers we use are never shared with anyone else, so someone would have to know the credentials to that server to be able to login. I now feel like I'm put into a position where nothing can be assumed safe, whether it is our configs, source code, or information about our users - the list is endless. This means that I can't confirm the forum is safe, which has been a major goal from the start of this shitshow.

As for what this means now, It's complicated. Unlike when other communities go down and everyone scatters, stupidly I will still be around. I will redirect all the Breached domains to my baph.is domain. The Telegram group and channel will remain up for now, but I will make a new Telegram group for those interested in seeing what I have planned next. I will always be willing to sign a message to prove my identity to the community.

While the community of Breached will die, I'm going to continue conversations with some of the competitor forum admins and various service operators who reached out to me over the past few days. I'm hoping to work with some of those people to build a new community, that will have the best features of Breached while reducing the attack surfaces we never properly addressed. As with things like this, I have no doubt our userbase may be absorbed by another community but if there is patience then I hope to bring something back that will rival any other community that can take our place.

I'll be taking 24 hours from the sharing of this message to just rest and think. I'll be back online to talk with everyone, and we'll go from there. The domains for the time being shouldn't be seized, but I'll let the community know if any of that happens.

For now - see you, space cowboy.

Baphomet

What’s Next?

Although the shutdown of Breach Forums is seen as a positive initiative, for investigators, cybersecurity journalists, and researchers, it may become a rabbit hole. With no reliable community to turn to, cybercriminals could move to Russian-language forums to dump stolen databases, which is a bigger and larger-scale threat to unsuspecting users and organizations.

It is worth noting that Russian hacker forums are already forming alliances with Chinese-speaking hacker groups, which could eventually become a perfect recipe for disaster for adversaries on the opposite side.

[ad_2]
Source link

Hacker steals govt database with info of entire Argentine population

Hacking

andreasc

-

August 20, 2023

0

Hacker steals govt database with info of entire Argentine population

[ad_1]

After the infamous La Gorra Leaks in 2017 and the exposure of Argentinian politicians and law enforcement officials in 2019, Argentine is back in the news for all the wrong reasons. This time, hackers have reportedly stolen a government database containing the entire Argentine populace’s information, which means around 46 million people are currently at risk of exploitation.

About the Hack

According to The Record, an Argentine government database known as RENAPER (Registro Nacional de las Personas/Argentina’s National Registry of Persons) was targeted. RENAPER hosts the country’s national registry, official ID card details, and photos of all 45.3 million citizens.

SEE: Google Argentina domain bought by a random citizen for $5

Reportedly, hackers have managed to steal the ID card data of the entire population and are now trying to sell it in private circles. Given the trove of information this database might contain, it could be a goldmine for threat actors as they can use it for scams, attacks, and exploits.

How did the Breach happen?

According to Argentinian media, the hacker breached the government’s IT network and stole ID card details. The breach took place in September, indicating that the government failed to protect its citizens’ identities.

The targeted department was responsible for issuing ID cards to all citizens, and the data was stored in digital format, and it was only accessible by government agencies. Hence, it seems probable that a security loophole would have allowed the hackers to infiltrate the network.

Entire Population’s ID Card Details Stolen

The Record reported that the first evidence that RENAPER was breached emerged earlier in October when a newly registered Twitter handle @AnibalLeaks published ID card photos of 44 well-known Argentinian celebrities, including president Alberto Fernández, football superstars Sergio Aguero and Lionel Messi, journalists, and political figures.

One day later, the personal details and images were also published on Twitter, and the hacker posted an ad on a popular hacking forum.

Government’s Response

The Argentinian government confirmed the breach three days later in a press release in which the Ministry of Interior explained that its security team learned that a VPN account assigned to the Ministry of Health was used to examine RENAPER for 19 photos. That very moment the photos were published on Twitter.

SEE: Argentina’s largest telecom hacked with hackers demanding $7.5 million

“The [RENAPER] database did not suffer any data breach or leak,” the ministry confirmed, adding that authorities are currently investigating 8 government employees for their possible involvement in the leak.

The hacker contradicted the government’s official statement when The Record contacted them and said they had a copy of the RENAPER database. Hackers proved their claim by sending personal details, including the Trámite number, of an Argentinian national chosen by The Record.

“Maybe in a few days I’m going to publish [the data of] 1 million or 2 million people,” the hacker told The Record.

Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.

[ad_2]
Source link

Minecraft declared the most malware-infected game

Malware

andreasc

-

August 20, 2023

0

Minecraft declared the most malware-infected game

[ad_1]

Malware strains have gradually become the leading cause of infection targeting millions of devices worldwide annually. A new report from Atlas VPN revealed that the PC and mobile gaming industry is the current big target of malware authors and Minecraft is their favorite game to bait gamers.

New Survey Reveals Startling Details

Atlas VPN researchers created a list of the most-targeted games both for mobile and PC. Minecraft topped the chart on both platforms. According to the researcher, nearly 184,887 players were impacted on PC as they downloaded malware hidden inside a Minecraft file.

SEE: 50,000 Minecraft users infected with hard drive wiping malware

Moreover, there were more than three million total detections of infected Minecraft files. Conversely, on mobile devices, Minecraft-related malware infected 44,335 devices while antivirus software detected 300,000 malware cases, reported Kaspersky Security Network.

It is understandable why malware developers are so keen on targeting Minecraft fans. The game is massively popular on both mobile and PC, for instance, as of 2021, Minecraft was home to over 131 million players.

Almost 303,827 Devices Affected Within a Year

In its survey, Atlas VPN concluded that between July 2020 and July 2021, around 303,827 devices got infected with malware spread via different malicious gaming software. Being the leading and most played game in the market, Minecraft attracted the highest number of malware since more than half of these 303,827 devices were affected by Minecraft-related malware.

Most Infected Games

Apart from Minecraft, many other games are on the radar of malware developers. These include:

Sims 4
PUBG
Free Fire
Among US.

Among US reported 9616 malware detections, whereas PUBG showed 9084, and Free Fire showed 6065 malware detections. On PC, Sims 4 and Minecraft attracted the most malware, followed by:

PUBG
Fortnite
Grand Theft Auto 5
Counter-Strike GO
League of Legends
Rocket Leagues
FIFA 21
Need for Speed Heat.

How are Gamers Targeted?

Minecraft, Sims 4, and other games that require users to download modpacks or mods are the prime targets of malware developers and scammers. A major chunk of such games is accessed by downloading additional files. Downloading mods bring the game to a whole new level and enhances players’ competitiveness.

When content creators combine several mods, it is called the modpack, which drastically improves the game. But the problem is that for downloading modes, you have to access third-party services and websites, which is where cyber criminals hide the malware.

How To Stay Safe?

Since mods are a hotspot for malware you have to be careful while downloading them. There is no need to avoid downloading mods but ensure you download them from official and trusted sites only. Every game with modding features has a hub where you can search and download your desired mods, such as Minecraft has CurseForge boasting a vast catalog of modpacks and mods.

SEE: Malware infected Minecraft modpacks hit Google Play Store

Moreover, never click on links or download files that promise cheating programs or hacks to help you gain an unfair edge over your competitors because it might be a malware payload. And whenever you feel like trying out a new game download it from the official website or store.

Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.

[ad_2]
Source link

Motorola Moto G54 appears in all color options

Android

andreasc

-

August 20, 2023

0

Motorola Moto G54 appears in all color options

[ad_1]

The Motorola Moto G54 has just surfaced in all color options, following a leak from earlier this month. This is the best view of the Moto G54 we have thus far, thanks to Evan Blass aka @evleaks.

The Motorola Moto G54 will launch in three color options, and all of them are shown here

As you’ll see in the gallery below the article, there are three color variants of the phone shown here. Those are seemingly all the colors that Motorola will offer. We have black, blue, and green versions shown here

The device will feature a flat display, with a centered display camera hole. All of that is clearly visible in the provided images. The bottom bezel will be thicker than the rest, which is not surprising.

On the back, the company will include two cameras inside the same camera island. Those cameras will sit in the top-left corner of the phone’s backplate. Motorola’s logo is also visible on the back, and the backplate is slightly curved towards the sides.

It will also include a 120Hz display, a 5,000mAh battery, and a 50MP main camera

This will be a mid-range phone, but it will still have rather interesting specs. We know that because some of them leaked before. The Moto G54 is tipped to feature a 6.5-inch fullHD+ display. That panel will offer a 120Hz refresh rate.

A 5,000mAh battery was also mentioned, as was a side-facing fingerprint scanner. Android 13 will come pre-installed on this smartphone, that’s for sure.

A 50-megapixel main camera was also mentioned in rumors, and it will offer OIS support. The last piece of information we have is that the device will include stereo speakers.

Its price tag is still a mystery, but it is expected to arrive in the near future. The Motorola Moto G53 arrived in December, but considering the timing of these rumors, the Moto G54 may launch sooner than that. We’ll have to wait and see.

[ad_2]
Source link

How using the purple team approach helps in addressing cybercrime

Cyber Attacks

andreasc

-

August 20, 2023

0

How using the purple team approach helps in addressing cybercrime

[ad_1]

Automated purple teaming is one of the best ways to address cybercrime as it does not only test for the deficiencies in existing security controls – Let’s dig deeper into this approach.

An IBM report reveals that the cost of data breaches has reached record highs over the past year. The banking industry has also seen an exponential rise in ransomware attacks, with one study indicating that banks have seen a 1,318 percent increase in ransomware attacks in 2021. Cyber attacks are on the rise, and it is only logical to respond to them by fortifying defenses.

Cyber defense fortification is not just about having the best security controls, though. Even with the most advanced security tech, bad actors can still find their way into networks or IT assets if they manage to find vulnerabilities they can exploit. Hence, organizations should consider security validation as a critical part of their security posture.

SEE: Google, Microsoft, and Oracle generated most vulnerabilities in 2021

One of the best ways to undertake security validation at present is purple teaming, an approach that entails the collaboration between the red (attack) and blue (defense) teams while still keeping them independent from each other. It significantly strengthens cyber defenses by taking advantage of the adversarial perspective in examining vulnerabilities and anticipating potential attacks.

In turn, purple teaming can serve an important role in addressing cybercrime. If this does not sound convincing enough, consider the following points.

Threshing out security weaknesses

Security validation is not just some supplementary security process implemented by organizations. It is crucial because it ascertains that the security controls put in place are functionally sound and capable of delivering the kind of protection expected from them. Testing security controls optimize an organization’s security posture by spotting defects or weaknesses promptly and addressing them accordingly.

Given the massive volumes of attacks, though, it is impossible to keep up with the attempts to penetrate cyber defenses using manual security testing. Also, with the increasing sophistication of attacks, it is usually not enough for organizations to rely on their in-house cybersecurity teams. They need an adversarial perspective as well as a more efficient way to detect and deal with the attacks. This is where advanced automated purple team simulation comes in.

Automated purple teaming is one of the best ways to address cybercrime as it does not only test for the deficiencies in existing security controls. It also helps in the evaluation of variations of threats and lateral attacks that may defeat defenses unexpectedly. With the help of up-to-date threat intelligence and a standardized collaborative threat handling framework like MITRE ATTACK, organizations can achieve enhanced security strategies capable of addressing even zero-day attacks and the complex schemes of bad actors.

Purple teaming, by the way, does not mean the creation of a new team with members coming from the red and blue teams. It is mainly about sharing insights on how to improve attack and defense simulations without necessarily letting each other know what the red and blue teams are doing. Purple teaming enables collaboration to help explore scenarios that would otherwise be left unexplored when the red and blue teams are virtually working in silos.

Countering the commonplaceness of vulnerable software

A survey report entitled Modern Application Development Security reveals that nearly five in every ten organizations wittingly release vulnerable codes. They make available to the public software or applications that have not gone through rigorous security testing. This affects not only the software or app providers but more importantly the end-users. It means vulnerabilities that can be exploited by cybercriminals to steal data, interrupt operations, or spread malicious software.

This tendency to push vulnerable software happens mainly because of very strict deadlines imposed on app developers. There are also instances when developers just do not have enough time to address security problems because the vulnerabilities have been discovered too late.

Purple teaming provides a good solution for this common problem by helping organizations undertake thorough evaluations of the security of the applications they are using. Companies can employ purple teaming to scrutinize their systems and discover various weaknesses in their software, including web applications, that have the potential to become serious cybersecurity incidents.

Purple teaming on web app use is a boon to many businesses that are now relying on online services or web-based platforms instead of using conventional client-based apps. Web apps are favorite targets for many cybercriminals because they can find various useful data that are often kept online for convenient access. Also, cyber attackers understand that they can “achieve better outcomes” if they manage to paralyze business operations after disrupting an organization’s core web apps.

Also worth noting, the OWASP Top 10 has been updated to reflect the growing seriousness of software security issues. Broken Access Control now tops the list in view of the increasing instances of Common Weakness Enumerations (CWEs) observed among web apps. This entails that organizations need to pay more attention to the security of the web applications they are using.

In a way, purple teaming can plug security issues that have been left unaddressed by the software developers. Organizations may not be able to plug these security gaps by modifying the app codes, but they can institute changes or new measures to prevent software vulnerabilities from contaminating the rest of their system and IT assets.

Addressing the human error factor

One IBM study says that human error is the leading cyber threat to businesses in 2021. These errors can be attributed to carelessness, switching to new arrangements that affect the cybersecurity posture, configuration errors, and the failure or refusal to update among others.

As fraud prevention tech expert Mus Huseyin declares, “Corporates seeking to protect digital assets must face an uncomfortable truth: the biggest threat to cybersecurity lies within the company.” Security technologies have continued improving significantly, but it appears the human problem in cybersecurity has remained largely the same over the years.

This is why there are still many cases of successful attacks that take advantage of human error. A VentureBeat report says phishing attacks on banking customers have risen by 30 percent in 2020. There are also reports that show dramatic increases in human hacking attacks across different digital channels. Social engineering attacks continue to be a critical threat to all kinds of organizations because of the human error factor.

SEE: OpenSea vulnerability allowed crypto stealing with malicious NFTs

Purple teaming is an effective way to address human errors in cybersecurity. By bringing together the adversarial perspective and expertise of cyber defense professionals, it becomes easier to detect and eliminate potential vulnerabilities in systems that are linked to human errors. Mistakes in configurations, problematic threat handling protocols, protocols that allow employees to ignore security procedures, and other similar weaknesses can be detected and addressed through purple teaming.

Cybercrime prevention and impact mitigation

Prevention is always better than cure, and this is what purple teaming does as it examines the effectiveness of security controls in catching and stopping cyber attacks. What makes purple teaming even better is that it can also help with mitigation. The purple team modules in automated cybersecurity platforms, for example, are designed to provide quick options on how to deal with detected threats or attacks.

Cybercrimes succeed because of poor cyber defenses. To strengthen these defenses, organizations should deem security validation particularly through purple teaming as something essential for their security posture.

Did you enjoy reading this article? Like our page on Facebook and follow us on Twitter.

[ad_2]
Source link