Snow
Forest
Mountains
Snow
Snow

Monthly Archives: June 2018

Ethereum

Ethereum “Giveaway” Scammers Have Tricked People Out of $4.3 Million

Category : Blog

Ethereum “Giveaway” Scammers Have Tricked People Out of $4.3 Million

Ethereum is a distributed public blockchain network. the Ethereum blockchain focuses on running the programming code of any decentralized application.

In the Ethereum blockchain, instead of mining for bitcoin, miners work to earn Ether, a type of crypto token that fuels the network.

Online crooks promoting fake “giveaways” have tricked people out of 8,148 Ether, currently worth around $4.3 million, according to statistical data compiled in EtherScamDB.

The EtherScamDB website was created by the team behind the MyCrypto wallet service for the purpose of tracking various types of online scams centering around the Ethereum platform and associated cryptocurrencies and assets.

For the past few months, the website has been inventorying various types of Ethereum scams, such as classic phishing sites that imitate legitimate apps and wallets, trust-trading sites that push inaccurate advice or recommendations, but also online giveaways scams that promise to multiply Ether funds if victims transfer crooks a small sum of money.

 

Ethereum

 

Twitter’s “Ether giveaway” scam problem

The latter category has recently become rampant on Twitter, and on a daily basis, the social network’s most popular tweets are often inundated by these “Ether giveaway” scams.

More precisely, this particular trend caught fire with crooks this past February after Bleeping Computer first reported that one particular scammer made $5,000 in one night just by posing as Elon Musk, John McAfee, and a few other celebrities on Twitter.

Soon after our report, scams of these types started to flood Twitter left and right, with crooks registering Twitter accounts with names similar to legitimate ones, and then posting misleading messages, asking users to donate funds to an Ethereum address to receive a multiplied sum as part of a limited offer giveaway.

 

scams

 

EtherScanDB tracks hundreds of fake giveway addresses

Some of these scams and the Ether addresses where crooks have been collecting “donations” for the fake giveaways have been tracked in the EtherScamDB.

According to a recent tweet by John Backus, founder of Bloom and Cognito, two blockchain-powered apps, crooks promoting these giveaway scams have made 8,148 Ether ($4.3 million) just from the Ether funds sent to the 468 Ethereum addresses tracked by the site.

This sum is obviously larger, since the website does not track all giveaway scams, but even so, this small statistics shows how big this problem is today.

 

blockchain

 

Twitter’s been slow to react

Twitter, in particular, has been slow to respond to users reporting ake accounts, sometimes taking days or weeks to suspend obvious clones. Nevertheless, with a limited support staff, and with all the hate speech and terrorist propaganda happening on the platform, it is somewhat understandable why Twitter has been slow to react.

In the meantime, spreading the word about this scam is probably the best way to educate users and remind them to pay attention to the Twitter handle from which these offers are being made.

But while some might think the consensus advice is to tell users to “pay attention to the Twitter handle pushing an Ethereum giveaway,” the actual sensible advice is to “not participate in giveaways” to begin with, since most of these are just plain ol’ scams.

 

Twitter

 

 

Highest Selling Technical Courses of Indian Cyber Security Solutions:

Certified Ethical Hacker Training in Bhubaneswar

Ethical Hacking Training in Bhubaneswar

Certified Ethical Hacker Training in Bangalore

Ethical Hacking Training in Bangalore

Certified Ethical Hacker Training in Hyderabad

Ethical Hacking Training in Hyderabad

Python Training in Bangalore

Python Training in Hyderabad

Python Training in Bhubaneswar

Microsoft Azure Training in Hyderabad

Microsoft Azure Training in Bangalore

Microsoft Azure Training in Bhubaneswar

Networking Training in Bangalore

Networking Training in Hyderabad

Networking Training in Bhubaneswar

Advance Python Training in Hyderabad

Advance Python Training in Bangalore

Advance Python Training in Bhubaneswar

Amazon Web Services Training in Hyderabad

Amazon Web Services Training in Bangalore

Amazon Web Services Training in Bhubaneswar

Certified Ethical Hacker Certification – C | EH v10

Summer Training for CSE, IT, BCA & MCA Students 

Network Penetration Testing training

Ethical Hacking  training

Python Programming training

Android Training in Bangalore

Android Training in Hyderabad

Android Training in Bhubaneswar

Diploma in Network Security Training

Android Development  training

Secured Coding in Java

Certified Network Penetration Tester 

Diploma in Web Application Security 

Certified Web Application Penetration Tester 

Certified Android Penetration Tester 

Certified Python Programming 

Advance Python Training 

Reverse Engineering Training  

Amazon Web Services Training  

VMware Training 

 

Cybersecurity services that can protect your company:

Web Security | Web Penetration Testing

Network Penetration Testing – NPT

Android App Penetration Testing

Source Web Development

Source Code Review

Android App Development

Digital Marketing Consultancy

Data Recovery

 

Other Location for Online Courses:

Bhubaneswar

Bangalore

Hyderabad


Weight Watchers

Weight Watchers IT Infrastructure Exposed via No-Password Kubernetes Server

Category : Blog

Weight Watchers suffered a small Security Breach

Weight Watchers is the registered trademark of Weight Watchers International, Inc.

Just like many companies before it, weight loss program Weight Watchers suffered a small security breach after security researchers found a crucial server exposed on the Internet that was holding the configuration info for some of the company’s IT infrastructure.

The exposed server was a Kubernetes instance, a type of software for managing large IT networks and easily deploying app containers across multiple servers, usually on a cloud infrastructure.

Dozens of servers containing Weight Watcher’s data were left exposed after the company failed to password protect software used for managing application containers, according to German cybersecurity firm Kromtech.

An Amazon cloud infrastructure used by Weight Watchers was left vulnerable—46 Amazon S3 buckets in total—including logs, passwords, and private encryption keys, Kromtech found.

 

Weight Watchers

 

Weight Watchers ran a no-password Kubernetes instance

Researchers from German cyber-security firm Kromtech discovered that Weight Watchers forgot to set a password for the administration console of one of its Kubernetes instances.

This granted anyone knowing where to look (port 10250) access to this servers, without the need to enter a username and password.

All in all, the Kubernetes instances exposed an administrator’s root credentials, access keys for 102 of their domains, and 31 IAM users including users with administrative credentials and applications with programmatic access.

Weight Watchers added that its internal team and a third-party forensics company investigated the incident and that “each has independently confirmed that there was no indication that any personally identifiable information was exposed,” a spokesperson said.

The exposure was the result of a misconfigured Kubernetes instance, Kromtech said. Kubernates is a tool developed by Google for managing large numbers of applications. Notably, a Kubernetes instance on Telsa’s cloud infrastructure was hacked earlier this year, and then used by the perpetrators to mine cryptocurrency.

 

Kubernetes

 

Unclear what data was exposed

It is unclear if someone else besides the Kromtech team discovered this Kubernetes instance, but an attacker with access to this server would have been able to access a large part of Weight Watchers’ network.

It is also unclear what kind of data (user details?) these servers were storing, as the Kromtech team could not go wandering off inside Weight Watchers’ network without violating a slew of laws.

Diachenko and the Kromtech team said they reported the exposed server to Weight Watchers, who quickly remediated the issue, thanking the researchers.

 

Unclear Data

 

Weight Watchers claims it was a non-production network

“We really appreciate the community working to make us all safer,” a Weight Watchers spokesperson said in its response to Kromtech.

“We have confirmed the issue – a security group for a test cluster in our non-production account was misconfigured during testing. The issue should be resolved and keys should be revoked. We’ve also implemented some safeguards to protect against this issue from recurrence.”

But Kromtech disputes Weight Watchers’ explanation that this was a non-production account. Nonetheless, today, a Weight Watchers spokesperson stood by its initial statement.

“Last week, Weight Watchers received a report from security researchers related to the exposure of credentials in one non-production AWS account,” a company spokesperson told Bleeping Computer via email. “The account was in a testing environment clearly labeled ‘nonprod’ and is used only to test new services and features.”

“To be able to test and innovate securely, we keep test environments completely separate from production environments. Our internal team and a reputable third-party security forensics team have investigated the exposed account key scope and activity, and each has independently confirmed that there was no indication that any personally identifiable information was exposed,” the spokesperson told us.

Weight Watchers is certainly not the first company to have to deal with a leaky or non-protected server. Other companies that suffered a similar fate include Tesla, Honda, Universal, and Bezop, just to name a few.

 

Kromtech

 

 

Highest Selling Technical Courses of Indian Cyber Security Solutions:

Certified Ethical Hacker Training in Bhubaneswar

Ethical Hacking Training in Bhubaneswar

Certified Ethical Hacker Training in Bangalore

Ethical Hacking Training in Bangalore

Certified Ethical Hacker Training in Hyderabad

Ethical Hacking Training in Hyderabad

Python Training in Bangalore

Python Training in Hyderabad

Python Training in Bhubaneswar

Microsoft Azure Training in Hyderabad

Microsoft Azure Training in Bangalore

Microsoft Azure Training in Bhubaneswar

Networking Training in Bangalore

Networking Training in Hyderabad

Networking Training in Bhubaneswar

Advance Python Training in Hyderabad

Advance Python Training in Bangalore

Advance Python Training in Bhubaneswar

Amazon Web Services Training in Hyderabad

Amazon Web Services Training in Bangalore

Amazon Web Services Training in Bhubaneswar

Certified Ethical Hacker Certification – C | EH v10

Summer Training for CSE, IT, BCA & MCA Students 

Network Penetration Testing training

Ethical Hacking  training

Python Programming training

Android Training in Bangalore

Android Training in Hyderabad

Android Training in Bhubaneswar

Diploma in Network Security Training

Android Development  training

Secured Coding in Java

Certified Network Penetration Tester 

Diploma in Web Application Security 

Certified Web Application Penetration Tester 

Certified Android Penetration Tester 

Certified Python Programming 

Advance Python Training 

Reverse Engineering Training  

Amazon Web Services Training  

VMware Training 

 

Cybersecurity services that can protect your company:

Web Security | Web Penetration Testing

Network Penetration Testing – NPT

Android App Penetration Testing

Source Web Development

Source Code Review

Android App Development

Digital Marketing Consultancy

Data Recovery

 

Other Location for Online Courses:

Bhubaneswar

Bangalore

Hyderabad

 

 

 

 

 


macOS

All New Privacy and Security Features Coming in macOS 10.14 Mojave

Category : Blog

macOS 10.14 Mojave coming with new Privacy and Security Features

macOS is a series of graphical operating systems developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple’s Mac family of computers. Within the market of desktop, laptop and home computers, and by web usage, it is the second most widely used desktop OS, after Microsoft Windows.

The new operating system will include a multitude of app redesigns, a new dark mode, and desktop versions of multiple iOS apps. One focus of the new OS is security and privacy. Mac users will now be a bit safer online thanks to these three changes coming to Mojave.

Apple CEO Tim Cook said the new features included in Mojave are “inspired by pro users, but designed for everyone,” helping you protect from various security threats.

 

macOS

 

Safari’s Enhanced “Intelligent Tracking Prevention”

It’s no longer shocking that your online privacy is being invaded, and everything you search online is being tracked—thanks to third-party trackers present on the Internet in the form of social media like and sharing buttons that marketers and data brokers use to monitor web users as they browse.

But not anymore. With macOS Mojave, Safari has updated its “Intelligent Tracking Prevention”—a feature that limits the tracking ability of website using various ad-tracking and device fingerprinting techniques.

The all-new enhanced Intelligent Tracking Prevention will now automatically block all third-party trackers, including social media “Like” or “Share” buttons, as well as comment widgets from tracking users without their permission.

 

safari

 

End-to-End Encrypted Group FaceTime (Up to 32 People)

This is a huge security improvement, as at WWDC 2018, Apple has introduced group FaceTime feature that lets groups of 32 or fewer people do video calls at the same time, which have end-to-end encryption just like the already existing one-to-one audio and video calls and group audio calls.

End-to-encryption for group calls with the Facetime app means that there’s no way for Apple or anyone to decrypt the data when it’s in transit between devices.

 

Encrypted

 

macOS Mojave Will Alert When Your Camera & Mic Are Accessed

As we reported several times in past few years, cybercriminals have now been spreading new malware for macOS that targets built-in webcam and microphone to spy on users without detection.

To address this threat, macOS Mojave adds a new feature that monitors access to your macOS webcam/microphone and alerts you with new permission dialogues whenever an app tries to access the camera or microphone.

This new protection has primarily been designed to prevent malicious software from silently turning on these device features in order to spy on its users.

 

malware

 

Excessive Data Access Request User Permissions

macOS Mojave also adds similar permission requirements for apps to access personal data like mail database, message history, file system and backups.

By default, the macOS Mojave will also protect your location information, contacts, photos, Safari data, mail database, message history, iTunes device backups, calendar, reminders, time machine backups, cookies, and more.

 

Data

 

Secure Password Management

It is a long warned users to deploy a good password practice by keeping their passwords strong and unique for every website or service. Now, Apple has made it easier in macOS 10.14 Mojave and iOS 12.

While Safari in macOS has provided password suggestions for years when users are asked to create a login at a site, Apple has improved this feature in a way that Safari now automatically generates strong passwords, enters them into the web browser, and stores them in the iCloud keychain when users create new online accounts.

Previously, third-party password manager apps have done that much of tasks, and now Apple is integrating such functionalities directly into the next major versions of both macOS and iOS.

 

Secure

 

 

Highest Selling Technical Courses of Indian Cyber Security Solutions:

Certified Ethical Hacker Training in Bhubaneswar

Ethical Hacking Training in Bhubaneswar

Certified Ethical Hacker Training in Bangalore

Ethical Hacking Training in Bangalore

Certified Ethical Hacker Training in Hyderabad

Ethical Hacking Training in Hyderabad

Python Training in Bangalore

Python Training in Hyderabad

Python Training in Bhubaneswar

Microsoft Azure Training in Hyderabad

Microsoft Azure Training in Bangalore

Networking Training in Bangalore

Networking Training in Hyderabad

Networking Training in Bhubaneswar

Advance Python Training in Hyderabad

Advance Python Training in Bangalore

Advance Python Training in Bhubaneswar

Amazon Web Services Training in Hyderabad

Amazon Web Services Training in Bangalore

Amazon Web Services Training in Bhubaneswar

Certified Ethical Hacker Certification – C | EH v10

Summer Training for CSE, IT, BCA & MCA Students 

Network Penetration Testing training

Ethical Hacking  training

Python Programming training

Android Training in Bangalore

Android Training in Hyderabad

Android Training in Bhubaneswar

Diploma in Network Security Training

Android Development  training

Secured Coding in Java

Certified Network Penetration Tester 

Diploma in Web Application Security 

Certified Web Application Penetration Tester 

Certified Android Penetration Tester 

Certified Python Programming 

Advance Python Training 

Reverse Engineering Training  

Amazon Web Services Training  

VMware Training 

 

Cybersecurity services that can protect your company:

Web Security | Web Penetration Testing

Network Penetration Testing – NPT

Android App Penetration Testing

Source Web Development

Source Code Review

Android App Development

Digital Marketing Consultancy

Data Recovery

 

Other Location for Online Courses:

Bhubaneswar

Bangalore

Hyderabad

 


RSAT

RSAT Will Automatically Be Reinstalled After New Updates in Next Windows 10 Version

Category : Blog

RSAT

(RSAT) Remote Server Administration Tools enables IT administrators to remotely manage roles and features in Windows Server 2012 R2, Windows Server 2012, Windows Server 2008, and  Server 2008 R2 from a computer that is running Windows 10, Windows 8.1, Windows 8, Windows 7, or Windows Vista.

RSAT allows administrators to run snap-ins and tools on a remote computer to manage features, roles and role services.

 

RSAT

 

RSAT Will Automatically Be Reinstalled After New Updates in Next Windows 10 Version

RSAT is a tool that allows administrators to manage Windows Server from a remote computer running Windows 10. For some time, Administrators have been complaining that when you install a new upgrade of Windows 10, the installed Remote Server Administration Tools would be removed. This is because each version of RSAT is tied to a particular version of Windows and thus you need to download and install the correct version for it to work properly.

In Windows Insider Preview build 17682, Microsoft has made the Remote Server Administration Tools (RSAT) an on-demand software feature. What this means is that once you install RSAT in Windows 10, it will be automatically reinstalled when you install a future operating system update.

Once it is installed as a feature, Windows 10 will automatically reinstall it after you upgrade to another version of the operating system.

 

Windows 10

 

Configuring Remote Server Administration Tools (RSAT) Through Optional Features:

In the future, to set up RSAT as an on-demand software feature, admins can go into the “Manage optional features” settings as shown below. To access this screen, just search for “optional features”.

To add the feature click on the “Add a feature” button. Microsoft will then build a catalog of available features, which may take some time, so please be patient.

Once you install an RSAT tool using this method, it will always be reinstalled when Windows 10 is updated in the future.

As this is currently a new feature in the latest Windows Insider build 17682, you will not see it in the current version of Windows. If you wish to test this feature, you can sign up as a Windows Insider and install the latest build.

 

Server Administration Tools

 

 

Highest Selling Technical Courses of Indian Cyber Security Solutions:

Certified Ethical Hacker Training in Bhubaneswar

Ethical Hacking Training in Bhubaneswar

Certified Ethical Hacker Training in Bangalore

Ethical Hacking Training in Bangalore

Certified Ethical Hacker Training in Hyderabad

Ethical Hacking Training in Hyderabad

Python Training in Bangalore

Python Training in Hyderabad

Python Training in Bhubaneswar

Microsoft Azure Training in Hyderabad

Networking Training in Bangalore

Networking Training in Hyderabad

Networking Training in Bhubaneswar

Advance Python Training in Hyderabad

Advance Python Training in Bangalore

Advance Python Training in Bhubaneswar

Amazon Web Services Training in Hyderabad

Amazon Web Services Training in Bangalore

Amazon Web Services Training in Bhubaneswar

Certified Ethical Hacker Certification – C | EH v10

Summer Training for CSE, IT, BCA & MCA Students 

Network Penetration Testing training

Ethical Hacking  training

Python Programming training

Android Training in Bangalore

Android Training in Hyderabad

Android Training in Bhubaneswar

Diploma in Network Security Training

Android Development  training

Secured Coding in Java

Certified Network Penetration Tester 

Diploma in Web Application Security 

Certified Web Application Penetration Tester 

Certified Android Penetration Tester 

Certified Python Programming 

Advance Python Training 

Reverse Engineering Training  

Amazon Web Services Training  

VMware Training 

 

Cybersecurity services that can protect your company:

Web Security | Web Penetration Testing

Network Penetration Testing – NPT

Android App Penetration Testing

Source Web Development

Source Code Review

Android App Development

Digital Marketing Consultancy

Data Recovery

 

Other Location for Online Courses:

Bhubaneswar

Bangalore

Hyderabad