Snow
Forest
Mountains
Snow
Snow

Author Archives: admin

Why Shopping Mall is being targeted by Hackers?

Category : Blog

Why Shopping Mall is being targeted by Hackers?

Last few years were critical for many companies in the E-commerce sector, due to the high amount of cyber-attacks and emerging threats.

 

Study of Business Insider shows that for the period of one year at least 16 separate security breaches have occurred at large retailers. Many of them are due to security flaws in payment systems.

 

Recent report by shape Security showed that many people that log in to a retailer’s E-commerce site are hackers using stolen data. This is the highest percentage of any sector. Some of the largest retailers like Adidas, Macy’s, Best Buy, Forever 21 and others have been affected. Large amount of compromised data is being sold on “dark web”, including databases with personal data, credit card numbers and confidential corporate data, used by the competitors.

 

Lets See What CEO of Indian Cyber Security Solutions, Mr. Abhishek Mitra has said about this

 

 

 

Another issue in the sector is being caused by the high amount of IoT devices, which allow more and better ICMP and DDOS attacks to be crafted. Many vulnerabilities are caused due to input validation errors, client side gaps, vulnerabilities in database servers or network related vulnerabilities.

It is very important for an E-commerce organization to provide layered security infrastructure, as well as to perform regular assessments in order to check the security of their systems, networks, web and mobile applications and employees.

GDPR and other law requirements provide a strong challenge for most organizations, operating with personal data.

In the white paper we will observe the following topics:

  • Some of the issues that you can face.
  • Famous attacks in the sector.
  • Protection mechanisms.
  • Basic security measures.

 

 

Attacks Shopping mall industry have seen in past

 

Malware

Malware is malicious software, developed by malicious hackers to gain access or cause damage to a computer system or network, often without the knowledge of the affected user.
Malware is often called ‘computer virus’, although there are big differences between these types of malicious software.

Magento and other E-commerce platforms are particularly vulnerable to widespread malware infections due to their prevalence in the market. Malware can perform an extremely wide range of activities. It can use your computer as part of a botnet in order to launch DDOS attacks, steal credit card numbers or sensitive account information from the users of your website. A famous malware, intended to target Magento sites, had the functionality to extract credit card information and store it in images so that the attacker could easily access it without raising any alarms.

 

 

 

 

Log Injection

Log files can be used by an attacker to inject malicious content or forge log entries if there is a vulnerability which allows unvalidated user input to be written in the logs.

Log injection vulnerabilities occur when the data comes from an untrusted source or the data is written to an application or system log file.
Log files are typically used by the applications to store a history of events or transactions which could be later reviewed. Logs could also be used for statistics gathering, or debugging. Depending on the application’s functionality, log files could either be reviewed manually or with the help of automated tool that automatically reads logs and searches for trending information or important events.

Log files might get corrupted if an attacker can supply data to the application that is subsequently logged verbatim.

 

 

 

 

Bad bots

Bots have many names – crawlers, spiders, Internet robots, web bots and more. They are frequently used to perform repetitive jobs and simple tasks, like indexing a search engine. However they often come as part of a malware. They are used to gain full control over a computer system. Some of them have the functionality to infect the host and connect back to a CNC (command and control) central server(s), which could be used to control a network of compromised computers and hosts.

 

  • Fraud – Bots can prevent your legit users from purchasing items by sending many purchasing requests for an item in order to make it appear out of stock for your clients. They can also list your items for sale in other sites at a lower price. Bots could also be used to attempt to brute-force the credentials of your consumers. In case of a successful login they can also resell the information to a third party. In case that someone is able to use the credit card of your clients, that could ruin the trust among them.

 

  • Price Scraping – Price scrapping is a technique used to craw an online store for its prices along with product catalog information, with the help of bots. It is often used by competitors in order to steal the dynamic pricing of a website, which is extremely important in the E-commerce platforms. The reason for this is that many consumer-buying decisions and revenue forecasts rely on the real-time dynamic pricing. Such hacking method would allow the competitors to set prices lower than baseline prices in the marketplace and therefore attract more consumers.

 

  • Analytics Bots can have a high impact on the analytics of your selling campaign, by imitating human behavior. Many of them use scripting code like JavaScript, which is also the mechanism most analytics tools are using to bounce rate, conversion rate, count page views and more. Such attacks could convince you to spend more money on advertising, compromise your metrics and lower your conversion rate.

 

Phishing

Hackers may try to attack your E-commerce business by launching phishing campaigns. For the purpose they might craft fake emails, phone calls and SMS messages. Hackers can also inject malicious JavaScript snippets to checkout pages in popular E-commerce platforms like Magento, Woo Commerce, PrestaShop and others. Many merchants use PayPal as a payment method, which means that if PayPal account gets suspended it will limit the consumer’s ability to purchase new items. That makes merchants to consider important if they receive an email claiming to suspend their account due to malicious or unusual activity. If they lack security awareness, merchants may follow a fake page link and according to the instructions provide their login credentials. They can also download, complete and submit invoices, bills and proposals in the form of attachment, which will provide the cybercriminal with their user names and passwords and full access to the merchant’s PayPal account. The attachment could also auto-install malicious software on the victim’s computer.

 

DDoS

 

A distributed denial-of-service (DDoS) attack is a malicious attempt to disrupt normal traffic of a targeted server, service or network by overwhelming the target or its surrounding infrastructure with a flood of Internet traffic. DDoS attacks achieve effectiveness by utilizing multiple compromised computer systems as sources of attack traffic. Online stores are especially vulnerable to those attacks especially during discount periods, like Black Friday. However, there are easy to implement measures, to protect against such type of attacks.

 

Vulnerabilities in firewall

 

Firewalls are usually important assets of every network security infrastructure. Their job is to restrict the inbound do outbound access and vice versa to specific IP addresses and networks. Firewall vulnerability might be caused because of an error made during firewall design, implementation, or configuration that can be exploited to attack the trusted network behind the firewall. Some common firewall vulnerabilities and misconfigurations include:

  • Allowed ICMP traffic.
  • Blocking traffic, instead of dropping it.
  • Lack of port restriction.
  • Unrestricted access to specific IPs and networks.
  • Unnecessarily open TCP and UDP ports.

 

 

Preventive measures in Shopping Mall industry:

  1. Trademark your company name and logo
  2. Use a trusted ecommerce platform
  3. Use HTTP with SSL = HTTPS
  4. Make sure your site is PCI DSS compliant
  5. Keep your site updated
  6. Require strong passwords
  7. Know the signs of fraud

5 most demanding skills in cyber security by ICSS

Category : Blog

5 most demanding skills in cybersecurity

 

The demand for cybersecurity professionals has become an essential part of all modern organizations. Due to the lack of expertise and insufficient skills, companies are unable to find and locate suitable candidates for this field. If you want to start your career in cybersecurity and have the ability to get an advantage of this opportunity, then you must increase your expertise and build the right skills.

 

The main issue is, technology is reshaping itself with the new innovations hence a cybersecurity professional must have to be active and updated with the new sets of technology. This article will help you to take a look at the required cybersecurity skills for 2019.

 

 

Internet of Things (IoT):

Although people understand the importance of “internet of things” (IoT) but still security loopholes exist. The cybercriminals get advantages of such loopholes and also they try to exploit the gaps. Therefore, you must need to develop your skills in IoT in order to safe interconnected networks and devices. With IoT practices being adopted by numerous industries, from agriculture to commercial, management to energy, picking up strong IoT security skills can aid you seriously in the coming years.

iot picture icss

 

Vulnerability Valuation:

 In the modern organization, a large amount of big data is used and transferred from one device to another. Data continues to increase in value hence you must need to apply new rules and regulations to safe data effectively. In modern devices, all the data gathered by manufacturers, businesses, and banks contain personally identifiable data that can also be used for malicious activities, like financial fraud and identity theft, etc. To secure your data on a regular basis, you need to continue with a vulnerability assessment.

 

VAPT Vulnerable

 

Customer Services:

In many organizations, the IT section requires a vast and energetic number of people working in tandem to fulfill tasks and meet necessities. These teams, including cybersecurity, must possess the customer service skills as there is a persistent need to communicate with the organizations’ internal staff or other partners, clients, and co-workers.

 

customer service

 

Malware Defense:

 Organizations including small enterprises never want their personal information and privacy to be leaked on the internet. Numerous incidents are observed where companies lost their precious data and brand perception after cyber-attack. Therefore, you must have the skills to handle such situations. In order to understand the need of the modern world, EH Academy offers the all-time best “Complete Ethical Hacking Bundle”. This bundle is well-designed and equipped with modern techniques of ethical hacking.

 

malwar

 

 

Artificial intelligence & Machine Learning:

Modern technology has minimized the involvement of humans. The same rule applies to cybersecurity professionals. You must have sufficient skills to use machine learning and artificial intelligence to identify new loopholes and weaknesses and averting malicious botnet or Ransomware attacks.

 


Why IOT industry is being targeted by Hackers?

Category : Blog

Why IOT industry is being targeted by Hackers?

We are living in a connected world, where nearly all devices are becoming connected.

The internet of things (IoT) is coming up in a big way and with amazing opportunities – but it also brings serious security threats.

IoT connects physical devices, so the hacking of IoT devices has the potential to cost human lives.

Further implications can be access to unauthorized and potentially confidential data that can then be used for other crimes.

 

Let Us See what our CEO, Abhishek Mitra have to say about IoT Hacking:

 

What type of attacks IOT based industry have seen in past?

 

 IoT devices have potential security vulnerabilities like weak passwords and other poor default security settings, lack of encryption when devices communicate over the network, and poor (or non-existent) user-serviceable device management.

Due to these vulnerabilities, many IoT devices are surprisingly easy to attack.

 

Ransom attack

Researchers at cybersecurity firm McAfee called the past months “the quarter of data dumps” in an alarming report released on Wednesday. 

The 40-page survey of the security landscape found more than 2.2 billion stolen account credentials were made available on the cybercriminal underground this quarter and hackers had even figured out ways to break into Wi-Fi enabled coffee makers.

“The impact of these threats is very real,” said Raj Samani, McAfee fellow and chief scientist.

“It’s important to recognize that the numbers, highlighting increases or decreases of certain types of attacks, only tell a fraction of the story. Every infection is another business dealing with outages, or a consumer facing major fraud. We must not forget for every cyberattack, there is a human cost.”

News from where this incident have been taken.

 

 

It is a small video on Ransom Attack:

 

 

IOT BOTNET ATTACK

A new IoT botnet named Ares is infecting Android-based devices that have left a debug port exposed on the Internet.

Among this botnet’s most common victims are Android set-top boxes manufactured by HiSilicon, Cubetek, and QezyMedia, cyber-security firm WootCloud said today. Check Out Here

 

VIDEO ON BOTNET RECENTLY SHOWCASE IN 2019:

 

 

 

What kind of action or preventive measures have saved the industry from being hacked and face humiliation?

 

  1. Learn how to maintain the security of IoT devices.Consumers need to protect their IoT devices the same way they would their smartphones, tablets and home computers. Look for ways to set strong passwords, reading the manuals for instructions on how to lock down these devices.

 

  1. Clean out old apps.Many of us tend to keep apps indefinitely, even if we don’t use them. Check your devices periodically and delete apps you no longer use.

 

  1. Own your online presence.Understand what information your devices collect and how they it is managed and stored.

 

  1. Do your research.Before you purchase an IoT device, do a search to see if it has had security problems with it and if it can be easily hacked.

 

  1. Change the default setting on the home router.This is worth reiterating: Strong passwords on home routers can prevent the type of DDoS that happened last Friday to Dyn.

Why healthcare industry is being targeted by Hackers?

Category : Blog

Why healthcare industry is being targeted by Hackers?

Health care is one of the most important industries. While other sectors focus on products people want, the medical field provides a service the public actually needs. Sadly, this altruism isn’t rewarded. Hackers are increasingly targeting these institutions with their nefarious plots, and a lot of patients are getting caught in the crossfire. The problem here is that quite a lot of people don’t understand the threat facing the health care industry right now. News reports of retailers and financial institutions getting hacked have people thinking these are the most targeted sectors, but this just isn’t true. Analysis of 10 years of cyber-attack data actually points to health care as being the most hacked industry out there. Clearly, hackers have a lot of motivation to go after these kinds of institutions. However, hospitals don’t really come to mind when most people think of an easy buck.

 

Why hackers target Hospital or healthcare industry 

Healthcare organizations collect and store vast amounts of personal information, making them a major target for cyber-criminals. This valuable data can be used for identity theft, says Peter Carlisle, head of EMEA at cloud and data security company Thales security. “In the US, stolen personal health insurance information can be used by criminals to obtain expensive medical services, devices and prescription medications, as well as to fraudulently acquire government benefits like Medicare or Medicaid.”

Healthcare breaches are especially serious because personal data can, in some cases, mean the difference between life and death. For example, says Carlisle, it could cause medications to become mixed up – or people might fail to get treatment for conditions such as diabetes. Making things worse, healthcare providers often struggle to find room in tight budgets to invest in new IT systems, leaving them vulnerable. “Compliance issues are commonplace in healthcare too, where organizations need to meet stringent requirements of governing bodies such as HIPAA,” Carlisle adds.

 

Why a VAPT service could have been a good habit to prevent hack?

 

NOW LET US SEE WHAT CEO OF ICSS HAD SAID ABOUT THIS TOPIC

 

 

 

What type of attacks healthcare industry have seen in past?

 

Security concerns are growing exponentially in healthcare, as hospitals become the most financially lucrative targets for cyber-attackers. The main reason for the increase in cyber-criminals targeting the healthcare industry is for the ease with which hackers can pull vast amounts of personal data from aged systems that lack necessary security features. The main reason for the increase in cyber-criminals targeting the healthcare industry is for the ease with which hackers can pull vast amounts of personal data from aged systems that lack necessary security features.

 

THE “KANE” INCIDENT

 The theft or even alteration of patient data had been a looming menace long before Dutchman “Kane” compromised Washington University’s Medical Center in 2000. The hospital at the time believed they had successfully detected and cut off the attack, a belief they were rudely disabused of six months later when Kane shared the data he’d taken with Security Focus journalist Kevin Poulsen, who subsequently published an article describing the attack and its consequences. This quickly became global news. Kane was able to stay hidden in the Medical Center networks by allowing his victims to believe they had expelled him. He did this by leaving easily discoverable BO2K Remote Access Trojans (a tool developed by the hacker group, “Cult of the Dead Cow” and popular around the turn of the century) on several of the compromised servers while his own command and control infrastructure was somewhat more discrete. The entire episode is well documented online and I suggest you read up on it, as it is both an excellent example of an early modern APT and a textbook case of how not to deal with an intrusion—procedurally and publicly.

CLICK HERE to See the original article

 

Ransomware

Notable Example: Presbyterian Medical Center

 

One of the more common types of attack occurring in 2016 has been ransomware. When this occurs, a hacker infiltrates the network and accesses data. It is then copied over and encrypted. Once encryption is complete, the original data will be deleted and data will be inaccessible until a ransom is paid. This usually results in an inability to access the EHR while the application is locked down; any communication has to be completed via telephone calls or faxes, resulting in an overall delay in patient care.

This recently occurred at Hollywood Presbyterian Medical Center in February 2016. Hackers used malware to infect the computers at the facility and stopped communication between devices. They demanded a ransom of $17,000 to restore their applications back to fully functional. Physicians were unable to access medical records for more than a week and they were forced to utilize paper record keeping until the facility ultimately paid the requested amount. While Hollywood Presbyterian stated that patient care was not impacted, patient history could not be viewed and test results could not be shared from lab work, X-rays, and more. It is believed that this occurred because an employee opened an infected email or downloaded the malware from a pop-up ad which brought the virus onto the network. A few weeks later, a group of Turkish hackers claimed responsibility for the attack which may mean that the motivation of the attack was not to steal patient data for financial means but as a political statement.

 

 

 

 

What kind of action or preventive measures have saved the industry from being hacked and face humiliation?

These days most of our important transaction happens over internet. The hackers have numerous ways to steal important data which is then put to misuse. Below there are five most common ways your data can be stolen and the precaution you can take to stay safe:

 

1. Phishing

 

Phishing is a fake email masquerading as legitimate. Hackers create phishing emails through which they intend to steal your confidential information like passwords and bank account details. This kind of email appears to have come from a well-known person or organization like your bank or company that you work for. These emails generally try to create an urgency or panic to trick users into giving out their personal details. For example, you receive an email from your bank saying that your ATM card has been disabled and you need to confirm your card number or your Aadhaar number to re-activate it. A victim who has received this email might think that it is from a legitimate source when in reality this email has been sent from a malicious hacker trying to steal your confidential information.

 

 

HOW TO PREVENT IT:

Look for spelling or grammatical errors in domain names or email addresses. Cyber criminals also often use email addresses that resemble the names of well-known companies but are slightly altered. For example, accounts@gmall.com instead of accounts@gmail.com (“l” instead of “i”).

Think twice before clicking any links. If you see a link in a suspicious email message, don’t click on it. Instead, hover your mouse on the link to see if the URL matches the link that was provided in the message.

Cyber criminals often use threats that your security has been compromised or your account has been blocked. Don’t fall for such tricks. Take your time to assess the situation.

 

2. Insecure Network:

Connecting your system or device to an insecure network can create the possibility of a hacker gaining access to all the files on your system and monitoring your activity online. A hacker in control of your system can steal passwords of your social accounts, bank accounts and even inject malware on authentic websites that you trust. With programmes freely available on the Internet, anyone can sit in a car outside your home and access your critical files, accounting data, usernames and passwords, or any other information on the network. A competitor in possession of such in-depth knowledge of your official documents can be a damaging or even fatal threat to your business.

 

HOW TO PREVENT IT:

Never connect to open Wi-Fi networks that you can’t trust. Just because it’s free, it doesn’t mean it’s safe too. When in a cafe with a Wi-Fi facility, ask the staff for the Wi-Fi you can connect to instead of randomly connecting to any open network.

If you are using a public Wi-Fi, avoid performing any bank transactions or accessing any critical information while being connected.
Use strong encryption like WPA2 on your home and office Wi-Fi router instead of Open or WEP security as these can easily be hacked.

Your security is in your own hands. Stay cautious and alert at all times. Always remember, someone, somewhere is trying to hack you and basic security practices mentioned above can protect you from most hacks.

 

3. Insecure API

There is a big misconception that every app available on Google Play store or Apple store is safe and legitimate. However, this is not the case. Not every app available on these stores is safe for users. Some of these apps may contain malicious code that can put your privacy at risk.

 

HOW TO PREVENT IT:

Always check the permissions before downloading an app.

Check reviews and ratings.

Avoid downloading an app if it has less than 50,000 downloads.

Do not download apps from third party app stores.

Never download pirated/cracked apps.

 

4. Malware:

Malware is a malicious software that is written with the intent of compromising a system and stealing the data available on the system. These programmers can perform a variety of functions some of which include stealing or deleting sensitive data, modifying system’s core functionalities, and secretly tracking the victim’s activities. There are various factors that can lead to the installation of malware in your system. One is running an older or pirated version of an operating system which is not safe or updated and thus vulnerable to attacks. Clicking on unknown links or installing fake/pirated software can also lead to downloading of malicious programmers.

 

HOW TO PREVENT IT:

Use a legitimate anti-virus software.

Do not download any fake software as there are chances it may contain malware.

Never click on fake antivirus pop-ups that are generated from websites.

Always keep your operating system updated.

Never download pirated apps/software as they always contain some kind of malware.

 

5. Physical Threads:

A physical threat is any threat to your sensitive information that results from other people having a direct physical access to your devices like laptops, hard drives and mobile devices.

Physical security threats are often underestimated in favor of technical threats such as phishing and malware. Physical device threats occur when someone is able to physically gain access to your confidential data like data gathered from stolen devices.

Physical security breaches can happen at your workplace or even at your home. For example, someone could get hold of your confidential files that they are not supposed to see or access an unattended system which is not password-protected.

 

HOW TO PREVENT IT:

 Be careful how you store confidential information. Use encrypted computer hard drives, USBs, etc if they contain sensitive information.
Never write your passwords on a post-it or notepad.

Never leave your system unattended. Always protect it with a strong password.

Don’t leave your phone unlocked and unattended.

Make sure proper backup and remote wipe services are enabled in case you lose your device.


How Android App Testing Is Important

Category : Blog

How Android App Testing Is Important

 

Android, the world’s most popular mobile platform, has made a revolution in the mobile industry. Today, Android is not just a mobile platform, rather it is one of the best ways to accomplish business and personal needs in a most efficient manner. The credit for making the Android app more popular goes to user-friendly Android App. You can use the full potential of your Android smartphone when you install high-quality Android apps that make your life easier.

As most people expect, a good Android app is one that gives great user experience, and free from any errors and bugs. Today, people have a plethora of options in choosing Android apps. So, even a slight error or few bugs can make them disliking or uninstalling the app. So, it is utmost of importance that the Android apps are tested for bugs and errors before publishing on the Play Store.

To develop an equally user-friendly and technically sound app, app developers put considerable effort. So, they never want to publish their apps with bugs and errors. To make sure app program is error and bug-free, both development and testing teams need to take utmost care when writing code and testing app respectively. Sometimes, it is also needed working for both teams together.

 

android app development

 

Advanced Testing Tools

 

It is difficult to achieve error-free app testing manually. So, the testers use advanced testing tools to make app error-free. Releasing a beta version of the Android app and passing it to the testing team can fasten the app testing process. Once testing is done, the developers should collect the test results and make any required changes.

There are many advanced testing tools available in the digital world that helps the developers to release the beta version of the app and share it with the testers. So, the testers can easily capture the errors by proper use of testing tools. This procedure ensures that the app you will publish on the app store is free from the errors and sure to give a great user experience.

 

advanced android app

Android App Testing

 

As Android is one of the most popular and secure mobile platforms, apps published it on should be error-free. Because, if your app is not error-free, it might fail to attract users. If so, that could be a big obstacle for your Android app development success.

Android offers many tools that help testers to effectively test the apps. The framework itself is equipped with a testing framework that is useful to test all aspects of the app. You can use SDK tools to set up and run test applications. You can perform the test within the emulator or on the device.

 

android app testing

 

Features of Android App Testing

 

The Android testing framework is one of the most important parts of the development environment. It gives architecture and powerful tools, which you can use to test every part of your application. You can also use it to test every level of the app development from the unit to the framework.

 

  • Android testing tools are JUnit based. A class that doesn’t call the Android API can be tested using plain JUnit. Android components can be tested using Android’s JUnit extensions.
  • Android JUnit extensions given component-specific test case classes can be used to prepare mock objects and methods, which is useful to control the lifecycle of the component.
  • Testers can use SDK tools available in Eclipse with ADT for building and tests. These tools create different files of the test package.

Since testing is one of the most important phases of Android app development, mobile app developments can’t ignore this step. Ignoring this step can be a big impediment to your Android app’s success. So, to develop an error-free app, you have to choose a well-versed Android App Development

 

features of android app

 

 Conclusion

Android, being a secure and popular platform, needs to be handled very carefully. You need to create apps that are bug-free if you want users to use your app. Otherwise, it may just fail. As such, Android app testing services are not only recommended but also inevitable for the success of your app. These days, there are several tools available to make it more effective. Use them to your advantage and make your app hit it in the Store.

There are a number of advanced tools available these days that make the whole process much simpler and faster. There are tools for releasing beta versions which could help the developers pass on the testing build really fast. The testing team could immediately get to work and get the results. Various testing tools could be used as per the requirements and scope of the app. Such advanced methods make sure that nothing is missed out, and one does not waste any time in the process. The end result is a bug-free app that makes the users happy and generates good revenue for the company.

 

android app development

 


A Few Quick Tips About VAPT Benefits

A Few Quick Tips About VAPT Benefits

Category : Blog

A Few Quick Tips About VAPT Benefits

 

Vulnerability assessment and penetration testing is the most comprehensive technical park for cybersecurity auditing. It includes assessing for vulnerabilities, penetration testing, reporting and parching of your company’s web/mobile applications and networking infrastructure. Whereas the vulnerability assessment aims at finding the security gaps in the application, penetration testing actually exploits the gaps discovered to generate a PoC (Proof of Concept). Vulnerability assessment and penetration testing are crucial activities in web application security assessment. They constitute a part of secure code development and are of utmost importance in today’s date of complex cyber-attacks. A website that has not been sufficiently assessed for common vulnerabilities may prove a treasure for hackers as they might attack such insecure websites to gain access to underlying databases leading to data breaches. Not just this, hackers may even add hidden malicious code in your website code that may lead anyone to visit your website, being unconsciously infected.

VAPT is a step in the right direction from the perspective of website security and with advanced automated off-the-shelf tools available the time for vulnerability discovery is slowly converging.  Know the type of VAPT is best for your environment and secure your website today.VAPT is an extremely significant exercise in web application security assessment. VAPT establishes a piece of secure code development and is of integral significance in today’s day and age of complicated cyber assaults. Here are some of the key benefits of Vulnerability assessment and penetration testing. Vulnerability assessment and penetration testing are the most far-reaching technical park for digital security reviewing. It is inclusive of the incorporation of surveying for vulnerabilities, penetration testing, announcing and parching organization’s web/portable applications systems administration framework. Vulnerability assessment aims for finding the security gaps in the application, on the other hand, penetration testing really exploits the security holes found to create a PoC.

VAPT Introduction

What is the significance of VAPT?

 

VAPT  is an extremely significant exercise in web application security assessment. VAPT establishes a piece of secure code development and is of integral significance in today’s day and age of complicated cyber assaults. A website that has not been adequately surveyed for regular vulnerabilities may present a glorious opportunity for unethical hackers enticing them to gain access. Not only this, unethical hackers may even include malware and malicious code in a website code that may lead anybody visiting your site, being unwittingly affected.

VAPT is a positive development from the point of view of site security and with cutting edge computerized off-the-shelf tools accessible the time-lapse for vulnerability revelation is steadily reducing. Vulnerability Assessment and Penetration Testing is a testing procedure to discover bugs inside a software program and is regularly misconstrued as two unique kinds of testing methods. VAPT’s objective is to look for and discover bugs.  Penetration Testing is performed to see whether the vulnerability exists by investigating and misusing the framework.

VAPT Applications

Here are some of the key benefits of Vulnerability assessment and penetration testing. 

1.Discovers vulnerabilities 

The primary objecting of Vulnerability assessment and penetration testing conducted by one of the many top vape companies is to discover vulnerabilities in a security framework but not all of them. This is primarily because the quantity of recognized vulnerabilities is directly proportional to the time span of the test and the abilities of the analyzers. Be that as it may, a penetration test centers around the high hazard vulnerabilities and, if none are discovered, it investigates vulnerabilities that are medium and low-risk. That is to improve the security of the frameworks, different penetration tests and vulnerability assessments ought to be performed intermittently.

2.Exposes danger of vulnerabilities 

Because of the way, penetration testers from a top vape company in Bangalore or anywhere else for that matter may endeavor to exploit the distinguished vulnerabilities, the customer can perceive what a hacker could do if those vulnerabilities were actually abused. Once in a while, a vulnerability that is hypothetically delegated as high hazard can be appraised as a medium or low hazard on account of the difficulty levels of the supposed exploitation carried out by penetration testers. Then again, low-risk vulnerabilities may have a high effect as a result of the unique context so they may turn out to be high risk. Besides, human investigation of vulnerabilities guarantees that no bogus positives are available in the report. This is useful for the customer to diminish the time spent on researching and fixing the vulnerabilities.

3.Tests cyber-defense abilities 

During an ongoing penetration test, the client’s security group ought to have the option to recognize different attacks and react as and when needed. Moreover, if an interruption is recognized, the security team should begin examinations and the testers ought to be blocked and their tools expelled from the ongoing investigation. The adequacy of your protection devices can likewise be tried during an ongoing penetration test. A large number of the cyber-attacks ought to be naturally recognized, cautions ought to be created and devoted individuals should act as indicated by the organization’s own internal procedures.

4.Offers expert outsider assessment 

Commonly, the administration of a prospective client organization does not by any stretch of the imagination act when certain issues are indicated from inside the association. Despite the fact that IT individuals or security individuals present a few issues to the administration, they don’t get the fundamental help or financing. In this circumstance, the report created by an outsider may affect the management and it might allotment extra assets for security investments.

 

WHAT  ARE  THE  BENEFITS  OF  VAPT?

 

  1. Identifies vulnerabilities and risks in your web/mobile applications and networking infrastructure.
  2. Validates the effectiveness of current security safeguards.
  3. Quantifies the risk to the internal systems and confidential information.
  4. It provides detailed remediation steps to detect existing flaws and prevent future attacks.
  5. Validates the effectiveness of security and system updates/upgrades.
  6. Protects the integrity of assets in case of existing malicious code hidden in any of them.
  7. Helps to achieve and maintain compliance with applicable International and Federal regulations.

Benefits of VAPT

CONCLUSION 

 

Penetration tests offer unparalleled insight into an organization’s security effectiveness as well as a road map for enhancing security. By hiring experts to simulate a cyber-attack, vulnerabilities can be identified and corrected before they are exploited by a hacker or malicious insider. Penetration testing helps answer the question, “how effective are my computers, network, people, and physical security at deterring a highly motivated and skilled hacker?” A Pen Test is a simulated cyber-attack that offers unparalleled insight into an organization’s data security effectiveness. During the test, security vulnerabilities are identified and attempts are made to compromise systems and gain unauthorized access to data. Manual Pen testing or Pentester or an Ethical Hacker are terms used to describe hacking performed by a company or individual to help identify potential threats on a computer or network. Pentester attempts to bypass system security and search for any weak points that could be exploited by malicious hackers. This information is then used by the organization to improve the system security, in an effort to minimize or eliminate any potential attacks. Expressed (often written) permission to probe the network and attempt to identify potential security risks. Respect the individual’s or company’s privacy. Closeout work, not leaving anything open for you or someone else to exploit at a later time. Allow software developers or hardware manufacturers to know of any security vulnerabilities you locate in their software or hardware, if not already known by the company. At the conclusion of the penetration test, a detailed report summarizing the project is provided as the deliverable. The report contains several elements, including an executive summary, project methodology, systems tested, detailed summary of findings, risk overview, and recommendations. The end result of the test is either confirmation that systems are effectively secured or the identification of vulnerabilities that require remediation efforts.

 

VAPT

 


Internet Of Things (IOT)

Category : Blog

Internet Of Things(IoT)

IOT-ICSS

Internet of Things (IoT), Big Data, and Analytics are all emerging areas of growth and promise. While the market value and potential are high and the use cases seem apparent, businesses are looking to improve the real business results and value generated in IoT projects. There is a need for new kinds of analytics platforms and tools to help them achieve their objectives quickly. IoT brings a different level of challenge. In IoT, we will end up dealing with an enormous amount of data that has a high degree of variance over speeds, feeds and data cycles. As we see millions and billions of devices in IoT being connected, each passing moment we see an overwhelming amount of new data generated which can bring more insights. Operations managers would like to leverage this data to detect anomalies, predict problems early, mitigate any disruption of service, and provide new customer experiences. In addition to the explosion of data, the business environment and conditions are changing more quickly. Real-time decision-making and rapid responses to competitive and operational challenges are required in this new environment. Organizations need to take action and be nimble to react to the environment and address IoT challenges to find insights and value.

 

IOT APPLICATIONS

Applications of IOT

1.Transportation

IoT can play an important role in the integration of communications,  control, and information processing across various transportation.  Application of the IoT extends to all aspects of transportation systems (i.e. the vehicle and the driver or user). Dynamic interaction between these components of a transport system enables inter and vehicular communication, smart traffic control, smart parking,

electronic, logistic and fleet management, vehicle control,  and safety and road assistance.  Modern automobiles are equipped with sensors that are connected to the internet through control systems.  Some of the sensors used in automobiles with their positions. IoT plays an important role in road safety-  systems.  Such as collision election, lane change warning, traffic signal control, intelligent traffic scheduling.

Transportation In IOT

 

2.Environmental Monitoring

The Environmental monitoring applications of the IoT typically use sensors to assist in environmental protection by monitoring atmospheric situations. like monitoring the movements of wildlife and their habitats.  The physical devices connected to the Internet which are used as warning systems can also be used by emergency services to provide more effective aid.

 

Environmental Monitoring of IOT

 

3.Infrastructure Management

Monitoring and control operations of rural infrastructures like bridges, railway tracks.  It is a key application of the IoT. The IoT infrastructure can be used for monitoring any events or changes in structural conditions that can compromise safety and increase risk.  It can also be used for scheduling repair and maintenance activities in an efficient manner, by coordinating tasks between different service providers and users of these facilities. IoT devices can also be used to control critical

infrastructure like bridges to provide access to ships. Usage of IoT devices for monitoring and operating infrastructure is likely to improve management and emergency response coordination, and quality of service, up-times and reduce costs of operation in all infrastructure related areas.

Infrastructure Management of iot

 

 

4.Manufacturing

The IoT enables the quick manufacturing of new products and real-time optimization of manufacturing production and supply by using networking machinery,  sensors, and control systems together IoT helps in digital control systems to automate the process,  to optimize the plant safety and security are interlinked with the IoT.  Measurements, automated controls, plant optimization, health and safety management, and other functions are provided by a large number of networked sensors.

The national science foundation established an industry/University cooperative Research center on intelligent maintenance systems(IMS). The vision is to achieve near-zero breakdown using IoT-based manufacturing. In the future, we can see thee-manufacturing plants and e-maintenance activities.

 

Manufacturing iot

 

5.Home automation

Home automation is the residential extension of building automation. It involves the control and automation of lighting, heating, ventilation, air conditioning (HVAC), and security, as well as home appliances such as washer/dryers, ovens or refrigerators/freezers.  They use Wi-Fi for remote monitoring and are a part of the Internet of things.

 

home automation iot

BENEFITS OF IOT

 

  1. Quick manufacturing of new products in manufacturing plants with proper accuracy.
  2. Use for patient monitoring in hospitals.
  3. It can be used as home security devices.
  4. It can help in individual tracking in shipping.
  5. IoT systems deliver faster and accurately with minimum utilization of energy, this improves quality of life.
  6. By using IoT in transportation causes minimize traffic jams and collisions.
  7. Transfer the data from one to other people.

 

Benefits of iot

 

CONCLUSION

The IoT has the potential to dramatically increase the availability of information and is likely to transform companies and organizations in virtually every industry around the world. As such, finding ways to leverage the power of the IoT is expected to factor into the strategic objectives of most technology companies, regardless of their industry focus. The number of different technologies required to support the deployment and further growth of the IoT places a premium on interoperability and has resulted in widespread efforts to develop standards and technical specifications that support seamless communication between IoT devices and components. Collaboration between various standards development groups and the consolidation of some current efforts will eventually result in greater clarity for IoT technology companies.

UL is committed to the continued development and widespread deployment of technologies in support of the IoT ecosystem. UL senior technical experts serve in key leadership positions in many of the current standards development efforts,
including the OIC, the Thread Group, the NFC Forum, and the Air Fuel Alliance. UL is also just one of two NFC Forum-authorized testing laboratories in North America and is the exclusive testing partner for the Thread Group’s recently announced certification program. UL has extensive experience in IoT technologies and can conduct testing at locations throughout North America, the European Union, and Asia.

 

 


New Features In RHEL8

Category : Blog

New Features In RHEL8

What is RHEL8?

Red Hat Enterprise Linux (RHEL) is a Linux-based operating system from Red Hat designed for businesses. RHEL can work on desktops, on servers, in hypervisors or in the cloud. Red Hat and its community-supported counterpart, Fedora, are among the most widely used Linux distributions in the world.

Red Hat Enterprise Linux has multiple variants, with server versions for x86, x86-64, PowerPC, Itanium, and IBM System z. It also includes desktop versions for x86 and x86-64. As of November 2011, the latest variant of is RHEL 8. Red Hat, Inc. is an American multinational software company, owned by IBM, providing open-source software products to the enterprise community. Founded in 1993, Red Hat has its corporate headquarters in Raleigh, North Carolina, with other offices worldwide. I think Red Hat Enterprise Linux 8 is the most developer-friendly Red Hat Enterprise Linux that we’ve delivered, and I hope you agree. Let’s get down to business, or rather coding, so you can see for yourself.

For this article, I’ll quickly recap Red Hat Enterprise Linux 8 features (architecture, containers), introduce the very new and cool Red Hat Universal Base Image (UBI), and provide a handy list of developer resources to get you started on Red Hat Enterprise Linux 8.

 

RHEL 8 Architectures

 

Red Hat Enterprise Linux 8 is distributed with the kernel version 4.18, which provides support for the following architectures:

  • AMD and Intel 64-bit architectures
  • The 64-bit ARM architecture
  • IBM Power Systems, little-endian
  • IBM Z

Make sure you purchase the appropriate subscription for each architecture. For more information, see Get started with red hat enterprise additional architecture. For a list of available subscriptions, see Subscription Utilization on the Customer Portal.

Note that all architectures are supported by the standard kernel packages in RHEL 8; no kernel-alt package is needed.

 

 

RHEL 8 New

 

Red Hat Enterprise Linux 8 (RHEL 8) is now available for Production use with lots of developer-friendly capabilities. RHEL 8 official release by Red Hat Inc, the company behind the Development of Red Hat Enterprise Linux (RHEL) 8 was announced on May 7, 2019.

1.YUM version available in RHEL 8 is 0.4. YUMbased on DNF has the following advantages over the previous YUM v3 used on RHEL 7:

  • Increased performance
  • Support for modular content
  • Well-designed stable API for integration with tooling

2. Below is a list of components available on Red Hat Enterprise Linux 8.

  •   Python: The default Python implementation in RHEL 8 is Python 3.6.
  •               Database  Servers: RHEL 8 provide the following databases – MariaDB 10.3, MySQL 8.0, PostgreSQL 9.6, PostgreSQL 10.
  •    RedisThe Redis version available is 4.0
  •    Web Servers: httpd 2.4& Nginx 1.14*
  •    OpenLDAP replaced by 369 LDAP Server
  •    Varnish Cache 6.0*
  •    Git 2.17
  •    Maven 3.5
  •    Perl 5.26* and 5.24
  •    PHP 7.2* and 7.1*
  •    RUBY 2.5
  •    Node.js 10* and 8*
  •    Python 3.6* and 2.7*
  •    Rust Toolset 1.26*
  •    Scale 2.10
  •    Go Toolset 1.10*
  •    GCC System Complier 8.1
  •    .NET Core 2.1*
  •    Java 8 and Java 11

 

Conclusion

Red Hat has sought to reduce complexity in RHEL 8, which comes with ten guaranteed years of enterprise support. Their model involves repositories for the base operating system as well as application streams for flexible lifecycle options, which offer multiple versions of databases, languages, various compilers, and other tools to help facilitate the use of RHEL for business models. Build-in defaults in RHEL 8 include tuned profiles for database options (ready-to-go options out of the box) and ansible system roles to provide a common configuration interface (ensuring standardization and reliability)The RHEL 8 YUM package manager is now based on the Dandified Yum (DNF) technology, which supports modular content, better performance, and a stable API for integration with tooling. User feedback indicated that “yum is a lot faster than it used to be, and all the commands work well.”

Red Hat Insights (tools to provide system administrators with analytics, machine learning, and automation controls) are now included in RHEL 8 along with a session recording feature, which can record and playback user terminal sessions for better security and training capabilities.RHCE training in Kolkata by Indian Cyber Security Solutions is awarded as the best professional training institute by students. We bring in working professionals with more than 8 years of experience to train the students. Our comprehensive RHCE training in Kolkata covers all topics starting from the basic to advance level. RHCE training by Indian Cyber Security Solutions is by far rated high by our students. Red Hat Certified Engineer (RHCE) is a leading certification course for Linux network administrators who configure networking services and security on servers running a Red Hat Operating System.

 


Are You Secure While Watching Smart T.V?

Category : Uncategorized

 

 

Are You Secure While Watching Smart  T.V

You might enjoy watching your smart TV, but what if your smart TV is watching you back? And it’s not just about tracking what you watch. Your TV might actually be listening to your conversations. Or maybe even watching you through its camera. That’s scary!

 

The TV manufacturer might be getting your information and using it for targeted advertising. But that’s not all. Research has found out that smart TVs can be hacked, thanks to their security flaws. So if someone needs to gain access to your personal life, all they have to do is hack your smart TV and learn all about you.

 

Even if you turn off the mic or camera of the smart TV, there are security vulnerabilities that can let hackers spy on you. To make sure this doesn’t happen, follow these tips. If you already have a smart TV, just stop its supply of connectivity. It won’t be able to send your data to its manufacturers, ad companies, or hackers if you just disconnect it from the internet. Because honestly, you rarely use the voice commands. Sure, when the TV is new, everyone wants to use voice commands. But over the time, you just switch back to remotes since the TV doesn’t interpret voice commands correctly anyway. So to disconnect the TV, just visit the settings and turn off its Wi-Fi capabilities. But you do need Netflix on your TV, right? No problem at all. Just get a streaming box. Google Chromecast will play Netflix, Hulu, YouTube, and several other channels.

smart tv hacked

But smart TV spying has gotten much more sophisticated. The latest scandal involves a company called Samba TV, an app included in smart TVs made by Sony, TCL, Philips, and other major manufacturers. Samba is a seemingly harmless app that offers recommendations on what to watch, and that sounds awfully handy in a world where we may spend hours scrolling through Netflix to pick a show. It’s handy enough that most people (around 90%) just click “accept” when their new TV asks if they want to enable Samba.

The trouble is that by clicking accept you’re giving Samba access to a lot more than your viewing information. Samba also checks out devices connected to the same Wi-Fi network as your television, tracking not only what you’re watching on TV, but when you watch, where you go, and what you’re doing in other apps — which it can share with others for marketing purposes.

Even if you turn off the mic or camera of the smart TV, there are security vulnerabilities that can let hackers spy on you. To make sure this doesn’t happen, follow these tips. If you already have a smart TV, just stop its supply of connectivity. It won’t be able to send your data to its manufacturers, ad companies, or hackers if you just disconnect it from the internet. Because honestly, you rarely use the voice commands. Sure, when the TV is new, everyone wants to use voice commands. But over the time, you just switch back to remotes since the TV doesn’t interpret voice commands correctly anyway. So to disconnect the TV, just visit the settings and turn off its Wi-Fi capabilities. But you do need Netflix on your TV, right? No problem at all. Just get a streaming box. Google Chromecast will play Netflix, Hulu, YouTube, and several other channels.

I want to bring in the context the recent incident occurred in the Surat about a couple which has lead to crime smart tv made that couple private videos.

Rajesh Kumar* was in the habit of watching porn on his smart TV in his bedroom and often visited adult websites. Recently, the married man got the shock of his life when he discovered a video of intimate moments he had shared with his wife, on one such website. The cybersecurity experts that Rajesh* contacted eventually found out that the smart TV in his room had been hacked into and that its camera functionality was remotely used to capture footage – all without Rajesh’s* knowledge.

Rajesh*, a resident of a posh locality in Surat, was both stunned and extremely disturbed when he had discovered the video of him and his wife on a porn site. While he did not contact cops owing to fear of public humiliation, he got in touch with certain cybersecurity experts with knowledge of crimes using high-end technology. These experts reportedly investigated Rajesh’s* room where the video was shot but did not find any hidden camera anywhere. For a considerable period of time, even the experts were apparently flummoxed by how the video could have been recorded and then uploaded online. Then, eyes fell on the smart TV in the room.

Subsequent investigations revealed that because Rajesh* used to visit porn sites, a hacker on one such site could have easily broken into the TV – just like computers are hacked into – and used the in-built camera remotely to capture the live feed. Because the TV was WiFi-enabled, the recorded video was also uploaded online – all without the knowledge of Rajesh* and his wife. –about this incident let us see what

 

 

Pritam Mukherjee (ICSS Senior IT Security Analysis)-  icss it security analysis

Actually there are two processes through which this device could be hacked that are as followed:

1. When there is a device connected with the internet and that device is having the loophole (vulnerabilities access) then that device can easily be hacked.

  1. In smart tv, there could be browser and email sender both so if someone browses any the malicious website then the file is download from the website and it can access to the system and can also send email in the malicious file then it could be hacked easily.

                                  So looking to these points we can say that the incident took place in Surat was really hacked through smart tv


IS FACE APP REALLY SAFE TO PRIVACY?

Category : Blog

 

IS Face App Really Safe To Privacy?

FACE APP

Should you be frightened of FaceApp, the image editor out of Russia defendant of vacuuming up photos of uncountable Americans? According to security researchers, we have a tendency to all have to be compelled to settle down. The app isn’t making an attempt to invade your privacy and mass transfer all the photos from your phone. “We have found nothing out of the standard during this app,” Aviran Hazum, a research worker at the antivirus company Check purpose, same in associate email. Hazum is among the specialists who’ve analyzed FaceApp and located no major privacy violations within the software’s processes. “I should say that this app appears to be developed during a sensible fashion—no greedy permissions, and it will what they claim it does,” he supplemental. So why did the app suddenly raise alarms? FaceApp has really been around for 2 years, and comes from a little-known company primarily based in St. Petersburg, Russia, known as Wireless research laboratory. In recent days, the app went infectious agent once more with the assistance of a photograph filter that may age your face into an grownup. Celebrities together with Lebron James, Kevin Hart, and Drake have announce the amusive results. however not everybody has been pleased. “BE CAREFUL WITH FACEAPP,” tweeted Joshua Nozzi, a package developer, United Nations agency began warning concerning the reputed privacy violations with the app on Mon. “It right away uploads your photos while not asking, whether or not you selected one or not.” His tweet sparked a cascade of media stories concerning the privacy risks with FaceApp. “Russians currently own all of your recent photos,” reads the headline from The big apple Post. According to reports, the Democratic National Committee—which was hacked by Russians throughout the 2016 presidential election—warned 2020 candidates and their workers to delete the app. United States of America legislator Chuck Schumer of latest House of York additionally asked the Federal Bureau of Investigation and independent agency to analyze the privacy and national security risks with the app. BIG: Share if you used #FaceApp: The @FBI & @FTC should consider the national security & privacy risks currently Because uncountable Americans have used it It’s owned by a Russia-based company And users are needed to produce full, irrevocable access to their personal photos & information pic.twitter.com/cejLLwBQcr — Chuck Schumer (@SenSchumer) July eighteen, 2019 The only problem? The app doesn’t mechanically break in and collect the photos keep on your phone. “The press coverage of this FaceApp story is out of management,” tweeted Robert Baptiste, another security research worker United Nations agency additionally analyzed the merchandise. “No, they’re not uploading your photos to their server. They transfer solely the image you’re functioning on.” FaceApp later explained during a statement to Mashable that the merchandise can solely transfer the image the user selects for written material to an organization server, that then applies the image filter. In alternative words, this is often no totally different from however alternative on-line photo-editing package works. “We would possibly store associate uploaded image within the cloud,” FaceApp’s chief executive officer Yaroslav Goncharov same within the statement. “The main reason for that’s performance and traffic: we would like to create certain that the user doesn’t transfer the image repeatedly for each edit operation. Most pictures are deleted from our servers at intervals forty eight hours from the transfer date. “All FaceApp options are on the market while not work in, and you’ll be able to log in barely from the settings screen. As a result, ninety nine % of users don’t log in; so, we have a tendency to don’t have access to any information that would determine an individual,” he supplemental. ‘I Was Wrong’ Nozzi has since deleted his original tweets warning concerning FaceApp. “I was wrong. i used to be wrong concerning what i assumed the app was doing (uploading all pics once granted access), and that i was wrong to own announce the accusation while not testing it 1st. Full stop,” he wrote during a web log post. Despite his acknowledgement, Nozzi believes there are still legitimate issues with app. He points to however the merchandise neglects to warn users that emended photos are going to be uploaded to the company’s servers. FaceApp’s terms and conditions additionally permit it to use your uploaded photos for industrial functions. “What I don’t regret within the slightest has known as attention to the privacy issues close this app,” he wrote in his web log post. Indeed, we must always all worry concerning our digital privacy. however an equivalent worries apply to nearly any major technical school product or app within the market, together with Facebook, Instagram, and Snapchat, that additionally contains a broad policy on however it will use your uploaded content for industrial functions. exploitation any of those product typically means that submitting some personal data and trusting the corporate to not misuse it. However, it’s clear that even the largest corporations have hassle following their own rules and privacy policies. The issue has prompted scrutiny into however uploaded photos to social media and mobile apps could be used for functions users ne’er fanciful. This includes coaching AI-powered facial-recognition package, that privacy advocates worry might in the future power police work systems. “Ultimately, you’ve got no say in however your image is employed when you’ve given it to them,” Richard Henderson, head of threat intelligence at the safety firm Lastline, same in associate email. FaceApp, however, same it will permit users to get rid of their information from its servers. “Our support team is presently overladen, however these requests have our priority. For the quickest process, we have a tendency to advocate causation the requests from the FaceApp mobile app using ‘Settings > Support > Report a bug’ with the word ‘privacy’ within the subject line. we have a tendency to are functioning on the higher UI for that,” the corporate told Mashable.

QUOTES:

Samiran Santra(CTO Of ICSS)

“FACE APP GETS AUTHORITY TO LOOK INSIDE OUR GALLERY WHICH CAN LEAD TO SECURITY ISSUES. SO IT IS IMPORTANT FIRST NEED TO GO THROUGH THE APP NICELY AFTER THAT WE SHOULD PROVIDE OUR INFORMATION TO THE APP”

Abhishek Mitra(CEO of ICSS)

“ NOT ONLY FACE APP IS TAKING OUR PRIVACY BUT ALSO THERE ARE MANY SOCIAL MEDIA WHICH ARE DOING THIS SAME ….SO WHY NOT FBI IS NOT QUESTIONING THEM”- about this below there is a video….