How Attackers Used Look-Alike Domains to Steal $1 Million From a Chinese VC

This is a simple but brilliantly executed heist. Pretend to be the sender by sending from a similar looking domain.

One of the domains was a look-alike of the Chinese investment company’s domain; the other was a spoof of the Israeli firm’s domain. In both instances, the threat actors simply added an “s” to the end of the original domain name.

The next phase of the scam involved the attackers sending two emails with the same subject header as the original email thread about the planned seed funding.

Money meant to fund an Israeli startup wound up directly deposited to the scammers.

Source: How Attackers Used Look-Alike Domains to Steal $1 Million From a Chinese VC

1.2 billion people exposed in data leak includes personal info, LinkedIN, Facebook

Another data leak, this time involving, let’s see, 1.2 billion people. This was found by security researchers in an unsecured ElasticSearch server – the server is now down. According to analysis, the data most likely comes from data enrichment companies.

A total count of unique people across all data sets reached more than 1.2 billion people, making this one of the largest data leaks from a single source organization in history. The leaked data contained names, email addresses, phone numbers, LinkedIN and Facebook profile information.

For a very low price, data enrichment companies allow you to take a single piece of information on a person (such as a name or email address), and expand (or enrich) that user profile to include hundreds of additional new data points of information.

Source: 1.2 billion people exposed in data leak includes personal info, LinkedIN, Facebook

Breaking: Private Equity company acquires .Org registry – Domain Name Wire | Domain Name News

ICANN lifts price caps on .org registry. PE firm acquires .org registry. PE firm appoints former ICANN executives to top positions. Does something seem fishy here? How much does companies like Wikipedia have to pay to keep their .org domain from now on?

Ethos Capital is a new private equity firm lead by Erik Brooks. Brooks was at Abry Partners until earlier this year. Abry Partners acquired Donuts and installed former ICANN President of Global Domains Akram Atallah in the top spot there.

Source: Breaking: Private Equity company acquires .Org registry – Domain Name Wire | Domain Name News

(Edit) 2019-11-23: You can sign up to reject the sale.

Samy Kamkar: PoisonTap – exploiting locked computers over USB

This is brilliant and scary at the same time. I’m always impressed by what Samy can think of. This particular hack makes your computer think a plugged-in Raspberry Pi is an Ethernet device and takes over all your Internet traffic, at the same time poisoning your browser with hijacked copies of Javascripts. This works even on a machine with screen locked.

It is reminiscent of the days of CD-ROM attacks, when your computer will auto-run the contents of a CD-ROM, even when the account is locked.

Source: Samy Kamkar: PoisonTap – exploiting locked computers over USB

US City Rejects $5.3 Million Ransom Demand and Restores Encrypted Files from Backup (SecAlerts)

This is the right strategy against ransomware. Backup, backup and backup. At the first sign of any ransomware attack it is important to isolate affected machines immediately and contact a cybersecurity professional to mitigate and prevent further infection.

The US city of New Bedford, Massachusetts, rejected a ransom demand of $5.3 million and came back with a counter-offer of $400,000, while restoring encrypted data from backup.

Source: US City Rejects $5.3 Million Ransom Demand and Restores Encrypted Files from Backup (SecAlerts)

Police hijack a botnet and remotely kill 850,000 malware infections – TechCrunch

When what you can remotely exploit, you can remotely remove.

In a rare feat, French police have hijacked and neutralized a massive cryptocurrency mining botnet controlling close to a million infected computers. The notorious Retadup malware infects computers and starts mining cryptocurrency by sapping power from a computer’s processor. Although the malware was used to generate money, the malware operators easily could have run other […]

Source: Police hijack a botnet and remotely kill 850,000 malware infections – TechCrunch

How to Build Good Software

A break from the usual articles on cybersecurity. This is a good article that talks about the problems of software development and some strategies for mitigating them:

  • starting simple
  • focussing on the problem
  • iteration
  • spending time between expanding features and reducing complexity

Software has characteristics that make it hard to build with traditional management techniques; effective development requires a different, more exploratory and iterative approach.

Source: How to Build Good Software