Technide

  ICMR Indian Council of Medical Research: 815,000,000 breached records Date of breach:  9 October 2023 Breached organisation:  The ICMR (Indian Council of Medical Research) Incident details:  The personal data of 815 million Indian residents, apparently exfiltrated from the ICMR’s Covid-testing database, was sold on the dark web earlier this month.   According to the security company Security , which discovered the listing, the data included victims’ names, ages, genders, addresses, passport numbers and Aadhaar number (12-digit government identification numbers). Records breached:  815,000,000 According to the following attack, the threat is  improper network segmentation. I'll continue the threat modling for this.

As simply Port scanning is like knocking on doors in a neighborhood to see who's home.  In the world of network security, it's a crucial step to identify open ports and potential vulnerabilities in your network.  Port scanning is a useful technique for exploring network systems and gathering information about their services.  Used Parties Security professionals and system administrators use port scanning to diagnose network problems, audit network security, or discover vulnerabilities. Why Port Scanning It's kind of a enumeration process that defines the ports on a network or targeted machines which open and receive or send. It's sending the crafted packet to analyse the response and determine software and associated vulnerabilities on each port. Socket Programming A socket is an endpoint of a two-way communication server with a socket and is bounded by a specific port number as an 80 network. These are bounded with specific port numbers and use backend software to r...

  Security code review, also known as code security review or secure code review, is a process in software development where the source code of an application is systematically and manually examined to identify and fix security vulnerabilities. The goal is to ensure that the code complies with security best practices, follows coding standards, and does not contain vulnerabilities that could be exploited by attackers. Objective: Identify Vulnerabilities: The primary goal of a security code review is to identify security vulnerabilities in the code, such as injection flaws, authentication issues, authorization problems, and other common security risks. Security code reviews covered area's Authentication,  authorization,  security configuration,  session management,  logging,  data validation,  error handling, and  encryption Timing: Throughout the Software Development Lifecycle: Code reviews are most effective when conducted regularly throughout the...

  (CNN) Russian hackers carried out a "cyberattack" on Ukraine's biggest private energy conglomerate in retaliation for its owner's opposition to Russia's war in Ukraine, the firm said Friday.

  Over 900,000 Kubernetes instances were found exposed online                       Over 900,000 misconfigured Kubernetes clusters were found exposed on the internet to potentially malicious scans, some even vulnerable to data-exposing cyberattacks. Kubernetes is a highly versatile open-source container orchestration system for hosting online services and managing containerized workloads via a uniform API interface. It enjoys  massive adoption  and growth rates thanks to its scalability, flexibility in multi-cloud environments, portability, cost, app development, and system deployment time reductions. Finding exposed Kubernetes Researchers at  Cyble  have conducted an exercise to locate exposed Kubernetes instances across the internet, using similar scanning tools and search queries to those employed by malicious actors. The results show a massive 900,000 Kubernetes servers, with 65% of them (585,000) being ...

  The novel cybercriminal group tapped the ever-evolving info-stealing trojan to move laterally on a network in a recent attack, researchers have found. A newcomer on the ransomware scene has coopted a 14-year-old malware variant to help it maintain persistence on a targeted network in a recent attack, researchers have found. Black Basta, a ransomware group that emerged in April, leveraged Qbot, (a.k.a. Quakbot), to move laterally on a compromised network, researchers from security consulting firm NCC Group wrote in a blog post published this week. Researchers also observed in detail how Black Basta operates. “Qakbot was the primary method utilized by the threat actor to maintain their presence on the network,” NCC Group’s Ross Inman and Peter Gurney wrote in the post. Qbot emerged in 2008 as a Windows-based info-stealing trojan capable of keylogging, exfiltrating cookies, and lifting online banking details and other credentials. Since then it has stoo...

  Phishing. Phishing is the most common hacking technique. Attackers can trick you into visiting malicious sites using trusted marketing methods such as paid-for advertising on websites. When websites sell advertising space, it can be purchased by rogue attackers. The bona fide advertisement can be replaced with a ‘bad’ link that can be used to download malware, lock up your browser, or compromise your systems. Alternatively, the advertisement may link to a legitimate website, but it will be programmed to redirect you to a harmful site. Key Logger.  Key logger or Keystroke logging often referred to as keylogging or keyboard capturing, is the action of recording the keys struck on a keyboard, typically covertly, so that a person using the keyboard is unaware that their actions are being monitored. Data can then be retrieved by the person operating the logging program. Sign of a keylogger attack is  Signs a keylogger is monitoring your device including  slow Inter...