By Owais Sultan
If you own a WordPress website this article is for you because it addresses WordPress security and protection…
This is a post from HackRead.com Read the original post: How To Secure WordPress Website From Cyber Attacks?

****If you own a WordPress website this article is for you because it addresses WordPress security and protection against cyber attacks.****

WordPress is a widely used CMS (content management system), powering a significant proportion of all available websites. Unfortunately, it also attracts cyber criminals who take advantage of the platform’s security flaws.

It does not mean that WordPress’s security mechanism is ineffective. Security issues can also occur due to the absence of security measures from the users’ side such as outdated or malware-infected plugins. Therefore, it is crucial to take security measures before your WordPress website becomes a target of a malicious attack.

Although you can maintain network security while transferring files by understanding the TCP vs UDP comparison and selecting the best one for web security, some valuable yet small details might help you secure your website in the long run.

*   **What Is the Importance of WordPress Website Security?**

A hacked WordPress site can significantly harm your company’s income and credibility. Cybercriminals can access passwords and user information and even exploit the site to spread malware or harvest login credentials and banking card information. Therefore, providing a secure platform for your website’s users/visitors is a must.

Also, keeping a high-end website requires maintaining your WordPress website’s safety. Website security has a direct impact on search engine visibility. And the most straightforward strategy to improve your search ranking is to improve your security. Thus, the importance of WordPress website security cannot be denied whatsoever.

*   **Is WordPress a Safe Platform?**

If this question always pops up in your mind, you are not alone. It is one of the most frequently asked questions. And the answer to this question is “Yes, it is safe.” It is safe for the most part as long as you take all necessary security precautions seriously.

*   **Avoid “Admin” Username**

The disclosure of a username may not appear to be particularly harmful. Still, it might set off a chain reaction of security flaws that can lead to account identity theft, hijacking, or financial harm.

If you have named the site’s administrator as admin, it is recommended to change it because cyber criminals are good at exploiting platforms with default setups. They understand that “admin” is frequently used as an administrator account. They may exploit that username in a “brute force” attack. Avoid the “Admin” username and save your WordPress website from such attacks.

*   **WordPress Must Be Updated Regularly**

WordPress publishes software updates regularly to enhance security and speed. These upgrades also help in keeping your site safe from cyber attacks. The most straightforward approach to improving your WordPress website’s security is to update your WordPress version. 

To see if you own the most recent WordPress version, go to Dashboard, then click on Updates.

Stay updated on the release dates for new upgrades to guarantee that your site isn’t running an old WordPress version. Moreover, try to update the plugins and themes on your WordPress site. Older plugins and themes might cause conflicts with the newly updated WordPress software, resulting in problems and security vulnerabilities.

*   **Limit the Number of Log In Times**

Cybercriminals may try to guess your admin password via a brute force attack or use leaked credentials to log in to the site. You can reduce their chances of winning by limiting the number of times they can try to log in. As a result, if someone continuously enters the incorrect password, they will be blocked for hours, months, or even years depending on what options you select.

Thus, Limit Login Attempts is a plugin that you may use to secure your website. It works by allowing you to set up a significant number of wrong passwords that may be entered before the IP address of the person who entered the wrong password is locked out.

*    **All Hotlinking Should Be Disabled**

Rather than downloading the file, putting it on your server, and providing a correct citation. Hotlinking or Inline linking is a technique of linking to a file stored on another site. It is most commonly used for images, but it may also be used for videos, music files, flash animations, and other digital content.

If you want to keep your WordPress website secure, hotlinking should be disabled. Otherwise, you’ll notice slower loading times, the possibility of more server expenses, and an increased risk of being hacked.

Although there are several manual methods for avoiding hotlinking, the most straightforward solution is to use a WordPress security plugin. The All-in-One WP Security and Firewall plugin, for example, has built-in solutions for preventing all hotlinking.

*   **Use Two-Factor Authentication**

Two-factor authentication, often known as 2FA, dual-factor authentication, or two-step verification, is a security method in which users validate their identity using two independent authentication factors. This is another smart step to include in your security strategies.

The authentication can be a conventional password followed by a security question, a combination of letters, a hidden code, or the Google Authenticator application delivering a secret code to your phone. The person who has your phone may log in to your website. It is used to safeguard a user’s credentials and the information they have access to.

**Conclusion**

Malicious actors are continuously coming up with new ways to use a company’s online presence against them, while cyber security specialists are always coming up with new ways to resist them.

This is the never-ending cycle of cybersecurity, and we’re all trapped in its center. Your WordPress site is just like any other website on the internet when it comes to cyber-attacks. However, by following the above-recommended tips and hacks, you can secure your WordPress website from cyber criminals or at least reduce the risk of being attacked. 

**More WordPress Security News**

1.  7 Tips to Increase Your WordPress Security
2.  5 WordPress Security Solutions with Free SSL Certificates
3.  Critical WordPress plugin vulnerability allowed wiping databases
4.  Flaws in 2 famous WordPress plugins put millions of websites at risk
5.  WordPress security: Steps to assess employee before granting admin access

How To Secure WordPress Website From Cyber Attacks?

By Owais Sultan
Hyperconverged infrastructure is changing the way data centers work for the better. Learn about the benefits of hyperconverged…
This is a post from HackRead.com Read the original post: Hyperconverged Infrastructure (HCI) is Changing Data Centers

****Hyperconverged infrastructure is changing the way data centers work for the better. Learn about the benefits of hyperconverged infrastructure.****

Every year there is a huge number of technological reforms and upgrades that can make life easier for both individuals and companies. Sometimes, large-scale changes also affect the data processing centers.

If even more than 10 years ago data center managers worked with traditional infrastructure familiar to everyone, then in recent years there have been big changes. These changes were the use of networks that provide both speed and availability (software-defined networks), a distributed information technology architecture in which customer data is processed at the edge of the network, as close as possible to the source (edge computing), the fifth generation of mobile communications, as well as artificial intelligence. 

Such technologies imply a major transformation in how data centers operate. However, the most important thing is that qualified specialists are needed to work with such technologies, which means higher requirements for data center managers. They must be able and know how to work with such innovative solutions, and explore and customize them. It would seem that the use of technology should be beneficial, but for people working with such innovations, this becomes a challenge. 

That is why the latest technology has been developed that promises to solve all these problems. 

**Table of Contents:**

1.  **Hyperconverged Infrastructure** 
2.  **Converged Infrastructure** 
3.  **Key Benefits of HCI**

**Hyperconverged Infrastructure **

Before describing all the advantages of technology, it is worth considering the hyperconverged infrastructure definition. HCI is a distributed infrastructure platform that combines servers, networks, and storage with sophisticated software to produce adaptable key components that may improve existing infrastructure.

The consistent building pieces required to establish a hyperconverged infrastructure can be acquired as a mix of electronic, electrical, and mechanical hardware or as virtual stacks.

Such an infrastructure consists of standard components: servers running on the x86 architecture, software for creating, running, and managing virtual machines, and special software needed for management.

The beauty of a hyperconverged data center is that if you need more processing power, you can easily scale the process. All you need to do is attach a few extra boxes, depending on how much you need to scale everything. Thus, each organization gets a great opportunity to improve the processing centers of HCI data. 

It is already clearly visible how quickly the demand for the creation of such data centers is growing. 3 years ago, the global market for such products and services was estimated at over $6 billion. In 5 years, it will be valued at more than $22 billion. Companies now must cut information technology expenses, drastically speed up the building of data centers, manage numerous operations, and grow swiftly.

**Converged Infrastructure **

There existed a converged infrastructure prior to the introduction of such an upgraded infrastructure. It comprises pre-engineered equipment and programs that professionals may purchase and install independently. In short, it’s like an IKEA crib. You get a set of ready-made components that you need to combine to get the finished product. That is, you get components that will be compatible with each other. You do not need to search for suppliers for each component to separately assemble everything you need. 

Hyperconverged infrastructure is a more advanced CI. This infrastructure already contains all the necessary components that you can work with. In simple words, if CI is an IKEA crib that needs to be assembled, then HCI is a prepackaged meal that you just need to heat.

If you use a similar infrastructure in your data center, then to increase the capacity, you only need to order more infrastructure units. Easy and simple scalability allows multiple companies to increase the volume of data processing, as well as quickly adapt to new company needs. 

**Key Benefits of HCI**

Scalability is the most important advantage of HCI. However, this is not all that such an infrastructure can offer. 

**Low-cost hyperconverged infrastructure units **

HCI requires x86 servers, which are installed in most modern data centers. Thus, companies do not need to spend money to buy the necessary servers. In addition, every time there is a need to add capacity, companies need to buy only one type of device instead of a huge variety of different devices. They can be purchased from a single supplier, which reduces the time of purchase and implementation.

In addition, if necessary, if there are difficulties with installation or updates, then you only need to seek technical assistance from one vendor instead of working with many different vendors. 

**Remote control **

Infrastructure components are handled as services in a software-defined data center. They can be managed and configured remotely, which greatly facilitates the work of managers. At any time of the day or night, managers can quickly reduce or increase the amount of storage, and memory, adjust computing power, as well as all the necessary resources. This means that managers will be able to update all resources used as soon as it is needed.  

**Achieving the greatest efficiency of all processes **

All used infrastructure resources are combined into clusters. If you need more memory for a particular process or application, or need more storage capacity and compute power, you can quickly identify those resources that aren’t already being used to provide what you need. With unified management, managers can quickly discover these resources, pool them together, and make them available for process or application execution when needed. 

**Integrated management **

You only need a single console to manage all the processes. Local and remote clusters can be managed from one place. Thus, the entire management process is greatly simplified. 

Companies operating in the field of IT have a chance to reduce the costs of IT departments, as well as increase their productivity. The work of specialists is facilitated since it is no longer necessary to think about how to deploy a system, integrate it, and separately maintain each component while solving other problems associated with managing the center. 

There is no need to expand the staff, as well as to attract consultants who charge a lot for their work. If your staff has generalists, then they will be able to do most of the work without help. 

**Conclusion **

There are many benefits to implementing hyperconverged infrastructure in your data center. The first and most important is the speed and ease of scaling, which is low cost. In addition, all processes can be controlled remotely using a single console. Achieving the greatest efficiency of all processes occurs quickly if necessary.

1.  Why Data Security is crucial?
2.  Big Data and Cybersecurity: Opportunity or Threat?
3.  How big data analytics helps enterprises improve cybersecurity
4.  Top Data-Driven Methods for Improving Your Investment Decisions
5.  Cybersecurity, Big Data & Automation Tools: What Marketers Need To Know

Hyperconverged Infrastructure (HCI) is Changing Data Centers

By Waqas
The Kommersant FM’s online bulletin was suddenly interrupted to play Ukraine’s anthem and anti-war songs by anti-war hackers…
This is a post from HackRead.com Read the original post: Russian Radio Station Hacked to Broadcast Ukrainian National Anthem

****The Kommersant FM’s online bulletin was suddenly interrupted to play Ukraine’s anthem and anti-war songs by anti-war hackers to protest against Vladimir Putin’s invasion of Ukraine.****

The online bulletin broadcast of a Russian radio station, Kommersant FM, was interrupted on Wednesday. The content was replaced with the Ukrainian national anthem and antiwar songs. However, the broadcast was quickly taken off the air. The station released the following statement to confirm the hack:

> “The radio station has been hacked. The internet stream will soon be reinstated.”

Kommersant FM’s editor-in-chief, Alexey Vorobyov, told the state-owned news agency, Tass, that the online stream was hacked on Wednesday, and their technical specialists were figuring out the attack’s origin.

**Details of the Incident**

The hackers disrupted the lunchtime bulletin of the targeted radio station, which is Kommersant newspaper’s radio offshoot. BBC Monitoring reporter Francis Scarr tweeted that the radio station played the Ukrainian anthem “Oh, the Red Viburnum in the Meadow.”

Moreover, the hackers played Russian rock band Nogu Svelo! ‘s song titled “We Don’t Need a War,” featuring a quote from Russia’s foreign minister Sergei Lavrov which means “a tough guy always keeps his word.”

Check out the recording of the Ukrainian national anthem playing on Kommersant FM after the hacking.

**About Kommersant FM**

Uzbek billionaire Alisher Usmanov owns the hacked radio station. The US and the EU sanctioned him after the invasion of Ukraine due to his alleged link with the Russian president Putin. However, Usmanov has challenged the sanctions, and a decision is expected soon.

1.  Hackers disrupt Chicago police radios with anti-cop songs
2.  Someone hacked N. Korean Radio Station to Play “The Final Countdown”
3.  Anonymous hacked Russian TV and streaming services with war footage
4.  Hackers can take over & control emergency alarm system with a $35 radio
5.  Anonymous hacks Russian TV, EV charging station with pro-Ukraine messages

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Russian Radio Station Hacked to Broadcast Ukrainian National Anthem

By Deeba Ahmed
DogWalk comes soon after another MSDT zero-day vulnerability dubbed Follina was discovered, and Microsoft claimed it was a…
This is a post from HackRead.com Read the original post: New MSDT 0-day Flaw ‘DogWalk’ Receives Free Unofficial Patches

****DogWalk comes soon after another MSDT zero-day vulnerability dubbed Follina was discovered, and Microsoft claimed it was a non-security issue.****

Last week a critical 0day security vulnerability called Follina was identified in Microsoft Office. The issue was a critical one and required urgent security patches. To make sure the vulnerability is fixed on an urgent basis (although it was already being exploited by Chinese hackers) 0Patch, a Maribor, Slovenia-based IT security firm issued free but unofficial micropatches addressing the Follina vulnerability.

Now, 0Patch is at it again. It all started with security researcher Imre Rad first disclosing a vulnerability in January 2020 which is now called DogWalk. But Microsoft ignored the flaw because the tech giant didn’t consider it a security issue. Recently, the same vulnerability was re-discovered by security researcher j00sean.

Although the vulnerability hasn’t been assigned a CVE or tracking ID yet, it is confirmed that this vulnerability drops a payload in the Startup folder of Windows at this location:

C:\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup

**About DogWalk**

The flaw is dubbed DogWalk, and according to j00sean, it is a path traversal flaw that attackers can exploit to copy an executable to the Windows startup folder after the victim opens a malicious .diagcab file, a Cabinet (CAB) file format containing a diagnostics configuration file.

This file is either downloaded from the internet or received through email. The malicious executable gets automatically executed the next time the Windows is restarted.

It is worth noting that this malicious file features a Mark of the Web/MOTW. However, the Microsoft Support Diagnostic Tool (MSDT) ignores this warning and runs the file, exposing the victim to exploitation.

> This has to be a joke. That path traversal 0day is a "wonfix" again. 🤦‍♂️
> 
> I think someone at @msftsecresponse didn't get this is not a chromium-based bug. It's a MSDT one, buddies! Someone at Redmond should review my Twitter timeline :-) Isn't a MSRC guy there reading this? 🫤 pic.twitter.com/jC02nzgnuV
> 
> — j00sean (@j00sean) June 7, 2022

For your information, the MOTW tag is used to establish the origin of the file and determine the feasible security response. According to 0patch’s Mitja Kolsek, the MSDT application cannot check this flag, which is why the file is opened.

Microsoft claims that Outlook users aren’t at risk since the .diagcab files are blocked automatically by the platform. But, security researchers claim that the bug is still a potential attack vector.

> “Outlook is not the only delivery vehicle: such file is cheerfully downloaded by all major browsers including Microsoft Edge by simply visiting(!) a website, and it only takes a single click (or misclick) in the browser’s downloads list to have it opened,”
> 
> Mitja Kolsek – 0patch

**0patch’s Free But Unofficial Micropatches**

The flaw impacts all Windows versions from Win 11 and Server 2022 to Win 7 and Server 2008. Microsoft is yet to release an official patch for this zero-day flaw. Therefore, the micropatching service 0patch has developed an unofficial, free patch for the Windows versions most impacted by this bug, which includes:

*   Windows 7
*   Windows 11 21H2
*   Windows 10 21H2
*   Windows 10 21H1
*   Windows 10 2004
*   Windows 10 1909
*   Windows 10 1903
*   Windows 10 1809
*   Windows 10 1803
*   Windows 10 20H2
*   Windows Server 2012
*   Windows Server 2019
*   Windows Server 2016
*   Windows Server 2022
*   Windows Server 2012 R2
*   Windows Server 2008 R2

Source: 0patch 

Visit the official 0patch blog post for technical details and download the micropatch. Before installing the patches, you will need to register a 0patch account and install and launch the 0patch agent, after which the micropatch will automatically apply without requiring a system restart.

**More Microsoft Vulnerabilities**

1.  New Bug Lets Attacker Takeover PC via Outlook Email
2.  Microsoft Outlook bug exposes Windows credentials to hackers
3.  Beware of Fake Windows 11 Downloads Distributing Vidar Malware
4.  Pwn2Own 2022 – Windows 11, MS Teams, and Firefox Pwned on Day 1
5.  USB-based Wormable Raspberry Robin Malware Targeting Windows Installer

New MSDT 0-day Flaw ‘DogWalk’ Receives Free Unofficial Patches

By Waqas
MyEasyDocs is a Chennai, India based online documents verification platform whose Microsoft Azure server exposed data of over…
This is a post from HackRead.com Read the original post: MyEasyDocs Exposed 30GB of Israeli and Indian Students PII Data

****MyEasyDocs is a Chennai, India based online documents verification platform whose Microsoft Azure server exposed data of over 57,000 students.****

The team of IT security researchers at vpnMentor led by Noam Rotem identified a misconfigured Microsoft Azure server that exposed the personal and educational records of tens of thousands of students from India and Israel.

The exposed server belonged to Myeasydocs, an online data verification platform based in Chennai, India. Myeasydocs specialises in verifying documents related to banking, colleges, universities, goverment institutians and law enforcement agencies.

To verify, users are required to submit their records via Myeasydocs’ software which are then uploaded to the company’s cloud server. In this case, it was a Microsoft Azure server left exposed without any security authentication.

This means anyone with a slight bit of knowledge about finding unsecured databases on Shodan and other such platforms would have complete access to the exposed data which contained 30.5GB worth of files belonging to 57,400 Israeli and Indian students.

> The breach we discovered was connected to an Israeli URL owned by a company that appeared to facilitate Indian students submitting documents to educational institutes in Israel and India.
> 
> vpnMentor – Blog post

Upon analysing the trove of data, researchers identified following records:

*   Grades
*   Full names
*   Subject Majors
*   Phone numbers
*   Email addresses
*   Dates of graduation
*   National ID and university/college registration numbers and more.

**Example Screenshot**

Screenshots show PII data and a University certificate (Credit: vpnMentor)

**Potential Dangers**

The severity of misconfigured and exposed databases can be quantified by the fact that earlier this year, Anonymous and its affiliate group of hacktivists compromised around 90% of Russian cloud databases that were exposed to the public without any security authentication or password.

In Myeasydocs’ case, considering the extent and nature of exposed data, the incident could have far-reaching implications. Such as bad actors could download the data and carry out identity theft, phishing scams, scam marketing campaigns, and education related fraud including making fake university degrees, certificates and passes. The possibility of malicious use of such documents is endless.

**Good News**

It is worth noting that the exposed server was discovered on Feburary 2nd 2022 however the details of the incident were only shared today on June 9th, 2022. Nevertheless, the good news is that due to vpnMentor’s ethical approach the exposed server has been secured.

The researchers managed to inform the Israeli Cyber Emergency Response Team (CERT) and the impacted company. On Feburary 14th, 2022 the miscofigured Microsoft Azure server was secured and its IP addresses were no longer accessible to the public.

**Misconfigured Databases – Threat to Privacy**

Misconfigured or unsecured databases, as we know it, have become a major privacy threat to companies and unsuspected users. In 2020, researchers identified over 10,000 unsecured databases that exposed more than ten billion (10,463,315,645) records to public access without any security authentication. 

In 2021, the number increased to 399,200 exposed databases. The top 10 countries with top database leaks due to misconfiguration in 2021 included the following:

1.  USA – 93,685 databases
2.  China – 54,764 databases
3.  Germany – 11,177 databases
4.  France – 9,723 databases
5.  India – 6,545 databases
6.  Singapore – 5,882 databases
7.  Hong Kong – 5,563 databases
8.  Russia – 5,493 databases
9.  Japan – 4,427 databases
10.  Italy – 4,242 databases

**More database Mess Ups**

1.  9,517 unsecured databases identified with 10 billion records globally
2.  New malware attack turns Elasticsearch databases into DDoS botnet
3.  Stripchat database mess up exposes 200M adult cam models, users’ data
4.  US and China Exposed Most Databases Among 308,000 Discovered in 2021
5.  Misconfigured ElasticSearch Servers Exposed 579GB of Users’ Website Activity

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

MyEasyDocs Exposed 30GB of Israeli and Indian Students PII Data

By Waqas
The FBI teamed up with European law enforcement authorities to dismantle the marketplace but couldn’t arrest its administrators.…
This is a post from HackRead.com Read the original post: SSNDOB Cybercrime Marketplace Seized in Intl. Coordinated Operation

****The FBI teamed up with European law enforcement authorities to dismantle the marketplace but couldn’t arrest its administrators.****

The US Federal Bureau of Investigation/FBI and the IRS, in collaboration with law enforcement authorities from Latvia and Cyprus, seized domains associated with the infamous SSNDOB Marketplace. The seized domains include the following:

*   Ssndob.ws
*   Ssndob.vip
*   Blackjob.biz
*   Ssndob.club

The seizure orders were executed on Tuesday, June 8th, 2022. SSNDOB was involved in selling stolen private data of users, which visitors could get access to after paying in cryptocurrency, to the marketplace administrators. The information was later used in phishing attacks, identity fraud, and extortion.

Blockchain analytics firm Chainalysis stated that the service received around USD22 million in Bitcoin across 100,000 transactions since 2015. Some users spent more than USD100,000 on bulk buying of PII.

The report highlighted that there could be a link between Joker’s Stash and SSNDOB. Joker’s Stash specialized in illicit trading of stolen PII and credit card data, and the service was shut down in 2021.

**SSNDOB’s Background**

SSNDOB is an underground cybercrime marketplace known for selling personally identifiable information (PII), including users’ names, email IDs, dates of birth, credit card and Social Security numbers, and passwords.

The marketplace ran a series of websites to sell PII. The administrators marketed the sites on the Dark Web cybercrime forums and offered customer support. The marketplace earned over USD19 million by selling private data of around 24 million victims, most of which are US citizens.

Moreover, the admins of SSNDOB employed numerous anonymity protection measures and detection evading techniques such as using online monikers to hide their identities, using servers from different countries, and asking for payments in cryptocurrencies, mainly Bitcoin and Litecoin.

Blockchain analysis: SSNDOB’s cryptocurrency transaction history and connections to Joker’s Stash (Credit: Chainalysis)

**SSNDOB – A Threat to User Safety**

The US Department of Justice (DoJ) explained (and as we know it) that if users’ private data lands in the wrong hands, the threat actors can exploit the victim in more than one way. For instance, identity theft can cause heavy financial loss to the victim, which can cause a “devastating impact on a victim’s long-term emotional and financial health.”

As per the special agent in charge of the IRS-Criminal Investigation Washington, DC Field Office, Darrell Waldon, the dismantling of SSNDOB will disrupt identity theft criminals and help millions of American citizens who were victimized.

>  “Special agents with IRS-CI’s DC Cyber Crimes Unit will continue to work with the US and international law enforcement community to end these complex scams, regardless of where the money trail leads them.”
> 
> Special Agent in Charge Darrell Waldon – IRS

**More Cyber Crime Forum Seizures**

1.  Feds seize WeLeakInfo.com for selling stolen databases
2.  Domain, server of DoubleVPN used by ransomware gangs seized
3.  Russia seizes Trump Dumps, Ferum, and SkyFraud carding forums
4.  Police shut down illegal video streaming app Mobdro with 100M users
5.  FBI Seizes RaidForums and Arrests Alleged Founder Diogo Santos Coelho

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

SSNDOB Cybercrime Marketplace Seized in Intl. Coordinated Operation

By Deeba Ahmed
The popular messenger app has transferred the data of its users to the German Federal Criminal Police Office.…
This is a post from HackRead.com Read the original post: Telegram Shared Personal User Data With German Authorities

**The popular messenger app has transferred the data of its users to the German Federal Criminal Police Office.**

Telegram handed over users’ personal details to the German Federal Criminal Police Office (BKA) in a somewhat controversial turn of events. This move will receive criticism from privacy advocates as the company has long been voicing claims that it will protect user data from governments.

**Data of Suspected Criminals Shared by Telegram**

According to Germany’s leading news service, Der Spiegel, the company has shared data of suspected terrorists and child abusers. Furthermore, Telegram stated that German authorities would not get data of its users suspected of other crimes.

Nonetheless, the move in itself signifies that Telegram has softened its stance regarding data privacy because it didn’t respond positively to German investigators before, despite many requests from authorities, and never shared the identities of its users.

**Telegram’s Stance**

Telegram has revealed that its cloud chat data is stored worldwide in various data centers. Different legal entities across multiple jurisdictions control these centers. Furthermore, decryption keys are distributed into multiple parts, and the company never stores them in one place to protect the data.

Therefore, the company can only be forced to reveal or share user data if it receives several court orders issued by different jurisdictions. No single government or block of countries can force it to compromise user privacy and the right to freedom of expression.

**Previous Coverage**

Telegram was founded in 2013, and in 2018, its founder Pavel Durov announced revising the company’s privacy policy as per which they will issue IP addresses and contact numbers if the court orders.

It is worth noting that German Interior Minister Nancy Faeser stated in January that Berlin might shut down Telegram, and authorities were planning with the EU to regulate it.

In February this year, the authorities held talks with Telegram’s top management and reportedly had a “constructive discussion on further cooperation.” Later, Telegram blocked around 64 channels in Germany after receiving shut down requests from the BKA.

**More Telegram News**

1.  Telegram Bots Stealing One-Time Passwords
2.  Telegram leaked IP addresses of its desktop app users
3.  Snowden Explains Why Telegram Messenger App is Unsafe
4.  One sticker could have exposed your Telegram secret chats
5.  142 Million MGM Resorts Records Leaked on Telegram for Free Download

Telegram Shared Personal User Data With German Authorities

By Owais Sultan
Remediation following ransomware is a long process during which companies have to do to protect their assets and…
This is a post from HackRead.com Read the original post: How to Recover From a Ransomware Attack

The results of a ransomware attack are different for every organization. You might have paid the ransom and the hackers came through with their end of the deal, i.e. gave you the key to your files. In other scenarios, you might have paid, and data has remained in the hacker’s hands.

If you’ve involved the authorities that used the encrypting device to recover the data, you might have gotten access to your files back without paying the ransom. Regardless of how you initially handled the situation, what follows is the period of remediation.

The recovery period following a cyberattack is the most damaging time for affected organizations. It has been known to drain the finances of companies completely. Also, it causes irreversible damage to the reputation of companies that disclosed the breach to the public.

For ransomware, it’s estimated that it takes between a week and a month to fully recover. Even if your important files are encrypted for just two days, it’s estimated that the downtime will last between 15 and 22 days. 

Downtime considers the time it takes for businesses to get back to 100 percent after the attack interrupts their workflow. Remediation time is crucial because it determines whether your company can get back on its feet — this time preferably stronger and better protected from possible ransomware.

How do you prevent further attacks and strengthen your security?

**Analyze the Documentation of the Attack**

Depending on how you handle the security of your company, your team might have had to remove the malware manually from devices. Alternatively, you may have the tools that decrypt data and remove the malware.

In both cases, you’re left with the forensic report of the incident. During the analysis, find out:

*   How many devices have been encrypted?
*   How did your IT team handle the attack?
*   How long have your files been encrypted?
*   How did the ransomware enter your network?
*   How did the malware bypass the anti-malware software you had?

The analysis of the documents that depict the attack will leave you with an overview of your system. It’ll give you a clear image of what you must work on to strengthen your security, as well as what the most vulnerable parts of your network might be.

**Patch Up Flaws in the System**

If there are any vulnerabilities in your network, they can lead to repeated ransomware attacks. Threat actors might be the same, or new hackers might be going after your organization.

To weed out the flaws in your system, consider how the malware entered your system. Ransomware can get into your system via a phishing email infected with malware that encrypts data.

Another common route for the virus to breach your system is via websites that contain a virus. Therefore, vulnerable parts of your cybersecurity posture could be your employees that need more training. Educate your employees on the protocols and basic cybersecurity hygiene.

That can prevent simple errors such as weak passwords, opening emails from unknown senders, and downloading infected attachments.

**Getting Your Business Ready for Ransomware**

Some actions you can take to protect yourself from possible ransomware include:

*   Backing up important data
*   Preparing the tools that can remove malware
*   Training your employees, deciding on protocols early

Invest in software that can detect malware and remove it from your system even before it can turn into an incident and encrypt your files.

Hackers fundamentally rely on human mistakes and members of your team that may not be familiar with cybersecurity issues or aren’t tech-savvy. They are the ones that might click on a link that leads to malware-infected websites.

Determine how your teams should handle the attack before they occur. How should they mitigate the attack? Does your organization need to report the incident and notify the public? Those are some of the answers you need in advance.

Back up your data in isolated places so that you can reach them even if hackers manage to conduct one more attack. Otherwise, ransomware can disrupt your workflow and set you back by blocking the access to files you need to run your company.

**Monitor the Network to Discover New Ransomware Attempts**

After the vulnerable parts of your system have been patched up, and you’ve set it up to be bulletproof in case of further attacks, it’s necessary to continually scan the system.

Even if you paid the ransom, there is no guarantee that you won’t be the repeated target of these attacks.

Your system is continually changing — sometimes within minutes. Those alterations can result in new flaws that can leave your organization vulnerable to repeated ransomware.

**How Long Until Everything Returns to Normal?**

Ransomware is a major setback for businesses. How long might it take them to recover after the ransomware? That depends on whether they have been preparing for such incidents and how many files have been decrypted.

Did they have the measures, tools, and protocols that govern what to do in case of such an incident?

For companies that were prepared, but hackers still managed to discover a vulnerability and install malware, the best-case scenario would be that their systems are down for two days.

Unprepared businesses can deal with the consequences of ransomware for months to come.

Some businesses never recover after a cyberattack. They may not have the finances to remedy the flaws in the system following the breach.

The extent to which devices have been hit by ransomware also matters. You might have lost the vital files that haven’t been recovered. In other cases, some of your information might have been leaked to the public.

**Hope For the Best, Prepare for the Worst**

A successful ransomware attack can leave IT teams and business owners with a lot of anxiety. 

The best you can do is to patch up flaws to prevent further attacks and get ready for a repeated attack.

Therefore, have the security solutions and protocols ready, employees trained, and continually scan the network to discover signs of the ransomware early.

**More Ransomware Topics**

*   Ransomware Attacks: Everything You Need to Know
*   US Military’s Hacking Unit to take on ransomware gangs
*   How To Prevent Growing Issue of Encryption Based Malware (Ransomware)
*   52 Critical Infrastructure Orgs Hit by Ragnar Locker Ransomware Gang – FBI
*   PoC Shows IoT Devices Can Be Hacked to Install Ransomware on OT Networks

How to Recover From a Ransomware Attack

By Deeba Ahmed
According to a Mandiant representative, the company was aware of LockBit 2.0 claims, but there was no evidence of…
This is a post from HackRead.com Read the original post: Cyber Security Giant Mandiant Denies Hacking Claims By LockBit Ransomware

****According to a Mandiant representative, the company was aware of LockBit 2.0 claims, but there was no evidence of a cyberattack as yet.****

The infamous ransomware-as-a-service group using a variant of LockBit ransomware (LockBit 2.0) has claimed to have successfully hacked Mandiant cybersecurity firm and threatened to release company files. 

The ransomware gang was first seen in September 2019 as ABCD ransomware and has since targeted thousands of organizations worldwide. In its latest attack, the LockBit ransomware gang claimed that it would release Mandiant data on its Dark Web portal.

The group further claimed that they have stolen 356,841 files from Mandiant, which they intend to leak online. For your information, LockBit 2.0 has hit many high-profile entities in the past including the following:

*   Bangkok Airways
*   Crypto exchange PayBito,
*   The French Ministry of Justice
*   Global systems integrator Accenture

**No Evidence of Hacking- Mandiant**

According to a Mandiant representative, the company was aware of LockBit 2.0 claims, but there was no evidence of a cyberattack as yet. After LockBit 2.0 posted its second threat message late Monday, the company released a statement.

In response, the company rep stated that there’s no indication that Mandiant’s security was compromised. Moreover, they noted that the gang could be trying to “disprove Mandiant’s June 2nd, 2022 research blog on UNC2165 and LockBit.”

**The Bone of Contention**

The group has reportedly reacted to Mandiant’s report (published on June 2nd, 2022) in which the company claimed that the off-the-shelf ransomware LockBit 2.0 was in use by the Russian Evil Corp affiliates dubbed UNC2165 to evade sanctions.

This group was sanctioned by the U.S. Treasury Department‘s Office of Foreign Assets Control (OFAC) in 2019. However, LockBit 2.0’s website displayed a note posted by the group claiming that they didn’t have any affiliation with Evil Corp and rejected Mandiant’s claims in the report.

> “Our group has nothing to do with Evil Corp. We are real underground darknet hackers, we have nothing to do with politics or special services like FSB, FBI, and so on.”
> 
> LockBit 2.0

As seen by Hackraed.com, the gang has released a note maintaining its claims of attack on Mandiant and addressing the company’s report published last week.

Screenshot from LockBit gang’s dark web site (Image: Hackread.com)

Lockbit ransomware group’s response to Mandiant’s blog post

As per Emsisoft threat analyst Brett Callow, this group has previously made several false claims. In some cases, the group claimed to steal data from different firms, so it is “entirely possible” that the claims made by LockBit 2.0 have no substance.

The timing of the disclosure of this attack on Mandiant is unusual as it comes when the RSA cybersecurity conference has just started, and Mandiant is to be acquired by Google in a whopping $5.4 billion deal.

**More Ransomware News**

1.  Ransomware Attacks: Everything You Need to Know
2.  Conti Ransomware Gang Hits German Wind Turbine Giant Nordex
3.  GoodWill Ransomware demands food for the poor to decrypt locked files
4.  Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware
5.  PoC Shows IoT Devices Can Be Hacked to Install Ransomware on OT Network

Cyber Security Giant Mandiant Denies Hacking Claims By LockBit Ransomware

By Owais Sultan
Let’s talk about how AI in cybersecurity protects the corporate networks of companies. Technological progress has not only…
This is a post from HackRead.com Read the original post: How to use AI in cybersecurity?

****Let’s talk about how AI in cybersecurity protects the corporate networks of companies.****

Technological progress has not only pleasing but also bad consequences. Together with the accelerated pace of corporate security systems development, new and more sophisticated types of cyber-attacks are emerging.

According to the World Economic Forum, the protection measures taken by enterprises become outdated instantly. Over the previous year, the number of attacks increased by 30%, and this alarming trend continues.

The market is short of about 2.72 million cybersecurity professionals to deal with the growing number of threats. This is where artificial intelligence can help businesses. Let’s talk about six AI use cases in cybersecurity.

**Statistics on AI use in cybersecurity**

Researchers contributing to the 2022 Cybersecurity Almanac predict that spending on fighting cybercrimes will rise to $10.5 trillion. This is three times more than in 2015 ($3 trillion). Given the fact that the amount of global data is growing, it becomes more difficult to track and prevent vulnerabilities.

For example, 80% of telecommunications organizations are confident that they will not be able to respond to cyber-attacks without AI. The professional sector is a target for cyber villains (934 incidents were recorded in 2020). The public sector, manufacturing, and healthcare suffer from cyberattacks.

In 2020, AI in cybersecurity was worth more than $10 billion, and by 2027, the price will increase by almost 4.5 times. IBM estimates that companies that lack AI spend three times as much to mitigate cyberattacks as companies with deployed automated tracking systems.

Nearly half of the managers surveyed by Capgemini say they use a smart algorithm to detect cyber threats. With its help, 34% of these professionals predict attacks and 18% respond to incidents.

Based on the above trends, Meticulous Research says that AI in cybersecurity will grow by 24% per year to reach $46 billion by 2027.

**Six main AI use cases in cybersecurity**

Imagine a campus that consists of several buildings. Getting inside is not difficult, because it is impossible to put a guard at each door. This is where AI helps: cameras read the faces of visitors and find those who “sit on someone’s tail” following employees with passes to enter buildings. This may be a worker who was too lazy to show a pass or a scammer.

The larger the office, the higher the risk of intrusion, and the more useful AI systems for face recognition are. In a video, an algorithm singles out people who violate the security policy. An image of a person’s face is compared with the database of staff members’ photographs; thus, the system defines if it is an employee or a stranger who decided to illegally enter the office.

If we consider the use of AI in a corporate network or on the Internet, we can talk about six main options for using a smart algorithm.

*   **Detection of malicious code and malicious activity in corporate networks**

AI automatically classifies domains by analyzing DNS traffic to identify C&C, malicious, spam, phishing and clone domains, and so on. Previously, to manage this environment, it was enough to have good blacklists. They coped with their task albeit with regular updates and with large volumes.

Today, domains are created in 1-2 minutes, used no more than 2-3 times within half an hour, and then criminals switch to other domains. To track them, blacklisting is not enough: you need to use AI technology. A smart algorithm learns to detect such domains and block them immediately.

*   **Encrypted traffic analysis**

According to Cisco, more than 80% of Internet traffic is encrypted. It needs to be analyzed. You can apply the “government man in the middle” scheme or use AI technology, which, without encryption and decryption, allows you to identify the following issues by metadata and network packets and without analyzing the payload:

*   Malicious code; 
*   Malware family;
*   Applications that are used;
*   Devices that work within the framework of an encrypted TLS session or SSL of one version or another.

These are technologies that work in practice and allow you to understand what is happening inside the encrypted traffic the volume of which is growing. And you needn’t invest much in it.  

*   **Detection of fake photos and substituted pictures.**

An algorithm recognizes whether the face of a person in the photo has been replaced with someone else’s picture. This feature is particularly useful for remote biometric authentication in financial services. It prevents scammers from creating fake photos or videos and presenting themselves as legal citizens who could be granted a loan. Thus, they won’t steal the money of others. 

*   **Recognition of voice, language, and speech.**

This AI feature is used to detect information leaks and read unstructured information in non-machine readable formats. This information enriches the data from firewalls, gateways, proxy systems, and other technical solutions that provide structured data.

Thus, you will know who and when accessed the Internet and whether they used corporate or departmental networks. AI helps enrich this information with data from news, company newsletters, and so on.

*   **Providing recommendations**

Based on statistics, AI makes recommendations on what protection tools to use or what settings need to be changed to automatically increase the security of a corporate network. For example, the Massachusetts Institute of Technology has created AI2, a system that detects unknown threats with a probability of up to 85%.

The more analyses the system performs, the more accurately it gives the next estimate due to the feedback mechanism. Moreover, a smart algorithm does this on such a scale and at such a speed that human defenders would not be able to handle.

*   **Automation of software vulnerability search**

A vulnerability is a bug in a program that allows someone to benefit from it (for example, extract data for sale, transfer money, steal private data from a phone, and so on). Thanks to AI, it has become possible to search for such errors automatically.

AI looks for vulnerabilities in a program and examines the application interface. If it finds ransomware on a computer, it immediately disconnects its user from the network, thereby saving the rest of the company from dangerous infection.

**Conclusion**

AI in cybersecurity has great prospects. But it must be handled reasonably, like any other technology. It is not a silver bullet and having even the most advanced technology does not mean 100% protection. AI will not save you from serious attacks caused by neglecting basic cybersecurity rules. A smart algorithm should be implemented if a clear ecosystem that can adapt to a changing corporate network has been built.

AI will be genuinely effective if it is developed, corrected, and tuned. This is time-consuming and difficult work, which will benefit if the technology is used carefully and not for the sake of being trendy.

**More AI Topics**

1.  Fields of application of artificial intelligence
2.  How Artificial intelligence (AI) Stops Cybercriminals
3.  ‘Optical Adversarial Attack’ uses a low-cost projector to trick AI
4.  Ways to Take Advantage of Artificial Intelligence in Technology
5.  Website uses Artificial Intelligence to create utterly realistic human faces