By Owais Sultan
The online world has never been risk-free and in 2022 the risks posed by cybercriminals are a threat…
This is a post from HackRead.com Read the original post: 3 Simple Yet Vital Tips to Stay Safe Online

The online world has never been risk-free and in 2022 the risks posed by cybercriminals are a threat to all internet users. As scams and phishing methods become more complex there is a greater need for the individual to adopt a range of best practices to protect their personal information. 

Cybercriminals can target both individuals and businesses using a wide range of methods: malware can be activated by clicking on malicious links; personal details can be harvested simply by visiting unsecure sites. 

Whether you like to surf the internet for fun and recreation, use it as a platform for online trading, or buy a range of products and services, staying safe online should always be a priority. It is a sobering fact that thousands of pieces of malware are created every day. 

Stay safer online by following these three top tips.

**Be vigilant when trading **

Millions of people around the world now regularly trade online and increasingly that trade is in cryptocurrencies such as Bitcoin. With a wide range of cryptocurrencies now available, it is more important than ever to check that the site you trade on is secure. 

As a rule, you should only trade on sites that feature the padlock icon in their web address, such as can be seen at OKX. This padlock icon proves that the site is secure and uses SSL encryption to ensure that any financial or personal information is transmitted safely. 

It is also good practice to look at reviews from trading platforms. Customer experiences of using these sites can be a valuable source of information on the security of a platform. When trading online or undertaking any type of internet purchasing activity, it is also important to remember not to use unsecured networks.

Surfing in coffee shops and shopping malls can be an attractive proposition but should be avoided whenever any transactions are taking place; otherwise, a cybercriminal could easily pose as a contact from a website you have visited – leaving you open to phishing attacks in the future.

**Use strong passwords**

Whilst most people realize the value of having strong passwords across all the sites they use, it is still surprising how many people do not adhere to this best practice. Many consumers use the same passwords across numerous platforms and sites or use exceptionally weak passwords that can be cracked with a minimum amount of effort. 

Today, search engines can suggest strong passwords and store them securely. This method can make consumers safer online whilst also freeing the need to memorize complex passwords. Put simply, if you use weak or repetitive passwords across sites, you are making it easy for a cybercriminal to harvest your personal details or hack your accounts. 

**Stay up to date**

Another common practice that tends to be overlooked by millions of web visitors is to keep applications and devices up to date with the latest firmware. It is vitally important to check for system and firmware updates on a regular basis. Whilst many updates offer stability improvements or bug fixes, they often contain the latest security updates that keep devices and applications more secure. 

Running software or operating systems that do not have the latest patches leaves them far more vulnerable to attack, so make a point of checking for updates across your devices on a regular basis to ensure that you benefit from the latest security features. 

In summary, follow the above advice to avoid falling victim to one (or more) of the 300,000 pieces of malware that are created every day.

1.  5 Online Fraud Fighting Tips for Novices
2.  Simple Tips to Protect Yourself From Being Catfished
3.  Simple Yet Vital Crypto Security Tips for Beginners and Pros
4.  How to protect your privacy on a smartphone: 12 tips & tricks

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

3 Simple Yet Vital Tips to Stay Safe Online

By Waqas
The most prominent CMS today is WordPress which is being used by over 455 million across the globe.
This is a post from HackRead.com Read the original post: Step-by-Step Security Guide for WordPress

As the internet becomes increasingly integral to daily life, website security is more important than ever. Hackers can gain access to sensitive information, like credit card numbers and social security numbers, through websites with weak security. This can lead to identity theft and financial fraud.

Your website’s CMS (content management system) works as the backbone of your entire setup. The most prominent CMS today is WordPress which is being used by over 455 million across the globe. Naturally, WordPress is a lucrative target for cybercriminals and highlights the fact why WordPress security should never be ignored.

WordPress or another other CMS, while 100% security may be a myth, there are a few things you can do to ensure your website is secure from external and internal threats.

**Secure Hosting**

A website is a powerful tool that can help businesses of all sizes reach new customers and grow. However, a website is only as secure as the hosting provider that it uses. That’s why it’s important to choose a secure website hosting provider when setting up your website. Here are two things to look for in a secure website hosting provider:

**1. Industry-Leading Security Measures:** A good web hosting provider will have industry-leading security measures in place to protect your website from hackers and other online threats. This includes things like firewalls, DDoS protection, and malware scanning.

**2. Regular Backups:** In the event that your website is hacked or compromised, regular backups will ensure that you can quickly restore your site to its previous state. A good web hosting provider will perform regular backups of your site automatically.

**Strengthening Login Credentials**

According to studies, around 8 percent of hacked WordPress websites are due to weak passwords. However, as the largest self-hosted blogging tool in the world, WordPress has a responsibility to its users to keep their information safe. One way it does this is by natively offering two-factor authentication (2FA).

Two-factor authentication is an extra layer of security that requires not only a username and password but also something that the user has on them, like a phone. This makes it much harder for someone to hack into a WordPress account, even if they have the login credentials.

WordPress offers 2FA through several different methods, including SMS text messages, email, and authenticator apps. Which method you choose is up to you, but we recommend using an authenticator app like Authy or Google Authenticator.

**Updated Plugins**

The reason why WordPress powers millions of websites and blogs is its user-friendliness and free plugins. Although WordPress is good at adding new features and constantly issues security patches, zero-day vulnerabilities can be a calamity.

Therefore, always keep your plugins up to date because newer versions of plugins often fix security vulnerabilities that older versions had. Outdated plugins can cause compatibility issues with other plugins or with WordPress itself.

Additionally, newer versions of plugins usually have new features and improvements that can make your site run better. So next time you see a plugin update available, don’t ignore it – go ahead and update!

**Hiding WordPress Login URL**

There are a few reasons webmasters might want to change the default WordPress login URL. By doing so, you can help keep your site more secure from hackers and bots who try to gain access by brute force. Additionally, it can also deter casual users from trying to snoop around areas of your site they shouldn’t be.

If you’re running a membership site or online community, you may also want to change the login URL to something more branded and memorable for your users. By making it easy for them to find and login, you can reduce frustration and increase adoption.

Whatever your reason for wanting to change the WordPress login URL, it’s actually quite easy to do. There are a few different methods you can use, including plugins and editing code directly.

**Login Limit Plugin**

As a website owner, it’s important to make sure that your site is secure. One way to do this is by using a WordPress login limit plugin. This type of plugin will help to protect your site by limiting the number of failed login attempts.

There are many benefits of using a WordPress login limit plugin. By limiting the number of failed login attempts, you can help to prevent hackers from gaining access to your site. Additionally, this plugin can also help to improve the security of your password.

If you’re looking for a way to improve the security of your website, then we recommend that you consider using a WordPress login limit plugin.

**Security Plugins**

Using a security plugin is a must. There are many security plugins available for WordPress, but not all of them are created equal. Do some research and find a plugin that suits your needs. (We recommend looking into Wordfence or Sucuri.)

Once you’ve found a plugin, install it and activate it. Follow the instructions on the plugin’s settings page to configure it properly.

Most security plugins will offer features like blocking IP addresses, two-factor authentication, malware scanning, and more. Choose the features that are most important to you and make sure they’re enabled.

Keep your security plugin up to date by installing new versions when they’re released.

**Sharing Admin Access**

If you’re planning on giving someone else access to your WordPress admin panel, there are a few security precautions you should take first.

For starters, be sure to create a separate user account for the person to whom you’re granting access. That way, if their account is ever compromised, your main admin account will remain safe.

Next, be sure to set strong passwords for both your main admin account and the new user account. Use a combination of letters, numbers, and symbols to make it as difficult as possible for hackers to guess.

**Take Away**

Malicious actors are continuously coming up with new ways to use a company’s online presence against them, while cyber security specialists are always coming up with new ways to resist them.

This is the never-ending cycle of cybersecurity, and we’re all trapped in its center. Your WordPress site is just like any other website on the internet when it comes to cyber-attacks. However, by following the above-recommended tips and hacks, you can secure your WordPress website from cyber criminals or at least reduce the risk of being attacked. 

1.  What is WooCommerce, and Why You Should Care
2.  Tips for Using Uploader Widgets on WordPress Blogs
3.  5 WordPress Security Solutions with Free SSL Certificates
4.  Flaws in 2 famous WordPress plugins put millions of sites at risk
5.  WordPress GDPR Compliance plugin hacked to spread backdoor

Step-by-Step Security Guide for WordPress

By Deeba Ahmed
According to researchers, at least seven magecart groups are targeting Magento 2 websites in TrojanOrders attacks.
This is a post from HackRead.com Read the original post: TrojanOrders Attack Hits Magento and Adobe Stores

Sansec, a vulnerability detection, and website security firm, has warned about a spike in cyberattacks exploiting a critical mail template vulnerability tracked as CVE-2022-24086, with a CVSS score of 9.8. The researchers have dubbed the attack as TrojanOrders.

This flaw affects Magento and Adobe Commerce stores. Adobe released emergency patches for this flaw in February 2022 and warned e-commerce stores’ administrators and owners that the flaw was being exploited in the wild.

Later, Adobe confirmed that the patches it released were bypassed, and a new CVE identifier was assigned to the flaw (CVE-2022-24087).

**Researchers Observe a Rise in TrojanOrders Attacks**

According to Sansec, at least seven magecart groups are targeting Magento 2 websites in TrojanOrders attacks, exploiting the same vulnerability. It lets the attacker compromise vulnerable servers.

Sansec researchers have warned that around 40% of Magento 2 websites are targeted in these attacks. In fact, the company believes that hacking groups are at daggers drawn to gain control of the affected website. This trend is likely to continue now that online shops are expecting a rise in visitors due to Christmas.

**How does the Attack Works?**

The attacker injects malicious JavaScript code into an e-commerce website to disrupt the business. It can also lead to customer credit card theft. If such an activity is carried out on a busy day such as Black Friday or Cyber Monday, it can cause extensive damage.

The vulnerability is an improper input validation flaw in the checkout mechanism that can be exploited without authentication to achieve arbitrary code execution.

Attackers first analyze the Adobe Commerce and Magento stores to trigger the system. They send an email with one field having the exploit code. These triggers may be an order placement, customer registration, or sharing a wishlist.

If the trigger is successful, attackers try to gain control of the infected site and install a RAT (remote access trojan) to retain permanent access even when the system is patched. Usually, the backdoor is hidden in the health\_check.php file. Sansec identified seven attack vectors targeting this vulnerability.

> “Seven attack vectors means at least seven Magecart groups now actively trying TrojanOrders on Magento 2 websites. Developing an attack route is difficult and expensive. Once a group has a working exploit (attack vector), they keep on using it unless it ceases to be effective.”
> 
> Sansec

In their blog post, researchers wanted that even though fixes were released around nine months back, one-third of Magento sites and e-commerce stores haven’t yet applied them, so these could be vulnerable to TrojanOrders attacks.

1.  100s of schools at risk after Magecart attack on Wisepay
2.  Hackers steal credit card data of 14,579 BevMo customers
3.  Lazarus use Magecart attack to steal card data from EU, US sites
4.  Magecart hackers launched largest attack against Magento stores
5.  How to check for sites hacked to run web skimming, magecart attack

TrojanOrders Attack Hits Magento and Adobe Stores

By Waqas
The suspect, Vyacheslav Igorevich Penchukov, was wanted by the FBI since August 2012.
This is a post from HackRead.com Read the original post: Ukrainian behind global Zeus malware operation finally caught

As per security journalist Brian Krebs, a Ukrainian national identified as Vyacheslav Igorevich Penchukov has been arrested by Swiss law enforcement agencies. The suspect was nabbed for his involvement in cybercrime especially the infamous Zeus malware.

The suspect used the nickname Tank and Father. He was arrested on 23 October 2022 from Geneva and is awaiting extradition to the USA, reported Krebs.

**About Zeus**

For your information, Zeus is a banking trojan created by an unknown individual known by the handle lucky12345. The devices infected by this highly adaptable malware can be included in an army of a botnet to launch distributed denial of service attacks (DDoS attacks).

The FBI wanted Penchukov on cybercrime charges for more than a decade. He was a member of one of the most notorious cybercrime gangs dubbed JabberZeus. In their malicious campaigns, the cybercriminals stole over $70 million from innocent victims’ bank accounts. 

The gang, which the US Department of Justice referred to as a wide-ranging racketeering enterprise, used Zeus malware for their operations. Reportedly, Penchukov was in a western Ukrainian city called Uzhgorod before Russia invaded the country. He traveled with fake identification details and was in Geneva at the time of his arrest, where he came to meet his wife.

It is worth noting that the suspect was charged in Nebraska back in August 2012 along with Ivan Viktorovich Klepikov, known by the nick “nowhere” and “petrovich,” and Alexey Dmitrievich Bron, also known as “thehead.” 

**Details of Charges**

In 2014, the US Department of Justice released court documents that revealed Penchukov worked with eight gang members. Together they infected countless business computers with Zeus malware to steal account numbers, passwords, and other sensitive data to hack bank accounts and siphon funds from the victims’ accounts.

They were charged for their role in a botnet-based campaign in which they collected targeted users’ bank account login credentials using Zeus malware and drained funds from their accounts. The gang sent the money outside the USA via an extensive network of money mules.

1.  Arrested: 4 hackers involved in SIM Swap, malware attacks
2.  ATM hacker behind $1 billion malware heists arrested in Spain
3.  Japanese boy arrested for developing crypto-stealing malware
4.  Hacker gets 14 years jail over Scan4You malware scanning service
5.  Malware service operators arrested; offered antivirus bypassing tools

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Ukrainian behind global Zeus malware operation finally caught

By Waqas
The smart contracts that govern DeFi are littered with exploitable code, and hackers understand that since hundreds of millions of crypto funds have been siphoned off due to this very issue.
This is a post from HackRead.com Read the original post: We Need Smarter Smart Contracts To Prevent DeFi Hacks

Decentralized finance (DeFi) aims to disrupt the traditional financial world with its promise of greater inclusiveness and faster, anonymous transactions, but to do that it will need to overcome a significant challenge. The smart contracts that govern DeFi are littered with exploitable code that has resulted in millions of dollars of user funds being lost. 

Back in August 2021, Liquid Global, a leading Japanese cryptocurrency exchange, suffered a hack that resulted in more than $97 million worth of crypto being stolen. It was later discovered that hackers had targeted the exchange’s multi-party computation wallets, siphoning the funds within them to four external wallets. The hackers made off with around 107 Bitcoin, 9 million TRON, 11 million XRP, and almost $600 million worth of Ethereum. 

Just one day later, the DeFi industry experienced its largest-ever hack when an attacker made off with a staggering $612 million worth of crypto from the Poly Network protocol. Luckily, the hacker Mr. White Hat returned the funds soon after, saying he was an ethical hacker that just wanted to highlight the vulnerability within the protocol’s smart contract code. It was in any case an extremely close shave, as a less ethical hacker could have easily stumbled across the exploit and made off with a similar amount. 

Later that month, yet another attack targeted the crowdfunding platform, DAO Maker. Once again, smart contract code was exploited by an attacker to gain more than $7 million worth of user’s funds. It meant that hackers stole a combined $716 million worth of crypto that month alone. 

In December of the same year, hackers stole $30 million from the MonoX DEX platform after hackers exploited vulnerabilities in its smart contract.

Fast-forward to this year and the hacks have kept on coming. The biggest so far in 2022 was the attack on Ronin, a cross-chain bridge used by the popular NFT game Axie Infinity. The hackers found a critical vulnerability in Ronin’s code and stole an incredible 1730,000 ETH and over $25 million worth of USDC, for a total gain of $552 million.

That attack came barely a month after another bridge, Wormhole, suffered an attack that lost more than $300 million. Then, in April, the DeFi protocol Beanstalk fell victim to a $182 million hack that took advantage of the 24-hour execution delay in its flash loan smart contract.

**Smart Contracts Are Vulnerable**

With more than $40 billion worth of cryptocurrency locked into the DeFi ecosystem at the time of writing, it seems clear that the industry is here to stay, despite the risks it runs. However, with the top four DeFi protocols – namely Oasis, Lido, Uniswap V2, and Aave – all currently home to more than $4 billion worth of user assets, the worrying spate of high-profile hacks poses a major threat to the industry that could derail its ambition of emerging as a viable alternative to traditional financial services. 

Although some hack attacks are due to lax security measures and phishing attempts on users’ personal keys, the truth is that the majority of funds stolen in the DeFi industry are due to one thing – vulnerabilities in the smart contracts that power the industry. The vulnerabilities might be due to a coding error or external price manipulation or something else, but the end result is always the same – millions of dollars in value lost, and despair for the victims. 

Smart contracts are the self-executing code that underpins DeFi. They run on decentralized blockchain networks and play the role of automating transactions, thereby doing away with the need for a middleman (bank). They allow agreements between anonymous parties to be carried out immediately once certain conditions are met, speeding up transactions and eliminating costly fees. 

But as important as smart contracts are, they’re also littered with vulnerabilities that hackers are only too keen to exploit. That’s not a surprise given some of the amounts they have made off with. DeFi is a tempting target and will continue to be one so long as the vulnerabilities persist.

**How The Industry Has Responded**

The good news is that the DeFi industry is working hard to solve this potentially fatal problem. One way it’s doing so is by maintaining best practices for developers. After all, Solidity, which is the programming language used to create smart contracts on Ethereum, is still new and experimental, so developers can benefit from a helping hand. 

Consensys, an Ethereum software developer, has created a list of best practices that are available on its GitHub page. It provides recommendations for Solidity developers, along with examples of common smart contract hacks. It also provides software that developers can use to try and identify vulnerabilities themselves. Another company, 101 Blockchains, has created an extensive list of blockchain principles and advice around risk mitigation that developers can use to tie up loose ends in their code. 

The proliferation of smart contract hacks has also led to the rise of a new industry around blockchain security. Companies such as Kaspersky offer blockchain security assessments and network penetration testing, while its Endpoint Protection product can secure entire systems at the device level. Meanwhile, the data security firm Cocoon Data’s Safeshare offering relies on patented technology to ensure file security and prevent breaches. 

Also doing good business are the smart contract auditing firms like CertiK, which analyze application codebases for vulnerabilities before they are launched. These extensive audits determine how the code functions, identify bugs, and provide feedback for developers to fix any holes that might be identified. 

In the case of CertiK, it uses specialized software called Skynet Scanning Technologies to review smart contract codes. Meanwhile, Slowmist offers an integrated data system called Blockchain Threat Intelligence, and Quantstamp has created a decentralized smart contract audit protocol that any developer can use to check their code against validator nodes. 

**Rethinking Smart Contracts**

Not everyone is throwing in the towel though. A company called Radix, which defines itself as an asset-oriented smart contract purpose-built for DeFi, is instead aiming to reinvent how smart contacts work, in order to minimize the risk of vulnerabilities creeping into code. 

To do this, Radix has come up with an alternative DeFi infrastructure that doesn’t rely on Solidity and Ethereum Virtual Machine, but rather an entirely new architecture it calls Radix Engine. Notably, it relies on the concept of finite-state machines. Radix’s use of FSMs has resulted in an entirely new developer paradigm compared to Turing complete smart contracts. With it, the opportunities for hackers can be dramatically reduced. 

Rather than using traditional smart contracts, Radix developers instead build their DeFi apps using “components”, which are bits of code that define what their decentralized applications (dApps) can do with “actions”.

In turn, this makes dApps easier to design and analyze, and ensures their behavior is more predictable. The components can be thought of as Lego building bricks – developers can customize them, and link them together with additional components to create the smart contract functionality that powers their dApps.

Because the components are heavily scrutinized by the community and then reused time and again, they’re far more secure than traditional smart contracts that are written from scratch with each and every dApp that’s created. 

Radix dApps built using components can be likened to cogs in a machine. Assuming all of the cogs work as expected, the transaction will be successful. However, if one of the cogs (components) fails, the entire transaction will be aborted, ensuring the user’s funds remain safe in their wallets. 

**A Smarter Future**

The rising popularity of cryptocurrency means that funds will inevitably continue to pour into the DeFi space in the coming years. As such, developers cannot ignore the dangers of smart contract vulnerabilities, meaning they cannot persist with the unreliable development paradigms of the past. 

The good news is that projects like Radix prove that there are ways to bring greater security to DeFi and ensure proper safeguards for users. It remains to be seen if Radix-based DeFi will take off in the long term, but the fact it is getting traction tells us that developers understand they need to be more stringent as they create their smart contract code.

In conclusion, the industry is slowly waking up to the realization that smart contract code must become smarter if the threat of hack attacks is to subside. 

1.  The Lessons to Learn from Nomad Crypto Hack
2.  Meet Blokhaus’s New Open-Source NFT Tool Minterpress
3.  Why general population has to be educated on cryptocurrency
4.  US seizes $1.4 billion in Bitcoin from Silk Road Market Scammer
5.  DeFi Startup AllianceBlock’s Trustless ID Verification Service For Dapps

We Need Smarter Smart Contracts To Prevent DeFi Hacks

By Waqas
Cryptocurrency and blockchain education is critical for anyone looking to grow their personal wealth and achieve financial freedom.
This is a post from HackRead.com Read the original post: Making a case for crypto knowledge – why the general population has to be educated on cryptocurrency

No other asset or innovation has influenced the world of finance the way crypto did over the past few years, and we can safely say that **no one saw it coming**. It almost seems like the crypto hype materialized out of thin air – a decade ago, the concept of digital currency was completely foreign to most people, and then, all of a sudden, we were all watching the **Bitcoin** revolution unfold, paving the path for the emergence of a wide range of cryptocurrencies that would later become known as altcoins.  

Then we all know what happened: Bitcoin went through multiple ups and downs, taking traders on a wild rollercoaster and gaining worldwide popularity. But despite the constant **BTC price** fluctuations, the number of followers kept increasing, establishing the coin as the leader of the crypto sphere – a title that it still holds to this day.

Plenty of other digital assets were created, trying to mimic Bitcoin’s success. Some became quite popular and managed to attract investors’ attention, while others remained relatively unknown or enjoyed a very short time in the spotlight. 

And here we are today, looking at an ever-growing crypto industry that’s becoming more influential with every passing year. There are over **300 million people using crypto** worldwide at the moment, and many more will adopt digital coins in the future.

Right now, the most important question is not whether cryptocurrencies are just a passing fad or they’re here to stay. It’s become pretty clear that the only way for cryptocurrency is upward, and they’re not going anywhere. The issue everyone should focus on – both stakeholders and individuals – is how to approach the rise of crypto. 

Whether we like it or not, digital currencies are now a part of the global financial system, and some go as far as saying they represent the future of finance. So, while we cannot predict how the crypto industry is going to evolve, given its novelty and inherently volatile nature, we can make sure everyone is ready to navigate the crypto sphere, and that involves getting properly educated on the topic.  

**Breaking barriers to usage **

It seems like everyone is trading cryptos these days, but that’s not necessarily the case. Indeed, the number of crypto traders and investors continues to increase as the market expands.

However, a large percentage of the population is still reluctant to use cryptocurrencies, given the perceived complexity of the field. Let’s not forget that **cryptocurrencies represent a financial innovation** that’s still in its infancy, and many people are completely oblivious about how it works or how it can benefit them. The lack of knowledge on the topic makes a lot of people shy away from using cryptocurrencies. 

That’s the case with every innovation ever made. The birth of the internet offers a prime example in this regard. It took time for people to get familiarized with the technology and understand the advantages it provided.

Decades later, the internet has become an integral part of our lives. The same thing is happening now with cryptocurrency. Very few people are eager to learn the ins and outs of a new technology that seems extremely complicated at first glance. Most would rather stick to the traditional assets they’ve used all their lives, but that would limit their options.  

**Crypto education** can arm people with the knowledge and skills they need to become proficient crypto users. The more knowledgeable they become, the easier it will be for them to enter the crypto sphere and navigate it confidently. A larger and more stable user base will also help decrease crypto volatility, which is another major deterrent for traders and investors. 

**Mainstream adoption**

In recent years, more businesses have **started accepting digital assets** as a form of payment, and institutional interest in crypto is also on the rise, which means crypto is getting closer to mainstream adoption.

Government opposition is **getting milder**, and many countries have already expressed their intention to include cryptocurrencies in their financial system. Experts estimate that within the next 10 years, cryptocurrencies will enter mainstream usage, on par with fiat currencies and other asset classes. 

It’s one thing to refuse to use cryptos right now, but when they become part of the local economies, people will no longer be able to ignore them. Governments should make sure their population is prepared to embrace this new form of finance to ensure smooth and frictionless adoption, and that can only be achieved by investing in crypto education and awareness. 

**Protection against crypto scams**

Cryptocurrencies have numerous characteristics that have helped increase their appeal on the investment front, and security is definitely one of them. Digital assets have been praised for the unmatched level of protection and security they provide, being built on **decentralized blockchain platforms** that ensure immutability and anonymity. 

However, this doesn’t mean the crypto environment is free of **scams and frauds**. On the contrary, the hype that’s been created around digital assets also led to the rise of crypto criminals.

These scammers have developed all sorts of methods to catch their targets’ attention or trick people into sharing their personal information or sending them money. Teaching people about cryptocurrencies and how they can differentiate a legitimate project from a potential scam can help them avoid common pitfalls and create a much safer crypto environment. 

**Keeping up with the times **

With all their pros and cons, cryptocurrencies are not a simple trend one can ignore until it goes away. Digital assets are part of the current reality and most likely will become part of our future. It’s already been proven they have real-world value and utility, especially as an alternative form of payment and investment, as well as a solution to provide access to financial services for the unbanked in developing countries.  

Therefore, **educating people on cryptocurrency** is simply a matter of helping them step into the future and expand their options so we can create a more inclusive and sustainable world for everyone.

Making a case for crypto knowledge – why the general population has to be educated on cryptocurrency

By Owais Sultan
The top causes of cloud hacking have evolved over the years. Currently, APIs are among the top threats to clouds.
This is a post from HackRead.com Read the original post: Cloud Hacking – Why API Remains the Biggest Threat?

Cloud computing is central to digital transformation. Most enterprises use cloud-based services today. They help enterprises remain agile and resilient in the era of constant changes.

 92% of enterprises host resources and functions in the cloud. These resources and functions are vital to business operations. But how secure are clouds? Not very.

98% of enterprises faced cloud hacking, as per a 2021 study. This figure has shot up over 18 months from 10% in 2020. 

The top causes of cloud hacking have evolved over the years. Currently, APIs are among the top threats to clouds. And API security risk is a disturbing trend in cyber security today. Two-thirds of cloud breaches are due to misconfigured APIs.

Why are APIs the top threats to your clouds? What can you do to protect your clouds and the resources hosted? Keep reading to find out. 

**Cloud Hacking: A Snapshot **

First things first, can the cloud be hacked? Yes, absolutely! CISA warned us last year.

Hackers are aware of the criticality of clouds to enterprises today. They also know that many companies use public clouds. Private/ on-premise clouds are more difficult to hack than public clouds.

With public clouds, enterprises and vendors share security responsibilities. There are growing numbers of vulnerabilities in public ones that attackers can exploit. 

Several enterprises also fail to apply adequate security controls to secure the cloud. As a result, we are seeing an increase in the instances of cloud hacking. 

**Why are APIs Top Threats to Cloud Security? **

Insecure APIs and interfaces are among the top threats to cloud security today. They are second on the list after insufficient identity, access, and key management. 

**Ascent of APIs **

APIs weren’t considered a big threat to cloud security in 2019. Back then, API dependency was minimal. Today, our dependence on APIs is growing rapidly. We are shifting away from web-based infrastructures to API infrastructures for apps. Monolithic apps and websites are fewer. 

APIs provide developers with agile, hassle-free building blocks to develop cloud services. They offer much better connectivity. But these benefits also come with several risks. So, we see that they are top security concerns for CISOs. 

**APIs Widen the Attack Surface **

APIs make it easy for cloud hacking by widening the attack surface. How do they widen the attack surface? Because they are everywhere. Their ubiquity creates an interconnected architecture.

A misconfiguration here or a broken access control there is all a hacker needs. They can hack clouds using these vulnerabilities. 

Further, there is a massive rise in the use of external APIs and third-party cloud services. You will have to face the damage if your vendor doesn’t take API security seriously. 90% of data breaches target cloud assets and servers. 

**APIs Create Data Security Problems by Their Very Nature **

APIs ensure easier access and connectivity to resources and data. In other words, they expose data and resources programmatically. You will expose sensitive data residing in the cloud to attackers if you don’t secure APIs. Attackers can then modify, delete, or steal data easily. 

APIs threaten cloud data security because most enterprises don’t have the: 

*   proper access controls
*   real-time visibility 
*   robust data security policies

**Managing APIs is Complex  **

Enterprises use 15,564 APIs on average. API use has grown exponentially within enterprises in the past year at 201%. Larger enterprises use an average of 25,592 APIs.

This makes it difficult for developers to monitor, manage and secure all their APIs. The lack of centralized visibility further augments this challenge. 

As a result, several vulnerabilities and security weaknesses arise. These unmanaged shadow APIs enable attackers to perform cloud hacking easily. Here are some examples of such vulnerabilities: 

*   SaaS misconfigurations 
*   Disabled security controls 
*   Unauthenticated endpoints 
*   Disabled logging and monitoring 

**API Security Myths Cause Poor Security Posture **

Some of these API security myths are:  

*   Port-based blocking works 
*   Signature-based techniques are enough to secure APIs
*   Firewalls, API gateways, and IAM tools are enough to secure APIs 
*   Single, automated tools work effectively against API threats. For instance – next-gen WAFs and Intrusion prevention systems (IPS)

But the reality is starkly different. You need multi-layered, comprehensive API security solutions that combine 

*   Next-gen WAF
*   API-specific rules 
*   Global threat feeds
*   Real-time, centralized visibility 
*   Advanced Bot and DDoS mitigation
*   Self-learning AI, automation, and analytics
*   Behavioral analysis to detect malicious behavior
*   Expertise of certified security professionals to address more complex issues 

Only such solutions ensure that you don’t get blindsided by exposed APIs.

**Conclusion **

Cloud hacking caused by exposed APIs is a big problem for your business. It causes multiple layers of damage to cloud security. Avert these damaging consequences by hardening your API security.

Choose solutions like **Indusface API Protection** for real-time, context-aware, data-aware, fully managed security. 

1.  Explaining Cloud Native Application Security
2.  What are the future prospects of a Cloud architect?
3.  Secure Email Gateway Vs. Integrated Cloud Email Security

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Cloud Hacking – Why API Remains the Biggest Threat?

By Deeba Ahmed
RapperBot malware is known for brute-forcing SSH servers that can accept password authentication.
This is a post from HackRead.com Read the original post: New RapperBot malware targets gaming servers with DDoS attacks

Fortinet FortiGuard Labs researchers discovered new samples of RapperBot malware, indicating that threat actors are building a botnet to launch crippling distributed denial of service attacks (DDoS attacks) against game servers.

The malware was reported previously in FortiGuard’s article- So RapperBot, What Ya Bruting For?

FortiGurad’s researchers Joie Salvio and Roy Tay noted a drop in the number of samples circulating in the wild in August 2022 from when it was first discovered. They identified new samples from October using the same unique C2 protocol RapperBot malware used earlier. For your information, RapperBot malware is known for brute-forcing SSH servers that can accept password authentication.

This malware is different because it can perform Telnet brute-force apart from supporting DoS attacks through the Generic Routing Encapsulation (GRE) tunneling protocol and UDP floods targeting game servers that run Grand Theft Auto: San Andreas.

The Telnet brute-forcing code is developed for self-propagation. Researchers noted that the Mirai botnet inspires the RapperBot malware since the Telnet code resembles the Mirai Satori.

It is worth noting that Mirai’s source code was leaked in October 2016, and since then, many different variants of Mirai have emerged.

Researchers at FortiGuard are certain that the samples are created for a brand-new DDoS campaign against game servers. It may also be the reappearance of a similar campaign detected earlier in 2022. This new campaign is much different from the older RapperBot campaign detected in February 2022, which later disappeared in April.  

Fortinet researchers wrote in a blog post that the malware could only target appliances running PowerPC, ARM, SH4, SPARC, and MIPS architectures. It can quickly halt its self-propagation mechanism if they are run on Intel chipsets.

> “Based on the undeniable similarities between this new campaign and the previously reported RapperBot campaign, it is highly likely that they are being operated by a single threat actor or by different threat actors with access to a privately-shared base source code.”
> 
> Joie Salvio and Roy Tay – FortiGurad

Top/Featured Image: PixaBay – Victoria\_Watercolor

1.  **Major EU country hit by crippling DDoS attacks**
2.  **Iran’s Largest Steel Producer Hit By Crippling Cyberattack**
3.  **Two major flight tracking services hit by crippling cyberattacks**
4.  **European Banking Authority victim in MS Exchange Server hack**
5.  **Fake WHO Emails on COVID-19 Dropping Nerbian RAT Across Europe**

New RapperBot malware targets gaming servers with DDoS attacks

By Deeba Ahmed
The extension will support all EVM chains and Solana.
This is a post from HackRead.com Read the original post: Trust Wallet Launches Browser Extension Wallet for Desktop

Binance’s Trust Wallet has launched a new browser extension wallet. The world’s leading multi-chain wallet provider’s brand-new extension for desktops will support all EVM chains and Solana. It will provide an enhanced dApp experience to users as they can explore things beyond CEXs (centralized exchanges).

**Trust’s Browser Extension Wallet Details**

This wallet is compatible with Chrome, Opera, and Brave browsers and syncs with Trust Wallet’s mobile wallet. For your information, Trust’s mobile wallet is one of the best mobile crypto wallets in the world, with over 60 million downloads. It receives ten million active users per month, which indicates its global appeal.

As per Trust Wallet CEO Eowyn Chen, users had been requesting for Browser extension with the same quality of experience as they receive on the Trust Wallet Mobile App, including multi-chain coverage. The company tried to empower users regarding the choice of device when accessing the wallet, which led to the development of the new browser wallet.

“This is our initial step, and we will listen to users’ and developers’ feedback to improve,” Chen noted.

Trust Mobile Wallet features such as multi-wallet support, fiat on-ramp and NFT support, and non-EVM blockchain integrations will be added to the new browser extension apart from unique features like hardware wallet support.

**What’s in it for Users?**

Both mobile and desktop versions of the wallet would offer enhanced Web3 accessibility and a seamless wallet experience across the two environments. It enables users to securely store, send/receive, and manage data easily.

The desktop browser extension wallet would let users receive more than eight million tokens across Solana and all available EVM chains, such as Ethereum, Polygon, BNB Chain, and Avalanche. Users can also custom-add EVM chains. It is worth noting that non-EVMs will also be added in the future.

Furthermore, the wallet extension is expected to improve the multi-chain user experience. With network auto-detect, users will enjoy a seamless dApp experience without manually adding networks. Eight million tokens are available out of the box to ease the demand for the manual addition of tokens and improve asset traceability.

In short, the new browser extension wallet will offer an optimized dApp experience so that users “effectively discover things beyond centralized exchanges (CEXs), like Web3 gaming, metaverse, DeFi, tokens not found on CEX, and more,” the company’s press release explained.

1.  Ankr Launches Chainscanner Blockchain Explorer Tool
2.  Improving privacy – Alternative browsers and chrome extensions
3.  Can This Browser Extension Really Protect You From Cybercrime?

Trust Wallet Launches Browser Extension Wallet for Desktop

By Waqas
The planned smart device security labeling program spearheaded by the US government will be introduced next year, although…
This is a post from HackRead.com Read the original post: Will a Labeling System Solve IoT Security Challenges?

The planned smart device security labeling program spearheaded by the US government will be introduced next year, although official details about its implementation are not yet available. From home routers to smart cameras, various connected devices are set to get cybersecurity labels similar to the Energy Star labels used on appliances.

The question is this: Can labels really help address the IoT security challenges associated with smart devices? Some compare this IoT cybersecurity labeling plan to the compulsory “nutrition facts” on food products, which does not appear to inspire optimism. The nutrition information on junk food and sugar-rich food products has not discouraged people from consuming unhealthy products. 

Will the same happen to the US government’s device labeling plan? Can cybersecurity labels drive consumers towards highly secure gadgets, or will they just go on with their usual buying habits, wherein product availability and prices are usually the most important purchase decision-driving factors?

The answers to these questions can be explained more intuitively by discussing smart device and IoT security challenges and presenting the proposed or expected benefits of the cybersecurity labeling program.

**Challenge 1: Lack of visibility**

More often than not, Internet of Things (IoT) manufacturers do not have any system for monitoring their products. Once their devices move to the hands of customers, they no longer exert any effort to check if their products require security updates or patches to address malfunctions and security vulnerabilities. They do not have a system to keep track of changes or product activity histories that can be used to determine the root cause of issues and provide the necessary remedies.

This lack of visibility suggests that products are unlikely to be secure. It is an important fact that should be taken into account when examining the cyber threat readiness of certain smart devices, something that can be reflected in the proposed IoT labeling program.

**Challenge 2: Reactive approach to zero-day threats**

A big majority of IoT and smart device manufacturers do not include the anticipation of zero-day threats as part of their product security strategy. Primarily reactive, their sole solution to threats is security patching, which is useless against zero-day threats. It takes time to develop and release a security patch in response to newly discovered vulnerabilities. It takes even longer for the patches to be applied by the device owners.

Before the security patch is installed, it is likely that threat actors have already managed to exploit an unpatched vulnerability and inflicted damage that could have been preventable. IoT makers need to consider employing cybersecurity solutions that are proactive instead of reactive. Examples of these are simplified network access controls (NAC), web application firewalls (WAF), and extended detection and response (XDR).

This does not mean that security patching is no longer necessary. It is still an important part of securing smart devices, but there have to be ways to address zero-day or newly emerging unidentified threats.

IoT cybersecurity labeling can be used to indicate if specific IoT devices or smart gadgets have proactive security versus zero-day threats. Regulators will be obliged to examine the protection systems baked into devices or their ability to integrate with the proactive cyber defense solutions employed by organizations.

**Challenge 3: Open source and third-party vulnerability exposure**

Many IoT device makers do not develop from scratch their own firmware or the basic software installed in their devices. This is particularly true for mass-produced generic devices that flood the low-cost electronics retail industry. These unknown brands or generic devices rely on open-source or third-party software libraries for their authentication, communication, encryption, and other fundamental functions.

One report indicates that around 84 percent of codebases have components that contain known security vulnerabilities. This figure should alarm those that patronize cheap IoT and smart devices for various purposes. A significant number of “successful” cyber attacks on IoT devices are attributed to open-source and third-party. This makes cyber attacks easier for cybercriminals, as the knowledge of the specific devices used by an organization could be all they need to come up with an efficient attack strategy against specific businesses or organizations.

Cybersecurity labeling for IoT devices can help address this problem by alerting prospective smart device buyers about the possible security flaws or defects of the software in the products they are considering. Regulators can keep a comprehensive and growing guide on all open-source and third-party software security flaws.

**Challenge 4: Performance over security**

IoT devices inherently have limited resources, particularly their CPU, RAM, and ROM. As such, they cannot pack advanced security software tools, which are generally resource-intensive. It would be difficult to bring together security and performance with all the limitations of IoT products.

Many IoT device manufacturers admit that they purposely take out or cut corners on their security features to ensure that their devices can run relatively smoothly. This results in vulnerabilities that make IoT gadgets even less capable of resisting attacks, especially sophisticated tactics.

The planned nonprofit/nongovernmental organization that will be established to oversee the national cybersecurity certification and labeling activities can evaluate devices to ascertain their cybersecurity readiness. Too many security compromises will be indicated in the cybersecurity label or reflected in the overall score/rank written on the label.

**Challenge 5:  Outdated or obsolete security tools and methods**

Some smart device makers demonstrate some inclination to make their devices safe and secure. However, the tools they install or the approaches they undertake may no longer be applicable to the current threat ecosystem. They could be using outdated static analysis and vulnerability discovery solutions, which do not help improve the security of their products. There are also those that employ perimeter defense and network segmentation solutions that have notably limited capabilities in detecting and stopping IoT device assaults.

These facts need to be indicated in the proposed IoT cybersecurity label to encourage device makers to update the security solutions they use. If manufacturers refuse to update their security features, customers will know that they will likely be endangering their IT assets or resources by allowing such devices to connect to their network.

**Guide, not a silver bullet**

Will a cybersecurity labeling system be enough to address the challenges that mire IoT and connected smart devices? It can certainly help, but it is not going to be the be-all and end-all solution. There is and will never be a foolproof solution. However, labels can guide customers in making smart choices. If customers still choose devices with low cybersecurity ratings/scores and various caveats, the risk is theirs to take. 

Nevertheless, authorities may use the labels in setting thresholds for the cybersecurity level acceptability of devices that will be allowed in certain settings. By doing this, they can subtly enforce a policy of only using proven secure devices in businesses and government offices.

1.  Access:7 Supply Chain Flaws Impact ATMs, Medical, IoT devices
2.  IoT Devices Can Be Hacked to Install Ransomware on OT Networks
3.  Millions of IoT devices, baby monitors open to audio, video snooping
4.  Vulnerable Smartphones, IoT Devices: 400% increase in infection rate
5.  Tiny Mantis Botnet Can Launch More Powerful DDoS Attacks Than Mirai