Cyber Training Group International (CTGI)

Tag: hacking

  • Hackers are stealing 2FA codes with terrifyingly effective voice bots

    Hackers are stealing 2FA codes with terrifyingly effective voice bots

    Every time a massive data breach makes the news, we remind you about the best practices you need to employ to protect your online properties. You should never use weak passwords and recycle them. Instead, pick a password manager that lets you generate unique passwords for every different service, website, and app. And use two-factor authentication (2FA) or one-time passwords (OTP) whenever you can. That way, when hackers inevitably hack one of your accounts, your other properties are protected. But you should remain vigilant when it comes to defending your online accounts.

    Unique passwords and 2FA/OPT aren’t enough, as hackers have found a clever way to trick you into giving them that unique code they need to break into your account. And you might not even realize that you’ve opened the doors to your Amazon, PayPal, Coinbase, or bank account to attackers who might steal money from you. It’s all possible thanks to a new type of customizable bots that place automated calls with the sole scope of stealing that temporary password.

    How bots hack your 2FA codes

    Even without bots, 2FA protection isn’t foolproof. Some hackers might try social engineer attacks to convince you to give up that temporary code or password. But not all of them might be that convincing.

    On the other hand, the bot is a lot more sophisticated and will make you believe that you’re talking to the automated security system belonging to the service that hackers want to penetrate. Motherboard demonstrated the attack with a simple example, an incoming call supposedly coming from PayPal’s fraud prevention system.

    An automated voice tells the PayPal account holder that someone tried to spend a particular sum of money. PayPal needs to verify the account holder’s identity to block the transfer, and they’ll ask for the 2FA/OTP.

    ‘In order to secure your account, please enter the code we have sent your mobile device now,’ the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, ‘Thank you, your account has been secured and this request has been blocked.’

    The bot then proceeded to inform the user there’s no reason to worry about:

    ‘Don’t worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up,’ the voice said.

    What actually happens

    Hackers who obtained someone’s personal data — such as their real name, email address, and phone number — might use it to determine whether they have a PayPal account with that address. They can apply the same procedure to any sort of online account. Once they find a match, they can feed the victim’s phone number to a bot that’s tailored for that service.

    Motherboard explains that these bots can cost a few hundreds of dollars per month and target specific services like Amazon and PayPal. Others can target specific banks like Bank of America and Chase. And some of them let you customize the experience to any type of account.

    The bot sounds just like one of the bots you’re might be talking to during regular customer service calls. They’ll invite you to press certain keys and then to input your 2FA/OTP code. But as soon as you do, the code reaches the hacker who initiated the attack.

    Also Read: ROBINHOOD CUSTOMERS WORRIED ABOUT THE DATA HACK: AN IDENTITY THEFT PROTECTION SERVICE CAN HELP

    The reason you get a code via text message on your phone is that the hacker has tried to log into your account, fully knowing they won’t be able to get into it. The bot makes it sound that it’s a service like PayPal that’s generating the unique 2FA/OTP code. And you’ll have no way of knowing it’s a hacker targeting you. Especially as you rush to deal with the threat.

    Once inside your account, the hackers can steal money or cryptocurrency. The video below shows one such conversation with a bot.

    https://youtu.be/Age9FQOwljc

    What you can do to protect your 2FA codes

    If you’re worried about 2FA/OTP bots attacks, you should make sure you understand how they work, and Motherboard’s coverage is a great place to start. You’ll want to inform your friends and family about the increased usage of this sort of hack.

    Next time you receive a call inviting you to input 2FA codes, you should hang up. Never send those codes to anyone. Instead, log into those services to monitor your activity. And call customer support. You might want to change the email associated with that account to prevent these attacks from happening. Once hackers know what email you use for PayPal or Bank of America, they might still target you with similarly sophisticated attacks.

    Credits: bgr.com

  • Robinhood customers worried about the data hack: An identity theft protection service can help

    Robinhood customers worried about the data hack: An identity theft protection service can help

    Robinhood’s latest data hack is a reminder of how we can protect our identity from being stolen.

    On Nov. 8, investment platform Robinhood announced that a data breach revealed the personal information of more than 7 million of its customers. According to a statement made by the company, the security attack did not expose Social Security numbers, bank account numbers or debit card numbers, and no customers experienced “financial loss” from the incident.

    The data breach was largely contained to only customer names and emails. A limited number of customers had additional personal information exposed such as birth date and zip code, and the company says roughly 10 customers had “more extensive account details revealed” (though details were not disclosed).

    If you are a Robinhood user, you can learn more about keeping your account secure by going to the help center on the company’s website. You may want to take an extra step, however, by investing in an extra level of protection for your personal information. Here’s where identity theft services are a good idea.

    How to further protect yourself from identity fraud

    Identity theft can come in all sorts of ways, a stolen Social Security number or seized credit card information, and it can be costly. A 2020 Identity Fraud Study by Javelin Strategy and Research found that identity fraud cost consumers a whopping $16.9 billion in 2019. You may not spot fraud right away but yet the longer it drags on, the more expensive the identity theft can be to resolve.

    Robinhood users who got off the hook this time but want to quickly spot potential fraud in the future may want to consider signing up for an identity theft protection service.

    These services can tell if a fraudster has your info by checking if your personal information is misused or if it appears on the dark web, social media or other databases. If you’re the victim of fraud, many services also offer advice from specialists, as well as insurance that can offset legal fees and other expenses related to restoring your identity.

    The best identity theft protection services

    Select reviewed dozens of identity theft protection and credit monitoring services that safeguard your information and provide insurance. The best services, like IdentityForce®, offer up to $1 million for eligible expenses associated with resolving and restoring your identity.

    In fact, we ranked IdentityForce the ‘best overall’ because its two UltraSecure and UltraSecure+Credit plans both provide standard coverage up to $1 million to help you recover out-of-pocket expenses and lost wages when your identity is compromised. Robinhood customers should take note that with either plan they can also receive alerts for potential fraud on their bank, credit card and investment accounts, as well as the use of their medical ID, Social Security number and address. Find out what other coverage you get, plus pricing details, in our full review of IdentityForce.

    Below, we rank the top identity theft services — in addition to IdentityForce — that can alert you of potential breaches to your personal information. (Read more about our methodology for selecting the best identity theft protection services.)

    It’s important to understand that these services can’t prevent fraud from happening. You’ll need to be proactive and safeguard your personal information to reduce your exposure to identity theft.

    Also Read: THESE 23 FAKE ANDROID APPS ARE DANGEROUS SPYWARE, SO DELETE THEM NOW

    Our methodology

    To determine which identity theft protection services offer the most benefits to consumers, Select analyzed and compared over a dozen services that offer a variety of plans.

    When ranking the best identity theft protection services, we focused on the following features:

    • Cost: Typically, these services bill monthly but some have deals where you can pay annually.
    • Identity theft insurance: We considered whether the services offered identity theft insurance and looked at the amount you’re covered up to. We found that the best services offer up to $1 million for eligible expenses associated with resolving and restoring your identity.
    • Wide variety of identity monitoring: The more platforms the service checks for breaches to your personal information, the better.
    • Credit monitoring: We ranked services that monitor your credit reports higher than those they don’t. The best plans offer triple-bureau monitoring.
    • Family plans: If you can enroll your family members, that’s an added plus.
    • Mobile app: The ability to access services from a smartphone was crucial.

    Keep in mind that identity theft protection services can only alert you of breaches to your personal information, not prevent any fraud.

    Credit: cnbc.com

  • These 23 fake Android apps are dangerous spyware, so delete them now

    These 23 fake Android apps are dangerous spyware, so delete them now

    Danger lurks around every corner online. Whether you’re using a phone, a tablet, or a computer, you always have to keep your guard up to avoid hacks and scams. This is especially true for Android users, as dangerous phishing campaigns appear to be popping up on a weekly basis. The latest is PhoneSpy, and it involves a collection of spyware apps masquerading as helpful tools. If you have any of these malicious apps on your phone, it’s imperative that you delete them immediately.

    Mobile security company Zimperium recently uncovered a targeted spyware campaign it has dubbed PhoneSpy. As the company explains, PhoneSpy disguises itself as a standard mobile app that purports to stream movies, help users learn yoga, or browse photo collections. But in reality, the spyware steals documents, photos, videos, and more from the Android phone.

    PhoneSpy Android spyware campaign

    Here’s what will happen if PhoneSpy manages to infect your device, according to Zimperium:

    Upon infection, the victim’s mobile device will transmit accurate GPS locational data, share photos and communications, contact lists, and downloaded documents with the command and control server. Similar to other mobile spyware we have seen, the data stolen from these devices could be used for personal and corporate blackmail and espionage. The malicious actors could then produce notes on the victim, download any stolen materials, and gather intelligence for other nefarious practices.

    If you want an even more detailed breakdown, here’s what a PhoneSpy app can do to your phone:

    • Complete list of the installed applications
    • Steal credentials using phishing
    • Steal images
    • Monitoring the GPS location
    • Steal SMS messages
    • Steal call logs
    • Record audio in real-time
    • Steal phone contacts
    • Record video in real-time using front & rear cameras
    • Access camera to take photos using front & rear cameras
    • Send SMS to attacker-controlled phone number with attacker-controlled text
    • Exfiltrate device information (IMEI, Brand, device name, Android version)
    • Conceal its presence by hiding the icon from the device’s drawer/menu

    As terrifying as that might sound, there is some relatively good news. Zimperium says that its zLabs mobile threat research team found just 23 Android apps in the PhoneSpy campaign. All of those apps were targeting South Korean citizens specifically, so if you’re anywhere but South Korea, you’re in the clear for now. That said, Zimperium believes thousands of South Korean victims already downloaded the malicious apps. This is why it’s so vital to constantly be on the lookout.

    Credits: bgr.com

  • Security researcher updates OMG Cables to record user keystrokes

    Security researcher updates OMG Cables to record user keystrokes

    Security researcher Mark Green, (who goes by MG) has revealed to the Vices team at Motherboard that he and his team have upgraded their version of a hacked Lightning cable in a way that allows a hacker to record keystrokes and then to send the data to a designated site. This would allow the device to be used to steal passwords and other sensitive information.

    A Lightning cable allows for charging a  such as a smartphone using a computer or laptop instead of a charger. Back in 2019, MG demoed a cable that looked like a Lightning cable but had hacking capabilities built into it. Shortly thereafter, MG reportedly partnered with a cybersecurity vendor called Hak5 and began selling the cables. The idea behind the development of the cable and sales of it were meant not just to highlight, but demonstrate how such simple devices can be altered in minor ways that allow real hackers to take advantage of consumers.

    More recently, MG spoke with the team at Motherboard and told them that he has updated the cable to allow it to both record keystrokes and to use an added WiFi chip to broadcast the data it captures to a designated site where hackers could conceivably study the data and use it to their advantage.

    MG also told the team at Motherboard that part of the reason he built the new cable was because other experts in the field had claimed that it could not be done due to size and space limitations—there was not enough room inside the connective housing on Type C Lightning cables. MG claims to have proven such experts wrong by adding tiny chips to the cables and then demonstrating that they work in a YouTube of his cable in action.

    He also told Motherboard that the new cable also has geofencing features that allow for blocking data. Motherboard also tested the cable, and found that it worked as advertised, though admittedly in a close-proximity environment. MG claimed the cable could deliver data as far as a mile and that it works equally well with smartphones and tablet computers. He noted that he had also added an ability to alter keyboard mapping and to allow the  to mimic identity-specific USB devices.

    Credit: Techxplore

    Photo credit: Pixabay/CC0 Public Domain

  • A huge trove of credit card records and Social Security numbers just got hacked

    A huge trove of credit card records and Social Security numbers just got hacked

    Not a week goes by anymore, it seems like, when we don’t have multiple hacks to report on, as well as a fresh data breach or systems intrusion on the part of attackers constantly probing for weaknesses anywhere that consumer records are stored.

    Many of these episodes garner headlines simply because of the scale of the data breach and the target of the attack. Facebook is one example of this, as the social network is still facing an onslaught of criticism online over the revelation from this past weekend that the company has suffered yet another embarrassingly massive data leak — encompassing personal information from more than 533 million Facebook users across 106 countries. Meantime, hackers themselves are also getting hacked, as word of a separate breach at a hub for stolen data has also just been reported.

    Threat research firm Group-IB posted a report on Thursday documenting how Swarmshop — described as a “neighborhood” store for stolen personal and payment records, such as credit card data — saw a major cache of its user and administrator data leaked online to another underground hacker forum. Appropriately, the title of the Group-IB report summarizing what happened here is “What Goes Around Comes Around,” but make no mistake — there’s just as good of a chance that your data may be caught up in this as there is that hackers acquired stolen data on other hackers.

    According to the report on this hack, the Swarmshop database that was posted on a different underground forum contained 12,344 records of the card shop administrators, sellers, and buyers. That’s per a Twitter thread from Group-IB, which goes on to note that this database also “exposed all compromised data traded on the website, including 623,036 payment card records, 498 sets of online banking account credentials and 69,592 sets of US Social Security Numbers and Canadian Social Insurance Numbers.”

    Given the nature of the treasure trove of data that Swarmshop represents, it should probably come as no surprise that this is also not the first time that the stolen data hub has found itself in the crosshairs of other cybercriminals. In January 2020, the site’s records were leaked on an underground forum, reportedly by a user motivated by revenge. Meantime, here’s what else we know about this new hack — the data dump included records on more than 623,000 payment cards, almost 63% of which were issued by US banks.

    “While underground forums get hacked from time to time, cardshop breaches do not happen very often,” Group-IB CTO Dmitry Volkov said. “In addition to buyers’ and sellers’ data, such breaches expose massive amounts of compromised payment and personal information of regular users. Although the source remains unknown, it must be one of those revenge hacks cases. This is a major reputation hit for the card shop as all the sellers lost their goods and personal data. The shop is unlikely to restore its status.”

    Culled from bgr.com