By Waqas
Ilya Sachkov was accused of treason by Russian authorities for providing classified cybersecurity data to a foreign intelligence firm.
This is a post from HackRead.com Read the original post: Group-IB Founder Ilya Sachkov Jailed for 14 Years in Russia

****Despite the charges, Ilya Sachkov pleaded not guilty to all accusations, while Group-IB expressed their disappointment over the trial, describing it as “an unreasonably rushed trial that was held entirely behind closed doors.”****

Ilya Sachkov, a renowned cybersecurity expert and founder of Group-IB, a Singapore-based cybersecurity firm, has been convicted of treason and sentenced to 14 years in prison by the Russian government.

The verdict, **reported** by the Russian news agency TASS, has sent ripples through the cybersecurity community, raising concerns about the challenges faced by independent cybersecurity firms.

Ilya Sachkov (Image credit: Group-IB)

Group-IB, once a Russian cybersecurity company, had exited from Russia in April 2023, leaving Sachkov no longer associated with the Singaporean branch. However, it is crucial to note that he still retains ownership of shares in its Russia-based operation.

Sachkov, known for his remarkable contributions to the industry and efforts in combatting cyber threats, had previously received awards from Russian President Vladimir Putin for his outstanding work in 2019. Nevertheless, **in September 2021**, he was detained by the Russian Federal Security Service on treason charges.

The allegations centered around accusations of providing the U.S. government with classified cybersecurity data and sensitive information about the notorious “Fancy Bear” hackers, believed to have influenced the 2016 United States presidential election. Despite the charges, Ilya Sachkov **pleaded not guilty** to all accusations.

The verdict has drawn significant attention, with Group-IB expressing their disappointment over the trial, **describing it** as “an unreasonably rushed trial that was held entirely behind closed doors.” The lack of transparency in such a high-profile case has raised concerns about the fairness of the judicial process.

This event highlights the challenges faced by cybersecurity firms globally, striving to operate independently and provide valuable insights to safeguard against cyber threats. **Group-IB itself recently revealed** that it had become a prime target of Chinese hackers, underscoring the growing concern of state-backed actors limiting the freedom of information security research.

The case is reminiscent of previous incidents in other countries where cybersecurity experts have faced legal repercussions for their efforts to protect digital infrastructure. In Hungary, an ethical hacker and computer specialist **was accused** of infiltrating a leading telecom firm’s database, Magyar Telekom, while attempting to report security vulnerabilities. Such actions emphasize the delicate balance between recognizing ethical hackers’ vital role and ensuring compliance with legal frameworks.

Similarly, in the United States, cybersecurity company Kaspersky, with its Russian roots, has encountered resistance from both the government and military establishment. In March 2022, the company was **added to the list of firms** deemed threats to the national security of the United States.

As the global cybersecurity landscape evolves, the case of Ilya Sachkov and Group-IB serves as a reminder of the challenges faced by cybersecurity experts and firms in their pursuit of securing digital spaces while navigating complex geopolitical landscapes.

The verdict raises questions about the future of independent cybersecurity research and the delicate relationship between infosec professionals and governments worldwide.

**RELATED ARTICLES**

1.  Legendary Hacker Kevin Mitnick Passes Away
2.  Kaspersky Willing to Share Its Source Code with US Govt
3.  German Authorities Warn Against Using Kaspersky Products

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Group-IB Founder Ilya Sachkov Jailed for 14 Years in Russia

By Owais Sultan
Are you considering developing a Java web application? While you may have the skills to do it yourself,…
This is a post from HackRead.com Read the original post: Benefits of hiring a Java web application development company

Are you considering developing a Java web application? While you may have the skills to do it yourself, have you considered the benefits of hiring a professional Java web application development company?

Java is one of the most widely used programming languages for web application development. Developing a high-quality, efficient, and secure Java web application requires expertise and knowledge of the latest technologies and best practices. Hiring a professional Java web application development company can ensure that your project is completed successfully and meets your specific requirements.

In today’s competitive digital landscape, having a well-designed and functional web application is crucial for the success of your business. Hiring a Java web application development company can provide you with numerous benefits, including access to a team of experienced developers, cost and time efficiency, and the ability to focus on your core business activities.

In this article, we will explore the various advantages of hiring a Java web application development company and how it can contribute to the growth and success of your business. Are you interested in web development and looking to expand your programming skills?

If so, then learning Java web application development might be the next step for you. Java is a versatile programming language that is widely used for building robust and scalable web applications. In this article, we will provide an introduction to Java web application development and guide you on how to get started in this exciting field.

*   **Understand the Basics of Java**

Before diving into web application development, it is essential to have a solid understanding of the Java programming language. Familiarize yourself with the syntax, data types, control structures, and object-oriented programming concepts. There are numerous online tutorials, courses, and books available that can help you learn the fundamentals of Java.

*   **Learn Java Servlets and JavaServer Pages (JSP)**

Java Servlets and JSP are the building blocks of Java web applications. Servlets are Java classes that handle HTTP requests and generate responses, while JSP allows you to create dynamic web pages by embedding Java code within HTML. Mastering these technologies will enable you to create interactive and dynamic web applications.

*   **Choose a Development Framework**

To streamline the development process and enhance productivity, it is recommended to use a Java web development framework. Some popular frameworks include Spring MVC, JavaServer Faces (JSF), and Apache Struts. These frameworks provide a set of libraries, tools, and best practices that simplify web application development and promote code reusability.

*   **Set Up a Development Environment**

To start building Java web applications, you need to set up a development environment. Install Java Development Kit (JDK) and an Integrated Development Environment (IDE) such as Eclipse, IntelliJ IDEA, or NetBeans. These tools provide a user-friendly interface, code editor, and debugging features that facilitate the development process.

In today’s digital age, security is of utmost importance, especially when it comes to web applications. With the increasing number of cyber threats and data breaches, implementing secure authentication and authorization in Java web applications has become a necessity. This article will guide you through the steps to ensure that your Java web application is protected and only accessible to authorized users.

**Understand the Basics of Authentication and Authorization.** Authentication is the process of verifying the identity of a user, while authorization determines what actions and resources a user is allowed to access. It is crucial to have a clear understanding of these concepts before implementing security measures in your Java for web development. 

**Use a Secure Password Storage Mechanism.** One of the most common security vulnerabilities is storing passwords in plain text. Instead, use a secure password storage mechanism, such as hashing algorithms like bcrypt or PBKDF2, to store passwords securely. These algorithms convert passwords into irreversible hashes, making it difficult for attackers to retrieve the original password.

**Implement Two-Factor Authentication (2FA).** Two-factor authentication adds an extra layer of security by requiring users to provide two separate forms of identification, typically a password and a one-time code sent to their mobile device. Implementing 2FA can significantly enhance the security of your Java web application and protect against unauthorized access.

Benefits of hiring a Java web application development company

By Waqas
Why Coding for Kids is Vital – Importance & Benefits Explained! In an era dominated by rapid technological…
This is a post from HackRead.com Read the original post: Empowering Future Minds: The Indispensable Role of Coding for Kids

**Why Coding for Kids is Vital – Importance & Benefits Explained!**

In an era dominated by **rapid technological advancements**, the clamour for equipping the next generation with essential skills is louder than ever. Amidst this digital renaissance, an educational revolution is taking place, with an increasing number of voices advocating for coding to be an integral part of every child’s learning journey.

As we delve deeper into the importance of coding for kids, it becomes evident that this skill is not just about programming computers; it’s about empowering young minds to conquer the challenges of tomorrow.

**Fostering Creativity and Problem-Solving Skills**

Coding, at its core, is a language of innovation. It encourages creativity, turning abstract ideas into concrete reality. By introducing kids to coding at an early age, we provide them with a unique medium to express their creativity, instilling the confidence to tackle problems head-on.

Coding is essentially problem-solving in action, and learning to code equips children with the tools to break down complex issues into manageable parts, thereby honing their critical thinking skills.

Presently, numerous websites and applications offer block-based coding lessons to kids and teenagers. Popular platforms like Thunkable and **code.org** provide tailored learning experiences, allowing you to select the most suitable resource for your needs.

**Building Resilience and Perseverance**

Coding is a process riddled with trial and error, where even the most seasoned programmers face challenges and setbacks. Teaching children to code instils resilience and perseverance in the face of adversity. As they debug errors and refine their code, they learn that failure is merely a stepping stone towards success. This invaluable lesson equips them with the mental fortitude needed to embrace challenges in any area of life.

**Enhancing Computational Thinking**

**According to** ISTE, Computational thinking is the bedrock of coding, encompassing problem decomposition, pattern recognition, abstraction, and algorithm design. When kids learn to code, they unknowingly develop and enhance their computational thinking skills. This type of thinking goes beyond coding and permeates other subjects and real-life scenarios. From mathematics to science to everyday decision-making, the ability to think computationally empowers kids to approach problems systematically and efficiently.

**Future-Proofing Career Prospects**

The job market is evolving at breakneck speed, and technology continues to disrupt traditional industries. By introducing coding into the educational landscape, we equip children with the tools to navigate the shifting job market of the future. Whether they end up as software engineers or not, the understanding of coding opens doors to a myriad of opportunities across various sectors, where digital literacy is increasingly becoming a prerequisite.

**Fostering Collaboration and Communication**

In the digital age, collaboration and communication have transcended geographical boundaries. Coding encourages teamwork, as young coders often collaborate on projects, sharing ideas and learning from one another.

Moreover, coding necessitates clear communication, as coding concepts are often conveyed through written code and explanations. These vital soft skills not only aid children in their academic endeavours but also prepare them for the interconnected global workplace.

Incorporating coding into the curriculum promotes inclusivity and diversity within the tech industry. By introducing children from all backgrounds to coding, we break down barriers and encourage participation from underrepresented groups. The more diverse the minds involved in coding, the more innovative and inclusive the solutions created will be.

In conclusion, teaching kids to code is not about creating an army of programmers, but rather about empowering them with essential skills that will serve them in any path they choose. Coding fosters creativity, problem-solving abilities, computational thinking, and collaboration – attributes that will shape these young minds into the innovators, leaders, and change-makers of tomorrow.

As educators, parents, and society as a whole, it is our collective responsibility to ensure that coding takes its rightful place in the realm of education, unlocking the full potential of future generations.

If you’re a beginner wondering **how to start coding**, there are numerous resources that can guide you through the process, suitable for all ages, not just children and teenagers. It’s essential to start with understanding the basic concepts and gradually progresses to more advanced topics. In doing so, you can build a solid foundation in coding, making it easier to pick up different programming languages and techniques in the future.

**RELATED ARTICLES**

1.  How Internet can get smarter by combining AI and ML
2.  What Programming Languages Do Ethical Hackers Use?
3.  How to Develop Complex Marketing Op with “No Code” Tools
4.  How to Teach Your Child Coding: A Gift for Their Digital Future

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Empowering Future Minds: The Indispensable Role of Coding for Kids

By Waqas
FraudGPT: Yet Another AI-Driven Chatbot Assisting Cybercriminals in Malicious Activities.
This is a post from HackRead.com Read the original post: Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime

FraudGPT is up for sale on Dark Web marketplaces apart from Telegram at a starting price of $200 per month and up to $1,700 for an annual subscription.

Recently Hackread shared **details** of a malicious chatbot, WormGPT, created to help cybercriminals carry out illegal activities. Now, another chatbot has emerged on the Dark Web called FraudGPT. It is a subscription-based, AI-driven chatbot that can perform various functions for cybercriminals to help them successfully launch phishing campaigns and scams.

Regenerative AI models have dramatically changed cyberspace, with one after another chatbot surfacing on the web. It was, therefore, impossible for threat actors to ignore their rising popularity and extensive reach. That’s why we keep hearing about **fake versions of ChatGPT**, and now cybercriminals prefer generative AI jailbreaking for creating malicious chatbots to cause further devastation.

According to a **blog post** from Netenrich’s threat researchers, authored by Rakesh Krishnan and published on 25 July 2023, FraudGPT surfaced on Telegram Channels on 22 July 2023. FraudGPT is a malicious AI bot crafted to facilitate spear phishing emails, create cracking tools, and carding.

In addition, it can assist attackers in writing enticing emails to trap targets. Moreover, FraudGPT is efficient enough to select the best services or sites to target and defraud users. Here’s a breakdown of its key features.

*   Assisting in hacking
*   Locating carding sites
*   Writing malicious code and scam letters or pages
*   Creating undetectable malware, phishing pages, and hacking tools
*   Finding targetable sites/pages/groups, vulnerabilities, leaks, and non-VBV bins

FraudGPT is up for sale on Dark Web marketplaces apart from Telegram at a starting price of $200 per month and up to $1,700 for an annual subscription. FraudGPT creator claims to have secured 3000 sales and reviews for the chatbot.

It is worth noting that the creator is new on Telegram. Reportedly, the threat actor created their Telegram channel on 23 June and launched the malicious chatbot later. The actor is a verified vendor on numerous underground dark web marketplaces, including WHM, Empire, AlphaBay, World, Versus, and Torrez.

Given the ease with which these platforms get scammed, the FraudGPT creator is looking for a seamless revenue stream through Telegram. The creator is registered on a Dark Web form with a Gmail email address.

The emergence of malicious chatbots like FraudGPT and WormGPT is a concerning sign. Cybercriminals can now use AI for their nefarious objectives and ensure a higher success margin for **phishing scams**. These tools can help attackers generate malicious texts and lure targets to BEC or many other email-based attacks.

**RELATED ARTICLES**

1.  DarkBERT: Enhancing Cybersecurity Efforts on the Dark Web
2.  100,000 Hacked ChatGPT Accounts Discovered on Dark Web
3.  Researcher create polymorphic Blackmamba malware with ChatGPT

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime

By Waqas
The hackers have leaked almost 1 GB worth of data, which contains documents, presentations, and contact details of over 70 NATO officials.
This is a post from HackRead.com Read the original post: SiegedSec Hacktivist Claims to Strike NATO and Leak Sensitive Docs

On its Telegram channel, the SiegedSec group claimed that its NATO hack has nothing to do with the war between Russia and Ukraine, and it is merely highlighting human rights abuses by NATO.

The hacktivist group “SiegedSec” has launched a cyber attack on NATO, claiming to compromise its COI portal and subsequently leaking hundreds of sensitive documents intended for NATO countries and partners. The data also contains full names, email addresses, phone numbers, office addresses, and ranks of at least 70 NATO officials.

This latest attack showcases the group’s increasing aggression and proficiency in breaching high-profile targets.

SiegedSec has emerged as a significant cyber threat, driven by a blend of hacktivism and personal gain, aiming to draw attention to its causes and also to exploit the momentum of offensive cyber operations for its own sinister objectives.

The motive behind the NATO hack, as claimed by SiegedSec, is the alleged infringement on human rights by NATO. While some may draw connections to Russia’s invasion of Ukraine and the subsequent rise of such threat groups, SiegedSec asserts that its attack on NATO is an act of retaliation against the countries of NATO for what they perceive as attacks on human rights.

Cyberint, a renowned cybersecurity research firm, has been closely monitoring SiegedSec’s activities and shared an exclusive report with Hackead.com detailing the group’s modus operandi. The group uses the Anonymous movement to carry out its attack, often referred to as a specialized “special forces unit” within the hacktivist landscape.

The alleged attack on NATO’s COI portal signifies a disturbing escalation in SiegedSec’s tactics. Their strategy often involves stealing and leaking sensitive information from well-known and popular companies or organizations to garner attention and gain free publicity. This tactic has proved effective in the past, evident from their high-profile campaign against Atlassian earlier this year.

Although NATO officials are yet to confirm the data breach, the leaked documents are said to contain information of critical importance to NATO countries and partners, raising concerns about potential security implications.

Screenshot from the leaked data (Image credit: Hackread.com)

This is not the first time that NATO has been targeted by hackers. Earlier in April this year, the pro-Russian hacktivist group Killnet claims it carried out cyberattacks that resulted in the “paralysis” of 40% of NATO’s electronic infrastructure.

KillNet hackers also claimed that it targeted NATO with DDoS attacks, stole plain-text login credentials and used them **to create accounts on a gay dating portal** in Kyiv and Moldova.

**RELATED ARTICLES**

1.  NATO Data Stolen in Cyberattack on Portugal’s Armed Forces
2.  NATO Probes Hackers Selling Data from Top Missile Firm MBDA
3.  Authentication bypass flaw found in NATO, EU-approved firewall
4.  Smartphones of NATO Soldiers Compromised By Russian Hackers
5.  RomCom RAT Hits Pro-Ukraine Guests at Upcoming NATO Summit

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

SiegedSec Hacktivist Claims to Strike NATO and Leak Sensitive Docs

By Waqas
Stellar Cyber, a cybersecurity company that specializes in providing an Open XDR (Extended Detection and Response) platform, has…
This is a post from HackRead.com Read the original post: Groundbreaking Integration: Stellar Cyber Safeguards OT Environments Alongside IT

Stellar Cyber, a cybersecurity company that specializes in providing an Open XDR (Extended Detection and Response) platform, has **revealed** that its Open XDR Platform users can now safeguard their Operational Technology (OT) environments seamlessly alongside their IT environments, all under a single unified platform and license.

This integration empowers security teams to counter IT and OT breaches from a unified front, even without specialized expertise in OT security.

For your information, Stellar Cyber recently made headlines as one of the “10 Hot XDR Security Companies You Should Watch In 2023” by CRN Magazine,

In the current landscape, cyberattacks targeting OT environments have become increasingly prevalent, with recent studies indicating that over 90% of manufacturers experienced production or energy supply disruptions due to cyber intrusions in 2021.

The recent Proof of Concept (PoC) **released** by researchers sheds light on the threat against OT networks, exposing how threat actors can compromise IoT devices to install ransomware on OT Networks. Despite the escalating danger, many security vendors have struggled to offer accessible and efficient OT security solutions.

Sam Jones, the Vice President of Product Management at Stellar Cyber, remarked on their pioneering approach, stating, “With our open data architecture and integrated network security (NDR) capabilities, we can now detect the most common OT environment cyber-attacks without burdening the security team to create OT-specific detection content.”

One of the primary challenges in securing OT environments lies in their unique deployment models, which depend on their individual OT architecture. However, Stellar Cyber’s agentless deployment strategy, combined with a strategic partnership with Garland Technology, a leading network visibility products provider, has facilitated the seamless integration of OT environment assets into the platform.

Stellar Cyber’s Open XDR Platform now equips security teams with the ability to automatically detect a wide range of threats, including various **SCADA protocols**, SCADA network segmentation violations, network attacks, suspicious file transfers, anomalous communication, and IT-to-OT breaches.

Several existing Stellar Cyber customers have already begun incorporating their OT environment assets into the platform, reaping unprecedented insights into the threats targeting their OT infrastructure. A SOC manager for a mid-sized manufacturing organization attested to the benefits, saying,

“Securing my OT environment seemed unrealistic given my resources and budget, but now that I can use the Stellar Cyber Platform for both my IT and OT environments, my security team is delivering better security outcomes across the entire organization, protecting our bottom line.”

Changming Liu, the CEO of Stellar Cyber, emphasized the democratizing impact of their solution, asserting, “Securing an OT environment should not be exclusively available to organizations that have embedded OT expertise in their security teams. With our platform, all customers can now reduce the risk of a widespread breach that might bring the shop floor, a utility turbine, or a critical manufacturing line offline.”

**In August 2022**, a significant development occurred as Barmak Meftah, an influential figure in the industry, joined Stellar Cyber, the innovative provider of Open XDR solutions, as a Board Advisor. The following year, in a strategic move, the company introduced the **InterSTELLAR Partner Program**, targeting resellers of their cutting-edge Open XDR platform. This program aims to empower resellers with advanced solutions to meet the evolving cybersecurity needs of their clients.

**RELATED ARTICLES**

1.  Will a Labeling System Solve IoT Security Challenges?
2.  Vulnerabilities in ICS Lets Attackers Remotely Unlock Doors
3.  Controller-level flaws let hackers physically damage moving bridges
4.  Power Grids to Airports: TETRA Radio Hacking Risks Global Infrastructure

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Groundbreaking Integration: Stellar Cyber Safeguards OT Environments Alongside IT

By Deeba Ahmed
Researchers at the AI-powered Security solutions provider, FortiGuard Labs, have been monitoring Microsoft Message Queuing (MSMQ) service for…
This is a post from HackRead.com Read the original post: Critical Flaws Exposed Microsoft Message Queuing Service to DoS Attacks

Researchers at the AI-powered Security solutions provider, FortiGuard Labs, have been monitoring Microsoft Message Queuing (MSMQ) service for the past few months. In an exclusive research report shared with Hackread.com, the company revealed details of multiple security vulnerabilities in the widely used message queuing service.

The vulnerabilities allow remote code execution and denial of service attacks (DoS attacks), mainly impacting Windows-based devices with MSMQ installed.

**Vulnerabilities Details**

FortiGuard Lab’s research report, authored by Wayne Low and published on July 24, 2023, explains that the vulnerabilities have been categorized as critical. The details of each flaw are as follows:

The flaw allows out-of-bounds read because of not validating some critical functions, including EodHeader, StreamIdSize, and OrderQueueSize before they are accessed in the message header parser routine (CQmPacket::CQmPacket). 

Researchers agree that this information disclosure exploit is implausible, but attackers can easily achieve a denial of service attack if the out-of-bound read accesses an invalid address. FortiGuard Labs released the MS.Windows.Message.Queuing.Service.CVE-2023-28302.DoS signature to detect this flaw.

When the message header parser CQmPacket::CQmPacket doesn’t validate a message header with an arbitrary size, out-of-bound write occurs.

Further probing revealed that some message headers, for instance, EodHeader, EodAckHeader, and CompoundMessageHeader  EodHeader, EodAckHeader, and CompoundMessageHeader, let attackers specify an improperly sanitized arbitrary size/length if the message header parser (that typically adjusts the pointer per each header’s pre-defined data structures) gets adjusted to point to an arbitrary location.

This would be an invalid address and can cause memory corruption if the message header gets dereferenced later in the code. To detect this issue, FortiGuard Labs released the IPS signature MS.Windows.MSMQ.CVE-2023-21554.Remote.Code.Execution.

This issue occurs due to a manual code audit when the CompoundMessage header fails to run a sanity check on its data structure.

**What is MSMQ?**

MSMQ is a standalone Windows server hosted under MQSVC.EXE. Microsoft developed this proprietary messaging protocol much on the lines of the open-source RabitMQ so that applications running on different computers can communicate in a failsafe manner.

Messages that cannot reach their destination are placed in a queue and are resent when the destination is reachable. Typical MSMQ packet includes headers like BaseHeader, UserHeader, and MessagePropertiesHeader and may also include TransactionHeader, SecurityHeader, DebugHeader, and SessionHeader.

Fortinet urges customers to immediately identify network assets vulnerable to the abovementioned vulnerabilities and apply patches. The company notified Microsoft about these issues as part of responsible disclosure practice. Microsoft promptly released patches in April and July 2023 security updates.

**RELATED ARTICLES**

1.  Check Point: Microsoft the Most Phished Brand in Q2 2023
2.  Microsoft Discloses DDoS Attack Impact with Limited Details
3.  Microsoft Teams Flaw Sends Malware to Employees’ Inboxes
4.  Microsoft sued for alleged misuse of stolen Dark Web credentials
5.  New Phishing Attack Spoofs Microsoft 365 Authentication System

Critical Flaws Exposed Microsoft Message Queuing Service to DoS Attacks

By Waqas
These vulnerabilities have been dubbed TETRA:BURST by researchers.
This is a post from HackRead.com Read the original post: From Power Grids to Airports: TETRA Radio Hacking Risks Global Infrastructure

The TETRA vulnerabilities have been identified by Dutch cybersecurity researchers, who plan to reveal more information at the upcoming Black Hat USA 2023.

Dutch cybersecurity researchers have discovered significant vulnerabilities in the widely used TETRA radio technology, raising concerns about the safety of critical infrastructure worldwide – These vulnerabilities have been dubbed TETRA:BURST by researchers.

**TETRA**, or Terrestrial Trunked Radio, employed to control essential systems like power grids, gas pipelines, and trains, has been found to possess a deliberate backdoor in its encryption algorithm, allowing for relatively easy hacking.

The team at cybersecurity firm Midnight Blue, consisting of Job Wetzels, Carlo Meijer, and Wouter Bokslag, made this alarming discovery and alerted relevant authorities. Despite efforts to raise awareness, many critical infrastructure entities remain unresponsive to the risks posed by these vulnerabilities.

**The Vulnerabilities:**

Researchers from **Midnight Blue** identified a backdoor in the encryption algorithm of TETRA radios, which are manufactured by companies such as Motorola, Damm, and Hytera. The intentional vulnerability, easy to exploit, allows attackers to compromise the network and execute malicious commands. These attacks can disrupt critical infrastructure operations and even enable unauthorized access to emergency services, posing a grave threat to public safety.

**Global Impact:**

TETRA technology is widely used across the world, controlling vital infrastructure in more than 120 countries. For instance, in the Netherlands, the port of Rotterdam, public transport companies, most airports, and the C2000 communication system utilized by the police, fire brigade, ambulance services, and parts of the Ministry of Defence rely on TETRA.

Additionally, many critical infrastructure authorities in Germany, France, Spain, and various European countries, as well as several equivalent entities in the USA, depend on this radio technology.

**Ease of Hacking:**

The most concerning aspect of these vulnerabilities is how accessible they are to potential hackers. According to Midnight Blue, even individuals without extensive hacking expertise can infiltrate the TETRA network in under a minute using simple hardware. Once inside, attackers can execute malicious commands on critical infrastructure systems without detection, leading to severe consequences.

**Efforts to Address the Issue:**

**According to** local Dutch media, the researchers responsible for uncovering these vulnerabilities immediately reported their findings to the Dutch National Cyber Security Centre (NCSC) in 2021. Over the past two years, the NCSC has diligently informed governments in various countries about the risks posed by TETRA’s loopholes.

Furthermore, the Midnight Blue team took the initiative to notify manufacturers and users of the technology, aiming to increase awareness and encourage mitigation efforts.

**The Call for Action:**

As the information about the TETRA backdoor vulnerabilities becomes public, Midnight Blue warns all users of radio technologies to contact their manufacturers and assess if their devices employ TETRA. Understanding the potential risks and seeking available fixes or mitigations is crucial in safeguarding critical infrastructure from potential attacks.

**More At Black Hat USA 2023**

The Midnight Blue team plans to unveil more information about the backdoor at the **“Redacted Telecom Talk**“ session during the Black Hat Security Conference (Black Hat USA 2023), which is scheduled to take place from Saturday, August 5, 2023, to Thursday, August 10, 2023, at the Mandalay Bay Convention Center in Las Vegas, Nevada.

The complete information on the Midnight Blue team’s upcoming presentations and conferences is available on the **TETRA:BURST website**, which is dedicated to addressing the TETRA vulnerabilities.

**Takeaway:**

The discovery of deliberate vulnerabilities in TETRA radio technology has raised alarm bells among cybersecurity experts and governments worldwide. The risks posed by these backdoors are substantial, with the potential to disrupt critical infrastructure and compromise public safety.

While efforts have been made to address the issue, the lack of response from some critical infrastructure companies remains a cause for concern. As the world becomes increasingly reliant on advanced technologies, the need to prioritize cybersecurity and address potential vulnerabilities becomes more critical than ever.

**RELATED ARTICLES**

1.  White Hat Hacker at DefCon Jaikbreaks Tractor to Play Doom
2.  Hackers can take control of emergency alarm with a $35 radio
3.  Defcon: 11-year-old modifies Florida Presidential voting results
4.  7 Unexpected Hacks of 2015, Thanks To DefCon and Black Hat

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

From Power Grids to Airports: TETRA Radio Hacking Risks Global Infrastructure

By Deeba Ahmed
The Cl0p Ransomware Gang has begun its clearweb journey by leaking data stolen from PWC.com.
This is a post from HackRead.com Read the original post: Cl0p Ransomware Gang Leaks MOVEit Data on Clearweb Sites

At the time of writing, the clearweb domain of the Cl0p Ransomware Gang was offline; however, the gang’s entry to the clearweb reveals upcoming cybersecurity threats intended for their victims.

The Cl0p ransomware gang is among the cybercrime syndicates that have exploited the MOVEit vulnerability more extensively than any other. To exacerbate the situation, the ransomware gang is now leaking the data it stole through the MOVEit vulnerability on its clearweb domain.

According to security researcher Dominic Alvieri, the Cl0p ransomware gang is leaking the data they stole from the MOVEit Transfer platform in May on the publicly accessible website. The gang exploited a zero-day vulnerability in the secure file transfer platform, leading to a data breach that drastically impacted hundreds of businesses and government institutions worldwide. 

Cl0p has dumped the data as large downloadable files instead of opting for specific searchable items and didn’t host the site on the Tor network, as has been the case in many previous data leaks.

Screenshot from Cl0p’s dark web domain (Image credit: Hackread.com)

**What is the difference between Clearweb and Dark Web**

The Clearweb, also known as the Surface Web or Visible Web, refers to the part of the internet that is easily accessible and indexed by search engines like Google. It includes websites and web pages that can be accessed through standard web browsers without requiring any special configurations.

On the other hand, the Dark Web is a portion of the internet that is intentionally hidden and not indexed by traditional search engines. Accessing the Dark Web requires specialized software, such as the Tor browser, which provides anonymity and encryption.

This anonymity allows users to access hidden websites that use “.onion” domains. The Dark Web is often associated with illicit activities, illegal marketplaces, and anonymous forums where users can communicate without revealing their identities.

It is worth noting that Cl0p has recently developed this tactic to blackmail their victims where the gang creates Clearnet websites hosted on the surface web to leak stolen data. They first tried this tactic to leak data stolen from the PWC business consulting firm, which was uploaded in four spanned ZIP archives. Later Cl0p used the same tactic for leaking data from TD Ameritrade, Aon, Kirkland, and Ernest & Young.

Screenshot from Cl0p’s clearweb domain (Image credit: Hackread.com)

Perhaps, the Cl0p ransomware gang believes it to be a more effective method for extorting victims (even though such websites get quickly removed). Leaking data on Tor-hosted darknet platforms has lost the charm given their restricted reach.

Although Tor offers anonymity, not all users can access the sites without a specialized browser, whereas, on the surface web, anyone having the website link can download the stolen data.

Another reason is that search engines don’t index darknet content, so, download speed is usually pretty slow, whereas, on Clearweb, the site gets indexed, and downloading is quicker. Nonetheless, this tactic is more detrimental for the victims as they become vulnerable to harassment and online scams from all fronts.

Cl0p is among the most notorious hacking gangs currently having successfully targeted high-profile firms and extracted millions of dollars in ransom. Per Coveware’s latest report, the gang has raked in $75-$100 million from their latest MOVEit attacks. Coveware CEO Bill Siegel noted that only a handful of Cl0p’s victims generally give in to their demands.

Therefore, the hackers are using different extortion strategies. Siegel also noted that MOVEit attacks have proven far more successful than GoAnywhere data theft, where the hackers could breach 130 victims and didn’t receive their desired ransom as well.

As expected, all Clearweb extortion sites created by the Cl0p ransomware gang have been taken offline, proving the short-lived nature of this method. Security researchers highlighted that Cl0p’s latest site lacks the sophistication seen in the approach used by the rival ALPHV ransomware gang, aka BlackCat, which introduced this method to pressurize their victims more profoundly.

**RELATED ARTICLES**

1.  Big Head Ransomware Found in Fake Windows Updates
2.  LockBit Ransomware Expands Attack Spectrum to Mac Devices
3.  Genesis Market’s Clearnet domain seized; Dark Web site still online

Cl0p Ransomware Gang Leaks MOVEit Data on Clearweb Sites

By Habiba Rashid
The cyberattack was discovered earlier this month.
This is a post from HackRead.com Read the original post: Norway Probes Major Cyberattack on 12 Government Ministries

According to local media, the cyberattack on the Norwegian ministries was made possible after unknown attackers exploited a new patch 0-day vulnerability.

Norwegian authorities are currently conducting a thorough investigation into a large-scale cyberattack that has targeted twelve government ministries. The attack, which was discovered earlier this month, has raised concerns about the nation’s cybersecurity readiness and the potential implications for sensitive government data.

Erik Hope, Director of the Norwegian ministries’ security and service organization, addressed the media during a press briefing, revealing that the attackers exploited a previously unknown vulnerability in the software of one of their suppliers.

> “We have uncovered a previously unknown vulnerability in the software of one of our suppliers,” said Hope. “This vulnerability has been exploited by an unknown actor. We have now closed this vulnerability. It is too early to say anything about who is behind it and the scale of the attack. Our investigations and the police’s investigation will be able to provide more answers.”
> 
> Erik Hope

As of now, the Norwegian Data Protection Authority has been notified to address any privacy concerns arising from the incident.

While the attack has caused disruptions in the affected ministries, the government’s core operations have remained largely unaffected. The Prime Minister’s services, defense, foreign affairs, and justice departments were shielded from the attack as they operate on separate and secure platforms.

Workers in the affected ministries have encountered challenges when trying to access standard mobile services, including email. However, officials have assured the public that essential government functions are continuing without interruption.

In a comment on the incident, Chris Hauk, consumer privacy champion at Pixel Privacy, told Hackread.com that “This incident emphasises how important it is for organisations to not only keep their own systems and software updated to plug security holes but to do regular supply chain checks to make sure all other organisations in the chain are also performing regular updates and security checks on a regular basis.”

“I do admire how the government official, Eric Hope, didn’t offer up the usual platitudes we hear after data breaches. Instead, he laid it out as “We screwed up, and now it’s fixed.” That’s refreshing,” Hauk added.

Elliott Wilkes, chief technology officer at Advanced Cyber Defence Systems (ACDS), also commented on the cyberattack stating, “While details on the latest attack are limited, it does appear that business systems like email were affected for up to a dozen government agencies in Norway. This is yet another reminder of the urgency needed to assess and mitigate security vulnerabilities in suppliers, as this attack has been attributed to a weakness in an IT supplier.”

Wilkes warned that _“_With the MOVEit attack earlier this year and countless others like the VMware attacks and SolarWinds, it is crucial that organisations regularly review the permissions and privileges granted to systems and software they use. Limiting access, relying on the principles of least privilege and just-in-time access provisioning (versus having an admin account used every day for all non-admin functions) are some of the ways businesses and government teams can mitigate risks posed by vulnerabilities in suppliers’ tools.”

Norway’s vulnerability to cyber threats has been evident in recent times. In 2020 and 2021, the Norwegian Parliament experienced cyberattacks, with some of them being attributed to Russian hackers.

Earlier this month, the Norwegian Refugee Council also reported a cyberattack targeting a database containing the personal information of project participants, adding to the growing concerns over the nation’s cybersecurity landscape.

The investigation into the current cyberattack is ongoing, and authorities are implementing additional measures to bolster their cybersecurity defences. With cyber threats on the rise globally, Norway’s authorities are treating the incident with utmost seriousness and vigilance.

As the situation unfolds, government officials and cybersecurity experts are closely monitoring the situation to ascertain the full extent of the breach and identify those responsible for the attack.

**RELATED ARTICLES**

1.  SmugX: Chinese Hackers Targeting Embassies in Europe
2.  Chinese Group Storm-0558 Hacked European Govt Emails
3.  Killnet Hits European Parliament Website with DDoS Attack

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.