# data[].attributes.body
ation Security (INFOSEC) related tips and tricks.
Avatar of Pinboards
Pinboards
●
20m

# data[].attributes.attachment_link.readable_text
VPN stands for " Virtual Private Network ." When you connect to a VPN, all data that you send (such as the requests to servers when browsing the web) appears to originate from the VPN itself, rather than your own ISP. This masks your IP address , which can be an important tool for protecting your privacy, since your IP address provides an indication of your general location and can therefore be used to identify you.

In practice, VPNs can:

Protect your Internet activity from prying eyes, especially if you're connected to an unsecure Wi-Fi network in a café, airport, library, or somewhere else.

Circumvent Internet censorship on a network that blocks certain sites or services. For example, when you are working from a school's Internet connection or in a country that blocks content. Note: It's important to keep up to date on security news for specific countries' policies on VPNs.

Connect you to the corporate intranet at your office while you're traveling abroad, at home, or any other time you are out of the office.

One common misconception is that VPNs are just for desktop computers. Logging in to strange or unfamiliar Wi-Fi connections from your phone can be just as risky as logging onto a strange Wi-Fi network from your computer. You can have a VPN on your phone to encrypt traffic from your carrier and Internet Service Provider, or ISP.

There is no one-size-fits-all solution when it comes to VPNs. Just like email, there are many VPN services out there and you should choose the service that works best for you. Depending on which one you choose, you can benefit from an increased level of security when connected to networks you wouldn't ordinarily trust. This does mean, however, that you will be placing your trust in the VPN itself.

So do you need a VPN? And which VPN should you use? The answer to these questions are packed with various considerations and nuances. This guide will help you think through what tools are right for you, and what factors you should consider in your search for a VPN.

Let's Start With the Basics: How do VPNs Actually Work? Anchor link

This explainer by the Center for Democracy & Technology describes a VPN as a tool that creates "a sort of tunnel for your internet traffic [in order to] prevent outsiders from monitoring or modifying your traffic. Traffic in the tunnel is encrypted and sent to your VPN, which makes it much harder for third parties like internet service providers (ISPs) or hackers on public Wi-Fi to snoop on a VPN users' traffic or execute man-in-the-middle attacks. The traffic then leaves the VPN to its ultimate destination, masking that user's original IP address . This helps to disguise a user's physical location for anyone looking at traffic after it leaves the VPN."

We recommend reading the Center for Democracy & Technology's entire article before continuing on to better understand what VPNs are and how they work.

Things to Consider: What VPNs Don't Do Anchor link

A VPN protects your Internet traffic from surveillance on the public network, but it does not protect your data from the private network you're using. If you are using a corporate VPN, then whoever runs the corporate network will see your traffic. If you are using a commercial VPN , whoever runs the service will be able to see your traffic.

A disreputable VPN service might do this deliberately, to collect personal information or other valuable data.

The manager of your corporate or commercial VPN may also be subject to pressure from governments or law enforcement to turn over information about the data you have sent over the network. You should review your VPN provider's privacy policy for information about the circumstances under which your VPN provider may turn your data over to governments or law enforcement.

You should also take note of the countries in which the VPN provider does business. The provider will be subject to the laws of those countries, including laws governing government requests for information. Laws vary from country to country, and sometimes those laws allow officials to collect information without notifying you or giving you an opportunity to contest it. The VPN provider may also be subject to legal requests for information from countries with whom the countries in which it operates have a legal assistance treaty.

Most commercial VPNs require you to pay using a credit card, which includes information about you that you may not want to disclose to your VPN provider, as it can easily be linked back to your identity. If you would like to keep your credit card number from your commercial VPN provider, use a VPN provider that accepts bitcoin or gift cards, or use temporary or disposable credit card numbers. Also, note that the VPN provider may still collect your IP address when you use the service, which can also be used to identify you, even if you use an alternative payment method. If you would like to hide your IP address from your VPN provider, you could use Tor when connecting to your VPN, or connect to the VPN only from a public Wi-Fi network.

How Do I Choose a VPN That's Right For Me? Anchor link

Everyone has different needs for how they hope to use a VPN. And the range and quality of VPNs varies a lot from one service to another. To find the VPN that's right for you, you can evaluate VPNs based on the following criteria:

Claims

Is the VPN provider making claims about their product or services? Maybe they claim not to log any user connection data ( see data collection below), or they claim not to share or sell data. Remember that a claim is not a guarantee, so be sure you verify these claims. Dig deep into a VPN provider's privacy policy to uncover details about how your data is monetized, even if the VPN doesn't sell it to third parties directly.

Business model

Even if a VPN isn't selling your data, it must be able to stay in operation somehow. If the VPN doesn't sell its service, how is it keeping its business afloat? Does it solicit donations? What is the business model for the service? Some VPNs run on a "freemium" model, meaning they are free to join, but after you transfer a certain amount of data they will charge you. If your budget is constrained, this is useful information to know.

Reputation

It is worthwhile to do a search on the people and organizations associated with the VPN. Is it endorsed by security professionals? Does the VPN have news articles written about it? If the VPN was established by people known in the information security community, it is more likely to be trustworthy. Be skeptical of a VPN offering a service that no one wants to stake their personal reputation on, or one that is run by a company that no one knows about.

Data collection

A service that does not collect data in the first place will not be able to sell that data. When looking through the privacy policy, see whether the VPN actually collects user data. If it doesn't explicitly state that user connection data is not being logged, chances are that it is. And, depending on jurisdiction, a government can demand that data or issue a subpoena for it.

Even if a company claims not to log connection data, this may not always be a guarantee of good behavior. We encourage you to investigate instances where a VPN has been mentioned in the media. They may have been caught misleading or lying to their customers. A simple search can go a long way.

Location and laws

You might choose a VPN based on where its headquarters are based. Choosing a VPN based on the data privacy laws of that country may be an important factor, but please note that laws and policies can change.

How safe is the VPN encryption? If a VPN is using broken encryption- such as Point-to-Point Tunneling Protocol (PPTP) or weak encryption ciphers-any data flowing through it can be easily decrypted and viewed by your ISP or country. If you're using a work VPN, contact your IT department and inquire about the security of the connection. Evaluating the strength of encryption in a VPN can be difficult to do, so you may want to check out this VPN comparison chart by That One Privacy Site, which analyzes almost 200 VPN providers based on their jurisdictions and policies.

EFF cannot vouch for these or any VPN ratings. Some VPNs with exemplary privacy policies could be run by devious people. Do not use a VPN that you do not trust.

Remember: There is no one-size-fits-all VPN. There are many factors to consider when choosing a VPN. Always remember to consider your security plan before making any decisions about the tools you use to protect your digital security.

# data[].attributes.attachment_link.description
VPN stands for "Virtual Private Network." When you connect to a VPN, all data that you send (such as the requests to servers when browsing the web) appears to originate from the VPN itself, rather than your own ISP.

# data[].attributes.headline
A blog about reverse engineering, mathematics, politricks and some more ...

# data[].attributes.subject
A blog about reverse engineering, mathematics, politricks and some more ...

# data[].attributes.attachment_link.readable_text
In a world of changing technology, there are few constants - but if there is one constant in security, it is the rhythmic flare-up of discussions about disclosure on the social-media-du-jour (mailing lists in the past, now mostly Twitter and Facebook).

Many people in the industry have wrestled with, and contributed to, the discussions, norms, and modes of operation - I would particularly like to highlight contributions by Katie Moussouris and Art Manion, but there are many that would deserve mentioning whose true impact is unknown outside a small circle. In all discussions of disclosure, it is important to keep in mind that many smart people have struggled with the problem. There may not be easy answers.

In this blog post, I would like to highlight a few aspects of the discussion that are important to me personally - aspects which influenced my thinking, and which are underappreciated in my view.

I have been on many (but not most) sides of the table during my career:

On the side of the independent bug-finder who reports to a vendor and who is subsequently threatened.

On the side of the independent bug-finder that decided reporting is not worth my time.

On the side of building and selling a security appliance that handles malicious input and that needs to be built in a way that we do not add net exposure to our clients.

On the side of building and selling a software that clients install.

On the side of Google Project Zero, which tries to influence the industry to improve its practices and rectify some of the bad incentives.

The sides of the table that are notably missing here are the role of the middle- or senior-level manager that makes his living shipping software on a tight deadline and who is in competition for features, and the role of the security researcher directly selling bugs to governments. I will return to this in the last section.
I expect almost every reader will find something to vehemently disagree with. This is expected, and to some extent, the point of this blog post.

The simplistic view of reporting vulnerabilities to vendors

I will quickly describe the simplistic view of vulnerability reporting / patching. It is commonly brought up in discussions, especially by folks that have not wrestled with the topic for long. The gist of the argument is:

1. Prior to publishing a vulnerability, the vulnerability is unknown except to the finder and the software vendor.

2. Very few, if any, people are at risk while we are in this state.

3. Publishing about the information prior to the vendor publishing a patch puts many people at risk (because they can now be hacked). This should hence not happen.

Variants of this argument are used to claim that no researcher should publish vulnerability information before patches are available, or that no researcher should publish information until patches are applied, or that no researcher should publish information that is helpful for building exploits.
This argument, at first glance, is simple, plausible, and wrong. In the following, I will explain the various ways in which this view is flawed.

The Zardoz experience

For those that joined Cybersecurity in recent years: Zardoz was a mailing list on which "whitehats" discussed and shared security vulnerabilities with each other so they could be fixed without the "public" knowing about them.

The result of this activity was: Every hacker and active intelligence shop at the time wanted to have access to this mailing list (because it would regularly contain important new attacks). They generally succeeded. Quote from the Wikipedia entry on Zardoz:

On the other hand, the circulation of Zardoz postings among computer hackers was an open secret, mocked openly in a famous Phrack parody of an IRC channel populated by notable security experts.

History shows, again and again, that small groups of people that share vulnerability information ahead of time always have at least one member compromised; there are always attackers that read the communication.

It is reasonably safe to assume that the same holds for the email addresses to which security vulnerabilities are reported. These are high-value targets, and getting access to them (even if it means physical tampering or HUMINT) is so useful that well-funded persistent adversaries need to be assumed to have access to them. It is their job, after all.

(Zardoz isn't unique. Other examples are unfortunately less-well documented. Mail spools of internal mailing lists of various CERTs were circulated in hobbyist hacker circles in the early 2000s, and it is safe to assume that any dedicated intelligence agency today can reproduce that level of access.)

The fallacy of uniform risk

Risk is not uniformly distributed throughout society. Some people are more at-risk than others: Dissidents in oppressive countries, holders of large quantities of cryptocurrency, people who think their work is journalism when the US government thinks their work is espionage, political stakeholders and negotiators. Some of them face quite severe consequences from getting hacked, ranging from mild discomfort to death.

The majority of users in the world are much less at risk: The worst-case scenario for them, in terms of getting hacked, is inconvenience and a moderate amount of financial loss.

This means that the naive "counting" of victims in the original argument makes a false assumption: Everybody has the same "things to lose" by getting hacked. This is not the case: Some people have their life and liberty at risk, but most people don't. For those that do not, it may actually be rational behavior to not update their devices immediately, or to generally not care much about security - why take precautions against an event that you think is either unlikely or largely not damaging to you?

For those at risk, though, it is often rational to be paranoid - to avoid using technology entirely for a while, to keep things patched, and to invest time and resources into keeping their things secure.

Any discussion of the pros and cons of disclosure should take into account that risk profiles vary drastically. Taking this argument to the extreme, the question arises: "Is it OK to put 100m people at risk of inconvenience if I can reduce the risk of death for 5 people?"

I do not have an answer for this sort of calculation, and given the uncertainty of all probabilities and data points in this, I am unsure whether one exists.

Forgetting about patch diffing

One of the lessons that our industry sometimes (and to my surprise) forgets is: Public availability of a patch is, from the attacker perspective, not much different than a detailed analysis of the vulnerability including a vulnerability trigger.

There used to be a cottage industry of folks that analyze patches and write reports on what the fixed bugs are, whether they were fixed correctly, and how to trigger them. They usually operated away from the spotlight, but that does not mean they do not exist - many were our customers.

People in the offensive business can build infrastructure that helps them rapidly analyze patches and get the information they need out of them. Defenders, mostly due to organizational and not technical reasons, can not do this. This means that in the absence of a full discussion of the vulnerability, defenders will be at a significant information disadvantage compared to attackers.

Without understanding the details of the vulnerability, networks and hosts cannot be monitored for its exploitation, and mitigations-other-than-patching cannot be applied.

Professional attackers, on the other hand, will have all the information about a vulnerability not long after they obtain a patch (if they did not have it beforehand already).

The fallacy of "do not publish triggers"

When publishing about a vulnerability, should "triggers", small pieces of data that hit the vulnerability and crash the program, be published?

Yes, building the first trigger is often time-consuming for an attacker. Why would we save them the time?

Well, because without a public trigger for a vulnerability, at least, it is extremely hard for defensive staff to determine whether a particular product in use may contain the bug in question. A prime example of this CVE-2012-6706: Everybody assumed that the vulnerability is only present on Sophos; no public PoC was provided. So nobody realized that the bug lived in upstream Unrar, and it wasn't until 2017 that it got re-discovered and fixed. 5 years of extra time for a bug because no trigger was published.

If you have an Antivirus Gateway running somewhere, or any piece of legacy software, you need at least a trigger to check whether the product includes the vulnerable software. If you are attempting at building any form of custom detection for an attack, you also need the trigger.

The fallacy of "do not publish exploits"

Now, should exploits be published? Clearly the answer should be no?

In my experience, even large organizations with mature security teams and programs often struggle to understand the changing nature of attacks. Many people that are now in management positions cut their teeth on (from today's perspective) relatively simple bugs, and have not fully understood or appreciated how exploitation has changed.

In general, defenders are almost always at an information disadvantage: Attackers will not tell them what they do, and gleefully applaud and encourage when the defender gets a wrong idea in his head about what to do. Read the declassified cryptolog_126.pdf Eurocrypt trip report to get a good impression of how this works.

Three of the last four sessions were of no value whatever, and indeed there was almost nothing at Eurocrypt to interest us (this is good news!). The scholarship was actually extremely good; it's just that the directions which external cryptologic researchers have taken are remarkably far from our own lines of interest.

Defense has many resources, but many of them are misapplied: Mitigations performed that do not hold up to an attacker slightly changing strategies, products bought that do not change an attacker calculus or the exploit economics, etc.

A nontrivial part of this misapplication is information scarcity about real exploits. My personal view is that Project Zero's exploit write-ups, and the many great write-ups by the Pwn2Own competitors and other security research teams (Pangu and other Chinese teams come to mind) about the actual internal mechanisms of their exploits is invaluable to transmit understanding of actual attacks to defenders, and are necessary to help the industry stay on course.

Real exploits can be studied, understood, and potentially used by skilled defenders for both mitigation and detection, and to test other defensive measures.

The reality of software shipping and prioritization

Companies that sell software make their money by shipping new features. Managers in these organizations get promoted for shipping said features and reaching more customers. If they succeed in doing so, their career prospects are bright, and by the time the security flaws in the newly-shipped features become evident, they are four steps in the career ladder and two companies away from the risk they created.

The true cost of attack surface is not properly accounted for in modern software development (even if you have an SDLC); largely because this cost is shouldered by the customers that run the software - and even then, only by a select few that have unusual risk profiles.

A sober look at current incentive structures in software development shows that there is next to zero incentive for a team that ships a product to invest in security on a 4-5 year horizon. Everybody perceives themselves to be in breakneck competition, and velocity is prioritized. This includes bug reports: The entire reason for the 90-day deadline that Project Zero enforced was the fact that without a hard deadline, software vendors would routinely not prioritize fixing an obvious defect, because ... why would you distract yourself with doing it if you could be shipping features instead?

The only disincentive to adding new attack surface these days is getting heckled on a blog post or in a Blackhat talk. Has any manager in the software industry ever had their career damaged by shipping particularly broken software and incurring risks for their users? I know of precisely zero examples. If you know of one, please reach out, I would be extremely interested to learn more.

The tech industry as risk-taker on behalf of others

The software product industry (including mobile phone makers) has reaped excess profits for decades by selling risky products and offloading the risk onto their clients and society. My analogy is that they constructed financial products that yield a certain amount of excess return but blow up disastrously under certain geopolitical events, then sold some of the excess return and *all* of the risk to a third party that is not informed of the risk.

Any industry that can make profits while offloading the risks will incur excess risks, and regulation is required to make sure that those that make the profits also carry the risks. Due to historical accidents (the fact that software falls under copyright) and unwillingness to regulate the golden goose, we have allowed 30 years of societal-risk-buildup, largely driven by excess profits in the software and tech industry.

Now that MS (and the rest of the tech industry) has sold the rest of society a bunch of toxic paper that blows up in case of some geopolitical tail events (like the resurgence of great-power competition), they really do not wish to take the blame for it - after all, there may be regulation in the future, and they may have to actually shoulder some of the risks they are incurring.

What is the right solution to such a conundrum? Lobbying, and a concerted PR effort to deflect the blame. Security researchers, 0-day vendors, and people that happen to sell tools that could be useful to 0-day vendors are much more convenient targets than admitting: All this risk that is surfaced by security research and 0-day vendors is originally created for excess profit by the tech industry.

A right to know

My personal view on disclosure is influenced by the view that consumers have a right to get all available information about the known risks of the products they use. If an internal Tobacco industry study showed that smoking may cause cancer, that should have been public from day 1, including all data.

Likewise, consumers of software products should have access to all known information about the security of their product, all the time. My personal view is that the 90 days deadlines that are accepted these days are an attempt at balancing competing interests (availability of patches vs. telling users about the insecurity of their device).

Delaying much further or withholding data from the customer is - in my personal opinion - a form of deceit; my personal opinion is that the tech industry should be much more aggressive in warning users that under current engineering practices, their personal data is never fully safe in any consumer-level device. Individual bug chains may cost a million dollars now, but that million dollars is amortized over a large number of targets, so the cost-per-individual compromise is reasonably low.

I admit that my view (giving users all the information so that they can (at least in theory) make good decisions using all available information) is a philosophical one: I believe that withholding available information that may alter someone's decision is a form of deceit, and that consent (even in business relationships) requires transparency with each other. Other people may have different philosophies.

Rashomon, or how opinions are driven by career incentives

The movie Rashomon that gave this blog post the title is a beautiful black-and-white movie from 1950, directed by the famous Akira Kurosawa. From the Wikipedia page:

The film is known for a plot device that involves various characters providing subjective, alternative, self-serving, and contradictory versions of the same incident.

If you haven't seen it, I greatly recommend watching it.

The reason why I gave this blog post the title "Rashomon of disclosure" is to emphasize the complexity of the situation. There are many facets, and my views are strongly influenced by the sides of the table I have been on - and those I haven't been on.

Everybody participating in the discussion has some underlying interests and/or philosophical views that influence their argument.

Software vendors do not want to face up to generating excess profits by offloading risk to society. 0-day vendors do not want to face up to the fact that a fraction of their clients kills people (sometimes entirely innocent ones), or at least break laws in some jurisdiction. Security researchers want to have the right to publish their research, even if they fail to significantly impact the broken economics of security.

Everybody wants to be the hero of their own story, and in their own account of the state of the world, they are.

None of the questions surrounding vulnerability disclosure, vulnerability discovery, and the trade-offs involved in it are easy. People that claim there is an easy and obvious path to go about security vulnerability disclosure have either not thought about it very hard, or have sufficiently strong incentives to self-delude that there is one true way.

After 20+ years of seeing this debate go to and fro, my request to everybody is: When you explain to the world why you are the hero of your story, take a moment to reflect on alternative narratives, and make an effort to recognize that the story is probably not that simple.

# data[].attributes.attachment_link.description
In a world of changing technology, there are few constants - but if there is one constant in security, it is the rhythmic flare-up of discussions about disclosure on the social-media-du-jour (mailing lists in the past, now mostly Twitter and Facebook).

# data[].attributes.headline
What can be learned from a phishing domain

# data[].attributes.subject
What can be learned from a phishing domain

# data[].attributes.attachment_link.readable_text
W hat information can we learn from a phishing domain? Can we define the threat actor behind the phishing scam? By tracking and investigating one phishing domain, can we find other phishing domains in operation or even better in preparation? I try to answer those questions in this article with some case studies. I avoid using complicated forensics tools. The techniques used to track and investigate phishing domains in this article are open source and simple to use for anyone. Enjoy!

Before we dive into the nice case studies, it is important to define phishing attacks. If you already know what they are and you do not want to hear these definitive explanations, you can skip this section.

Phishing attacks are quite common among hackers to steal critical information such as login credentials, credit card information, personally identifiable information (PII), etc. or to download a malware to the target's computer. Hackers usually disseminate the link to their phishing domain through e-mails.

Phishing domains are copycats of legitimate sites such as banks, e-commerce sites, etc. Once the victim enters his/her login credentials or other important information, s/he will be redirected from doppelgänger to the legitimate site.

Phishing domains are exploited to target not only employees but also customers. Even though companies cannot be directly held responsible for customers deceived by phishing scams, it is a loss of reputation when a company does not take necessary measures.

Name-blending (look-alike) phishing domains often swap easily-confused letters ("u" and "v" or "t" and "f") and/or put additional characters in the domain (ex-ample.com for example.com). These typo-squatting techniques are quite efficient for attackers. Today, phishing domains even have valid SSL or TLS certificates to lure their targets.

In the past, we usually see phishing e-mails that include malware in the attachment. The advanced e-mail filters usually won't let these e-mails go through, so hackers evolve their techniques using malwareless attacks and using social media posts instead of e-mails.

FireEye found that 90% of e-mail attacks are malware-less (with 81% is phishing attacks) by analyzing over a half-a-billion e-mails sent in the first half of 2018.

Image courtesy: https://www.helpnetsecurity.com/2018/09/14/malware-less-email-attacks/

It is very difficult for a company to search the entire web and determine a phishing domain that may target its employees and customers, but certain tools can be used for those purposes such as NormShield's Free Phishing Domain Search. There are also some Python codes that domain names that can be used for phishing and checks if they exist.

If you are searching for phishing domains inserted in social media posts like sponsored tweets, it is kinda difficult. Let's take Twitter as our target social media platform (note that Twitter is the most common SM platform for such phishing attacks). Twitter Advanced Search does not allow you to filter out sponsored tweets.

Here are some characteristics of tweets used for phishing scams;

Always include a link (to a phishing domain)

Always include an image

Often overpromise something that lures victims to click on the link

Quickly detected by the crowd and flagged by them in the comments (Hurray crowdsource!!)

You can use these characteristics to search for tweets for phishing scams. Especially the last one may help you a lot. Though, it may be a regional parameter. For instance, in Turkey, when Twitter users see a phishing scammer tweet, they usually write one of the following phrases to the comment section by tagging Turkish Police's twitter account; dolandırıcı (fraud), "sakın tıklamayın" (don't click), sahte (fake), and so on.

Phishing domains can be investigated with basic Open-Source Intelligence Tools (OSINT). This investigation can give hints about who is behind the phishing attacks or help you identify new phishing domains.

An article that investigates the threat actors behind the Elon Musk phishing scam ends up with a name who may be behind the attack. Here, we will investigate three different phishing attacks disseminated through hacked Twitter accounts and targeting Turkish citizens.

Phishing domains sharing the same IP address

The first case study involves a phishing domain that imposters Turkcell's website, one of the major telecom operators in Turkey.

The phishing social media posts promise free data package of 8 GB. When you click on the link, it takes to the domain of turkcellcep[.]tk. It is important to note that domains with .tk extensions are one of the most preferred domains for phishing attacks that target Turkish people. On the website, if you click on the yellow buttons, an .apk file is downloaded to your device. I uploaded the file to VirusTotal and 22 engines detected the file as Spyware.

For my investigation, the first thing I did was to find the IP address of the domain, which can be done by whois, dig, nslookup commands, or by using many websites (just search for "IP for a domain").

If the domain is not active, you have to search Passive DNS to see what was the IP address used for this domain in the past. To that, you can use websites such as Mnemonic Passive DNS search engine, Robtex.com SecurityTrails.com, HackerTarget.com, Cymon.io, and VirusTotal.

Once I got the IP address (which is 181.174.165.164 in this case), I can search if this IP address is listed in the blacklist to ensure that it is reported before. Besides Cymon.io, and VirusTotal, NormShield's Free IP BlackList Search can also be used. Here I see that 181.174.165.164 is indeed listed by a few databases as blacklisted.

While investigating a phishing domain, it is important to check the other domains resolving the same IP address. Shared hosting techniques allow an IP address used by multiple domains and if you see a phishing domain resolving an IP address, you can be sure that there are other phishing domains at the same IP address. You can list the domains sharing the same IP address by SecurityTrails.com, Cymon.io, VirusTotal, and many other internet-wide scanners.

If we check this IP address on VirusTotal, we can see other domains. Here one of the domains called yapidabahar[.]com that sounds like a phishing domain to me because of its name. It can be translated as "Spring in Yapi" where the word yapi sounds like YapiKredi, one of the major banks in Turkey. The domain name is perfect if you use some spring campaign to lure people to the phishing domain.

When you go to this yapidabahar[.]com, you can see the index files indicating that the website is in preparation. There are two folders; one named index_dosyalar and the other one names xcvcxv.

If you click on the second folder, an empty page opens with a title of "Keriz Paneli" which can be translated as "Dupe Dashboard". It hints that this is another phishing domain.

The first folder includes several files including css, JavaScript and png files.

One JavaScript File called creditly.js contains codes to gather credit card information. It is mostly used in phishing attacks targeting banking customers.

So far, we understand that this is a phishing domain targeting some bank's customers. But what bank? The domain name suggests YapiKredi as I mentioned before. I also checked the png file (logo_white.png) on the websites to get a clue on my hypothesis.

Interestingly, the picture is the logo of another major bank in Turkey, Türkiye İş Bankası. That was quite interesting considering the domain name does not have any similarity to this bank. Nevertheless, we find another phishing domain in preparation that can be used to target banking customers.

Phishing domains sharing the same phrases or parameters

In this study, we have started with another phishing tweet that targets e-state (e-devlet in Turkish) users with the following promise:

Public Announcement
The refund of the dues of all citizens who use credit cards is refunded up to ₺10,000 as per the Legislation №4395.

To get the dues refund of your credit card;
You can click on the link above.

It was posted 20 minutes ago, so it was fresh and alive. Note that there is a shortened bit.ly link in the post and we will talk about link shorteners soon.

There is in fact such legislation passed from the Turkish Assembly. Phishing scammers want to exploit the news. As a matter of fact, I've personally seen the phishing kit and website codes are on sale (just for $20) in some deep web hacker forums. These scammers do not even bother to replicate a website, they just enjoy ready-to-use HTML codes and Javascript.

When you click on the link in the post, it directs you one of these look-a-like websites with the following phishing domain: www-e-devlet-portal[.]cf. The first screen asks for the credit card number and expiration date. The following screens ask for CVV number (3-digit number at the back of the credit card) and even ask for the credit card limit.

At this point, let me give you some quick tips about shortened links. Some of the url shorteners provide statistics with some easy tricks. For instance, if you add a plus (+) operator at the end of a bit.ly link, then you can see the stats, like this one ( https://bitly.com/aa+). The same trick works for some other url shorteners like goo.gl, tickurl.com, tiny.cc (use ~ instead of +), and bit.do (use - operator instead of +).

Now, if you look at the statistics of the shortened url in the tweet, you can see that more than six thousand people clicked on the link. But wait, the title in these stats says "Nike".

If I use the same shortened url by using VPN (so that I will be connecting from a different country), then it is in fact directs me to Nike's legitimate websites nike.com. Does this url shortener work on a location-based fashion? I don't know. It's a mystery to be solved another time. Let's move on to our investigation to the phishing domain.

Let's look at the HTML code of the phishing website by simply right-clicking on the website and click on "View Page Source". The code is pretty simple and if you scan through it, you can see some JavaScripts used.

One of the Javascripts embedded in the code is creditly.js. Looks familiar? That's right. It is the same js file we have seen in our previous case study used for grabbing credit card information.

As I mentioned before, many phishing scammers use the same HTML code for their phishing attacks. Some unique phrases and parameters (like a token or Google Analytics tag) may help you identify other phishing domains.

In the HTML code (and also on the website), you can see the text "Sadece Kredi Kartları Geçerlidir.." (that means "Only credit cards are accepted" in Turkish). If you simply Google it with quotation marks, it is possible that you can find other phishing domains that use the same code. I know that this phrase looks very generic, but it is worth to give it a shot. Here are the results;

Bingo! The title of the second result (modamarkam[.]com) is e-Devlet Kapisi which can be translated as "e-State Gate". If we click on that one, we see the replicate of the same phishing site with small modifications (they also ask for name and surname on the first page).

Now, let's try a token in the HTML code. In line 106, there is a token value that we can use. These tokens and tags should be unique for legitimate websites. Since these scammers use the same code, they don't bother to change these tokens.

The token can also be searched in Google, but this time we will use one of the internet-wide scanners, Shodan. In the search box of Shodan, if you use the parameter http.html: , it searches the term following the colon in the HTML codes. Here are the results;

The results showing an IP address (that is 172.104.156.186) and the domain title is Türkiye Halk Bankası, the largest state bank in Turkey. When we click on the details, we see that the location that this IP address is hosted is in Frankfurt, Germany and the registrant organization of the IP address is Linode.

Linode is a cloud hosting provider and phishing scammer got the IP address from this organization.

Now, the question is whether this new phishing domain is active or not. Since we only have the IP address and not a domain address, we can simply write http://172[.]104[.]156[.]186 to address bar of the web browser. Here how the website looks like.

This is a phishing website in preparation and the title and the external links at the website suggest that it will be targeting HalkBank customers.

I also checked if the IP address is blacklisted. It is reported by only one database.

Phishing domains sharing the same registrant

The last case study involves a phishing domain that targets a bank in Turkey called Turkiye Finans. The domain name is turkiyefinas[.]com (one letter is missing from the original domain) and it is not active (yet!).

When we explore this phishing domain in SecurityTrails, we can see the IP address, NS, MX, and SOA records of the domain.

There are also six subdomains created under this phishing domain.

When we look at the domains sharing the same IP address, we can see that there are more than six thousand domains hosted.

The important thing about this domain is that it is registered with a personal e-mail as seen in SOA records; kconsistency1@gmail.com. When we look at the domains registered by this e-mail address, we can identify many other phishing domains. Some are targeting again banking customers in Turkey.

Apparently, this guy is a serial phisher. So, I searched for the username of this persona (kconsistency1) to see if there is any information about him/her. A simple Google search returns much information about this scammer. So, I am not the first one who tracks this threat actor. That is good.

Some other curious people search for this guy and identify him as a 30-year old male in Nigeria named Oghenekevwe Ogodogun.

Tracking and investigating phishing domains with simple OSINT tools may help you identify other phishing domains in prep or the threat actor behind it.

_________________
Thanks for reading. If you enjoyed this article, feel free to hit that clap button 👏 (more than once if you like) to help others find it.

# data[].attributes.attachment_link.title
What can be learned from a phishing domain

# data[].attributes.attachment_link.description
W hat information can we learn from a phishing domain? Can we define the threat actor behind the phishing scam? By tracking and investigating one phishing domain, can we find other phishing domains in operation or even better in preparation? I try to answer those questions in this article with some case studies.

# data[].attributes.attachment_link.readable_text
This is the first in a series of blogs on a new area of focus at WITNESS around the emerging and potential malicious uses of so-called "deepfakes" and other forms of AI-generated "synthetic media" and how we push back to defend evidence, the truth and freedom of expression. This work kicked off with an expert summit-the full report on that is available here . This work is embedded in a broader initiative focused on proactive approaches to protecting and upholding marginal voices and human rights as emerging technologies such as AI intersect with the pressures of disinformation, media manipulation, and rising authoritarianism. We'll be sharing expanded elements of the report and further details on the recommendations in separate blogs-the second blog in the series can be found here.
People have started to panic about the increasing possibility of manipulating images, video, and audio, often popularly described as "deepfakes". In the past decade Hollywood studios have had the capacity to morph faces -from Brad Pitt in "The Curious Case of Benjamin Button" to Princess Leia in "Star Wars' Rogue One"-and companies and consumers have had tools such as Photoshop to digitally alter images and video in subtler ways. However, now the barriers to entry to create and manipulate audio and video in multiple, more sophisticated ways are beginning to fall, requiring less cost, less technical expertise and drawing on widely available cloud computing power. At the same time, the sophistication of manipulation of social media spaces by bad actors has led to increased opportunities to weaponize these manipulations.

This changing landscape allows for new challenges to human rights and reliable journalism that potentially includes categories of disruption including:

Reality edits removing or adding into photos and videos in a way that challenges our ability to document reality and preserve the evidentiary value of images, and enhances the ability of perpetrators to challenge the truth of rights abuses.

Credible doppelgangers of real people that enhance the ability to manipulate public or individuals to commit rights abuses or to incite violence or conflict.

News remixing that exploits peripheral cues of credibility and the rapid news cycle to disrupt and change public narratives.

Plausible deniability for perpetrators to reflexively claim "That's a deepfake" around incriminating footage or taken further, to dismiss any contested information as another form of fake news.

Floods of falsehood created via computational propaganda and individualized microtargeting, contributing to disrupting the remaining public sphere and to overwhelming fact-finding and verification approaches.

Why WITNESS is engaged

For more than 25 years, has enabled human rights defenders, and now increasingly anyone, anywhere to use video and technology to protect and defend human rights. Our work and the work of our partners demonstrates the value of images to drive a more diverse personal storytelling and civic journalism, to drive movements around pervasive human rights violations like police violence, and to be critical evidence in war crimes trials. We have also seen the ease in which videos and audio, often crudely edited or even simply recycled and re-contextualized can perpetuate and renew cycles of violence.

WITNESS' Tech + Advocacy work frequently includes engaging with key social media and video-sharing platforms to develop innovative policy and product responses to challenges facing high-risk users and high public interest content. As the threat of more sophisticated, more personalized audio and video manipulation emerges, we are focused on the critical need to bring together key actors before we are in the eye-of-the-storm, to push back against apocalyptic narratives on this issue, and identify proactive solutions to ensure we prepare in a more coordinated way.

What are deepfakes and synthetic media?

The development of new forms of image and audio synthesis is related to the growth of the subfield of machine learning known as deep learning, which includes using architectures for artificial intelligence similar to human neural networks. Generative Adversarial Networks (GANs) are the technology used in deepfakes. Two neural networks compete to produce and discern high quality faked images. One is the "generator" (which creates images that look like an original image) and the other is the "discriminator" (which tries to figure out if an image is real or simulated). They compete in a cat-and-mouse game to make better and better images.

The cost of producing these new forms of synthetic media has decreased significantly in the last few years given increasing amounts of training data, computing power and effective publicly shared approaches and code.

So what to call these manipulations? The terms to describe these advances in video and audio manipulation are not yet well defined. The current conversation is dominated by the term deepfakes, which refers to the result of software that swaps a face between one person and another, and which was initially deployed in contexts such as nonconsensual image manipulation for porn. But a broader range of manipulation (and consequent malicious uses) of audio and video is possible and has been called "synthetic media."

Potential tools susceptible to mal-uses included:

Individualized simulated audio: The enhanced ability to simulate individuals' voices as developed and available commercially via providers such as Lyrebird or Baidu DeepVoice.

Emerging consumer tools that make it easier to selectively edit, delete or change foreground and background elements in video. Concepts such as Adobe Cloak are advancing image editing currently available in tools like Photoshop or Premiere and competitors such as Pixelmator to allow better potential seamless editing of elements within video.

Facial reenactment: This refers to using images of real people as "puppets" and manipulating their faces, expressions and upper body movements. Tools such as Face2Face and Deep Video Portraits allow the transfer of the facial and upper body movements of one person onto the realistic appearance of another real person's face and upper body.

Realistic facial reconstruction and lipsync created around existing audio tracks of a person as seen for example with the LipSync Obama project.

Real people with exchange of one region, typically a face: Most commonly seen via deepfakes created using tools like FakeApp or FaceSwap these approaches also relate to technologies utilized in consumer tools like Snapchat, in which a simulation of the face of one person is imposed over the face of another person or in which a hybrid face is produced.

Combinations such as a deepfake matched with audio (simulated or real) and additional retouching, e.g. the Obama-Jordan Peele video in which the actor-director Jordan Peele made a realistic Obama say words that Peele himself was saying.

An introduction to the "arms" race between synthesis of synthetic media and detection/forensics

There is an ongoing arms race between manual and automatic synthesis of media, and manual and automatic forensic approaches.

Manual synthesis is characterized by the of texture, lighting or head motion as we have seen for example in explicit modeling of geometry, lighting and physics that we see in Hollywood effects. CGI has been a part of movie industry for 30 years, but it is time-consuming, expensive, and has required domain expertise. On the other hand, automatic synthesis involves use of implicit synthesis LipSync Obama, Deep Video Portraits or of course, deepfakes. Techniques here often involve a combination of computer vision and computer graphics, and in some cases uses of neural networks. Tools such as LipSync Obama build on a twenty-year research trajectory of exploring how to create 3D face models from existing images. There are a range of positive applications of enhanced 'synthetic media' including video and virtual telepresence, VR and AR and content creation, animation and dubbing. There will also be uses in autonomous systems and in human computer/human-robot interaction.

Editing software and manual and automatic synthesis can increasingly create perceptually realistic images that are not visible as manipulated to the naked eye and visual analysis.

Manual forensics does explicit checks of perspectival geometry, lighting, shadows and the 'physics' of images, as well as detecting for example copying and splicing between images and evidence of the camera model for a photo. A recent notable example of manual forensics specific to deepfakes is the idea of using a technique known as Eulerian Video Magnification , to see the visible pulse rate of real people that would be absent in a deepfake.

An emerging field is automatic forensics. Approaches explored in this include looking at larger datasets and using machine learning to do forensic analysis. Recent experimentation includes:

Detection of copy and splicing or use of two different camera models on origin images

Detection of " heat map" of fake pixels in facial images created using FaceSwap,

Identification of where elements of a fake image originate via image phylogeny

Use of neural networks to detect physiological inconsistencies in synthetic media, for example the absence of blinking

Use of GANs themselves to detect fake images based on training data of synthetic video images created using existing tools (the FaceForensics database).

However, most systems are trained on specific databases, and might detect mainly the inconsistencies of specific synthesis techniques, although there is work in progress that addresses these shortcomings . There are also new counter-forensic approaches that use GANs to fight back against forensic analysis - for example, by wiping the forensic traces of multiple cameras and creating an image that appears to have the uniform camera signature of another camera.

Researchers disagree on whether the "arms race" is likely to be won by the forgers or the detectors. Humans are not good at detecting the difference between a real and a fake video (see data in FaceForensics (pdf) which indicated that with low-resolution images humans had approximately 50% accuracy "which is essentially guessing") but machines are. Detection is currently easier than forgery and for every forgery AI there is a powerful detection model. Provided there is sufficient training data showing new types of faked images, audio and video, the use of GANs might be able to keep up in enabling AI-assisted identification of non-visible faking. There might be a time lag - which will be exploited by bad actors - but detection should keep improving.

What is WITNESS doing?

We see the need to:

Broaden journalists, technologists and human rights researchers' understanding of these new technologies.

Begin building a common understanding of the threats created by mal-uses of AI-generated imagery, video and audio to public discourse and reliable news and human rights documentation, and map landscape of innovation in this area.

Map the solutions emerging from existing practices in human rights, journalism and technology to deal with mal-uses of faked, simulated and recycled images, audio and video, and their relationship to other forms of mis/dis/mal-information.

Develop appropriate pragmatic tactical, normative and technical responses to risk models of fabricated audio and video that can be initiated by companies, independent activists, journalists, academic researchers, open-source technologists and commercial platforms.

Push for research and action priorities by key stakeholders.

To initiate that on June 11, 2018, WITNESS in collaboration with First Draft, a project of the Shorenstein Center on Media, Politics and Public Policy at Harvard Kennedy School, brought together thirty leading independent and company-based technologists, machine learning specialists, academic researchers in synthetic media, human rights researchers, and journalists.
Our convening report is available here and we'll be sharing expanded elements of the report and further details on the recommendations in separate blogs including:
Our goal was to have an open discussion under the Chatham House Rule about pragmatic proactive ways to mitigate the threats that widespread use and commercialization of new tools for AI-generated synthetic media such as deepfakes and facial reenactment potentially pose to public trust, reliable journalism and trustworthy human rights documentation.

What do we recommend as next steps?

Among the recommendations from the convening:
For further information on the project please contact Sam Gregory, sam@witness.org.

1. Baseline research and a focused sprint on the optimal ways to track authenticity, integrity, provenance and digital edits of images, audio, and video from capture to sharing to ongoing use. Research should focus on a rights-protecting approach that a) maximizes how many people can access these tools, b) minimizes barriers to entry and potential suppression of free speech without compromising right to privacy and freedom of surveillance c) minimizes risk to vulnerable creators and custody-holders and balances these with d) potential feasibility of integrating these approaches in a broader context of platforms, social media and in search engines. This research needs to reflect platform, independent commercial and open-source activist efforts, consider the use of blockchain and similar technologies, review precedents (e.g. spam and current anti-disinformation efforts) and identify pros and cons to different approaches as well as the unanticipated risks. WITNESS will lead on supporting this research and sprint.

2. Detailed threat modeling around synthetic media mal-uses for particular key stakeholders (journalists, human rights defenders, others). Create models based on actors, motivations and attack vectors, resulting in the identification of tailored approaches relevant to specific stakeholders or issues/values at stake.

3. Public and private dialogue on how platforms, social media sites, and search engines design a shared approach and better coordinate around mal-uses of synthetic media. Much like the public discussions around data use and content moderation, there is a role for third parties in civil society to serve as a public voice on pros/cons of various approaches, as well as to facilitate public discussion and serve as a neutral space for consensus building. WITNESS will support this type of outcomes-oriented discussion.

4. Platforms, search and social media companies should prioritize development of key tools already identified in the OSINT human rights and journalism community as critical; particularly reverse video search. This is because many of the problems of synthetic media relate to existing challenges around verification and trust in visual media.

5. More shared learning on how to detect synthetic media tha t brings together existing practices from manual and automatic forensics analysis with human rights, Open Source Intelligence (OSINT) and journalistic practitioners-potentially via a workshop where they test/learn each other's methods and work out what to adopt and how to make techniques accessible. WITNESS and First Draft will engage on this.

6. Prepare for the emergence of synthetic media in real-world situations by working with journalists and human rights defenders to build playbooks for upcoming risk scenarios so that no-one can claim "we didn't see this coming" and so as to facilitate more understanding of technologies at stake. WITNESS and First Draft will collaborate on this.

7. Include additional stakeholders who were under-represented in the June 11, 2018 convening and are critical voices either in an additional meeting or in upcoming activities including:

Global South voices as well as marginalized communities in U.S. and Europe.

Policy and legal voices and at national and international level.

Artists and provocateurs.

8. Additional understanding of relevant research questions and lead research to inform other strategies. First Draft will lead additional research.

# data[].attributes.attachment_link.title
Deepfakes and Synthetic Media: What should we fear? What can we do?

# data[].attributes.attachment_link.description
This is the first in a series of blogs on a new area of focus at WITNESS around the emerging and potential malicious uses of so-called "deepfakes" and other forms of AI-generated "synthetic media" and how we push back to defend evidence, the truth and freedom of expression.

# data[].attributes.headline
An Idiot’s Guide to Dealing with Hackers

# data[].attributes.subject
An Idiot’s Guide to Dealing with Hackers

# data[].attributes.attachment_link.readable_text
"Why not make sure you have a security@... email address?"
Add to favorites
This article is intended to be a guide for business leaders who never want to get caught with their pants down when it comes to dealing with hackers, writes Guise Bule, co-founder of WEBGAP, a remote browser isolation cybersecurity startup. It is a guide for those who want to be able to properly deal with hackers/security researchers who find holes in your security. Over the last few years I have seen these interactions botched so badly that they have burst into flames, burning brands in the process.

Dealing With Hackers #01: Don't Panic

The first thing to remember is not to panic. If a security researcher ( white hat hacker ) tells you about a hole in your security they found, this is a good thing and infinitely preferable to one of the bad guys finding it and not telling you. You should be pleased that a white hat hacker has taken the time to report the vulnerability to you and remember that they probably stumbled across it rather than 'hacked you' .

Think of them like Google , but instead of indexing the web content via ports 80 (HTTP) or 443 (HTTPS) like Google, what Shodan does is search the Web for devices that respond to a number of other ports like ports 21 (FTP), 22 (SSH), 23 (Telnet), 25 (SMTP), 443, 3389 (RDP) and 5900 (VNC), allowing searches for webcams, industrial control systems, routers, firewalls, systems CCTV, power grids and your organizations IT infrastructure.

If you put servers and services on the internet and fail to properly secure them, these automated tools will find them and alert the researcher, it's just a matter of time. If your online stuff is important enough and the vulnerability is serious enough, the researcher will reach out and try to contact you, they are trying to warn you.

If a security researcher found it first you wouldn't be contacted, instead you would see your data on the dark net for sale, or the vulnerability exploited for criminal gain. It could also be sold on through established vulnerability markets like or to the highest bidder. The bad guys will never warn you.

What Do The Hackers Want?

They want you to fix your security hole. This article intends to lay out some best practices, sensible next steps and common sense guidance for dealing with a 'hackers found holes in your security' situation in a proactive, legal and ethical way.

Security researchers come are naturally wary, too many times before have we seen security researchers threatened with legal action , , , , and when they try to tell organizations about their security vulnerabilities.

When a security researcher contacts you they are trying to tell you that they found some of your stuff online, be it an online database, a data archive, an app, an insecure web server or some sort of online service which contains an obvious and public facing vulnerability that they have stumbled across. They want you to fix it.

They are trying to warn you about it in the hope that you do something about it before somebody who is criminally minded does something about it for you. Most of the time they have to resort to contacting you on social media because it is a legitimate point of contact when no other point of contact exists, that or you have blatantly ignored their emails and failed to acknowledge them.

You have to understand that most of the time your security vulnerability is just another blip that has appeared on the researchers scanner, hardly ever have they 'hacked' you and if they did they would not be trying to warn you about it.

Never Ignore The Researcher

Never stick your head in the sand when a researcher contacts you, ignoring them in the hope they will go away is one of the worst things that you can do.

Nobody likes being ignored, especially if they are trying to warn you about a potentially serious vulnerability and there is no profit to be found in ignoring somebody who tells you about yours. If anything you will infuriate a stranger who knows about a potentially valuable and serious vulnerability in your cybersecurity setup.
The bare minimum you need to do is email the researcher saying thank you and inform them that you will look into the vulnerability immediately, this will put them at ease because you have reassured them that you are working on a fix.
If you ignore the researcher and the vulnerability there is a very real risk that they could go public with it, forcing your hand and embarrassing you in front of your audience because you left them no other choice. All the researcher wants is for you to fix your security hole and they will publicly disclose if you ignore them.

Never Threaten The Researcher Legally

It makes no sense to legally threaten security researchers who act in good faith to disclose a vulnerability when they are not a threat to your business, all you are really doing is informing your customers and partners that you do not understand the legitimate and legal work that researchers are performing. You are also announcing to black hat hackers that you do not follow best practices when it comes to dealing with security vulnerabilities and probably have other holes in your security.

Don't be like Keeper Security , drone maker , or River City Media and earn the ire and scorn of the infosec space and the media resulting in bad PR. Follow the lead of and and have clear vulnerability disclosure notices promising that you will not prosecute hackers acting in good-faith, this is a best practice approach .

Never Attack The Researcher Or Dismiss The Report

Please do not belittle, mock, or dismiss the security researchers on Twitter, as T-Mobile did shortly before they suffered a catastrophic data breach .

T-Mobile responding like this to a security researcher on social media made them look incompetent, especially when a couple of months later they suffered a huge data breach affecting two million users . It made them look like clowns.

The Helme-Gibbs Scale Of Response

The graphic below was created by security researchers as a guide to the damage you can cause your brand by botching your response to vulnerability disclosures.

As you can see it ranges from a category one with no significant damage because you acknowledged the researcher's contribution, to category three when you issue legal threats and personal attacks, all the way through to category five which results in a major loss of customers, the global media ridiculing you and affect investments.

This graphic is meant to be a tongue in cheek guide, created by Mike Thompson and Ian Thornton-Trump , based on comments from Scott Helme and Andrew Tierney , but it is still very accurate from what I have seen over the last few years in the cybersecurity space. You want to always be in category one if possible...

Consider Paying Out A Bounty - or Offering Swag

Paying out money to a researcher who found a hole in your security can feel like a shakedown and while I can understand this, I also see how misguided and unhelpful this attitude can be in the real world. Understand that a shakedown from a black hat hacker does not come in the form of a vulnerability disclosure, they prefer to use ransomware, data theft and fraud in order to extract their value. Thinking of a disclosure as a shakedown is a reflection of your own insecurity rather than reality.

Remember that the value of your vulnerability on the black market is much higher than whatever you plan to reward the researcher and that they could have easily sold your vulnerability to people who would use it for criminal financial gain.

If you are a small business who cannot afford a large bounty payment, just tell the researcher and send them a nice letter with a $20 dollar bill in it, the important thing is to acknowledge their work and remember it is usually not about the money for the researcher, they are usually happy to help out. Most researchers are never properly rewarded for their efforts and ethical hackers would never ask you for a bounty before disclosing a vulnerability to you. It's best practice to reward researchers and if you need them to, they may well sign an NDA in return, effectively buying their silence.

Use Non Disclosure Agreements The Right Way

Few companies want a researcher publicly disclosing their security holes on Twitter, or in a blog post, so make sure you get researchers to sign an NDA. Understand though that the researcher has zero legal obligation to sign an NDA with you if you offer nothing in return, so you are rewarding them with a bounty in return.

Whatever you do, do not try to get a researcher to sign an NDA in order to cover up the vulnerability; it's just as bad as threatening legal action and it will still leave you vulnerable from the real threats. An NDA does not fix your security or protect you from black hat hackers who will use it for criminal gain if it is left unresolved, The NDA buys the researcher's silence while you properly resolve the security issue and protect your IT infrastructure, data, customers, employees and shareholders.

Immediately Work To Resolve The Vulnerability

One way or another you have to resolve the vulnerability and plug the hole in your security, because if one researcher found it then it's only a matter of time before somebody else does. The longer this vulnerability is left unresolved, the more risk you expose your organization to; t he real threat to your reputation and the security of your business is a failure to resolve serious vulnerabilities when they are disclosed, and not the security researcher who is trying to warn you about the risk before it gets ugly.

Bring in professional contractors if you have to, but if you have no budget or resources to bring in the expertise you can always consider asking the researcher to help you resolve the problems themselves, usually they will be pleased to help you fix the holes in your security. Remember that these are guys who want to do good.

If you cannot afford to fix the vulnerability by bringing in professionals, or hiring your own security people, you need to trust the researcher and throw them a few dollars to help you fix the problem. Just make sure you do things properly and have the researcher sign a legal penetration testing agreement outlining the scope of the work, this protects you, the work and the security researcher legally.

Make It Easy For Researchers To Contact You In Future

I see security researchers on social media all the time becoming frustrated with companies and brands because they have no clear way to notify the right people and the people they can contact do not understand what the researcher is reporting.

Make sure you have a "security@..." email address, monitored by someone who is at least a little knowledgeable when it comes to infosec: most infosec researchers will gladly take it from there. This is best practice at some of the worlds largest organizations, if you make it easy for researchers to contact you, it shows you care about finding vulnerabilities in your infrastructure and possess cyber awareness.

Spread Around The Good Vibes For Researchers

With the press screaming about data breaches, cyberattacks, cybercriminals and malicious hackers, it is too easy for the technically inexperienced to mistake security researchers acting in good faith as malicious operators or black hat hackers, so spread word of the good guys out there, the white hats fighting the good fight.

White hat public service strengthens the cybersecurity our economy over the long term, so spread around some good vibes for the white hat hackers out there. A vulnerability disclosure is like getting a visit from the tooth fairy, it sucks to miss a tooth but you clearly profit from having a friendly tooth fairy pay you a visit.
*Editor's note: This guest post from Guise Bule has a slightly different flavour to much of Computer Business Review's fare, with its inherent sympathy for some of the often misunderstood and non-professional security researchers of the cybersecurity world. As the founder of Secjuice.com, a non-profit writing club focused on information security, network security, social engineering and open source intelligence (OSINT), Guise tells Computer Business Review: "I work with a group of 100+ emerging writers who are mostly young infosec researchers ,so I am very sympathetic to the trials and tribulations that they face as they go about mastering their craft in the real world." "The infosec space faces a unique challenge in that we have to persuade our young not to do something stupid and break the law [as for those with skills the opportunities are tempting when young]. I believe that we need to support and take pride in the security researchers who do act in good faith on a consistent basis when dealing with vulnerability disclosures. That's what inspired this post."

# data[].attributes.attachment_link.title
An Idiot's Guide to Dealing with Hackers

# data[].attributes.attachment_link.description
"Why not make sure you have a security@... email address?" Add to favorites This article is intended to be a guide for business leaders who never want to get caught with their pants down when it comes to dealing with hackers, writes Guise Bule, co-founder of WEBGAP, a remote browser isolation cybersecurity startup.

# data[].attributes.attachment_link.keywords[]
national manager for national security systems

# data[].attributes.attachment_link.description
Learn about NSA's role in U.S. cybersecurity. Includes information for students and educators, cybersecurity professionals, job seekers/careers, and also partners and affiliates.

# data[].attributes.attachment_link.readable_text
An easy, concise, and up-to-date introduction to the I2P anonymous network.

What's I2P?

I2P (Invisible Internet Project) is...well, you can read an introduction on the official site:

I2P is an anonymous network, exposing a simple layer that applications can use to anonymously and securely send messages to each other. The network itself is strictly message based (a la IP), but there is a library available to allow reliable streaming communication on top of it (a la TCP). All communication is end to end encrypted (in total there are four layers of encryption used when sending a message), and even the end points ("destinations") are cryptographic identifiers (essentially a pair of public keys).

Difficult? There is an even lengthier Wikipedia entry.

Simply put, I2P is something like Tor. You may call it Tor's distant cousin. Like Tor, you can visit or operate (special) websites without being known your identity. You can use I2P for protecting your privacy, without fearing tracking or censorship. Remember, privacy IS freedom. I2P can help you keeping it.

In this article, I would like to show you how to use I2P now. There are lots of information on I2P out there, but unfortunately some of (well, maybe most of) them are severely outdated. I intend to fill this gap.

Installing I2P

Installing I2P is quite easy now. The Download page of the official I2P website lists pre-built installer packages for Windows, MacOS, GNU/Linux, and Android. The Android version of I2P can be obtained from Google Play or F-Droid, too. There is also a Docker image. In addition, many GNU/Linux distros have I2P packages nowadays. Debian/Ubuntu packages are maintained by yours truly.

After installation, you can run I2P. On Windows, you can find "Start I2P" somewhere in Start Menu. On Debian/Ubuntu, you can run I2P on the command line:

$ i2prouter start

(Note that you should run it by a non-root account)

Then, visit http://localhost:7657 with your web browser. You will be greeted by the I2P router console.

Configure bandwidth for speeding up

To use I2P comfortably, you have to share some of your internet bandwidth. The default is 48 KBps, which is too conservative and too slow.

From the I2P router console, you can change bandwidth configuration. Find "Configure Bandwidth" in the "Applications And Configuration" section.

The optimal bandwidth depends on your situation. You can check your internet provider's specification or speedtest. Maybe 10-20% of the whole bandwidth should be good?

Using the remote I2P via SSH port fowarding

I2P is a decentralized, peer-to-peer network. So your I2P local instance ("router") needs some time to be "integrated" into the global I2P network. The longer you run I2P, the better I2P's performance becomes. If possible, you should run I2P 24 hours a day, 7 days a week.

However, if you are using mobile computers, it might be difficult. If you have a VPS or such, you may run I2P remotely, then use SSH port-forwarding. After setting up SSH access to the remote server, run the following on your local machine:

$ ssh -fTNL 4444:127.0.0.1:4444 -L 7657:127.0.0.1:7657 -L 7658:127.0.0.1:7658 -L 6668:127.0.0.1:6668 yourlogin@remoteipaddress

Replace "yourlogin" with your login name on the remote server and "remoteipaddress" with IP address of the remote server.

In this way, you can still visit http://localhost:7657, but actually connect with the remote server's port 7657. If you want to know about the other ports, see Ports Used by I2P.

Using Firefox and FoxyProxy with I2P

There are many "eepsites" inside the I2P network. They are essentially websites, but have pseudo Top-Level Domain ".i2p" and only accessible via I2P.

To browse eepsites, you have to configure proxy setting of your web browser. Find browser's proxy setting page, then set "HTTP Proxy" and "SSL Proxy" to "127.0.0.1" port "4444".

However, if you set proxy globally for all web accesses, you will access non-I2P, usual internet (often called "clearnet") websites through "outproxy" sites on the I2P network. Outproxies are extremely slow, thus not recommended. So, what you may want to do is:

Use I2P proxy setting for accessing *.i2p

Use default (non-)proxy setting for accessing clearnet sites (*.com, *.org, etc.)

This can be achieved by using Mozilla Firefox and its addon called FoxyProxy. FoxyProxy can change proxy settings on the fly, according to the pre-set rules. You can import this config file to FoxyProxy 6.x (current version) for use with I2P.

I2P Browser Bundle?

When you use the regular web browser, by default it leaks lots of personal information which can be used for tracking and identifying you. If you want to know how much information you leak, try EFF's Panopticlick.

Because of this, The Tor Project released excellent Tor Browser Bundle. TBB is actually a carefully configured version of Mozilla Firefox & Co. to protect your anonymity without any hassles.

There has been several attempts to build "I2P Browser Bundle", but for now, it would be easier to piggyback on Tor Browser Bundle. Simply install TBB, then install and set up FoxyProxy (and I2P, of course) as explained above.

Conclusion

Now you must be able to access eepsites via I2P. Let me introduce to you 3 eepsites as starting points.

Legwork.i2p (a search engine for the I2P network, run by me)

I2PWiki (Lots of how-to information on I2P's other services)

I2P Support Forum (there is also the clearnet version)

Welcome.

# data[].attributes.attachment_link.description
An easy, concise, and up-to-date introduction to the I2P anonymous network. I2P (Invisible Internet Project) is...well, you can read an introduction on the official site: I2P is an anonymous network, exposing a simple layer that applications can use to anonymously and securely send messages to each other.

# data[].attributes.attachment_link.readable_text
At one time or another, we have all been frustrated by trying to set a password, only to have it rejected as too weak. We are also told to change our choices regularly. Obviously such measures add safety, but how exactly?

I will explain the mathematical rationale for some standard advice, including clarifying why six characters are not enough for a good password and why you should never use only lowercase letters. I will also explain how hackers can uncover passwords even when stolen data sets lack them.
ChOose#W!sely@*
Here is the logic behind setting hack-resistant passwords. When you are asked to create a password of a certain length and combination of elements, your choice will fit into the realm of all unique options that conform to that rule-into the "space" of possibilities. For example, if you were told to use six lowercase letters-such as, afzjxd, auntie, secret, wwwwww-the space would contain 26 ⁶, or 308,915,776, possibilities. In other words, there are 26 possible choices for the first letter, 26 possible choices for the second, and so forth. These choices are independent: you do not have to use different letters, so the size of the password space is the product of the possibilities, or 26 x 26 x 26 x 26 x 26 x 26 = 26 ⁶.

If you are told to select a 12-character password that can include uppercase and lowercase letters, the 10 digits and 10 symbols (say, !, @, #, $, %, ^, &, ?, / and +), you would have 72 possibilities for each of the 12 characters of the password. The size of the possibility space would then be 72 ¹² (19,408,409,961,765,342,806,016, or close to 19 x 10 ²¹).

That is more than 62 trillion times the size of the first space. A computer running through all the possibilities for your 12-character password one by one would take 62 trillion times longer. If your computer spent a second visiting the six-character space, it would have to devote two million years to examining each of the passwords in the 12-character space. The multitude of possibilities makes it impractical for a hacker to carry out a plan of attack that might have been feasible for the six-character space.

Calculating the size of these spaces by computer usually involves counting the number of binary digits in the number of possibilities. That number, N, is derived from this formula: 1 + integer(log ₂( N)). In the formula, the value of log ₂(N) is a real number with many decimal places, such as log ₂(26 ⁶) = 28.202638.... The "integer" in the formula indicates that the decimal portion of that log value is omitted, rounding down to a whole number-as in integer(28.202638... 28). For the example of six lowercase letters above, the computation results in 29 bits; for the more complex, 12-character example, it is 75 bits. (Mathematicians refer to the possibility spaces as having entropy of 29 and 75 bits, respectively.) The French National Cybersecurity Agency (ANSSI) recommends spaces having a minimum of 100 bits when it comes to passwords or secret keys for encryption systems that absolutely must be secure. Encryption involves representing data in a way that ensures it cannot be retrieved unless a recipient has a secret code-breaking key. In fact, the agency recommends a possibility space of 128 bits to guarantee security for several years. It considers 64 bits to be very small (very weak); 64 to 80 bits to be small; and 80 to 100 bits to be medium (moderately strong).

Moore's law (which says that the computer-processing power available at a certain price doubles roughly every two years) explains why a relatively weak password will not suffice for long-term use: over time computers using brute force can find passwords faster. Although the pace of Moore's law appears to be decreasing, it is wise to take it into account for passwords that you hope will remain secure for a long time.

For a truly strong password as defined by ANSSI, you would need, say, a sequence of 16 characters, each taken from a set of 200 characters. This would make a 123-bit space, which would render the password close to impossible to memorize. Therefore, system designers are generally less demanding and accept low- or medium-strength passwords. They insist on long ones only when the passwords are automatically generated by the system, and users do not have to remember them.

There are other ways to guard against password cracking. The simplest is well known and used by credit cards: after three unsuccessful attempts, access is blocked. Alternative ideas have also been suggested, such as doubling the waiting time after each successive failed attempt but allowing the system to reset after a long period, such as 24 hours. These methods, however, are ineffective when an attacker is able to access the system without being detected or if the system cannot be configured to interrupt and disable failed attempts.

How Long Does It Take to Search All Possible Passwords?

For a password to be difficult to crack, it should be chosen randomly from a large set, or "space," of possibilities. The size, , of the possibility space is based on the length, A, of the list of valid characters in the password and the number of characters, , in the password. The size of this space (T = ) may vary considerably.

Each of the following examples specifies values of , , and the number of hours, , that hackers would have to spend to try every permutation of characters one by one. X is the number of years that will have to pass before the space can be checked in less than one hour, assuming that Moore's law (the doubling of computing capacity every two years) remains valid. I also assume that in 2019, a computer can explore a billion possibilities per second. I represent this set of assumptions with the following three relationships and consider five possibilities based on values of and N:

Relationships

Results

Weaponizing Dictionaries and Other Hacker Tricks

Quite often an attacker succeeds in obtaining encrypted passwords or password "fingerprints" (which I will discuss more fully later) from a system. If the hack has not been detected, the interloper may have days or even weeks to attempt to derive the actual passwords.

To understand the subtle processes exploited in such cases, take another look at the possibility space. When I spoke earlier of bit size and password space (or entropy), I implicitly assumed that the user consistently chooses passwords at random. But typically the choice is not random: people tend to select a password they can remember (locomotive) rather than an arbitrary string of characters (xdichqewax).

This practice poses a serious problem for security because it makes passwords vulnerable to so-called dictionary attacks. Lists of commonly used passwords have been collected and classified according to how frequently they are used. Attackers attempt to crack passwords by going through these lists systematically. This method works remarkably well because, in the absence of specific constraints, people naturally choose simple words, surnames, first names and short sentences, which considerably limits the possibilities. In other words, the nonrandom selection of passwords essentially reduces possibility space, which decreases the average number of attempts needed to uncover a password.

Below are the first 25 entries in one of these password dictionaries, listed in order, starting with the most common one. (I took the examples from a database of five million passwords that was leaked in 2017 and analyzed by SplashData.)

If you use password or iloveyou, you are not as clever as you thought! Of course, lists differ according to the country where they are collected and the Web sites involved; they also vary over time.

For four-digit passwords (for example, the PIN code of SIM cards on smartphones), the results are even less imaginative. In 2013, based on a collection of 3.4 million passwords each containing four digits, the DataGenetics Web site reported that the most commonly used four-digit sequence (representing 11 percent of choices) was 1234, followed by 1111 (6 percent) and 0000 (2 percent). The least-used four-digit password was 8068. Careful, though, this ranking may no longer be true now that the result has been published. The 8068 choice appeared only 25 times among the 3.4-million four-digit sequences in the database, which is much less than the 340 uses that would have occurred if each four-digit combination had been used with the same frequency. The first 20 series of four digits are: 1234; 1111; 0000; 1212; 7777; 1004; 2000; 4444; 2222; 6969; 9999; 3333; 5555; 6666; 1122; 1313; 8888; 4321; 2001; 1010.

Even without a password dictionary, using differences in frequency of letter use (or double letters) in a language makes it possible to plan an effective attack. Some attack methods also take into account that, to facilitate memorization, people may choose passwords that have a certain structure-such as A1=B2=C3, AwX2AwX2 or O0o.lli. (which I used for a long time)-or that are derived by combining several simple strings, such as password123 or johnABC0000. Exploiting such regularities makes it possible to for hackers to speed up detection.

Making Hash of Hackers

As the main text explains, instead of storing clients' passwords, Internet servers store the "fingerprints" of these passwords: sequences of characters that are derived from the passwords. In the event of an attack, the use of fingerprints can make it is very difficult, if not impossible, for hackers to use what they find.

The transformation is achieved by using algorithms known as cryptographic hash functions. These are meticulously developed processes that transform a data file, F, however long it may be, into a sequence, h(F), called a fingerprint of F. For example, the hash function SHA256 transforms the phrase "Nice weather" into:

DB0436DB78280F3B45C2E09654522197D59EC98E7E64AEB967A2A19EF7C394A3
(64 hexadecimal, or base 16, characters, which is equivalent to 256 bits)

Changing a single character in the file completely alters its fingerprint. For example, if the first character of Nice weather is changed to lowercase (nice weather), the hash SHA256 will generate another fingerprint:

02C532E7418CD1B57961A1B090DB6EC37B3C58380AC0E6877F3B6155C974647E

You can do these calculations yourself and check them at https://passwordsgenerator.net/sha256-hash-generator or www.xorbin.com/tools/sha256-hash-calculator

Good hash functions produce fingerprints that are similar to those that would be obtained if the fingerprint sequence was uniformly chosen at random. In particular, for any possible random result (a sequence of 64 hexadecimal characters), it is impossible to find a data file F with this fingerprint in a reasonable amount of time.

There have been several generations of hash functions. The SHA0 and SHA1 generations are obsolete and are not recommended. The SHA2 generation, including SHA256, is considered secure.

The Take-Home for Consumers

Taking all this into account, properly designed Web sites analyze the passwords proposed at the time of their creation and reject those that would be too easy to recover. It is irritating, but it's for your own good.

The obvious conclusion for users is that they must choose their passwords randomly. Some software does provide a random password. Be aware, however, that such password-generating software may, deliberately or not, use a poor pseudo-random generator, in which case what it provides may be imperfect.

You can check whether any of your passwords has already been hacked by using a Web tool called Pwned Passwords ( https://haveibeenpwned.com/Passwords). Its database includes more than 500 million passwords obtained after various attacks.

I tried e=mc2e=mc2, which I liked and believed to be secure, and received an unsettling response: "This password has been seen 114 times before." Additional attempts show that it is difficult to come up with easy-to-memorize passwords that the database does not know. For example, aaaaaa appeared 395,299 times; a1b2c3d4, 113,550 times; abcdcba, 378 times; abczyx, 186 times; acegi, 117 times; clinton, 18,869 times; bush, 3,291 times; obama, 2,391 times; trump, 859 times.

It is still possible to be original. The Web site did not recognize the following six passwords, for example: eyahaled (my name spelled backward); bizzzzard; meaudepace and modeuxpass (two puns on the French for "password"); abcdef2019; passwaurde. Now that I've tried them, I wonder if the database will add them when it next updates. In that case, I won't use them.

Advice for Web Sites

Web sites, too, follow various rules of thumb. The National Institute of Standards and Technology recently published a notice recommending the use of dictionaries to filter users' password choices.

Among the rules that a good Web server designer absolutely must adhere to is, do not store plaintext lists of usernames and passwords on the computer used to operate the Web site.

The reason is obvious: hackers could access the computer containing this list, either because the site is poorly protected or because the system or processor contains a serious flaw unknown to anyone except the attackers (a so-called zero-day flaw), who can exploit it.

One alternative is to encrypt the passwords on the server: use a secret code that transforms them via an encryption key into what will appear to be random character sequences to anyone who does not possess the decryption key. This method works, but it has two disadvantages. First, it requires decrypting the stored password every time to compare it with the user's entry, which is inconvenient. Second, and more seriously, the decryption necessary for this comparison requires storing the decryption key in the Web site computer's memory. This key may therefore be detected by an attacker, which brings us back to the original problem.

A better way to store passwords is through what are called hash functions that produce "fingerprints." For any data in a file-symbolized as F-a hash function generates a fingerprint. (The process is also called condensing or hashing.) The fingerprint- h(F)-is a fairly short word associated with F but produced in such a way that, in practice, it is impossible to deduce F from h(F). Hash functions are said to be one-way: getting from F to h(F) is easy; getting from h(F) to F is practically impossible. In addition, the hash functions used have the characteristic that even if it is possible for two data inputs, F and F', to have the same fingerprint (known as a collision), in practice for a given F, it is almost impossible to find an F' with a fingerprint identical to F.

Using such hash functions allows passwords to be securely stored on a computer. Instead of storing the list of paired usernames and passwords, the server stores only the list of username/fingerprint pairs.

When a user wishes to connect, the server will read the individual's password, compute the fingerprint and determine whether it corresponds to the list of stored username/fingerprint pairs associated with that username. That maneuver frustrates hackers because even if they have managed to access the list, they will be unable to derive the users' passwords, inasmuch as it is practically impossible to go from fingerprint to password. Nor can they generate another password with an identical fingerprint to fool the server because it is practically impossible to create collisions.

Still, no approach is foolproof, as is highlighted by frequent reports of the hacking of major sites. In 2016, for example, data from a billion accounts were stolen from Yahoo!

For added safety, a method known as salting is sometimes used to further impede hackers from exploiting stolen lists of username/fingerprint pairs. Salting is the addition of a unique random string of characters to each password. It ensures that even if two users employ the same password, the stored fingerprints will differ. The list on the server will contain three components for each user: username, fingerprint derived after salt was added to the password, and the salt itself. When the server checks the password entered by a user, it adds the salt, computes the fingerprint and compares the result with its database.

Even when user passwords are weak, this method considerably complicates the hacker's work. Without salting, a hacker can compute all the fingerprints in a dictionary and see those in the stolen data; all the passwords in the hacker's dictionary can be identified. With salting, for every salt used, the hacker must compute the salted fingerprints of all the passwords in the hacker's dictionary. For a set of 1,000 users, this multiplies by 1,000 the computations required to use the hacker's dictionary.

Survival of the Fittest

It goes without saying that hackers have their own ways of fighting back. They face a dilemma, though: their simplest options either take a lot of computing power or a lot of memory. Often neither option is viable. There is, however, a compromise approach known as the rainbow table method (see "Rainbow Tables Help Hackers").

In the age of the Internet, supercomputers and computer networks, the science of password setting and cracking continues to evolve-as does the relentless struggle between those who strive to protect passwords and those who are determined to steal, and potentially abuse, them.

Rainbow Tables Help Hackers

Say you are a hacker looking to exploit data that you have acquired. These data consist of username/fingerprint pairs, and you know the hash function (see "Making Hash of Hackers"). The password is contained in the possibility space of strings of 12 lowercase letters, which corresponds to 56 bits of information and 26 ¹² (9.54 x 10 ¹⁶) possible passwords.

At least two strong approaches are open to you:

Method 1. You scroll through the entire space of passwords. You calculate the fingerprint, h(P), for each password, checking to see whether it appears in the stolen data. You do not need a lot of memory, because prior results are deleted with each new attempt, although you do, of course, have to keep track of the possibilities that have been tested.

Scrolling through all the possible passwords in this way takes a long time. If your computer runs a billion tests per second, you will need 26 ¹²/(10 ⁹ x 3,600 x 24) days (1,104 days), or about three years to complete the task. The feat is not impossible; if you happen to have a computer network of 1,000 machines, one day will suffice. It is not feasible, however, to repeat such a calculation every time you wish to test additional data, such as if you obtain a new set of username/fingerprint pairs. (Because you have not saved the results of your computations, you would need an additional 1,104 days to process the new information.)

Method 2. You say to yourself, "I'll compute the fingerprints of all possible passwords, which will take time, and I'll store the resulting fingerprints in a big table. Then I'll have to find only a password fingerprint in the table to identify the corresponding password in the stolen data."

You will need (9.54 x 10 ¹⁶) x (12 + 32) bytes of memory because the task requires 12 bytes for the password and 32 bytes for the fingerprint if the fingerprint contains 256 bits (assuming an SHA256 function). That's 4.2 x 10 ¹⁸ bytes, or 4.2 million hard disks with a capacity of one terabyte.

This memory requirement is too large. Method 2 is no more feasible than method 1. Method 1 requires too many computations, and method 2 requires too much memory. Both cases are problematic: either each new password takes too long to compute, or precomputing all possibilities and storing all the results is too large a task.

Is there some compromise that requires less computing power than method 1 and less memory than required for method 2? Indeed, there is. In 1980 Martin Hellman of Stanford University suggested an approach that was improved in 2003 by Philippe Oechslin of the Swiss Federal Institute of Technology in Lausanne and further refined more recently by Gildas Avoine of the National Institute of Applied Sciences of Rennes (INSA Rennes) in France. It demands less computing power than method 1 in exchange for using a little more memory.

The Beauty of the Rainbow

Here is how it works: First, we need a function R that transforms a fingerprint h( P) into a new password R( h( P)). One might, for instance, consider fingerprints as numbers written in the binary numeral system and consider passwords as numbers written in the K numeral system, where K is the number of allowable symbols for passwords. Then the function R converts data from the binary numeral system to the K numeral system. For every fingerprint h( P), it computes a new password R( h( P)).

Now, with this function R, we can precompute data tables called rainbow tables (so named perhaps because of the multicolored way these tables are depicted).

To generate a data point in this table, we start from a possible password P ₀, compute its fingerprint, h(P ₀) and then compute a new possible password R( h(P ₀)), which becomes P ₁. Next, we continue this process from P ₁. Without storing anything other than P ₀, we compute the sequence P ₁, P ₂,... until the fingerprint starts with 20 zeros; that fingerprint is designated h(P n). Such a fingerprint occurs only once in about 1,000,000 fingerprints because the result of a hash function is similar to result of a uniform random draw, and 2 ²⁰ is roughly equal to 1,000,000. The password/fingerprint pair [P ₀, h(P n)], containing the fingerprint that starts with 20 zeros is then stored in the table.

A very large number of pairs of this type are computed. Each password/fingerprint pair [P ₀, h(P n)] represents the sequence of passwords P ₀, P ₁,... P and their fingerprints, but the table does not store those intermediate calculations. The table thus lists many password/fingerprint pairs and represents many more (the intermediates, such as P ₁ and P ₂, that can be derived from the listed pairs). But, of course, there may be gaps: some passwords may be absent from all the chains of calculations.

For a good database with almost no gaps, the memory needed to store the calculated pairs is a million times smaller than that needed for method 2, as described earlier. That is less than four one-terabyte hard disks. Easy. Also, as will be seen, using the table to derive passwords from stolen fingerprints is quite doable.

Let us see how the data stored on the hard disks makes it possible to determine a password in a given space in just a few seconds. Assume that there are no gaps; precomputation of the table takes into account all the passwords of a designated type-for example, 12-character passwords taken from the 26 letters of the alphabet.

A fingerprint f ₀ in a stolen data set can be used to reveal the associated password in the following way. Calculate h( R( f ₀)) to arrive at a new fingerprint, f ₁, then calculate h( R( f ₁)) to get f ₂, and so on, until you get to a fingerprint that begins with 20 zeros: f m. Then check the table to see which original password, P ₀, the fingerprint f m is associated with. Based on P ₀, calculate the passwords and fingerprints h ₁, h ₂,... that follow until you inevitably generate the original fingerprint f ₀, designated . The password you are looking for is the one that gave rise to-in other words, R(), which is one step earlier in the chain of calculations.

The computation time required is what it takes to look for f m in the table plus the time needed to compute the sequence of fingerprints from the associated password ( h ₁, h ₂,..., )-which is about a million times shorter than the time needed to compute the table itself. In other words, the time needed is quite reasonable.

Thus, doing a (very long) precomputation and storing only part of the results makes it possible to retrieve any password with a known fingerprint in a reasonable amount of time.

The sequences below represent separate chains of calculations leading from passwords (M o, N o,..., Q o) to fingerprints and other passwords, until the desired fingerprint (and thus the password that precedes it) pops out.(The long dotted line represents may other lines similar to the top two.)

To summarize, by knowing the beginning and end of each chain of computations (the only things that are stored during precomputation), a hacker can retrieve any password from a fingerprint. In somewhat simplistic terms, starting from a stolen fingerprint-call it fingerprint X-a hacker would apply the R and h functions repeatedly, calculating a series of passwords and fingerprints until reaching a fingerprint with 20 zeros in front of it. The hacker would then look up that final fingerprint in the table (Fingerprint C in the example below) and identify its corresponding password (Password C).

Sample Table Excerpt
Password A-Fingerprint A
Password B-Fingerprint B
Password C-Fingerprint C
Password D-fingerprint D

Next, the hacker would apply the h and R functions again, beginning with the identified password, continuing on until one of the resulting fingerprints in the chain matches the stolen fingerprint:

Password C → fingerprint 1 → password 2-- → fingerprint 2 → password 3.... → password 22-- → fingerprint 23 [a match to fingerprint X!]

The match (fingerprint 23) would indicate that the previous password (password 22), from which the fingerprint was derived, is the one linked to the stolen fingerprint.

Many computations must be done to establish the first and last column of the rainbow table. By storing only the data in these two columns and by recomputing the chain, hackers can identify any password from its fingerprint.

# data[].attributes.attachment_link.description
At one time or another, we have all been frustrated by trying to set a password, only to have it rejected as too weak. We are also told to change our choices regularly. Obviously such measures add safety, but how exactly?

# data[].attributes.attachment_link.readable_text
A botnet is a collection of internet-connected devices, which may include PCs, servers, mobile devices and internet of things devices that are infected and controlled by a common type of malware. Users are often unaware of a botnet infecting their system.

Infected devices are controlled remotely by threat actors, often cybercriminals, and are used for specific functions, so the malicious operations stay hidden to the user. Botnets are commonly used to send email spam, engage in click fraud campaigns and generate malicious traffic for distributed denial-of-service attacks.

How botnets work

The term botnet is derived from the words robot and network. A bot in this case is a device infected by malware, which then becomes part of a network, or net, of infected devices controlled by a single attacker or attack group.

The botnet malware typically looks for vulnerable devices across the internet, rather than targeting specific individuals, companies or industries. The objective for creating a botnet is to infect as many connected devices as possible, and to use the computing power and resources of those devices for automated tasks that generally remain hidden to the users of the devices.

For example, an ad fraud botnet that infects a user's PC will take over the system's web browsers to divert fraudulent traffic to certain online advertisements. However, to stay concealed, the botnet won't take complete control of the web browsers, which would alert the user. Instead, the botnet may use a small portion of the browser's processes, often running in the background, to send a barely noticeable amount of traffic from the infected device to the targeted ads.

On its own, that fraction of bandwidth taken from an individual device won't offer much to the cybercriminals running the ad fraud campaign. However, a botnet that combines millions of devices will be able to generate a massive amount of fake traffic for ad fraud, while also avoiding detection by the individuals using the devices.

Botnet architecture

Botnet infections are usually spread through malware, such as a Trojan horse. Botnet malware is typically designed to automatically scan systems and devices for common vulnerabilities that haven't been patched, in hopes of infecting as many devices as possible. Botnet malware may also scan for ineffective or outdated security products, such as firewalls or antivirus software.

Once the desired number of devices is infected, attackers can control the bots using two different approaches. The traditional client/server approach involves setting up a command-and-control (C&C) server and sending automated commands to infected botnet clients through a communications protocol, such as internet relay chat (IRC). The bots are often programmed to remain dormant and await commands from the C&C server before initiating any malicious activities.

The other approach to controlling infected bots involves a peer-to-peer network. Instead of using C&C servers, a peer-to-peer botnet relies on a decentralized approach. Infected devices may be programmed to scan for malicious websites, or even for other devices in the same botnet. The bots can then share updated commands or the latest versions of the botnet malware.

The peer-to-peer approach is more common today, as cybercriminals and hacker groups try to avoid detection by cybersecurity vendors and law enforcement agencies, which have often used C&C communications as a way to monitor for, locate and disrupt botnet operations.

Notable botnet attacks

The Zeus malware, first detected in 2007, is one of the best-known and widely used malware types in the history of information security.

Zeus uses a Trojan horse program to infect vulnerable devices and systems, and variants of this malware have been used for various purposes over the years, including to spread CryptoLocker ransomware.

Initially, Zeus, or Zbot, was used to harvest banking credentials and financial information from users of infected devices. Once the data was collected, attackers used the bots to send out spam and phishing emails that spread the Zeus Trojan to more prospective victims.

In 2009, cybersecurity vendor Damballa estimated Zeus had infected 3.6 million hosts. The following year, the FBI identified a group of Eastern European cybercriminals who were suspected to be behind the Zeus malware campaign; the FBI later made more than 100 arrests in the U.S. and Europe.

The Zeus botnet was repeatedly disrupted in 2010, when two internet service providers that were hosting the C&C servers for Zeus were shut down. However, new versions of the Zeus malware were later discovered.

Srizbi
The Srizbi botnet, which was first discovered in 2007, was, for a time, the largest botnet in the world. Srizbi, also known as the Ron Paul spam botnet, was responsible for a massive amount of email spam -- as much as 60 billion messages a day, accounting for roughly half of all email spam on the internet at the time. In 2007, the Srizbi botnet was used to send out political spam emails promoting then-U.S. Presidential candidate Ron Paul.

The botnet used a Trojan to infect users' computers, which were then used to send out spam. Experts estimated that the Srizbi botnet included approximately 450,000 infected systems.

The cybercriminals behind Srizbi used San Jose, Calif.-based hosting provider McColo for the botnet's C&C infrastructure. The botnet's activity ceased when McColo, which was discovered to be hosting other botnet and spam operations, as well, was shut down in 2008.

Gameover Zeus
Approximately a year after the original Zeus botnet was disrupted, a new version of the Zeus malware emerged, known as Gameover Zeus.

Instead of relying on a traditional, centralized C&C operation to control bots, Gameover Zeus used a peer-to-peer network approach, which initially made the botnet harder for law enforcement and security vendors to pinpoint and disrupt. Infected bots used the domain generation algorithm (DGA) to communicate.

The Gameover Zeus botnet would generate domain names to serve as communication points for infected bots. An infected device would randomly select domains until it reached an active domain that was able to issue new commands. Security firm Bitdefender reported two versions of Gameover Zeus, one of which generated 1,000 new domains, and the other which generated 10,000 new domains each day.

In 2014, international law enforcement agencies took part in Operation Tovar to temporarily disrupt Gameover Zeus by identifying the domains used by the cybercriminals, and then redirecting bot traffic to government-controlled servers.

The FBI also offered a $3 million reward for Russian hacker Evgeniy Bogachev, who is accused of being the mastermind behind the Gameover Zeus botnet. Bogachev is still at large, and new variants of Gameover Zeus have since emerged.

Methbot
An extensive cybercrime operation and ad fraud botnet known as Methbot was revealed in 2016 by cybersecurity services company White Ops. According to security researchers, Methbot was generating between $3 million and $5 million in fraudulent ad revenue daily last year by producing fraudulent clicks for online ads, as well as fake views of video advertisements.

Instead of infecting random devices, the Methbot campaign is run on approximately 800-1,200 dedicated servers in data centers located in both the U.S. and the Netherlands. The campaign's operational infrastructure includes 6,000 spoofed domains, and more than 850,000 dedicated IP addresses, many of which are falsely registered as belonging to legitimate U.S.-based internet service providers.

The infected servers can produce fake clicks and mouse movements, as well as forge social media account logins to appear as legitimate users to fool conventional ad fraud detection techniques. In an effort to disrupt the monetization scheme for Methbot, White Ops published a list of the spoofed domains and fraudulent IP addresses to alert advertisers and enable them to block the addresses.

Mirai
Several powerful, record-setting distributed denial-of-service (DDoS) attacks were observed in late 2016, and they later traced to a new brand of malware known as Mirai. The DDoS traffic was produced by a variety of connected devices, such as wireless routers and CCTV cameras.

Mirai malware is designed to scan the internet for insecure connected devices, while also avoiding IP addresses belonging to major corporations, like Hewlett-Packard and government agencies, such as the U.S. Department of Defense.

Once it identifies an insecure device, the malware tries to log in with a series of common default passwords used by manufacturers. If those passwords don't work, then Mirai uses brute force attacks to guess the password. Once a device is compromised, it connects to C&C infrastructure and can divert varying amounts of traffic toward a DDoS target.

Devices that have been infected are often still able to continue functioning normally, making it difficult to detect Mirai botnet activity from a specific device. For some internet of things (IoT) devices, such as digital video recorders, the factory password is hard coded in the device's firmware, and many devices cannot update their firmware over the internet.

The Mirai source code was later released to the public, allowing anyone to use the malware to compose botnets leveraging poorly protected IoT devices.

Preventing botnet attacks

In the past, botnet attacks were disrupted by focusing on the command-and-control source. Law enforcement agencies and security vendors would trace the bots' communications to wherever the C&C servers were hosted, and then force the hosting or service provider to shut them down.

However, as botnet malware has become more sophisticated, and communications have become decentralized, takedown efforts have shifted away from targeting C&C infrastructures to other approaches. These approaches include identifying and removing botnet malware infections at the source devices, identifying and replicating the peer-to-peer communication methods and, in cases of ad fraud, disrupting the monetization schemes, rather than the technical infrastructures.

Preventing botnet attacks has been complicated by the emergence of malware like Mirai, which targets routers and internet of things devices that have weak or factory default passwords, and which can be easily compromised.

In addition, users may be unable to change the passwords for many IoT devices, which leaves them exposed to attacks. If the manufacturer cannot remotely update the devices' firmware to patch them or change their hardcoded passwords, then they may have to conduct a factory recall of the affected devices.

# data[].attributes.attachment_link.title
What is botnet? - Definition from WhatIs.com

# data[].attributes.attachment_link.description
A botnet is a collection of internet-connected devices, which may include PCs, servers, mobile devices and internet of things devices that are infected and controlled by a common type of malware. Users are often unaware of a botnet infecting their system.

# data[].attributes.attachment_link.description
The Security Education Companion is a resource for people teaching digital security to their friends and neighbors.

# data[].attributes.attachment_link.readable_text
All of us, as active users of internet specially the social media, are always concerned about our privacy and our data that is processed by the giant organizations. The recent Facebook privacy breach incident has significantly escalated things in this domain.

In a world where everyone is over exposed the coolest thing you can do is maintain your mystery. (~Unknown)

A while ago, a blog drove my attention towards the privacy issues we deal nowadays, especially over the internet. World Wide Web is a very complex human invention and thus, technically very less understood by humans. The blog talked about how even TOR is compromised with honeypots. A decent explanation and working of honeypot will require a whole different article and I won't try it here.

As Wikipedia stated, a honeypot is a computer security mechanism set to detect, deflect, or, in some manner, counteract attempts at unauthorized use of information systems. Generally, a honeypot consists of data that appears to be a legitimate part of a website but is actually an isolated and monitored, and that seems to contain information or a resource of a value of attackers, which are then blocked. They are often used as baits for criminals, by legal authorities for undercover surveillance on various platforms like TOR.

The key thing is to minimize (or eliminate) your digital footprint while surfing the web. Webopedia defines digital footprint as a trail that people leave online. It is information transmitted online, such as forums registration, emails and attachments. This even includes your comments, likes and shares over different social media platforms.

The extent to which you want to minimize this footprint depends whether you are a hacker, a student (or employee) using an institutional network, or just a person sitting in front of your desktop at home. The important thing is to have control over your digital footprint. Make sure, what you want is only being shared online, or is available over the internet for others to see.

We usually switch our browser to incognito mode while surfing privately and thinks that we are doing fine in protecting our privacy. Browsing using private mode is not 100% private. The only thing that this mode does is stop storing history, cookies and temporary files on the client side. What about over the server side? In short, the answer is - nothing. Websites (on the server side) keep information about your IP and other data during the session.

This stored data can be stored in non-encrypted form. So, here much is left on the developer of the application you are using. Also, the use of incognito mode doesn't restrict the sniffers from viewing the data that enters or leaves your device. I will recommend the use of TOR browser if you want to extend your anonymity from what general browsers provide.

Websites we are surfing shares our data with other websites and keep track of our browsing. These trackers include advertisements, social media and site analysis sites and plugins. The collected data provides important input to the machine learning algorithms running on various servers.

They help to generate nice predicted options of what we might need or wishes to see. An advertisement on our visiting page is a product (to a great extent) of your previous searches. Organizations often sell this information to other organizations. The problem arises when the information is misused or it is stored in an unsecured (non-encrypted) manner.

To get the feel of who is keeping track of your browsing and who is getting your data via a website, you can use browser add-ons. Two of my favorite ones are ghostery and disconnect. The cool thing about them is that they allow us to have control over who can keep track of us and who can get our data. Ghostery tells about the trackers on the website, while disconnect shows the list (and graph) of the websites which might be receiving information about us. The image below shows their interfaces.

Another common mistake that people make is the improper deletion of files. We often sell (or dump them into dustbins) our used electronic devices like mobiles, laptops, printers, pen drives and external hard disks to others. Before that, we simply delete our important files, pictures or format the device.

Deleting a file only removes the reference to file objects, while actual data still resides in the memory. Anyone having access to the device can easily recover the data using any third-party software. There are many software available which securely clear data by overwriting them in multiple turns. CCleaner is a very good tool to perform the secure deletion. In case you are using Linux, commands like

shred /dev/sda

dd if=/dev/random of=/dev/sda

can come to your rescue. I will recommend you to go through the use of these commands by googling them. They are very good commands and will come in handy. You can find more about about the traces left behind in hard disks even after deletion here.

The Internet is the home of many viruses, Trojans, malware and worms. One must make sure about what websites are writing on your disks, especially on your C drive. Be cautious while downloading files from the internet. And keep an eye on the extension of the downloaded files, before opening them. Make sure that you have blocked pop-ups by going in the browser's settings.

The most important thing is to be always alert and pay attention to what the websites are trying to do. Don't open the links, unless you are sure, that are forwarded to you in group chats as they might hold malicious stuff. You can check for malicious links at VirusTotal. After a virus is planted on the device then it will start sending your sensitive data to its creator by creating a TCP connection. This is basically what Trojans do. One way of detecting a Trojan is using typing netstat (in windows). Any odd looking connection is possibly a Trojan.

In the end, I will say, keep learning how things work and don't be easy targets for hackers (or hackers who are better than you). The primary weapon that any hacker has is carelessness and ignorance of the victim. By increasing your knowledge and understanding about the networks and applications running over internet will greatly increase the amount of work hacker need to do before tricking you into a trap. Initially I published this article in my website.

# data[].attributes.attachment_link.title
Privacy And The Trail You Leave Behind - secjuice™ - Medium

# data[].attributes.attachment_link.description
All of us, as active users of internet specially the social media, are always concerned about our privacy and our data that is processed by the giant organizations. The recent Facebook privacy breach incident has significantly escalated things in this domain. In a world where everyone is over exposed the coolest thing you can do is maintain your mystery.

# data[].attributes.headline
Tools & Tactics That Hackers Use Against Hackers

# data[].attributes.subject
Tools & Tactics That Hackers Use Against Hackers

# data[].attributes.attachment_link.readable_text
How to protect yourself and be better at keeping secrets

Keeping secrets can be hard,

the "I am not telling anyone" can even turn into " I am telling one person at a time".

Well, the truth is, when it comes to getting hacked, our stupidity can be our largest threat.

So here's a short infographic that will show you how to protect yourself and make yourself a harder target for hackers.

Damn kids, they're all alike. _ The Hacker's Manifesto, The Mentor

The full infographic that includes the second part is available here on my website.

Hope this is helpful to you, hit that HEART button, it's easy, will help reach people and means a lot to me

xoxoxo

Love, hugs and all the good stuff,

Ismail

# data[].attributes.attachment_link.title
Tools & Tactics That Hackers Use Against Hackers - secjuice™ - Medium

# data[].attributes.attachment_link.description
Keeping secrets can be hard, the "I am not telling anyone" can even turn into " I am telling one person at a time". Well, the truth is, when it comes to getting hacked, our stupidity can be our largest threat.

# data[].attributes.attachment_link.description
In an age of nonstop breaches and hacks, here are ways to improve your online security based on your level of risk, from average user to NSA contractor.

# data[].attributes.attachment_link.readable_text
With the growth in ecommerce comes a huge risk to businesses and the personal and financial information they hold; never before has this information been such a high-risk asset.
Check out our H2 hedge fund letters here.
Although there are constant new developments being made to combat these crimes, there are also new and ingenious ways hackers and cybercriminals develop to get around them.

Cybercrime comes in many shapes and forms: malware, stolen devices, DDoS attacks, malicious program, web based attacks, and ransomware, to name but a few of the many.

Online businesses are often targeted across all industries, including the medical and healthcare fields which are particularly valuable due to the sensitive information they hold. It is not just businesses which are under threat - as an individual you are likely to have been the subject of some form of attack or cybercrime such as spam emails or popups. A staggering 91% of cybercrimes and attacks start with a phishing email which the recipient unknowingly opens.

Cybercrime is preventable, though. Businesses are spending big money on it too. In the UK, the average security breach costs around £36,500 so it comes as no surprise that the cybersecurity market is worth around $120 billion. Cybersecurity is huge and many businesses do well in protecting themselves by taking the right preventative measures and investing money in the right places and practices.
Preventing Cybercrime
In 2017, ransomware was the most popular cybercrime tool with the monthly rate of these attacks being ten times higher than in 2016. In 2017, there was a record breaking 700 million ransomware attacks.

So, how can you protect yourself or your business from these risks?

In addition to large high tech protocols, powerful firewalls, well configured virtual private networks and personnel training, there are many simple ways you can keep yourself or your company's information safe:

Encrypt wireless networks with a strong password;

Encrypt files, folders and drives which store sensitive information;

Operate strict company password policies;

Keep your operating systems up to date;

Only give access to data to those who need it.

These are just a few of the steps you can take as an individual or the operator of a business to help protect yourself from cybercrime. As a company, if you do not operate with these policies and do not take active and preventative steps to protect yourself from cybercrime, you are at a huge risk of being the victim of one.

Cybercrime is something which the public is generally not wholly aware of; most of it goes unreported. In 2014 there were 145 million eBay accounts compromised and on July 29, 2017, 143 million Equifax accounts were hacked and had their data stolen. These are big businesses, but it does not mean they are immune. This should highlight the importance to you of keeping on top of your cybersecurity and taking steps to learn more about it and how to prevent it.

To learn more about cybercrime, some facts and interesting statistics, check out our infographic below which has over 77 unique facts and figures!
Infographic source: Best VPNs

# data[].attributes.attachment_link.title
Cybercrime And How To Prevent It [INFOGRAPHIC]

# data[].attributes.attachment_link.description
With the growth in ecommerce comes a huge risk to businesses and the personal and financial information they hold; never before has this information been such a high-risk asset. Check out our H2 hedge fund letters here.

# data[].attributes.attachment_link.title
GreySec Forums - Security and Exploitation

# data[].attributes.attachment_link.description
Talk about web exploitation and security. Such as SQL injection, cross site scripting etc.

# data[].attributes.headline
How to Test a Suspicious Link Without Clicking it

# data[].attributes.subject
How to Test a Suspicious Link Without Clicking it

# data[].attributes.attachment_link.readable_text
Do you have click anxiety? It's that feeling you get right before you click a link that looks a little fishy. You think to yourself, am I going to get a virus by clicking this? Sometimes you click it, sometimes you don't.

Are there any warning signs that might tip you off that a link might infect your computer or send you to a phishing site?

Warning Signs of Possible Malware Links

The following sections will help you learn to spot malicious links and show you some tools you can use to test a link's safety without actually visiting it.

The Link is a Shortened Link

Link shortening services such as bitly and others are popular choices for anyone trying to fit a link into the confines of a Twitter post. Unfortunately, link shortening is also a method used by malware distributors and phishers to conceal the true destinations of their links.

Obviously, if a link is shortened, you can't tell whether it's bad or good just by looking at it, but there are tools to allow you to view the true destination of a short link without actually clicking it. Check out our article on the Dangers of Short Links for details on how to view a short link's destination.

The Link Came to You in an Unsolicited Email

If you received an unsolicited email that is supposedly from your bank asking you to "verify your information" then you are probably the target of a phishing attack.

Even if the link to your bank in the email looks legitimate, you shouldn't click it as it could be a phishing link in disguise.

ALWAYS go to your bank's website by entering their address directly into your browser or via a bookmark you made yourself. Never trust links in e-mails, text messages, pop-ups, etc.

The Link Has a Bunch of Strange Characters in it

Oftentimes, hackers and malware distributors will try to conceal the destination of malware or phishing sites by using what is known as URL encoding.

For example, the letter "A" that has been URL-encoded would translate to "%41".

Using encoding, hackers and malware distributors can mask destinations, commands, and other nasty stuff within a link so that you can't read it (unless you have a URL decoding tool or translation table handy). Bottom line: if you see a bunch of "%" symbols in the URL, beware.

How to Check a Suspicious Link Without Clicking it

Ok, so we've shown you how to spot a link that might be suspicious, but how can you check out a link to find out if it's dangerous without actually clicking it? Take note of these next sections.

Expand Shortened Links

You can expand a short link by using a service such as CheckShortURL or by loading a browser plug-in that will show you a short link's destination by right-clicking the short link. Some link expander sites will go the extra mile and will let you know if the link is on a list of known "bad sites".

Scan the Link with a Link Scanner

There are a host of tools available to check the safety of a link before actually clicking on it to visit the site. Norton SafeWeb, URLVoid, ScanURL, and others offer varying degrees of link safety checking.

Enable the "Real-time" or "Active" Scanning Option in Your Antimalware software

In order for you to have the best chances of detecting malware before it infects your computer, you should take advantage of any "active" or "real-time" scanning options provided by your antimalware software.

It may use more system resources to enable this option, but it's better to catch malware while it's trying to enter your system rather than after your computer has already been infected.

Keep Your Antimalware/Antivirus Software up to Date

If your antimalware / antivirus software doesn't have the latest virus definitions, it's not going to be able to catch the latest threats in the wild that might infect your machine. Make sure your software is set to auto update on a regular basis and check the date of its last update to ensure that updates are actually taking place.

Consider Adding a Second Opinion Malware Scanner

A second opinion malware scanner can offer a second line of defense should your primary antivirus fail to detect a threat (this happens more often than you would think).

There are some excellent second opinion scanners available such as MalwareBytes and Hitman Pro. Check out our article on Second Opinion Malware Scanners for more information.

# data[].attributes.attachment_link.title
How to Test a Suspicious Link Without Clicking it

# data[].attributes.attachment_link.description
Do you have click anxiety? It's that feeling you get right before you click a link that looks a little fishy. You think to yourself, am I going to get a virus by clicking this? Sometimes you click it, sometimes you don't.

# data[].attributes.headline
Geographical Region With the Most Ransomware Encounters in 2017

# data[].attributes.subject
Geographical Region With the Most Ransomware Encounters in 2017

# data[].attributes.attachment_link.readable_text
In the land of IT security, there is no better source for malware statistics than Microsoft, the company that has an antivirus engine running on almost all recent Windows operating systems.

Every six months, Microsoft releases the Security Intelligence Report (SIR), a comprehensive dossier full of juicy insights regarding malware and cybercrime operations.

Released today, the Microsoft SIR 23 report contains a section dedicated to ransomware -2017's most lucrative cybercrime operation.

Asia most hit by ransomware

According to Microsoft, based on analytics the company recorded between February and December 2017, Asia was the geographical region that recorded the greatest number of ransomware encounters last year.

Myanmar and Bangladesh were the two most hit countries, accounting for 0.48% and 0.36% of all encounter rates, while third place went to Venezuela, with 0.33%.

Locations with the lowest ransomware encounter rates included Japan, Finland, and the US, all of which had an average monthly ransomware encounter rate of 0.03%.

Android screenlocker was 2017's most active ransomware

But even if 2017 will be remembered as the year of the three ransomware outbreaks -WannaCry, NotPetya, and Bad Rabbit- according to Microsoft, the year's most encountered ransomware family was a relatively unknown strain named LockScreen.

This isn't an encryption-based ransomware, but a mere screenlocker that displays your typical "you've been watching porn" message and asks you to send an SMS to a premium phone number to receive an unlock code for your computer's screen.

According to Microsoft, LockScreen was first seen infecting Android devices, then it slowly started infecting Windows systems.

"This can happen if, for example, Android users sync their phones or download Android applications in Windows and do side loading of the applications that are not sanctioned (for example, not sourced from the official Google Play store)," Microsoft said. "The Southeast Asia region tends to have a higher adoption rate of Android, which would explain the greater number of encounters in that region."

Besides LockScreen, the rest of the top five belonged to WannaCry, Cerber, a generic Enestedel detection, and the now-defunct Spora family.

Besides an overview of ransomware activity, the Microsoft SIR 23 report also contains information on the aftermath following the shutdown of the Andromeda (Gamarue) botnet, and an analysis of a new trend of hackers going after easy marks using phishing, by targeting poorly secured cloud apps, and living off the land by using legitimate apps and services for malicious operations.

# data[].attributes.attachment_link.title
Geographical Region With the Most Ransomware Encounters in 2017 Was Asia

# data[].attributes.attachment_link.description
In the land of IT security, there is no better source for malware statistics than Microsoft, the company that has an antivirus engine running on almost all recent Windows operating systems. Every six months, Microsoft releases the Security Intelligence Report (SIR), a comprehensive dossier full of juicy insights regarding malware and cybercrime operations.

# data[].attributes.headline
A glossary of common words used within Cyber Security

# data[].attributes.subject
A glossary of common words used within Cyber Security

# data[].attributes.attachment_link.title
Secret Global Surveillance Networks report web (200)_0.pdf

# data[].attributes.attachment_link.readable_text
PLEASE BE PATIENT AS IT MAY TAKE SOME TIME FOR THE SHEET TO LOAD

Green = "Generally good", Yellow = "Something of concern", Red = "Something major of concern", Blank = Undefined or for reader's knowledge only.

See what these fields mean here.

You can download the VPN Comparison Chart in other formats below:

Excel - xlsx | LibreOffice - ods | CSV - csv

Color blind? There is a version of the table for you here.

I make every effort to keep the data on the VPN Comparison Chart up to date. However, parts of it could potentially be incorrect for various reasons - including if a given VPN service is not transparent and does not make the data available on their official site. Please do your own research if this is of concern. Note also that if a company does not make available certain data on their website, I may assume the worst and a default field will be used. This in no way means I am making a claim about a service, but rather noting the data they lack.

If you are with a VPN company and you'd like to request an update to your information, feel free to contact me citing a proper source on the official website and I will be happy to update your data!
(Data last updated on 4/28/18) If you like the project and find my work useful, please consider donating - your generous contributions help pay for the hosting, tools, and time I need to do my research and keep the data fresh.

# data[].attributes.attachment_link.description
PLEASE BE PATIENT AS IT MAY TAKE SOME TIME FOR THE SHEET TO LOAD Green = "Generally good", Yellow = "Something of concern", Red = "Something major of concern", Blank = Undefined or for reader's knowledge only. See what these fields mean here.

# data[].attributes.headline
EPIC Online Guide to Practical Privacy Tools

# data[].attributes.subject
EPIC Online Guide to Practical Privacy Tools

# data[].attributes.attachment_link.title
EPIC - EPIC Online Guide to Practical Privacy Tools

# data[].attributes.attachment_link.description
The Electronic Privacy Information Center (EPIC) focuses public attention on emerging civil liberties, privacy, First Amendment issues and works to promote the Public Voice in decisions concerning the future of the Internet.

# data[].attributes.headline
How I used a simple Google query to mine passwords from dozens of public Trello boards

# data[].attributes.subject
How I used a simple Google query to mine passwords from dozens of public Trello boards

# data[].attributes.attachment_link.readable_text
A few days ago on 25th April, while researching, I found that a lotof individuals and companies are putting their sensitive information on their public Trello boards. Information like unfixed bugs and security vulnerabilities, the credentials of their social media accounts, email accounts, server and admin dashboards  - you name it, is available on their public Trello Boards which are being indexed by all the search engines and anyone can easily find them.

How did I discover this?

I searched for Jira instances of companies running Bug Bounty Programs with the following search query:

inurl:jira AND intitle:login AND inurl:[company_name]

Note: I used a Google dork query, sometimes referred to as a dork. It is a search string that uses advanced search operators to find information that is not readily available on a website. -

I entered Trello in place of [company name]. Google presented a few results on Trello Boards. Their visibility was set to Public, and they displayed login details to some Jira instances. It was around 8:19 AM, UTC.
I was so shocked and amazed 😲
So why was this a problem? Well, Trello is an online tool for managing projects and personal tasks. And it has Boards which are used to manage those projects and tasks. The user can set the visibility of their boards to Private or Public.

After finding this flaw, I thought - why not check for other security issues like email account credentials?

I went on to modify my search query to focus on Trello Boards containing the passwords for Gmail accounts.

inurl:https://trello.com AND intext:@gmail.com AND intext:password

And what about SSH and FTP?

inurl:https://trello.com AND intext:ftp AND intext:password

inurl:https://trello.com AND intext:ssh AND intext:password

🔎 What else I found

After spending a few hours using this technique, I uncovered more amazing discoveries. All while I kept on changing my search query.

Some companies use Public Trello boards to manage bugs and security vulnerabilities found in their applications and websites.

People also use Public Trello boards as a fancy public password manager for their organization's credentials.

Some examples included the server, CMS, CRM, business emails, social media accounts, website analytics, Stripe, AdWords accounts, and much more.

Until then I was not focusing on any specific company or Bug Bounty Programs.

But nine hours after I discovered this Trello vulnerability, I had found the contact details of almost 25 companies that were leaking some very sensitive information. So I reported them. Finding contact details for some of them was a tedious and challenging task.

I posted about this in a private Slack of bug bounty hunters and a infosec Discord server. I also tweeted about this right after discovering this Trello technique. Thepeople there were as amazed and astonished as I was.

Then people started telling me that they were finding cool things like business emails, Jira credentials, and sensitive internal information of Bug Bounty Programs through the Trello technique I shared.

Almost 10 hours after discovering this Trello technique, I started testing companies running Bug Bounty Programs specifically. I then began with checking a well-known ridesharing company using the search query.

inurl:https://trello.com AND intext:[company_name]

I instantly found a Trello boardthat contained login details of an emplyee's business email account, and another that contained some internal information.

To verify this, I contacted someone from their Security Team. They said they had received a report about the Board containing email credentials of an employee right before mine and about the other board containing some internal information. The security team asked me to submit a complete report to them because this is a new finding.

Unfortunately, my report got closed as a Duplicate. The ridesharing company later found out that they had already had received a report about the Trello board I found.

In the coming days, I reported issues to 15 more companies about their Trello boards that were leaking highly sensitive information about their organizations. Some were big companies, but many don't run a Bug Bounty Program.

One of the 15 companies was running a Bug Bounty Program, however, so I reported to them through it. Unfortunately, they didn't reward me because it was an issue for which they currently don't pay. 🤷

Thanks for reading my story.

If you liked this article, give me some claps 👏

And you canfollow me on Twitter✌️

I'd like to thank CyberSecStu, Toffee and the freeCodeCamp editorial team for helping me proofread and edit this article.

# data[].attributes.attachment_link.title
How I used a simple Google query to mine passwords from dozens of public Trello boards

# data[].attributes.attachment_link.description
A few days ago on 25th April, while researching, I found that a lotof individuals and companies are putting their sensitive information on their public Trello boards. Information like unfixed bugs and security vulnerabilities, the credentials of their social media accounts, email accounts, server and admin dashboards  - you name it, is available on their public Trello Boards which are being indexed by all the search engines and anyone can easily find them.

# data[].attributes.attachment_link.description
At the National Cyber Security Centre, we use infographics to bring technical guidance to life.

# data[].attributes.headline
The Use of Pastebin for Sharing Stolen Data

# data[].attributes.subject
The Use of Pastebin for Sharing Stolen Data

# data[].attributes.attachment_link.readable_text
Pastebin is a popular website for storing and sharing text. Though it's mostly used for distributing legitimate data, it seems to be frequently used as a public repository of stolen information, such as network configuration details and authentication records. Various hacker groups and individuals also use Pastebin to distribute their loot the highest-a trend perhaps initially set in motion by LulzSec.

What's Popular on Pastebin

To get a taste for the kind of information available on Pastebin, take a look at its Trending Pastes page. It's not uncommon for the most popular pages to include gems such as:

A listing of subnet addresses that belong to various corporations

A dump of compromised Facebook accounts, complete with email addresses and passwords

An internal user database of a compromised website, including email addresses, privileges and password hashes

An export of a users table from a compromised database, including usernames and passwords

Why Do Hackers like Pastebin?

What is attracting the hacker community to Pastebin? And why do compromised records persist on the site? Trying to figure this out, I asked on Twitter, why Pastebin, rather than some other site, became a popular platform for sharing stolen records. The responses I received highlighted the following attributes of Pastebin:

It's easy to use

It can handle large text files

It doesn't proactively moderate postings

Publishing there doesn't require registration

Its heritage is rooted in IRC networks

Also, I received a pointer to an article by Matt Brian titled Pastebin: How a popular code-sharing site became the ultimate hacker hangout. Among the many examples brought up in the article is the story of the data stolen from Sony Pictures being posted on Pastebin and receiving 155,000 views before it was removed due to a takedown notice from Sony. I'd like to better understand the role that Pastebin plays in such incidents.

Pastebin's Handling of Takedown Notices

To me, the most interesting aspect of Matt's article was the the perspective that Jeroen Vader, the owner of Pastebin shared on the use of the site to share stolen data. He said:

"Pastebin is a website that is used by millions of people every month, and some of those people will create pastes with sensitive information in it. We have a good abuse report system in place that is monitored through out the day."

Jeroen explained that the site responds to takedown notices and that "if a reported item contains private information it can be removed instantly."

Is that a reasonable stance? I can understand why the site doesn't want to take on the burden of moderating content. Yet, identifying and flagging the files that might contain sensitive data isn;t very hard. As a starting point, Pastebin could merely look at the items on the top of its Trending Pastes page.

Automatically Finding Stolen Data on Pastebin

Pastebin could also automatically look for the signatures that indicate possible sensitive data. In fact, that's what Jaime Blasco seems to have done to create the now-defunct tool called PastebinLeaks, which automatically identifies stolen data artifacts posted on Pastebin. The service was quite accurate and its findings, published on Twitter, were disturbing:

A similar free service, still active on Twitter, is Dump Monitor by Jordan Wright. Another example of a free service that monitors Pastebin for stolen data is Have I Been Pwned? by Troy Hunt. Another is LeakedIn.

Keeping an eye on sites such as Pastebin has also become a common tactic for threat intelligence-gathering companies and projects.

Wrapping it Up

To sum up, attackers seem to use Pastebin to share stolen data because the site is easy to use for sharing voluminous text and because their buddies use it as well. Moreover, they know that the data published there will be around for some time for the world to see, since Pastebin doesn't proactively moderate content.

It's interesting to explore the technological, historic and sociological reasons why Pastebin has become a popular repository of stolen data. Perhaps more importantly, we need to understand how companies can identify when their data was published on a site such as Pastebin. Also, my hope is that such sites will implement some form of proactive monitoring and will deal with suspected data leaks without waiting for a formal takedown notice.

For my follow-up post related to this topic, see Using Pastebin Sites for Pen Testing Reconnaissance.

# data[].attributes.attachment_link.title
The Use of Pastebin for Sharing Stolen Data

# data[].attributes.attachment_link.description
Pastebin is a popular website for storing and sharing text. Though it's mostly used for distributing legitimate data, it seems to be frequently used as a public repository of stolen information, such as network configuration details and authentication records. Various hacker groups and individuals also use Pastebin to distribute their loot the highest-a trend perhaps initially set in motion by LulzSec.

# data[].attributes.attachment_link.readable_text
Introduction

Cyber criminals tend to favor cryptocurrencies because they provide a certain level of anonymity and can be easily monetized. This interest has increased in recent years, stemming far beyond the desire to simply use cryptocurrencies as a method of payment for illicit tools and services. Many actors have also attempted to capitalize on the growing popularity of cryptocurrencies, and subsequent rising price, by conducting various operations aimed at them. These operations include malicious cryptocurrency mining (also referred to as cryptojacking), the collection of cryptocurrency wallet credentials, extortion activity, and the targeting of cryptocurrency exchanges.

This blog post discusses the various trends that we have been observing related to cryptojacking activity, including cryptojacking modules being added to popular malware families, an increase in drive-by cryptomining attacks, the use of mobile apps containing cryptojacking code, cryptojacking as a threat to critical infrastructure, and observed distribution mechanisms.

What Is Mining?

As transactions occur on a blockchain, those transactions must be validated and propagated across the network. As computers connected to the blockchain network (aka nodes) validate and propagate the transactions across the network, the miners include those transactions into "blocks" so that they can be added onto the chain. Each block is cryptographically hashed, and must include the hash of the previous block, thus forming the "chain" in blockchain. In order for miners to compute the complex hashing of each valid block, they must use a machine's computational resources. The more blocks that are mined, the more resource-intensive solving the hash becomes. To overcome this, and accelerate the mining process, many miners will join collections of computers called "pools" that work together to calculate the block hashes. The more computational resources a pool harnesses, the greater the pool's chance of mining a new block. When a new block is mined, the pool's participants are rewarded with coins. Figure 1 illustrates the roles miners play in the blockchain network.

Underground Interest

FireEye iSIGHT Intelligence has identified eCrime actor interest in cryptocurrency mining-related topics dating back to at least 2009 within underground communities. Keywords that yielded significant volumes include miner, cryptonight, stratum, xmrig, and cpuminer. While searches for certain keywords fail to provide context, the frequency of these cryptocurrency mining-related keywords shows a sharp increase in conversations beginning in 2017 (Figure 2). It is probable that at least a subset of actors prefer cryptojacking over other types of financially motivated operations due to the perception that it does not attract as much attention from law enforcement.

Monero Is King

The majority of recent cryptojacking operations have overwhelmingly focused on mining Monero, an open-source cryptocurrency based on the CryptoNote protocol, as a fork of Bytecoin. Unlike many cryptocurrencies, Monero uses a unique technology called "ring signatures," which shuffles users' public keys to eliminate the possibility of identifying a particular user, ensuring it is untraceable. Monero also employs a protocol that generates multiple, unique single-use addresses that can only be associated with the payment recipient and are unfeasible to be revealed through blockchain analysis, ensuring that Monero transactions are unable to be linked while also being cryptographically secure.

The Monero blockchain also uses what's called a "memory-hard" hashing algorithm called CryptoNight and, unlike Bitcoin's SHA-256 algorithm, it deters application-specific integrated circuit (ASIC) chip mining. This feature is critical to the Monero developers and allows for CPU mining to remain feasible and profitable. Due to these inherent privacy-focused features and CPU-mining profitability, Monero has become an attractive option for cyber criminals.

Underground Advertisements for Miners

Because most miner utilities are small, open-sourced tools, many criminals rely on crypters. Crypters are tools that employ encryption, obfuscation, and code manipulation techniques to keep their tools and malware fully undetectable (FUD). Table 1 highlights some of the most commonly repurposed Monero miner utilities.

Table 1: Commonly used Monero miner utilities

The following are sample advertisements for miner utilities commonly observed in underground forums and markets. Advertisements typically range from stand-alone miner utilities to those bundled with other functions, such as credential harvesters, remote administration tool (RAT) behavior, USB spreaders, and distributed denial-of-service (DDoS) capabilities.

Sample Advertisement #1 (Smart Miner + Builder)

In early April 2018, actor "Mon£y" was observed by FireEye iSIGHT Intelligence selling a Monero miner for $80 USD - payable via Bitcoin, Bitcoin Cash, Ether, Litecoin, or Monero - that included unlimited builds, free automatic updates, and 24/7 support. The tool, dubbed Monero Madness (Figure 3), featured a setting called Madness Mode that configures the miner to only run when the infected machine is idle for at least 60 seconds. This allows the miner to work at its full potential without running the risk of being identified by the user. According to the actor, Monero Madness also provides the following features:

Unlimited builds

Builder GUI (Figure 4)

Written in AutoIT (no dependencies)

FUD

Safer error handling

Uses most recent XMRig code

Customizable pool/port

Packed with UPX

Works on all Windows OS (32- and 64-bit)

Madness Mode option

Sample Advertisement #2 (Miner + Telegram Bot Builder)

In March 2018, FireEye iSIGHT Intelligence observed actor "kent9876" advertising a Monero cryptocurrency miner called Goldig Miner (Figure 5). The actor requested payment of $23 USD for either CPU or GPU build or $50 USD for both. Payments could be made with Bitcoin, Ether, Litecoin, Dash, or PayPal. The miner ostensibly offers the following features:

Written in C/C++

Build size is small (about 100-150 kB)

Hides miner process from popular task managers

Can run without Administrator privileges (user-mode)

Auto-update ability

All data encoded with 256-bit key

Access to Telegram bot-builder

Lifetime support (24/7) via Telegram

Sample Advertisement #3 (Miner + Credential Stealer)

In March 2018, FireEye iSIGHT Intelligence observed actor "TH3FR3D" offering a tool dubbed Felix (Figure 6) that combines a cryptocurrency miner and credential stealer. The actor requested payment of $50 USD payable via Bitcoin or Ether. According to the advertisement, the Felix tool boasted the following features:

Written in C# (Version 1.0.1.0)

Browser stealer for all major browsers (cookies, saved passwords, auto-fill)

Monero miner (uses minergate.com pool by default, but can be configured)

Filezilla stealer

Desktop file grabber (.txt and more)

Can download and execute files

Update ability

USB spreader functionality

PHP web panel

Sample Advertisement #4 (Miner + RAT)

In January 2018, FireEye iSIGHT Intelligence observed actor "ups" selling a miner for any Cryptonight-based cryptocurrency (e.g., Monero and Dashcoin) for either Linux or Windows operating systems. In addition to being a miner, the tool allegedly provides local privilege escalation through the CVE-2016-0099 exploit, can download and execute remote files, and receive commands. Buyers could purchase the Windows or Linux tool for €200 EUR, or €325 EUR for both the Linux and Windows builds, payable via Monero, bitcoin, ether, or dash. According to the actor, the tool offered the following:
Windows Build Specifics

Written in C++ (no dependencies)

Miner component based on XMRig

Easy cryptor and VPS hosting options

Web panel (Figure 7)

Uses TLS for secured communication

Download and execute

Auto-update ability

Cleanup routine

Receive remote commands

Perform privilege escalation

Features "game mode" (mining stops if user plays game)

Proxy feature (based on XMRig)

Support (for €20/month)

Kills other miners from list

Hidden from TaskManager

Configurable pool, coin, and wallet (via panel)

Can mine the following Cryptonight-based coins:

Linux Build Specifics

Issues running on Linux servers (higher performance on desktop OS)

Compatible with AMD64 processors on Ubuntu, Debian, Mint (support for CentOS later)

Sample Advertisement #5 (Miner + USB Spreader + DDoS Tool)

In August 2017, actor "MeatyBanana" was observed by FireEye iSIGHT Intelligence selling a Monero miner utility that included the ability to download and execute files and perform DDoS attacks. The actor offered the software for $30 USD, payable via Bitcoin. Ostensibly, the tool works with CPUs only and offers the following features:

Configurable miner pool and port (default to minergate)

Compatible with both 64- and 86-bit Windows OS

Hides from the following popular task managers:

Windows Task Manager

Process Killer

KillProcess

System Explorer

Process Explorer

AnVir

Process Hacker

Masked as a system driver

Does not require administrator privileges

No dependencies

Registry persistence mechanism

Ability to perform "tasks" (download and execute files, navigate to a site, and perform DDoS)

USB spreader

Support after purchase

The Cost of Cryptojacking

The presence of mining software on a network can generate costs on three fronts as the miner surreptitiously allocates resources:

1. Degradation in system performance

2. Increased cost in electricity

3. Potential exposure of security holes

Cryptojacking targets computer processing power, which can lead to high CPU load and degraded performance. In extreme cases, CPU overload may even cause the operating system to crash. Infected machines may also attempt to infect neighboring machines and therefore generate large amounts of traffic that can overload victims' computer networks.

In the case of operational technology (OT) networks, the consequences could be severe. Supervisory control and data acquisition/industrial control systems (SCADA/ICS) environments predominately rely on decades-old hardware and low-bandwidth networks, therefore even a slight increase in CPU load or the network could leave industrial infrastructures unresponsive, impeding operators from interacting with the controlled process in real-time.

The electricity cost, measured in kilowatt hour (kWh), is dependent upon several factors: how often the malicious miner software is configured to run, how many threads it's configured to use while running, and the number of machines mining on the victim's network. The cost per kWh is also highly variable and depends on geolocation. For example, security researchers who ran Coinhive on a machine for 24 hours found that the electrical consumption was 1.212kWh. They estimated that this equated to electrical costs per month of $10.50 USD in the United States, $5.45 USD in Singapore, and $12.30 USD in Germany.

Cryptojacking can also highlight often overlooked security holes in a company's network. Organizations infected with cryptomining malware are also likely vulnerable to more severe exploits and attacks, ranging from ransomware to ICS-specific malware such as TRITON.

Cryptocurrency Miner Distribution Techniques

In order to maximize profits, cyber criminals widely disseminate their miners using various techniques such as incorporating cryptojacking modules into existing botnets, drive-by cryptomining attacks, the use of mobile apps containing cryptojacking code, and distributing cryptojacking utilities via spam and self-propagating utilities. Threat actors can use cryptojacking to affect numerous devices and secretly siphon their computing power. Some of the most commonly observed devices targeted by these cryptojacking schemes are:

User endpoint machines

Enterprise servers

Websites

Mobile devices

Industrial control systems

Cryptojacking in the Cloud

Private sector companies and governments alike are increasingly moving their data and applications to the cloud, and cyber threat groups have been moving with them. Recently, there have been various reports of actors conducting cryptocurrency mining operations specifically targeting cloud infrastructure. Cloud infrastructure is increasingly a target for cryptojacking operations because it offers actors an attack surface with large amounts of processing power in an environment where CPU usage and electricity costs are already expected to be high, thus allowing their operations to potentially go unnoticed. We assess with high confidence that threat actors will continue to target enterprise cloud networks in efforts to harness their collective computational resources for the foreseeable future.

The following are some real-world examples of cryptojacking in the cloud:

In February 2018, FireEye researchers published a blog detailing various techniques actors used in order to deliver malicious miner payloads (specifically to vulnerable Oracle servers) by abusing CVE-2017-10271. Refer to our blog post for more detailed information regarding the post-exploitation and pre-mining dissemination techniques used in those campaigns.

In March 2018, Bleeping Computer reported on the trend of cryptocurrency mining campaigns moving to the cloud via vulnerable Docker and Kubernetes applications, which are two software tools used by developers to help scale a company's cloud infrastructure. In most cases, successful attacks occur due to misconfigured applications and/or weak security controls and passwords.

In February 2018, Bleeping Computer also reported on hackers who breached Tesla's cloud servers to mine Monero. Attackers identified a Kubernetes console that was not password protected, allowing them to discover login credentials for the broader Tesla Amazon Web services (AWS) S3 cloud environment. Once the attackers gained access to the AWS environment via the harvested credentials, they effectively launched their cryptojacking operations.

Reports of cryptojacking activity due to misconfigured AWS S3 cloud storage buckets have also been observed, as was the case in the LA Times online compromise in February 2018. The presence of vulnerable AWS S3 buckets allows anyone on the internet to access and change hosted content, including the ability to inject mining scripts or other malicious software.

Incorporation of Cryptojacking into Existing Botnets

FireEye iSIGHT Intelligence has observed multiple prominent botnets such as Dridex and Trickbot incorporate cryptocurrency mining into their existing operations. Many of these families are modular in nature and have the ability to download and execute remote files, thus allowing the operators to easily turn their infections into cryptojacking bots. While these operations have traditionally been aimed at credential theft (particularly of banking credentials), adding mining modules or downloading secondary mining payloads provides the operators another avenue to generate additional revenue with little effort. This is especially true in cases where the victims were deemed unprofitable or have already been exploited in the original scheme.

The following are some real-world examples of cryptojacking being incorporated into existing botnets:

In early February 2018, FireEye iSIGHT Intelligence observed Dridex botnet ID 2040 download a Monero cryptocurrency miner based on the open-source XMRig miner.

On Feb. 12, 2018, FireEye iSIGHT Intelligence observed the banking malware IcedID injecting Monero-mining JavaScript into webpages for specific, targeted URLs. The IcedID injects launched an anonymous miner using the mining code from Coinhive's AuthedMine.

In late 2017, Bleeping Computer reported that security researchers with Radware observed the hacking group CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.

In late 2017, FireEye researchers observed Trickbot operators deploy a new module named "testWormDLL" that is a statically compiled copy of the popular XMRig Monero miner.

On Aug. 29, 2017, Security Week reported on a variant of the popular Neutrino banking Trojan, including a Monero miner module. According to their reporting, the new variant no longer aims at stealing bank card data, but instead is limited to downloading and executing modules from a remote server.

Drive-By Cryptojacking

In-Browser

FireEye iSIGHT Intelligence has examined various customer reports of browser-based cryptocurrency mining. Browser-based mining scripts have been observed on compromised websites, third-party advertising platforms, and have been legitimately placed on websites by publishers. While coin mining scripts can be embedded directly into a webpage's source code, they are frequently loaded from third-party websites. Identifying and detecting websites that have embedded coin mining code can be difficult since not all coin mining scripts are authorized by website publishers, such as in the case of a compromised website. Further, in cases where coin mining scripts were authorized by a website owner, they are not always clearly communicated to site visitors. At the time of reporting, the most popular script being deployed in the wild is Coinhive. Coinhive is an open-source JavaScript library that, when loaded on a vulnerable website, can mine Monero using the site visitor's CPU resources, unbeknownst to the user, as they browse the site.

The following are some real-world examples of Coinhive being deployed in the wild:

In September 2017, Bleeping Computer reported that the authors of SafeBrowse, a Chrome extension with more than 140,000 users, had embedded the Coinhive script in the extension's code that allowed for the mining of Monero using users' computers and without getting their consent.

During mid-September 2017, users on Reddit began complaining about increased CPU usage when they navigated to a popular torrent site, The Pirate Bay (TPB). The spike in CPU usage was a result of Coinhive's script being embedded within the site's footer. According to TPB operators, it was implemented as a test to generate passive revenue for the site (Figure 8).

In December 2017, researchers with Sucuri reported on the presence of the Coinhive script being hosted on GitHub.io, which allows users to publish web pages directly from GitHub repositories.

Other reporting disclosed the Coinhive script being embedded on the Showtime domain as well as on the LA Times website, both surreptitiously mining Monero.

A majority of in-browser cryptojacking activity is transitory in nature and will last only as long as the user's web browser is open. However, researchers with Malwarebytes Labs uncovered a technique that allows for continued mining activity even after the browser window is closed. The technique leverages a pop-under window surreptitiously hidden under the taskbar. As researchers pointed out, closing the browser window may not be enough to interrupt the activity, and that more advanced actions like running the Task Manager may be required.

Malvertising and Exploit Kits

Malvertisements - malicious ads on legitimate websites - commonly redirect visitors of a site to an exploit kit landing page. These landing pages are designed to scan a system for vulnerabilities, exploit those vulnerabilities, and download and execute malicious code onto the system. Notably, the malicious advertisements can be placed on legitimate sites and visitors can become infected with little to no user interaction. This distribution tactic is commonly used by threat actors to widely distribute malware and has been employed in various cryptocurrency mining operations.

The following are some real-world examples of this activity:

In early 2018, researchers with Trend Micro reported that a modified miner script was being disseminated across YouTube via Google's DoubleClick ad delivery platform. The script was configured to generate a random number variable between 1 and 100, and when the variable was above 10 it would launch the Coinhive script coinhive.min.js, which harnessed 80 percent of the CPU power to mine Monero. When the variable was below 10 it launched a modified Coinhive script that was also configured to harness 80 percent CPU power to mine Monero. This custom miner connected to the mining pool wss[:]//ws[.]l33tsite[.]info:8443, which was likely done to avoid Coinhive's fees.

In April 2018, researchers with Trend Micro also discovered a JavaScript code based on Coinhive injected into an AOL ad platform. The miner used the following private mining pools: wss[:]//wsX[.]www.datasecu[.]download/proxy and wss[:]//www[.]jqcdn[.]download:8893/proxy. Examination of other sites compromised by this campaign showed that in at least some cases the operators were hosting malicious content on unsecured AWS S3 buckets.

Since July 16, 2017, FireEye has observed the Neptune Exploit Kit redirect to ads for hiking clubs and MP3 converter domains. Payloads associated with the latter include Monero CPU miners that are surreptitiously installed on victims' computers.

In January 2018, Check Point researchers discovered a malvertising campaign leading to the Rig Exploit Kit, which served the XMRig Monero miner utility to unsuspecting victims.

Mobile Cryptojacking

In addition to targeting enterprise servers and user machines, threat actors have also targeted mobile devices for cryptojacking operations. While this technique is less common, likely due to the limited processing power afforded by mobile devices, cryptojacking on mobile devices remains a threat as sustained power consumption can damage the device and dramatically shorten the battery life. Threat actors have been observed targeting mobile devices by hosting malicious cryptojacking apps on popular app stores and through drive-by malvertising campaigns that identify users of mobile browsers.

The following are some real-world examples of mobile devices being used for cryptojacking:

During 2014, FireEye iSIGHT Intelligence reported on multiple Android malware apps capable of mining cryptocurrency:

In March 2014, Android malware named "CoinKrypt" was discovered, which mined Litecoin, Dogecoin, and CasinoCoin currencies.

In March 2014, another form of Android malware - "Android.Trojan.MuchSad.A" or "ANDROIDOS_KAGECOIN.HBT" - was observed mining Bitcoin, Litecoin, and Dogecoin currencies. The malware was disguised as copies of popular applications, including "Football Manager Handheld" and "TuneIn Radio." Variants of this malware have reportedly been downloaded by millions of Google Play users.

In April 2014, Android malware named "BadLepricon," which mined Bitcoin, was identified. The malware was reportedly being bundled into wallpaper applications hosted on the Google Play store, at least several of which received 100 to 500 installations before being removed.

In October 2014, a type of mobile malware called "Android Slave" was observed in China; the malware was reportedly capable of mining multiple virtual currencies.

In December 2017, researchers with Kaspersky Labs reported on a new multi-faceted Android malware capable of a variety of actions including mining cryptocurrencies and launching DDoS attacks. The resource load created by the malware has reportedly been high enough that it can cause the battery to bulge and physically destroy the device. The malware, dubbed Loapi, is unique in the breadth of its potential actions. It has a modular framework that includes modules for malicious advertising, texting, web crawling, Monero mining, and other activities. Loapi is thought to be the work of the same developers behind the 2015 Android malware Podec, and is usually disguised as an anti-virus app.

In January 2018, SophosLabs released a report detailing their discovery of 19 mobile apps hosted on Google Play that contained embedded Coinhive-based cryptojacking code, some of which were downloaded anywhere from 100,000 to 500,000 times.

Between November 2017 and January 2018, researchers with Malwarebytes Labs reported on a drive-by cryptojacking campaign that affected millions of Android mobile browsers to mine Monero.

Cryptojacking Spam Campaigns

FireEye iSIGHT Intelligence has observed several cryptocurrency miners distributed via spam campaigns, which is a commonly used tactic to indiscriminately distribute malware. We expect malicious actors will continue to use this method to disseminate cryptojacking code as for long as cryptocurrency mining remains profitable.

In late November 2017, FireEye researchers identified a spam campaign delivering a malicious PDF attachment designed to appear as a legitimate invoice from the largest port and container service in New Zealand: Lyttelton Port of Chistchurch (Figure 9). Once opened, the PDF would launch a PowerShell script that downloaded a Monero miner from a remote host. The malicious miner connected to the pools supportxmr.com and nanopool.org.

Additionally, a massive cryptojacking spam campaign was discovered by FireEye researchers during January 2018 that was designed to look like legitimate financial services-related emails. The spam email directed victims to an infection link that ultimately dropped a malicious ZIP file onto the victim's machine. Contained within the ZIP file was a cryptocurrency miner utility (MD5: 80b8a2d705d5b21718a6e6efe531d493) configured to mine Monero and connect to the minergate.com pool. While each of the spam email lures and associated ZIP filenames were different, the same cryptocurrency miner sample was dropped across all observed instances (Table 2).

california_540_tax_form_2013_instructions.exe

state_bank_of_india_money_transfer_agency.exe

format_transfer_sms_banking_bni_ke_bca.exe

confirmation_receipt_letter_sample.exe

sbi_online_apply_2015_po.exe

estimated_tax_payment_coupon_irs.exe

how_to_add_a_non_us_bank_account_to_paypal.exe

western_union_money_transfer_from_uk_to_bangladesh.exe

can_i_transfer_money_from_bank_of_ireland_to_aib_online.exe

how_to_open_a_business_bank_account_with_bad_credit_history.exe

apply_for_sbi_credit_card_online.exe

list_of_lucky_winners_in_dda_housing_scheme_2014.exe

Table 2: Sampling of observed ZIP filenames delivering cryptocurrency miner

Cryptojacking Worms

Following the WannaCry attacks, actors began to increasingly incorporate self-propagating functionality within their malware. Some of the observed self-spreading techniques have included copying to removable drives, brute forcing SSH logins, and leveraging the leaked NSA exploit EternalBlue. Cryptocurrency mining operations significantly benefit from this functionality since wider distribution of the malware multiplies the amount of CPU resources available to them for mining. Consequently, we expect that additional actors will continue to develop this capability.

The following are some real-world examples of cryptojacking worms:

In May 2017, Proofpoint reported a large campaign distributing mining malware "Adylkuzz." This cryptocurrency miner was observed leveraging the EternalBlue exploit to rapidly spread itself over corporate LANs and wireless networks. This activity included the use of the DoublePulsar backdoor to download Adylkuzz. Adylkuzz infections create botnets of Windows computers that focus on mining Monero.

Security researchers with Sensors identified a Monero miner worm, dubbed "Rarogminer," in April 2018 that would copy itself to removable drives each time a user inserted a flash drive or external HDD.

In January 2018, researchers at F5 discovered a new Monero cryptomining botnet that targets Linux machines. PyCryptoMiner is based on Python script and spreads via the SSH protocol. The bot can also use Pastebin for its command and control (C2) infrastructure. The malware spreads by trying to guess the SSH login credentials of target Linux systems. Once that is achieved, the bot deploys a simple base64-encoded Python script that connects to the C2 server to download and execute more malicious Python code.

Detection Avoidance Methods

Another trend worth noting is the use of proxies to avoid detection. The implementation of mining proxies presents an attractive option for cyber criminals because it allows them to avoid developer and commission fees of 30 percent or more. Avoiding the use of common cryptojacking services such as Coinhive, Cryptloot, and Deepminer, and instead hosting cryptojacking scripts on actor-controlled infrastructure, can circumvent many of the common strategies taken to block this activity via domain or file name blacklisting.

In March 2018, Bleeping Computer reported on the use of cryptojacking proxy servers and determined that as the use of cryptojacking proxy services increases, the effectiveness of ad blockers and browser extensions that rely on blacklists decreases significantly.

Several mining proxy tools can be found on GitHub, such as the XMRig Proxy tool, which greatly reduces the number of active pool connections, and the CoinHive Stratum Mining Proxy, which uses Coinhive's JavaScript mining library to provide an alternative to using official Coinhive scripts and infrastructure.

In addition to using proxies, actors may also establish their own self-hosted miner apps, either on private servers or cloud-based servers that supports Node.js. Although private servers may provide some benefit over using a commercial mining service, they are still subject to easy blacklisting and require more operational effort to maintain. According to Sucuri researchers, cloud-based servers provide many benefits to actors looking to host their own mining applications, including:

Available free or at low-cost

No maintenance, just upload the crypto-miner app

Harder to block as blacklisting the host address could potentially impact access to legitimate services

Resilient to permanent takedown as new hosting accounts can more easily be created using disposable accounts

The combination of proxies and crypto-miners hosted on actor-controlled cloud infrastructure presents a significant hurdle to security professionals, as both make cryptojacking operations more difficult to detect and take down.

Mining Victim Demographics

Based on data from FireEye detection technologies, the detection of cryptocurrency miner malware has increased significantly since the beginning of 2018 (Figure 10), with the most popular mining pools being minergate and nanopool (Figure 11), and the most heavily affected country being the U.S. (Figure 12). Consistent with other reporting, the education sector remains most affected, likely due to more relaxed security controls across university networks and students taking advantage of free electricity to mine cryptocurrencies (Figure 13).

Mitigation Techniques

Unencrypted Stratum Sessions

According to security researchers at Cato Networks, in order for a miner to participate in pool mining, the infected machine will have to run native or JavaScript-based code that uses the Stratum protocol over TCP or HTTP/S. The Stratum protocol uses a publish/subscribe architecture where clients will send subscription requests to join a pool and servers will send messages (publish) to its subscribed clients. These messages are simple, readable, JSON-RPC messages. Subscription requests will include the following entities: id, method, and params (Figure 15). A deep packet inspection (DPI) engine can be configured to look for these parameters in order to block Stratum over unencrypted TCP.

Encrypted Stratum Sessions

In the case of JavaScript-based miners running Stratum over HTTPS, detection is more difficult for DPI engines that do not decrypt TLS traffic. To mitigate encrypted mining traffic on a network, organizations may blacklist the IP addresses and domains of popular mining pools. However, the downside to this is identifying and updating the blacklist, as locating a reliable and continually updated list of popular mining pools can prove difficult and time consuming.

Browser-Based Sessions

Identifying and detecting websites that have embedded coin mining code can be difficult since not all coin mining scripts are authorized by website publishers (as in the case of a compromised website). Further, in cases where coin mining scripts were authorized by a website owner, they are not always clearly communicated to site visitors.

As defenses evolve to prevent unauthorized coin mining activities, so will the techniques used by actors; however, blocking some of the most common indicators that we have observed to date may be effective in combatting a significant amount of the CPU-draining mining activities that customers have reported. Generic detection strategies for browser-based cryptocurrency mining include:

Blocking domains known to have hosted coin mining scripts

Blocking websites of known mining project websites, such as Coinhive

Blocking scripts altogether

Using an ad-blocker or coin mining-specific browser add-ons

Detecting commonly used naming conventions

Alerting and blocking traffic destined for known popular mining pools

Some of these detection strategies may also be of use in blocking some mining functionality included in existing financial malware as well as mining-specific malware families.

It is important to note that JavaScript used in browser-based cryptojacking activity cannot access files on disk. However, if a host has inadvertently navigated to a website hosting mining scripts, we recommend purging cache and other browser data.

Outlook

In underground communities and marketplaces there has been significant interest in cryptojacking operations, and numerous campaigns have been observed and reported by security researchers. These developments demonstrate the continued upward trend of threat actors conducting cryptocurrency mining operations, which we expect to see a continued focus on throughout 2018. Notably, malicious cryptocurrency mining may be seen as preferable due to the perception that it does not attract as much attention from law enforcement as compared to other forms of fraud or theft. Further, victims may not realize their computer is infected beyond a slowdown in system performance.

Due to its inherent privacy-focused features and CPU-mining profitability, Monero has become one of the most attractive cryptocurrency options for cyber criminals. We believe that it will continue to be threat actors' primary cryptocurrency of choice, so long as the Monero blockchain maintains privacy-focused standards and is ASIC-resistant. If in the future the Monero protocol ever downgrades its security and privacy-focused features, then we assess with high confidence that threat actors will move to use another privacy-focused coin as an alternative.

Because of the anonymity associated with the Monero cryptocurrency and electronic wallets, as well as the availability of numerous cryptocurrency exchanges and tumblers, attribution of malicious cryptocurrency mining is very challenging for authorities, and malicious actors behind such operations typically remain unidentified. Threat actors will undoubtedly continue to demonstrate high interest in malicious cryptomining so long as it remains profitable and relatively low risk.

# data[].attributes.attachment_link.title
How the Rise of Cryptocurrencies Is Shaping the Cyber Crime Landscape: The Growth of Miners " How the Rise of Cryptocurrencies Is Shaping the Cyber Crime Landscape: The Growth of Miners

# data[].attributes.attachment_link.description
Introduction Cyber criminals tend to favor cryptocurrencies because they provide a certain level of anonymity and can be easily monetized. This interest has increased in recent years, stemming far beyond the desire to simply use cryptocurrencies as a method of payment for illicit tools and services.

# data[].attributes.attachment_link.readable_text
Our goal is to gain more information about our target by interacting with it and this is one of the most important phases of penetration testing because it sets a baseline for the things you might target next. We want to learn about the topology of the target environment while scanning, as this will help us understand how different systems in the environment connect with each other and help you plan your attack. We also want to understand the different operating system running on the machines we are scanning.

As we scan, we make observations and carefully note all of the TCP and UDP ports open on each of the systems, we can then use this information to run service specific tools to find additional information, like service vendors and version numbers. Make a note of all potential vulnerabilities each service may be suffering from by keeping the version number in mind. If you weren't able to enumerate a version number, test different vulnerabilities based on the systems behaviors and responses.

Before You Start Scanning

Before performing these scans it's important to remember that performing these scans has the potential to crash systems and that you should never scan a system that does not belong to you without permission, it's illegal.

Scanning is usually performed hastily, so take your time. First perform a network sweep to gain a list of potential targets. Then run network tracing to figure out the topology of the network. Next you will conduct more rigorous port scans to enumerate OS and service details and finally, initiate vulnerability scans on those applications. Let's do it together.

At times, these things may not be performed in this order due to the scope of the test or client requirements. If you are conducting penetration tests, you may have to skip some tests because the client says you can't perform that scan. It is important to remember that clients are the ones paying you so always follow the scope of the test and only perform the scans you are allowed to. Always obtain legal document because companies may not care if you found a vulnerability without their permission, many will try to sue you for disclosing the vulnerability, so always ask for permission.

Penetration Scanning Checklist

This list is not an A to B roadmap, a lot of the time you will miss something and have to rescan multiple times and this is normal.

Find the network topology

Find the operating system types of discovered hosts.

Find open ports and network services in a target
environment.

Find the network addresses of live hosts, firewalls, routers, etc.

Find a list of potential vulnerabilities.

Don't use tools that make a lot of noise; it can potentially crash the host or even make the host aware of our presence, reduce these risks as much as you can.

A Box Full Of Scans

Lets take a closer look at the different kinds of penetration testing scans you will probably need to run on your targets sooner or later:

Network tracing - Usually the first step, when we try to figure out the topology of the network which will help us in planning our attacks.

Network Sweeping - We try to figure out which of the addresses in the range are in use. We do this by sending our ICMP packets and listening carefully, if we get a response we know that an address is in use, giving us awareness of the active systems.

OS Scanning/ Fingerprinting - In this scan we try to enumerate the OS of the target system. This is done by sending a crafted packet which checks for the response of the system. Since every OS has a different behavior over the network, these specific crafted packets can check which OS is responding. Sometimes we want to be less noisy on the system so you can also perform a passive fingerprinting scan which won't send any packets but will receive them. Based on the response, you can decide what OS the system is and we can also figure out the OS of a system via HTTP headers. Direct and indirect banner grabbing can grab OS data, hosts often announce their OS to anyone trying to make a connection to them through banners.

Port Scanning - In this scan we try to figure out the different TCP and UDP ports that are open on the system. Primarily there are two types of port scans; SYN scan and FIN scan. Remember these scans can be intensive and might bring the system down so be careful.

Application / Application Version - In this scan we try to figure out the different applications that are running on these ports. Some ports have assigned applications. Ports 1 through 1024 have applications assigned applications but you should still try to figure out the application version using application specific scans.

Vulnerability Scanning - In this scan we try to find out if the application is vulnerable to any known vulnerabilities which stem from unpatched or mis-configured applications.
As attackers we only need one of the millions of known vulnerabilities to be present on a system, not to mention human errors and the misconfiguration and I have massive respect to blue teamers on the defense side.
Top Scanning Tips

Perform scans only to the subnets you are allowed to.

Perform scans on the IP address and not on the domain name.

Most scanning tools can output their scanning results, use that feature.

Plan on how you are going to perform the scans and in what order because this can change based on your scope.

Always share scan results with your team and brainstorm on potential vulnerabilities for that application version, unless you flying solo and conducting the test on your own of course.

If you are scanning a really large network, then check the firewall and only scan ports that will make it through the firewall rules.

When performing a scan also run a packet sniffer. It will help you visualize what the scan is doing and how that particular scan tool works. (Not necessarily capturing them in a file but rather just looking at them)

Wait There Is More

This is an introductory article to a series of articles I plan to write about scanning, articles will dive into depth and cover all the different types of scanning, while explaining the tools used to perform these scans.I thoroughly enjoyed writing this and hope that whoever reads this learns at least something from these posts because that was my only goal. I would like to thank Luke for helping me edit and also Medjay for proofreading this.
Main Image Credit : The awesome piece of artwork used to head this article is called 'Top City View' and it was created by graphic designer Gleb Kuznetsov.

# data[].attributes.attachment_link.title
An Introduction To Penetration Test Scanning

# data[].attributes.attachment_link.description
Our goal is to gain more information about our target by interacting with it and this is one of the most important phases of penetration testing because it sets a baseline for the things you might target next.

# data[].attributes.attachment_link.description
TeleGeography’s comprehensive and regularly updated interactive map of the world’s major submarine cable systems and landing stations.

# data[].attributes.headline
50+ Examples of How Blockchains are Taking Over the World

# data[].attributes.subject
50+ Examples of How Blockchains are Taking Over the World

# data[].attributes.attachment_link.readable_text
When talking about blockchains, we commonly think of its applications in the future. "Blockchain will solve this, blockchain will achieve that". It's easy to forget that blockchains are already deployed in the wild.

Pick an industry, from automobiles to artificial intelligence, and odds are you'll find examples of blockchains in action. In all quarters and all circles, blockchains are making their mark. Even the US Treasury is in on the act, advocating for more pilot projects and test programs.

The 'World Economic Forum' anticipates that 10% of global GDP will be stored on the blockchain by 2025. That means the global executives out there are preparing for this seismic shift, and are ready to completely back its implementation. The impact of distributed ledger technology could be as grand as the internet revolution itself.

The use cases differ, but the benefits derived from using the technology remain unchanged: transparency, immutability, redundancy and security. In 2018, new blockchain initiatives are launched every day. Here are 50 examples of blockchains in use around the globe.
Government
A number of governments have expressed an interest in blockchain technology to store public records on a decentralized data management framework. Essentia is developing an e-government pilot with Finland's Central Union of Agricultural Producers and Forest Owners. Blockchain will enable urban and rural citizens throughout Finland to access records.Other use cases include government applications such as education, public records and voting.
Waste Management
Waltonchain's RFID technology is being used by a Smart Waste Management System in China. Using Walton's blockchain, the project will enable supervision of waste levels to improve operational efficiencies and optimize resources.
Identification
Zug in Switzerland, known as "Crypto Valley" has developed a blockchain project in partnership with Uport to register residents' IDs, enabling them to participate in online voting and prove their residency.
Border Control
Essentia has been meeting with the Dutch government to create a new system for vetting passengers traveling between Amsterdam and London. At present, passengers on the Eurostar train between the two countries undergo border control checks at multiple points. Essentia is studying a blockchain-based solution that would securely store passenger data, enabling the metrics recorded in the Netherlands to be audited by agencies in the UK. Blockchain would provide a means of ensuring that the data has not been tampered with and is verifiably accurate.
Healthcare
Medical records are notoriously scattered and erroneous, with inconsistent data handling processes meaning hospitals and clinics are often forced to work with incorrect or incomplete patient records. Healthcare projects such as MedRec are using the blockchain as a means of facilitating data sharing while providing authentication and maintaining confidentiality.
Enterprise
Clients of Microsoft Azure Enterprise can access the Ethereum Blockchain as a Service. This provides businesses with access to smart contracts and blockchain applications in a secure hosted environment.

Google is also reported to be working on a proprietary blockchain to support its cloud-based business. Parent company Alphabet is developing a distributed ledger that third parties will be able to use to store data, believed to be in regards to Google's cloud services for enterprises, with a white label version for companies also in the works.
Medical
Medical centers that have digitized their patient records don't distribute their data across multiple facilities, instead keeping them on-site on centralized servers. These are a prime target for hackers, as evidenced by the ransomware attacks that struck NHS hospitals in the UK. Even if security risks are overlooked, there is still the problem of fragmentation. There are currently more than 50 different electronic healthcare record (eHR) software systems that operate in different hospitals, often with dozens of different packages within the same city. These centralized systems do not interoperate with one other and patient data ends up scattered between disparate centers.

In life-and-death settings, the lack of reliable data and sluggish interfaces may prove devastating. The Essentia framework addresses all these issues by using a blockchain-powered system that will store clinically relevant patient data and which can be immediately accessed, regardless of geographical borders. Patient privacy is maintained on a secure decentralized network where access is granted to only those who are medically authorized and only for the duration needed.
Music
One of the main benefits of blockchain technology is the way it removes intermediaries or middlemen. The music business is a prime example of an industry whose inefficiencies have seen artists poorly remunerated for their efforts. A number of blockchain-based projects have sprung up seeking a fairer deal for music creators, including Artbit, overseen by former Guns N Roses drummer Matt Sorum.
Carbon Offsets
As a heavily industrialised nation, China's environmental footprint is substantial. In March 2017, IBM launched the Hyperledger Fabric blockchain in conjunction with Energy-Blockchain Labs, as a means of tracking carbon assets in China. This creates a measurable and auditable system for tracking emissions, and facilitates a tradable market for companies seeking to offset their energy consumption whilst incentivizing greener industrial practises.
Supply Chains
Supply chain management is seen as one of the most beneficial use cases for blockchain, as it's ideal for industries where goods are passed through various pairs of hands, from beginning to end, or manufacturer to the store . IBM and Walmart have teamed up to launch Blockchain Food Safety Alliance in China. The project, run in conjunction with Fortune 500 company JD.com, is designed to improve food tracking and safety, making it easier to verify that food is safe to consume.

China is proving to be a ripe test bed for blockchain projects, for it's also home to the world's first agricultural commodity blockchain. Louis Dreyfus Co, a major food trader, has set up a project with Dutch and French banks which are used for selling soybeans to China, with transactions settled quicker than traditional methods thanks to the use of blockchain technology.
Diamonds
The De Beers Group, the world's most famous diamond company, now has its own blockchain up and running, designed to establish a "digital record for every diamond registered on the platform". Given concerns about the source of diamonds, and the ethics concerning their country of origin, coupled with the risk of stones swapped for less value ones along the line, blockchain is a natural fit. Because each record is indelible, it will ensure that data for each stone lasts as long as the diamonds themselves.
Real Estate
Ukraine holds the honor of becoming the first nation to use blockchain to facilitate a property deal. A property in Kiev was sold by prominent cryptocurrency advocate and TechCrunch founder Michael Arrington. The deal was enabled with the aid of smart contracts on the Ethereum blockchain, and is intended to be the first of many completed by Propy, a startup specializing in blockchain-based real estate deals.
Fishing Industry
Blockchain is now being used to support sustainable fishing. Illegally caught fish is an endemic problem within the industry, and distributed ledger technology provides a means of proving where fish were caught, processed and sold. This 'net-to-plate' chain allows inspectors to determine whether fish had come from regions notorious for human rights abuses or from countries that are affected by economic sanctions.
Fine Art
Similar to the diamond trade, the art industry is dependant on the provenance and authenticity of artworks. While blockchain cannot authenticate a painting to determine whether it is an original or forgery, it can be used to prove the piece's previous owners. In addition, blockchain is now used as a means of acquiring art. It's another example of how blockchain technology can be used to make tangible objects easily tradable and exchangeable from anywhere in the world, without the need to physically transfer them from secure storage.
Public Utilities
In the Australian city of Fremantle, an ambitious project focused on distributed energy and water systems is using blockchain technology. Solar panels are being used in the sun-blessed region to capture electricity, which is then used to heat water and provide power, and the data recorded on the blockchain.

Chile's National Energy Commission has begun using blockchain technology as a means of certifying data pertaining to the country's energy usage. Sensitive data will be stored on a blockchain as part of an initiative to help modernize and secure the South American nation's electrical infrastructure.
LGBT Rights
Blockchain can be helpful in building the "pink economy", as well as helping the LGBT community to fight for their rights without revealing people's identities. The latter is an extremely important issue since hate crimes are a recurring problem within the gay community, especially in countries notorious for human rights abuses and where homosexuality is outlawed or at least frowned upon.
Cat Bonds
Cat bonds can be the only hope for people who have been victims of earthquakes, tsunamis and other natural disasters. Blockchain allows for quick and transparent settlements between parties, and creates certainty that the system will remain operational even without human operation. Blockchain has now successfully been used as a cat bond settlement mechanism.
Tourism
Blockchain is being researched as a means of improving Hawaii's economy by giving tourists an opportunity to pay for local goods and services with bitcoin and other currencies. This way the state's government hopes to attract tourists, especially from Asia, to spend more money and eventually help Hawaii to develop economically.
National Security
In 2016, the US Department of Homeland Security (DHS) announced a project that would use blockchain as a means of securely storing and transmitting the data it captures. Using the Factom blockchain, data retrieved from security cameras and other sensors are encrypted and stored, using blockchain as a means of mitigating the risk of data breaches. The project is still ongoing.
Shipping
Blockchain's suitability to recording shiping data is self-evident. A number of projects have distributed ledger technology to work in this domain, using it within the maritime logistics industry to bring transparency to the unavoidable bureaucracy in international trade. Maersk, one of the largest global shippers, was the pioneer to make use of blockchain and now ZIM have picked up the torch.
Taxation
As one of the world's most technologically advanced countries, it's no surprise China has become one of the first and most prominent adopters of blockchain and everything it offers. It has decided to use the technology to facilitate taxation and electronic invoice issuance in a project headed by Miaocai Network in conjunction with the State Administration of Taxation.
Mobile Payments
Cryptocurrencies with its underlying blockchain technology is being used to facilitate mobile payments in a wide range of projects. One of the latest initiatives announced, scheduled to launch in the fall of 2018, will involve a consortium of Japanese banks. They'll be using Ripple's technology to enable instant mobile payments.
Land Registry
Blockchain once again proves that it's not just applicable in the crypto space and by small companies. The government of Georgia uses it to register land titles. They have created a custom-designed blockchain system and integrated it into the digital records system of the National Agency of Public Registry (NAPR). Georgia is now taking advantage of the transparency and fraud reduction offered by blockchain technology.
Computation
Amazon Web Services have collaborated with Digital Currency Group (DCG) to improve their database security with the help of blockchain. They will provide a platform for DCG's startups to work, as well as technical support for their projects.
Insurance
Blockchain in the insurance industry is often talked about, but many don't know the technology has already been implemented. For instance, Insurer American International Group Inc, in partnership with International Business Machines Corp, has completed a pilot of a so-called "smart contract" multi-national policy for Standard Chartered Bank PLC and plans to manage complex international coverage through blockchain.
Endangered Species Protection
A man is a wolf to another man, and an even bigger wolf to animals. 'Care for the Uncared' is an NGO that is working with leading developers to find a way to preserve and protect endangered species using blockchain technologies.
Advertising
New York Interactive Advertising Exchange in partnership with Nasdaq is using blockchain to create a marketplac e where brands, publishers and agencies can buy ads. The process is simple, though as secure as it can potentially be, using an open protocol on the Ethereum blockchain.
Journalism
Permanence is now a hot topic in the journalism trade. One wrong move and years of hard work and research could go down the drain. Blockchain is one smart solution to the problem. Civil, a decentralized journalism marketplace, apart from obvious blockchain benefits, offers an economic incentive model for quality news content, coupled with the ability to permanently archive content, which will remain accessible at any time in perpetuity.
Smart Cities
Smart cities are not the stuff of science-fiction anymore. Taipei is attempting to position itself as a city of the future with the help of Distributed Ledger Technology. It has announced a partnership with IOTA and they are already working on creating cards with light, temperature, humidity and pollution detection.
Oil Industry
One of the leading players in the commodity market, S&P Global Platts, is trialling a blockchain solution that's being used to record oil storage data. Weekly inventories will be stored on the blockchain, reducing the need for manual data management and minimizing the chance of human error.
Railways
In Russia, rail operator Novotrans is using blockchain technology with a goal to improve the speed of its operations. The company, which is one of the largest rolling stock operators in the country, will be using blockchain to record data pertaining to repair requests, inventory and other matters pertaining to their operations. The idea is that blockchain records will be more resistant to tampering and data corruption..
Gaming
One of the most influential companies in the gaming industry, Ubisoft, is researching on how to implement blockchain into its video games. Specifically, it's focusing on the ownership and transfer of in-game items such as rewards and digital collectibles. These have already been successfully demonstrated in action using the Ethereum blockchain.
Car Leasing
Blockchain's distributed ledger technology is ideally suited to registering records of any kind in a secure and unalterable manner. One such use case being developed by Essentia is the vehicle rental industry. Major rental companies will be able to utilize Essentia's blockchain protocol to store customer data, fully encrypted and shareable on a permissioned basis with relevant parties.
Energy Distribution
One of the biggest challenges facing the energy industry, companies in the habit of trading surplus supply need infallible record keeping. Tracking energy allocations in real time, and ensuring efficient distribution through the supply chain requires multiple data points, and also mandates close cooperation between all entities. Essentia is developing a test project with a number of major energy suppliers that will help them track the distribution of resources in real time, whilst maintaining data confidentiality at all times.

Every day, the number of blockchains used in real world scenarios grows. From logistics to fine art, it's hard to find a sector that hasn't been touched by this transformative technology. We have reached a point where the technology has proven itself to be superior than the current modus operandi.

The 'WEF' predicts that by 2025 the world will see mainstream blockchain adoption. But after examining the use cases already in the implementation stages we have to ask, we have to ask, will it really take that long?
There's only one small kink in the chain holding everything back. That kink is known as interoperability.
Think of a river that has peacefully flowed along for the past 15 years, then all of a sudden a storm appears and it rains for weeks on end, turning the river into a raging torrent, sweeping away everything in its path. That river is the Web 2.0 and the storm of blockchains have already changed the internet landscape. So what remains? When the rain stops and the floods subside, with the old foliage swept away, a vast swathe of fertile land awaits to be farmed.

The river, which facilitated the flow and interoperation within the natural ecosystem is gone. And the same goes for the Web 3.0, we can see growth in various sectors but they are still largely incompatible with each other. But 'hey presto' there's already a solution in the works for that.

It's called Essentia, and it's like a farmers tool for building new decentralized ecosystems on this fertile land. It's job is to create connections and facilitate interoperations to create a cohesive blockchain environment. This could mean health-care blockchains are compatible with insurance chains, or international rail working with with cross-border customs chains.

Essentia is the vehicle that the digital world needs in order speed up the blockchain adoption process. Some suggest that we could see it happen 50% sooner than originally estimated, that means by around the year 2020 the internet ecosystem could go regain its interoperability, while decentralized blockchains fill in the void of privacy, security and data ownership.

Disclaimer: *Im the CEO of Essentia One.

# data[].attributes.attachment_link.title
50+ Examples of How Blockchains are Taking Over the World

# data[].attributes.attachment_link.description
When talking about blockchains, we commonly think of its applications in the future. "Blockchain will solve this, blockchain will achieve that". It's easy to forget that blockchains are already deployed in the wild. Pick an industry, from automobiles to artificial intelligence, and odds are you'll find examples of blockchains in action.

# data[].attributes.headline
Why you should understand adversary playbooks

# data[].attributes.subject
Why you should understand adversary playbooks

# data[].attributes.attachment_link.readable_text
When deploying prevention and detection controls, most network defenders are on a treadmill of sifting through thousands of indicators of compromise, trying to prioritize which ones they should tackle first. Typically, they know nothing about the context of the indicator, just that it is bad, and that it should be blocked somewhere in the environment. The problem is they never sift through them all, which makes them feel like they are always behind - which they are.

What the Cyber Threat Alliance and Unit 42, Palo Alto Networks threat intelligence team, have been advocating for the past five years is to flip the equation and embrace adversary playbooks.

Prevention and detection controls should be designed to thwart all known adversaries

The idea is that network defenders should be deploying prevention and detection controls at all locations on the intrusion kill chain, designed specifically for all known adversary campaigns. In other words, get off the treadmill and start deploying controls designed specifically to thwart all known adversaries. This is an important idea because the network defender community already comprehends much about how adversaries run their attack playbooks. For all the "new" adversaries out there making headlines, most of the techniques they use are not new. I estimate that we, collectively, understand approximately 99 percent of the playbooks that cyber adversaries run on any given day.

The challenge has been: how do we organize that information and share it with the world at large? It turns out, that is way more complicated than it sounds. After much debate within Unit 42 and the Cyber Threat Alliance, we agreed that this is what constitutes an adversary playbook:

One or more cyber adversaries

Who run one or more campaigns

Who use a variety of techniques to attack their victims down the intrusion kill chain

Who leave indicators of compromise in their wake when they do

Once we agreed to the general idea of what an adversary playbook was, we needed a way to visualize it and built an open source playbook viewer earlier this year to do just that. Since then, they have been on track to publish one adversary playbook a month and have just published their ninth. (See Adversary Playbook viewer link at the bottom of the page).

Collaboration key to thwarting all known adversaries

But the question remains: how many adversary playbooks exist in the world on any given day? In other words, when the cyber adversary gets up in the morning, grabs a cup of coffee, sits down to work, and pulls an attack playbook off the shelf to begin the day's activities, how many other adversaries or adversary groups are doing the exact same thing? We don't know for sure, but the number is probably not high.

The current theory by the Cyber Threat Alliance is that the number of active playbooks running on the internet on any given day is less than 100, with some thinking it is less than 50. That is why we are all concentrating on building known adversary playbooks as fast as we can. If the number is less than 100 or even less than 50, this is a problem that we can solve.

Our mission is to build and maintain all of the known adversary playbooks that exist in the world so that network defenders can automatically deploy prevention and detection controls to their defensive posture in real time. Indeed, that is the reason we helped build the Cyber Threat Alliance in the first place. The alliance consists of vendors who can already update their own products with the latest prevention and detection controls. If alliance members are contributing to and sharing the intelligence for all of the known adversary playbooks running on the internet, their shared customers will have the means to block 99 percent of all adversary attacks. When something new is discovered, the alliance can deploy prevention controls to shared customers around the world in minutes to hours. That would be an amazing capability.

To accomplish this mission, two things have to happen. First, we have to build all the known playbooks. Second, we need more security vendors to join the Cyber Threat Alliance. Seventeen have recently joined, but our goal is to see the other hundreds of security vendors contributing as well. When you visit with your security vendors, encourage them to join the Cyber Threat Alliance. In the meantime, check out our new playbooks in the playbook viewer here.
This article is published as part of the IDG Contributor Network. Want to Join?

# data[].attributes.attachment_link.title
It's time to get off the treadmill: Why you should understand adversary playbooks

# data[].attributes.attachment_link.description
Flipping the equation on known adversaries by developing and deploying controls at locations on the intrusion kill chain designed specifically for these known playbooks will increase a company's ability to block an attack. The cybersecurity industry must collaborate to identify all know adversary playbooks and share this knowledge with each other and the public.

# data[].attributes.headline
Banks and Retailers Are Tracking How You Type, Swipe and Tap

# data[].attributes.subject
Banks and Retailers Are Tracking How You Type, Swipe and Tap

# data[].attributes.attachment_link.readable_text
A phone's touchscreen sensors can track where and how you swipe your device to help determine who you are. Credit Credit Andrew Roberts

When you're browsing a website and the mouse cursor disappears, it might be a computer glitch - or it might be a deliberate test to find out who you are.

The way you press, scroll and type on a phone screen or keyboard can be as unique as your fingerprints or facial features. To fight fraud, a growing number of banks and merchants are tracking visitors' physical movements as they use websites and apps.

Some use the technology only to weed out automated attacks and suspicious transactions, but others are going significantly further, amassing tens of millions of profiles that can identify customers by how they touch, hold and tap their devices.

The data collection is invisible to those being watched. Using sensors in your phone or code on websites, companies can gather thousands of data points, known as "behavioral biometrics," to help prove whether a digital user is actually the person she claims to be.

To security officials, the technology is a powerful safeguard. Major data breaches are a near-daily occurrence. Cyberthieves have obtained billions of passwords and other sensitive personal information, which can be used to steal from customers' bank and shopping accounts and fraudulently open new ones.

"Identity is the ultimate digital currency, and it's being weaponized at an industrial scale," said Alisdair Faulkner, one of the founders of ThreatMetrix, which makes fraud detection software for large merchants and financial companies. Many of his company's customers are now using or testing behavioral biometric tools, he said.

Image

The angle at which you hold your device is one of the many biometric markers that can be measured. Credit Andrew Roberts

Privacy advocates view the biometric tools as potentially troubling, partly because few companies disclose to users when and how their taps and swipes are being tracked.

"What we have seen across the board with technology is that the more data that's collected by companies, the more they will try to find uses for that data," said Jennifer Lynch, a senior lawyer for the Electronic Frontier Foundation. "It's a very small leap from using this to detect fraud to using this to learn very private information about you."

The Royal Bank of Scotland, one of the few banks that will talk publicly about its collection of biometric behavioral data, started testing the technology two years ago on private banking accounts for wealthy customers. It is now expanding the system to all of its 18.7 million business and retail accounts, according to Kevin Hanley, the bank's director of innovation.

When clients log in to their Royal Bank of Scotland accounts, software begins recording more than 2,000 different interactive gestures. On phones, it measures the angle at which people hold their devices, the fingers they use to swipe and tap, the pressure they apply and how quickly they scroll. On a computer, the software records the rhythm of their keystrokes and the way they wiggle their mouse.

R.B.S. is using software designed by a small New York company called BioCatch. It builds a profile on each person's gestures, which is then compared against the customer's movements every time they return. The system can detect impostors with 99 percent accuracy, BioCatch says.

A few months ago, the software picked up unusual signals coming from one wealthy customer's account. After logging in, the visitor used the mouse's scroll wheel - something the customer had never done before. Then the visitor typed on the numerical strip at the top of a keyboard, not the side number pad the customer typically used.

Alarm bells went off. The R.B.S. system blocked any cash from leaving the customer's account. An investigation later found that the account had been hacked, Mr. Hanley said.

"Someone was trying to set up a new payee and transfer a seven-figure sum," he said. "We were able to intervene in real time and stop that from happening."

That case was unusually blatant. A user's behavior isn't constant; people act differently when they're tired, injured, drunk, distracted or in a hurry. The way people type at an office desk is distinct from when they're slumped on their sofa at home.

Biometric software can also determine the pressure you tend to apply to your phone when you tap and type. Credit Andrew Roberts

Behavioral monitoring software churns through thousands of elements to calculate a probability-based guess about whether a person is who they claim. Two major advances have fed its growing use: the availability of cheap computing power and the sophisticated array of sensors now built into most smartphones.

The system's unobtrusiveness is part of its appeal, Mr. Hanley said. Traditional physical biometrics, like fingerprints or irises, require special scanning hardware for authentication. But behavioral traits can be captured in the background, without customers doing anything to sign up.

BioCatch occasionally tries to elicit a reaction. It can speed up the selection wheel you use to enter data like dates and times on your phone, or make your mouse cursor disappear for a fraction of a second.

"Everyone reacts a little differently to that," said Frances Zelazny, BioCatch's chief strategy and marketing officer. "Some people move the mouse side to side; some people move it up and down. Some bang on the keyboard."

Because your reaction is so individual, it's hard for a fraudulent user to fake. And because customers never know the monitoring technology is there, it doesn't impose the kind of visible, and irritating, roadblocks that typically accompany security tests. You don't need to press your thumb on your phone's fingerprint reader or type in an authentication code.

"We don't have to sit people down in a room and get them to type under perfect laboratory conditions," said Neil Costigan, the chief executive of BehavioSec, a Palo Alto, Calif., company that makes software used by many Nordic banks. "You just watch them, silently, while they go about their normal account activities."

Businesses call that a "frictionless" experience. Privacy watchdogs call it dangerous.

Biometric systems can sometimes detect medical conditions. If a customer with a once-steady hand develops a tremor, her automobile insurance company might get worried. That's potentially a problem if the customer's bank, which detected the tremor through its security software, is also her insurer.

"This is the kind of data that usually has some kind of consumer protections around it, but here there's none at all," said Pam Dixon, the executive director of the World Privacy Forum. "Companies are using these systems with no notice of any kind."

In most countries, there are no laws governing the collection and use of biometric behavioral data.

Even Europe's new privacy rules have exemptions for security and fraud prevention. A new digital privacy law in California includes behavioral biometrics on the list of tracking technologies companies must disclose if they collect, but it does not take effect until 2020.

Banks and merchants sometimes store their customers' biometric data internally. In many cases, though, they allow the outside vendors they work with to hold it. That magnifies the risks, Ms. Dixon said.

BioCatch has profiles on about 70 million individuals and monitors six billion transactions a month, according to Ms. Zelazny, the company's strategy executive. American Express, an investor in BioCatch, recently began using its technology on new account applications.

Some of BioCatch's rivals have even larger networks. Forter, a New York start-up that sells online fraud detection software incorporating behavioral biometrics to big retailers, said its database has records on 175 million people from more than 180 countries. Another competitor, NuData, was acquired last year by Mastercard.

On your computer, software can track your mouse habits, including the speed and rhythm of your cursor tracking. Credit Andrew Roberts

More than a dozen technology vendors, from under-the-radar start-ups to giants like I.B.M., have built behavioral biometrics into the security software they sell to retailers and banks.

The technology can be useful for rooting out fraud even without personal data on individual customers.

On new account applications, for example, behavioral biometric systems pay close attention to where and when applicants pause. A legitimate applicant typically types personal information - their name, their address, their Social Security number - fluidly, with few breaks. A scammer will often either cut and paste or take breaks to consult their notes.

"This used to be like science fiction," said Ryan Wilk, a NuData employee who is now a Mastercard vice president. "When we described what we did, people would give us looks like, 'Is this real?' Now, it's become not just a gimmick but a major technology in the financial industry. Lots of big companies are using it."

A version of this article appears in print on , on Page B1 of the New York edition with the headline: Type Carefully. Your Bank Is Watching.. Order Reprints | Today's Paper | Subscribe

# data[].attributes.attachment_link.title
Banks and Retailers Are Tracking How You Type, Swipe and Tap

# data[].attributes.attachment_link.description
When you're browsing a website and the mouse cursor disappears, it might be a computer glitch - or it might be a deliberate test to find out who you are. The way you press, scroll and type on a phone screen or keyboard can be as unique as your fingerprints or facial features.

# data[].attributes.headline
The Lowdown on Cybercrime: The Evil Internet Minute (infographic)

# data[].attributes.subject
The Lowdown on Cybercrime: The Evil Internet Minute (infographic)

# data[].attributes.attachment_link.readable_text
The internet has made a lot of things exceedingly easy, but it has also opened up the world to an entirely new threat: cybercrime. In the modern world, untold amounts of money are transferred via the internet every single hour. In fact, corporations spent a whopping 171,000 dollars every single minute on cybersecurity in an attempt to prevent cyber attacks from occurring. In spite of this seemingly exorbitant expenditure, cybercrimes manage to abscond with over a million dollars every minute, almost ten times the amount of money spent trying to prevent these attacks from happening in the first place.

This information is based on research recently conducted by RiskIQ. This research also ascertained that over one business suffers from a cyber attack every minute, and on average these attacks cos the victims 15,000 dollars with each occurrence. The infographic provided below elucidates the state of cybercrime in the modern era and shows how cybersecurity is playing a constant game of catch up, with each innovation in cybercrime providing the impetus for a new wave of innovation in cybersecurity as a result.

Also Read: Protect Your Privacy While Venturing The World Of The Internet (infographic)

# data[].attributes.attachment_link.keywords[]
digital information world: the lowdown on cybercrime: the evil internet minute (infographic)

# data[].attributes.attachment_link.description
The infographic provided below elucidates the state of cybercrime in the modern era and shows how cybersecurity is playing a constant game of catch up, with each innovation in cybercrime providing the impetus for a new wave of innovation in cybersecurity as a result.

# data[].attributes.headline
5 privacy settings you should change in Windows 10.

# data[].attributes.subject
5 privacy settings you should change in Windows 10.

# data[].attributes.attachment_link.readable_text
Microsoft has made attempts to be more transparent with its privacy settings and, while it may have simplified some of the language of its policies, there is still work to be done. Here are five privacy-related settings you can change for a less invasive and more secure experience.

Turn off your location

If you're using a mobile device, such as a tablet or a laptop, there are plenty of times when allowing Windows 10 and third-party apps to access your location is convenient. But that doesn't mean that you should leave your location switched on at all times. When your location is switched on, Windows 10 stores your device's location history for up to 24 hours and allows apps with location permission to access that data.

If you turn your location off, apps that use your location (such as the Maps app) will not be able to find you. You can, however, manually set a default location that apps can use as a stand-in.

To turn off your location, go to Settings > Privacy > Location and the Change button under Location for this device is on and toggle it Off. Below, you can set permissions to allow or restrict individual apps from knowing your location.

Screenshot by Matt Elliott/CNET

Stop syncing

There's a lot of syncing going on in Windows 10. If you sign in with a Microsoft account, your settings -- including passwords -- may be synced across other devices you sign into with the same account. If you turn off syncing, your settings and passwords will not be synced across other devices when you sign in with your Microsoft account, so you'll need to do things like enter passwords in manually.

To turn off settings syncing, got to Settings > Accounts > Sync your settings. You can either turn off all syncing at once, or you can toggle individual sync settings off.

Use a local account

If you've disabled syncing across your devices, then there's little reason to use your Microsoft account to log into your PC. You can use a local account instead that doesn't require an email, which will prevent Microsoft from collecting information about you. With a local account, you create a username and password for your PC and that's it. (You will still need a Microsoft account to buy apps from the Windows Store and if you do want to sync files with Microsoft services such as OneDrive, OneNote and Office 365.)

To create a local account, go to Settings > Accounts > Your info, click Sign in with a local account instead and follow the instructions to create a username, password and password hint.

Lock down your lock screen

The lock screen is the first thing anyone sees when they open up your device, and this screen can have a lot of information that you might not want strangers to access.

Here are three things you need to do to lock down your lock and log-in screens:

Make sure your notifications aren't appearing on the lock screen. Go to Settings > System > Notifications & actions and toggle off Show notifications on the lock screen. The downside to turning this feature off, of course, is that you won't be able to see any notifications until you unlock your device.

Turn off Cortana on the lock screen by opening Cortana and going to Settings > Cortana > Talk to Cortana and toggle off Use Cortana even when my device is locked. The downside to turning this feature off is that you won't be able to use Cortana while your device is locked. You can also limit her scope on the lock screen (instead of turning her off completely) by unchecking the box for Let Cortana access my calendar, email, messages and Power BI when my device is locked. This way, you'll still be able to ask Cortana to answer questions that don't reveal any personal information while your device is locked.

Hide your email address on the login screen by going to Settings > Accounts > Sign-in options and making sure that Show account details (e.g. email address) on sign-in screen is toggled off. There's no downside to turning this feature off, unless you really like seeing your email address.

Turn off your advertising ID

Each Microsoft account has a unique advertising ID that lets the company collect information about you and deliver a personalized ad experience across different platforms. If you sign into Windows 10 with a Microsoft account, those personalized ads will follow you onto your computer -- you'll see them in apps and possibly in the operating system itself (in the Start menu, for example).

To turn these ads off in Windows 10, go to Settings > Privacy > General and toggle off Let apps use advertising ID to make ads more interesting to you based on your app usage. You'll still see ads, but they won't be eerily personalized to your tastes and preferences.

Turning this feature off will prevent personalized ads from popping up in your Windows 10 experience, but won't necessarily keep you from seeing personalized ads when you're using your Microsoft account on other platforms. To get rid of ads on other platforms, such as in browsers, head to Microsoft's advertising opt-out page.

Lastly, you can visit Microsoft's privacy dashboard for your account to see what information it's storing in the cloud about you, including your browsing and search history in Microsoft Edge and your location data.

Read more: Windows 10 October 2018 Update: The 7 best new features

Editors' note: First published Oct. 13, 2016, this article was updated Nov. 8, 2018 with information about the Windows 10 October 2018 Update.

# data[].attributes.attachment_link.title
5 privacy settings you should change in Windows 10

# data[].attributes.attachment_link.description
Microsoft has made attempts to be more transparent with its privacy settings and, while it may have simplified some of the language of its policies, there is still work to be done. Here are five privacy-related settings you can change for a less invasive and more secure experience.

# data[].attributes.attachment_link.title
InfoSec Handlers Diary Blog - Internet Storm Center Diary 2018-09-22

# data[].attributes.attachment_link.description
Internet Storm Center Diary 2018-09-22, Author: Manuel Humberto Santander Pelaez

# data[].attributes.headline
DeepLocker: How AI Can Power a Stealthy New Breed of Malware

# data[].attributes.subject
DeepLocker: How AI Can Power a Stealthy New Breed of Malware

# data[].attributes.attachment_link.readable_text
With contributions from Jiyong Jang and Dhilung Kirat.

Cybersecurity is an arms race, where attackers and defenders play a constantly evolving cat-and-mouse game. Every new era of computing has served attackers with new capabilities and vulnerabilities to execute their nefarious actions.

In the PC era, we witnessed malware threats emerging from viruses and worms, and the security industry responded with antivirus software. In the web era, attacks such as cross-site request forgery (CSRF) and cross-site scripting (XSS) were challenging web applications. Now, we are in the cloud, analytics, mobile and social (CAMS) era - and advanced persistent threats (APTs) have been on the top of CIOs' and CSOs' minds.

But we are on the cusp of a new era: the artificial intelligence (AI) era. The shift to machine learning and AI is the next major progression in IT. However, cybercriminals are also studying AI to use it to their advantage - and weaponize it. How will the use of AI change cyberattacks? What are the characteristics of AI-powered attacks? And how can we defend against them?

At IBM Research, we are constantly studying the evolution of technologies, capabilities and techniques in order to identify and predict new threats and stay ahead of cybercriminals. One of the outcomes, which we will present at the Black Hat USA 2018 conference, is DeepLocker, a new breed of highly targeted and evasive attack tools powered by AI.

IBM Research developed DeepLocker to better understand how several existing AI models can be combined with current malware techniques to create a particularly challenging new breed of malware. This class of AI-powered evasive malware conceals its intent until it reaches a specific victim. It unleashes its malicious action as soon as the AI model identifies the target through indicators like facial recognition, geolocation and voice recognition.

You can think of this capability as similar to a sniper attack, in contrast to the "spray and pray" approach of traditional malware. DeepLocker is designed to be stealthy. It flies under the radar, avoiding detection until the precise moment it recognizes a specific target. This AI-powered malware is particularly dangerous because, like nation-state malware, it could infect millions of systems without being detected. But, unlike nation-state malware, it is feasible in the civilian and commercial realms.

A Bit of Evasive Malware History

The DeepLocker class of malware stands in stark contrast to existing evasion techniques used by malware seen in the wild. While many malware variants try to hide their presence and malicious intent, none are as effective at doing so as DeepLocker.

Let's recap the evolution of evasive malware:

In the late 1980s and early 1990s, the first variants of polymorphic and metamorphic viruses were designed to disrupt and destroy data. By means of obfuscation and mutating payloads, malware authors were avoiding antivirus systems that could easily screen files for known patterns using static signatures. Consequently, the antivirus industry gradually developed static code and malware-analysis capabilities to analyze obfuscated code and infer the malicious intent of code or files running on the endpoints they protected.

In the 1990s, malware authors started to encrypt the malicious payload (using so-called packers), such that the malicious code would only be observable when it was decrypted into memory before its execution. The security industry responded with dynamic malware analysis, building initial versions of malware sandboxes, such as virtualized systems, in which suspicious executables (called samples) are run, their activities monitored and their nature deemed benign or malicious.

Of course, attackers would not give in. In the 2000s, the first forms of evasive malware - malware trying to actively avoid analysis - were captured in the wild. For example, the malware used checks to identify whether it was running in a virtualized environment and whether other processes known to run in malware sandboxes were present. If any were found, the malware would stop executing its malicious payload in order to avoid analysis and keep its secrets encrypted. This approach is still prevalent today, as a May 2018 Security Week study found that 98 percent of the malware samples analyzed uses evasive techniques to varying extents.

As malware sandboxes have become increasingly more sophisticated in the past few years - for example, using bare metal analysis systems, according to the Computer Security Group at the University of California, Santa Barbara, that run on real hardware and avoiding virtualization - adversaries have moved to a different strategy: targeted attacks. They section their infection routines to have an initial step to carefully inspect the environment they run in for any predefined "suspicious" features, such as usernames and security solution processes. Only if the target endpoint is found "clear" would the malware be fetched and executed, unleashing its nefarious activity. One well-known example of evasion is the Stuxnet worm, which was programmed to target and seek out only specific industrial control systems (ICS) from a particular manufacturer, and only with certain hardware and software configurations.

Nevertheless, although malware evasion keeps evolving, even very recent forms of targeted malware require predefined triggers that can be exposed by defenders by checking the code, packed code, configuration files or network activity. All of these triggers are observable to skilled malware analysts with the appropriate tools.

DeepLocker: Ultra-Targeted and Evasive Malware

DeepLocker has changed the game of malware evasion by taking a fundamentally different approach from any other current evasive and targeted malware. DeepLocker hides its malicious payload in benign carrier applications, such as a video conference software, to avoid detection by most antivirus and malware scanners.

What is unique about DeepLocker is that the use of AI makes the "trigger conditions" to unlock the attack almost impossible to reverse engineer. The malicious payload will only be unlocked if the intended target is reached. It achieves this by using a deep neural network (DNN) AI model.

The AI model is trained to behave normally unless it is presented with a specific input: the trigger conditions identifying specific victims. The neural network produces the "key" needed to unlock the attack. DeepLocker can leverage several attributes to identify its target, including visual, audio, geolocation and system-level features. As it is virtually impossible to exhaustively enumerate all possible trigger conditions for the AI model, this method would make it extremely challenging for malware analysts to reverse engineer the neural network and recover the mission-critical secrets, including the attack payload and the specifics of the target. When attackers attempt to infiltrate a target with malware, a stealthy, targeted attack needs to conceal two main components: the trigger condition(s) and the attack payload.

DeepLocker is able to leverage the "black-box" nature of the DNN AI model to conceal the trigger condition. A simple "if this, then that" trigger condition is transformed into a deep convolutional network of the AI model that is very hard to decipher. In addition to that, it is able to convert the concealed trigger condition itself into a "password" or "key" that is required to unlock the attack payload.

Technically, this method allows three layers of attack concealment. That is, given a DeepLocker AI model alone, it is extremely difficult for malware analysts to figure out what class of target it is looking for. Is it after people's faces or some other visual clues? What specific instance of the target class is the valid trigger condition? And what is the ultimate goal of the attack payload?

Figure 1. DeepLocker - AI-Powered Concealment

To demonstrate the implications of DeepLocker's capabilities, we designed a proof of concept in which we camouflage a well-known ransomware (WannaCry) in a benign video conferencing application so that it remains undetected by malware analysis tools, including antivirus engines and malware sandboxes. As a triggering condition, we trained the AI model to recognize the face of a specific person to unlock the ransomware and execute on the system.

Imagine that this video conferencing application is distributed and downloaded by millions of people, which is a plausible scenario nowadays on many public platforms. When launched, the app would surreptitiously feed camera snapshots into the embedded AI model, but otherwise behave normally for all users except the intended target. When the victim sits in front of the computer and uses the application, the camera would feed their face to the app, and the malicious payload will be secretly executed, thanks to the victim's face, which was the preprogrammed key to unlock it.

It's important to understand that DeepLocker describes an entirely new class of malware - any number of AI models could be plugged in to find the intended victim, and different types of malware could be used as the "payload" that is hidden within the application.

DeepLocker Briefing at Black Hat USA

Alongside my colleagues Dhilung Kirat and Jiyong Jang, I will present the implications of AI-powered malware (and DeepLocker in particular) at Black Hat USA 2018. We will show how we combined open-source AI tools with straightforward evasion techniques to build a targeted, evasive and highly effective malware.

The aim of our briefing is threefold:

1. To raise awareness that AI-powered threats like DeepLocker are coming our way very soon;

2. To demonstrate how attackers have the capability to build stealthy malware that can circumvent defenses commonly deployed today and;

3. To provide insights into how to reduce risks and deploy adequate countermeasures.

While a class of malware like DeepLocker has not been seen in the wild to date, these AI tools are publicly available, as are the malware techniques being employed - so it's only a matter of time before we start seeing these tools combined by adversarial actors and cybercriminals. In fact, we would not be surprised if this type of attack were already being deployed.

The security community needs to prepare to face a new level of AI-powered attacks. We can't, as an industry, simply wait until the attacks are found in the wild to start preparing our defenses. To borrow an analogy from the medical field, we need to examine the virus to create the "vaccine."

To that effect, IBM Research has been studying AI-powered attacks and identified several new traits compared to traditional attacks. In particular, the increased evasiveness of AI-powered attacks challenges traditional rule-based security tools. AI can learn the rules and evade them. Moreover, AI enables new scales and speeds of attacks by acting autonomously and adaptively.

We, as defenders, also need to lean into the power of AI as we develop defenses against these new types of attack. A few areas that we should focus on immediately include the use of AI in detectors; going beyond rule-based security, reasoning and automation to enhance the effectiveness of security teams; and cyber deception to misdirect and deactivate AI-powered attacks.

Additionally, it would be beneficial to focus on monitoring and analyzing how apps behave across user devices, and flagging events when a new app is taking unexpected actions. This detection tactic could help identify these types of attacks in the future.

# data[].attributes.attachment_link.title
DeepLocker: How AI Can Power a Stealthy New Breed of Malware

# data[].attributes.attachment_link.description
With contributions from Jiyong Jang and Dhilung Kirat . Cybersecurity is an arms race, where attackers and defenders play a constantly evolving cat-and-mouse game. Every new era of computing has served attackers with new capabilities and vulnerabilities to execute their nefarious actions.

# data[].attributes.attachment_link.readable_text
Compared to the traditional financial system, cryptocurrency can seem murky. Bitcoin transactions are pseudonymous, which makes them attractive to criminals. When you send money to a Bitcoin address, who exactly are you dealing with? To provide a little more clarity, LongHash has added Bitcoin address search to our homepage, as shown below.

To be clear, we are not revealing the identities of Bitcoin holders. We just hope to offer more peace of mind to investors, regulators and the general public. The mainstream perception that cryptocurrency is associated with crime is not good for the industry as a whole.

First, go to our homepage, LongHash.com. Clicking on the "Address" link enables a search for any Bitcoin address. The following two modes are supported:

"Fuzzy" Search: If you enter the first few characters of an address, then any of the 10,000 richest bitcoin addresses that begin with those characters will pop up automatically in the search suggestions, in descending order of total account balance (i.e., richest accounts first).

Precise Search: You can enter any BTC address in the search box for detailed information about that address, including its balance, the amount of Bitcoin it received and sent, as well as transactions.

Let's take a closer look the results of a precise search.

Address Rate: We rate addresses by analyzing their transactions as well as the addresses that it sends money to and receives money from. If we find, for example, that an address is transacting with another address that is affiliated with crime, the first address will get a lower rating. The higher the address rate, the more trustworthy the address.
Tracking A Bitcoin's Journey
Say you are receiving Bitcoin from an address, and you want to know more about that address. Where did that address get its money from, for example? In the course of its lifetime, a Bitcoin will likely pass through several different address types, some of which are associated with crime. We classified four main address types. The light blue refers to a mixing service, which purposely disguises the source of a Bitcoin transaction. The darker blue refers to a cryptocurrency exchange. The magenta refers to a mining pool, and the orange refers to a gambling site. The light purple refers to an old address that is no longer in use.

So in the chart below, the most inner ring represents where a Bitcoin address originally received its Bitcoin from. This demo illustrates an address's early transactions. In the example below, the most inner ring is blue, which means that the address's first 30 Bitcoin transactions came directly from cryptocurrency exchanges. But where did the cryptocurrency exchange's Bitcoin come from? The second inner-most ring is purple, with a little orange. This means the majority of transactions came from cryptocurrency exchanges, with a small fraction coming from gambling sites. The outer ring shows that Bitcoins came from a combination of cryptocurrency exchanges, mixing services and mining pools, gambling sites. So by using this chart, you can see if a Bitcoin has any relationship to dirty money.

Address Chart: The chart below is a more detailed version of the circle chart above. It shows information for addresses that have traded with a given address. The first layer is comprised of addresses that have traded with directly this address. Similarly, the second and third layers are addresses that have traded directly with the previous layer. More detailed information such as balance and transaction type are available by clicking on any address in the chart, allowing you to trace the sources and recent transactions of the account you searched.

Blocks and Transactions:

Bitcoin transactions are recorded in blocks.This table shows the block details of each of the address's transactions, including block height, transaction date and amount, as well as address balance.

# data[].attributes.attachment_link.description
Compared to the traditional financial system, cryptocurrency can seem murky. Bitcoin transactions are pseudonymous, which makes them attractive to criminals. When you send money to a Bitcoin address, who exactly are you dealing with? To provide a little more clarity, LongHash has added Bitcoin address search to our homepage, as shown below.

# data[].attributes.headline
Many free mobile VPN apps are based in China or have Chinese ownership

# data[].attributes.subject
Many free mobile VPN apps are based in China or have Chinese ownership

# data[].attributes.attachment_link.readable_text
Roughly 60 percent of the top free mobile VPN apps returned by Google Play Store and Apple Play Store searches are from developers based in China or with Chinese ownership, raising serious concerns about data privacy, a study published today has revealed.

"Our investigation uncovered that over half of the top free VPN apps either had Chinese ownership or were actually based in China, which has aggressively clamped down on VPN services over the past year and maintains an iron grip on the internet within its borders," said Simon Migliano, Head of Research at Metric Labs, a company that runs the Top10VPN portal.

The researcher says he analyzed the top 20 free VPN apps that appear in searches for VPN apps on the Google and Apple mobile app stores, for both the US and UK locales.

He says that 17 of the 30 apps he analyzed (10 apps appeared on both stores) had formal links to China, either being a legally registered Chinese entity or by having Chinese ownership, based on business registration and shareholder information Migliano shared with ZDNet.

"Furthermore, we found the majority of free VPN apps had little-to-no formal privacy protections and non-existent user support," Migliano said.

The expert says that 86 percent of the apps he analyzed had "unacceptable privacy policies." For example, some apps didn't say if they logged traffic, some apps appeared to use generic privacy policies that didn't even mention the term VPN, while some apps didn't feature a privacy policy at all. On top of this, other apps admitted in their policies to sharing data with third-parties, tracking users, and sending and sharing data with Chinese third-parties.

Almost half of the free VPN apps also appeared to take the privacy policy as a joke, with some hosting the policy as a plain text file on Pastebin, AWS servers, or raw IP addresses, with no domain name.

In addition, 64 percent of the apps also didn't bother setting up a dedicated website for their VPN service, operating strictly from the Play Store.

The results of this study should worry VPN users, from both a privacy standpoint, but also from a technical and professional point of view.

The study's results are also worrisome especially for businesses that use these apps internally or have employees who use the apps without prior approval.

Data exchanged via these VPNs, some of which may be company trade secrets, may end up being logged, and in the worst case scenario logged on Chinese servers, where it may be at the disposal of Chinese authorities, which have a long and well-documented history of hacking, favoring, and helping local businesses at the expense of foreign competitors.

In addition, China has also enacted strict regulation in the past two years that has clamped down on VPN services and has forced local VPN providers to register with state authorities in order to obtain a license to operate in the country.

This regulation has resulted in several arrests, and some VPN operators being sentenced to heavy prison sentences.

Due to its lack of legal boundaries and heavy-handed authoritarian mode of operation, the Chinese state has now a firm grasp on any VPN providers located inside its borders.

According to Migliano, users and companies should rethink their approach of using some of the above-listed apps, on both the grounds of the operator being under the possible influence of the Chinese authoritarian regime, but also due to some of these VPN provider's poor to privacy policies, a sign that they don't really value customer privacy as well.

Migliano's report, available here, lists all the problems he discovered with each of the 30 VPN apps in finer detail.

More security news:

# data[].attributes.attachment_link.title
Many free mobile VPN apps are based in China or have Chinese ownership | ZDNet

# data[].attributes.attachment_link.description
Roughly 60 percent of the top free mobile VPN apps returned by Google Play Store and Apple Play Store searches are from developers based in China or with Chinese ownership, raising serious concerns about data privacy, a study published today has revealed.

# data[].attributes.attachment_link.readable_text
This is a guest post by Ori. In the past 12 months I attended two SANS training events as a Work Study participant and decided to write this post based on my observations. SANS Institute is the biggest player in information security education field with the best and brightest instructors and unmatched content quality. This... Continue Reading →

This is a guest post by Steve Hall ( https://twitter.com/shall_1). Thanks for writing it Steve! I recently attended SANS Denver (SEC487) because I wanted to round out my knowledge on some of the OSINT I had been doing. The class covered multiple tools to help accomplish the task of documenting your process, one of them being... Continue Reading →

The OSINT Resource Classification System (ORCS https://orcs.osint.ninja) has a huge goal: to provide a common categorization/classification system for OSINT resources. My hope is that our OSINT and ThreatIntel community can come together and agree on some sort of organization system for OSINT resources so that when you visit one site like http://osintframework.com and look for... Continue Reading →

I absolutely love all of the public projects where people share their favorite OSINT bookmarks with others. You've most likely seen some of them. [UPDATE] Bruno Mortier (@digintelosint) created an excellent resource of resources page at https://start.me/p/ZME8nR/osint where a bunch of these sites are catalogued. Head over there and check them out! If you haven't... Continue Reading →

This is a guest post by David Mashburn (@d_mashburn, https://www.sans.org/instructors/david-mashburn), Certified SANS Instructor and cyber ninja! OSINT isn't just about doing pre-attack recon. It is often leveraged by defenders as part of the incident response and investigation process. One of the most common applications of OSINT for a defender is to perform lookups on available... Continue Reading →

SEC487 SANS Institute course announcement http://www.sec487.info

Using a Google CSE (Custom Search Engine) to enhance OSINT investigations.

In this post I use a python tool (EyeWitness), TOR, TorGhost, and the Dark Web Reports from Hunchly to automate viewing the Dark Web resources.

# data[].attributes.attachment_link.title
infosec - WebBreacher's Hacking and Hiking Blog

# data[].attributes.attachment_link.description
This is a guest post by Ori. In the past 12 months I attended two SANS training events as a Work Study participant and decided to write this post based on my observations. SANS Institute is the biggest player in information security education field with the best and brightest instructors and unmatched content quality.

# data[].attributes.attachment_link.description
All Cyber Attack Insider Threat Malware Ransomware Vulnerability

# data[].attributes.attachment_link.readable_text
In December 2022, KrebsOnSecurity broke the news that a cybercriminal using the handle " USDoD" had infiltrated the FBI's vetted information sharing network InfraGard, and was selling the contact information for all 80,000 members. The FBI responded by reverifying InfraGard members and by seizing the cybercrime forum where the data was being sold. But on Sept. 11, 2023, USDoD resurfaced after a lengthy absence to leak sensitive employee data stolen from the aerospace giant Airbus, while promising to visit the same treatment on top U.S. defense contractors.

In a post on the English language cybercrime forum BreachForums, USDoD leaked information on roughly 3,200 Airbus vendors, including names, addresses, phone numbers, and email addresses. USDoD claimed they grabbed the data by using passwords stolen from a Turkish airline employee who had third-party access to Airbus' systems.

USDoD didn't say why they decided to leak the data on the 22nd anniversary of the 9/11 attacks, but there was definitely an aircraft theme to the message that accompanied the leak, which concluded with the words, "Lockheed martin, Raytheon and the entire defense contractos [sic], I'm coming for you [expletive]."

Airbus has apparently confirmed the cybercriminal's account to the threat intelligence firm Hudson Rock, which determined that the Airbus credentials were stolen after a Turkish airline employee infected their computer with a prevalent and powerful info-stealing trojan called RedLine.

Info-stealers like RedLine typically are deployed via opportunistic email malware campaigns, and by secretly bundling the trojans with cracked versions of popular software titles made available online. Credentials stolen by info-stealers often end up for sale on cybercrime shops that peddle purloined passwords and authentication cookies (these logs also often show up in the malware scanning service VirusTotal).

Hudson Rock said it recovered the log files created by a RedLine infection on the Turkish airline employee's system, and found the employee likely infected their machine after downloading pirated and secretly backdoored software for Microsoft Windows. Continue reading

# data[].attributes.attachment_link.description
In December 2022, KrebsOnSecurity broke the news that a cybercriminal using the handle " USDoD" had infiltrated the FBI's vetted information sharing network InfraGard, and was selling the contact information for all 80,000 members. The FBI responded by reverifying InfraGard members and by seizing the cybercrime forum where the data was being sold.

# data[].attributes.attachment_link.readable_text
Vulnerability-disclosure policies (VDPs), if done right, can help provide clarity and clear guidelines to both bug-hunters and vendors when it comes to going public with security flaws.

The high-severity flaw in the Email Subscribers & Newsletters plugin by Icegram affects more than 100,000 WordPress websites.

A cloud misconfiguration at the gaming-gear merchant potentially exposed 100,000 customers to phishing and fraud.

Fortinet's recently released Global Threat Landscape Report shows how the perimeter is extending to the home in the first half of 2020 - and what that means for cybercrime.

Andrew Ginter, VP Industrial Security at Waterfall Security Solutions, talks about the differing priorities between IT and OT security teams as industrial control systems become connected.

Derek Manky, Chief, Security Insights & Global Threat Alliances at Fortinet's FortiGuard Labs, discusses the top threats and lessons learned from the first half of 2020.

Insider-threat security experts unravel the new normal during this time of remote working, and explain how to protect sensitive data from this escalating risk.

Threatpost Senior Editor Tara Seals is joined by Russ Mohr, engineer and Apple evangelist at MobileIron along with Jerry Ray, COO at SecureAge, for a discussion about the now postponed Tokyo Games and its use of 5G and the myriad of security concerns Japan is preparing for.

2019 was another banner year for bots, trojans, RATS and ransomware. Let's take a look back.

# data[].attributes.attachment_link.title
Threatpost | The first stop for security news

# data[].attributes.attachment_link.description
Vulnerability-disclosure policies (VDPs), if done right, can help provide clarity and clear guidelines to both bug-hunters and vendors when it comes to going public with security flaws. The high-severity flaw in the Email Subscribers & Newsletters plugin by Icegram affects more than 100,000 WordPress websites.

# data[].attributes.headline
Guide to help you buy safe, secure products

# data[].attributes.subject
Guide to help you buy safe, secure products

# data[].attributes.attachment_link.title
*Privacy Not Included: A Buyer’s Guide for Connected Products

# data[].attributes.attachment_link.description
Be Smart. Shop Safe. How creepy is that smart speaker, that fitness tracker, those wireless headphones? We created this guide to help you shop for safe, secure connected products.

# data[].attributes.attachment_link.provider_name
Adventures in Infosec & Social Engineering

# data[].attributes.attachment_link.title
Adventures in Infosec & Social Engineering

# data[].attributes.attachment_link.description
Philosophy junkie experimenting with Information Security, Social Engineering and Computing.

# data[].attributes.headline
Build your cyber securityor IT career, for free

# data[].attributes.subject
Build your cyber securityor IT career, for free

# data[].attributes.attachment_link.readable_text
Cybrary's accessible, affordable training platform provides curated career paths, threat-informed training, and certification preparation for professionals at all levels.

Launch Your Career

Start your cyber journey confidently with curated paths that teach the foundational concepts related to real, on-the-job skills.

Get Certified

Ace the exam with certification prep content developed by industry-leading instructors. Test yourself with our practice exams.

Upskill and Practice

Master hands-on skills and familiarize yourself with the latest vulnerabilities and threats so you can prepare for real-world attacks.

Upskill your team with Cybrary's suite of learning activities and management tools, including hands-on practice labs, assessments, and custom guided pathways. Request a demo and learn how Cybrary tailors our deep library of trainings to your team's unique needs.

Live Certification Prep Training

Designed to complement Cybrary's on-demand certification prep content, Cybrary Live allows team members to interact directly with expert instructors in a boot camp-style virtual classroom environment.

Advanced Red Team and DFIR Content

Cybrary Select offers content focused on the industry's most cutting-edge skills. Keep your team challenged and engaged with specialized security concepts, operational tactics, leadership skills, and more.

Stand out from the crowd and advance your career with Cybrary

Popular Courses

New Courses

Words from our users

Join 3 million+ users, including 96% of Fortune 1000 companies who use our platform to upskill their teams. See what the buzz is about - start learning for free!

# data[].attributes.attachment_link.title
Free Cybersecurity Training and Career Development | Cybrary

# data[].attributes.attachment_link.description
Cybrary's accessible, affordable training platform provides curated career paths, threat-informed training, and certification preparation for professionals at all levels. Launch Your Career Start your cyber journey confidently with curated paths that teach the foundational concepts related to real, on-the-job skills. Get Certified Ace the exam with certification prep content developed by industry-leading instructors.

# data[].attributes.headline
DataBasic is a suite of easy-to-use web tools for beginners that introduce concepts of working with data

# data[].attributes.subject
DataBasic is a suite of easy-to-use web tools for beginners that introduce concepts of working with data

# data[].attributes.attachment_link.description
Rahul Bhargava (Northeastern University) & Catherine D’Ignazio (MIT)

# data[].attributes.attachment_link.description
A curated list of Awesome Threat Intelligence resources - hslatman/awesome-threat-intelligence

# data[].attributes.attachment_link.readable_text
Short on time? Here's the best VPN service for most users:

🥇 ExpressVPN (#1 in 2021) - it's got excellent security, ultra-fast speeds, and a great user experience. ExpressVPN maintains a strict no-logs policy, is full of features for streamers and torrenters, and protects all purchases with a 30-day money-back guarantee.

Get today's top deal () at:

I spent the last several months testing 45 of the top virtual private networks (VPNs) on the market - from well-known brands to unknown brands to a lot of other brands in between. I wanted to find the best VPN for most users in 2021.

I compared, rated, and ranked each VPN I tested based on a variety of metrics - across categories like privacy, speed, and overall functionality - and I have verified through extensive research, testing, and consulting with other security researchers - that the top VPN service providers listed here are:

From secure and reputable companies.

Able to bypass geo-blocks.

Able to stream content from other countries.

Designed well enough to maintain fast internet functions.

Able to hide activity from hackers, ISPs, governments, and other surveillance agents.

After months of running speed tests, reading privacy policies, and stress-testing all of the features of the many VPN services on the market, I ranked and compared the top 10 VPNs based on security, ease of use, privacy features, and overall value. These are those results.

Quick summary list of the best VPN services in 2021:

Not Everyone Needs a VPN: What Does a VPN Actually Do?

If you've read some of the marketing blogs recommending the "best VPNs", they've probably told you that a VPN is ESSENTIAL FOR KEEPING YOU ANONYMOUS ONLINE!!!! 👈👈👈😮💻👉🔒😎

Well, that's not entirely true... A VPN can help you stay anonymous in certain instances, but there's no guarantee that it will - most of those claims are just marketing hype. If someone wanted to spy on you, a VPN wouldn't really do much to protect you. For starters, you'd need to check for spyware or other hidden malware (you'd need an antivirus). And if someone steals the passwords to your online accounts, a VPN wouldn't do anything to prevent them from harvesting your data and leaking it on the web (but a password manager would).
This is what a VPN can do: It's important to note that all of these things are legal if no other law is being broken. Likewise, using a VPN is perfectly legal in jurisdictions where doing so isn't illegal (most every country in the world). There are some countries where VPNs are illegal, and there are some uses for VPNs that can allow people to break the law. I don't condone anyone using a VPN for illegal reasons, nor do I condone anyone breaking the law.

Change/hide your IP address. A VPN reroutes your internet traffic from your normal IP address to the IP address of the VPN server, thereby obscuring your IP address from whomever is receiving your traffic (like your destination website). It's important to note that the VPN company can still see your IP address - and only some VPNs won't store, log, or track your IP information. Private Internet Access is the best for changing your IP address (and comes with a court-tested no-logs policy) >

Bypass government restrictions. If you live in (or are moving to) a country that has a government-imposed firewall on internet content, a good VPN will be able to bypass those restrictions, allowing you to access "blocked" content. ExpressVPN is the best for overcoming government restrictions >

Access geo-restricted content (like Netflix and Hulu). Online streaming services have different content libraries in different parts of the world. If you want to watch something in the US Netflix library but you're in the UK, some VPN services will allow you to pretend to be in the US (thereby giving you access to the Netflix US library). ExpressVPN is the best for Netflix, Hulu, and most other streaming services >

Hide internet traffic from a hacker, network administrator, or ISP. In the event that your internet traffic gets intercepted in any way, all the traffic going through the VPN gets encrypted, so all of that traffic becomes unreadable. A VPN also hides certain browsing activity from anyone who "owns" a network, like the owner of a public Wi-Fi hotspot or your internet service provider (ISP) - and your ISP likely does see and log all of your user data. This is especially important if you like torrenting, something many ISPs consider to be illegal behavior. ProtonVPN is the best for high-privacy needs >

Connect to a home or business network while you're away. If you're traveling and need to connect to a home or business network, you can set up a VPN so that it functions as a mobile gateway to your home or business LAN. VyprVPN has the best business VPN >

Find the best prices when shopping online. Some online retailers will sell the exact same product on another country's website for cheaper than on your country's website. Using a VPN, you can purchase that product while claiming to be in the cheaper country and save a significant amount of money. CyberGhost VPN is the best for online shopping >

So if you still want a VPN, let's take an in-depth look at the top 10 VPN services in 2021:
ExpressVPN is extremely fast, has easy-to-use apps, and comes with some excellent security features - high-security standards like 256-bit AES encryption, an independently confirmed no-logs policy, and a flawless kill switch. In terms of security features, it also has a few advanced features like its own VPN protocol, strong security server architecture, and split-tunneling on its Windows and Mac clients.

ExpressVPN even has its own private DNS encryption service, which provides an extra layer of security by encrypting DNS requests running through ExpressVPN's servers. And ExpressVPN's TrustedServer technology stores its server metadata on memory (RAM) as opposed to a hard drive, meaning all of your personal data is scrubbed when the servers reboot.

If you're looking for a VPN to bypass restrictions, ExpressVPN is the best choice there is. My colleagues in China, Iran, Indonesia, and various other countries with internet limitations have all confirmed that ExpressVPN is able to overcome most government restrictions (confirmed July 2021). And ExpressVPN is also a great option for torrenting, gaming, and streaming - it unblocks all major streaming sites, like Netflix, Hulu, and Disney+, as well as lesser-known sites like FuboTV, RaiPlay, and Crackle.

And then there's ExpressVPN's Lightway protocol, which ExpressVPN claims is more reliable, faster, and maintains stronger security over other top VPN protocols like OpenVPN and WireGuard. In my tests, Lightway proved to be the fastest VPN protocol out of any other I tested.

ExpressVPN allows 5 simultaneous connections, accepts a wide range of payment methods (including Bitcoin), and it has a risk-free 30-day money-back guarantee.
Try ExpressVPN (30 Days Risk-Free)
ExpressVPN Security Facts

ExpressVPN Speed Tests

With VPN servers located in 94 countries, ExpressVPN offers one of the most expansive networks on this list - and it has at least 15 countries with servers located in multiple cities. For example, the US has 20+ server locations (in New York, Chicago, Salt Lake City, Los Angeles, etc.), while the UK has 4 different locations (Docklands, East London, London, and Wembley). I tested a connection in each country, and I tested each city in countries with multiple server locations.
Here are some highlights:
I connected via ExpressVPN's "Smart Location" tool, which chooses the top server for your location. I was connected to every server almost instantly and maintained extremely fast speeds - even in locations that were more than 6,000 miles (9,000 kilometers) from my home server. These high speeds are due to ExpressVPN's "Lightway" protocol, which performed much better than any other VPN protocol (including WireGuard). Overall, ExpressVPN only reduced my speed by an average of 15% - substantially better than most competitors.
Try ExpressvPN Now
ExpressVPN Streaming, Torrenting + Government Bypassing

Streaming: Strong

ExpressVPN unblocks 25+ streaming apps - including lesser-known services like Kodi, Sling TV, and FuboTV. I had no problem watching movies and TV shows in HD quality on Netflix, Hulu, BBC iPlayer, YouTube, and other streaming apps.

Torrenting: Strong

ExpressVPN supports P2P file sharing and torrenting on each of its 3,000+ servers - this is in contrast to many other top VPNs, which only support torrenting on dedicated P2P servers.

ExpressVPN also has split-tunneling - allowing you to have both internet traffic going through a VPN and your local server. I like ExpressVPN's split-tunneling tool a lot because it's very easy to use and navigate. Plus, ExpressVPN is the only VPN on this list that provides split-tunneling for Mac devices (macOS 10.15 and below).

Government Bypassing: Strong

ExpressVPN has obfuscated servers that will give you access to the internet in restrictive countries.

Even though many of these countries have "banned" VPNs, ExpressVPN's obfuscation tool makes sure that ExpressVPN's protocols go unnoticed in countries with tightly monitored internet restrictions. My colleagues in China, Russia, Iran, and Indonesia all confirmed that ExpressVPN overcomes internet restrictions in these countries.

With its high security focus, ExpressVPN is the easiest, quickest, and safest way to overcome internet censorship.
Read the full ExpressVPN review >
ExpressVPN Plans + Pricing

ExpressVPN offers 1-month, 6-month, and 12-month plans. Although ExpressVPN is a little more expensive than some providers on this list, it provides the best service with its excellent security, speed, and privacy features (and also its strong streaming capabilities).

ExpressVPN accepts payment in many forms, including 7 different credit cards, PayPal, Bitcoin, and various online banking services - apps like Mint, WebMoney, Alipay, Sofort, and more. There is a 30-day money-back guarantee with each plan.
Try ExpressVPN (30 Days Risk-Free)
ProtonVPN is an extremely secure, fast, and intuitive VPN developed by the same team that made the encrypted email service ProtonMail. ProtonVPN has a strict no-logs policy that's been independently audited, and it's based in Switzerland (which is outside EU jurisdiction).

ProtonVPN's Secure Core VPN architecture bounces user traffic through multiple ProtonVPN servers (which are located in underground bunkers and data centers in Switzerland, Iceland, and Sweden) before the data leaves ProtonVPN's network. And all of ProtonVPN's apps are open source, allowing anyone to examine the software source code and look for holes in its security or privacy.

ProtonVPN has perfect forward secrecy, offers extras like split-tunneling and ad blocking, unblocks 20+ popular streaming services, and supports torrenting. ProtonVPN also provides access to Tor over a VPN connection, allowing you to browse .onion sites in your regular browser while keeping your IP address hidden from any Tor node.

ProtonVPN offers a free version, as well as 3 paid subscriptions which are backed by a prorated 30-day money-back guarantee.
Try ProtonVPN (30 Days Risk-Free)
ProtonVPN Security Facts

ProtonVPN Speed Tests

I tested a random server in each of ProtonVPN's 55 countries to see how the VPN compared to its competitors.
Here are some highlights:
ProtonVPN's speeds were pretty decent in my speed tests. The VPN reduced my download speeds by an average of 35%, though I did encounter a few servers where there was a significant drop in download speed. That said, using all ProtonVPN's servers, I was able to seamlessly browse the internet, stream videos, and make VoIP (Voice over Internet Protocol) calls even when I was connected to a distant server (and even when my speed tests showed a big drop in download speed).
Try ProtonVPN Now
ProtonVPN Streaming, Torrenting + Government Bypassing

Streaming: Mostly Strong

ProtonVPN provides detailed instructions on how to unblock 20+ streaming services, from popular ones like Netflix, Hulu, and HBO to lesser-known platforms such as Peacock and Pluto TV. However, keep in mind that ProtonVPN is primarily desktop-based, so only some streaming services will work with Android and iOS devices.

Torrenting: Strong

ProtonVPN supports torrenting on dedicated P2P servers - it has 12 P2P servers located in North America, Europe, Iceland, Hong Kong, and Singapore. ProtonVPN will automatically redirect you to one of its dedicated P2P servers if it identifies P2P traffic. I tested each of ProtonVPN's P2P servers, and I was able to quickly download torrents from all of the popular torrenting clients.

Unlike ExpressVPN, ProtonVPN doesn't support IPv6 - to prevent IPv6 leaks, ProtonVPN blocks all IPv6 traffic.

I also conducted a DNS leak test on each of ProtonVPN's P2P servers - each one reported 0 DNS leaks.

Government Bypassing: Weak

ProtonVPN unfortunately doesn't have obfuscated servers and is not a good choice for overcoming internet blocks in countries that restrict internet access. ProtonVPN admits that it doesn't work in China and advises users to try to bypass the Great Firewall with a Tor bridge.
Read the full ProtonVPN review >
ProtonVPN Plans + Pricing

ProtonVPN's free version allows you to connect just 1 device and it gives you access to only 3 servers (in the Netherlands, Japan, and the US). But unlike many free VPNs, ProtonVPN's free plan includes unlimited browsing data (one of the reasons it ranks among the top free VPNs).

ProtonVPN has 3 premium plans, including Basic, Plus, and Visionary. ProtonVPN Basicincludes 2 VPN connections, access to servers in 55 countries, torrenting support, and an ad blocker. ProtonVPN Plus adds up to 5 VPN connections, Secure Core and TOR servers, as well as access to streaming services. ProtonVPN Visionary is the same, but it adds up to 10 connections and a ProtonMail account. All of ProtonVPN's paid plans are backed by a prorated 30-day money-back guarantee.
Try ProtonVPN (30 Days Risk-Free)
CyberGhost VPN is very fast, easy to use, and offers a particularly good VPN for gamers. During my speed tests, I maintained an average speed drop of only 30%, which is well above average. And CyberGhost maintains a vast server network (6,600+ servers), so it's pretty easy to find a fast server in a lot of different locations.

With CyberGhost, I was able to access 40+ geo-blocked streaming services without interruptions (Netflix, Hulu, and many more), and I downloaded torrents using all major torrenting clients without any problems. I particularly like that CyberGhost's user interface tells you exactly which server to connect to if you're trying to connect to a server for US netflix or a server for torrenting - this takes the guesswork out of choosing the best server.

CyberGhost's high performance makes it a particularly good choice for gamers looking for a fast and stable VPN. I connected CyberGhost VPN to my router to cover my gaming consoles (because Xbox and PS4 don't support VPN connections), and I was able to play fast and smooth games without any buffering.

CyberGhost VPN allows 7 simultaneous connections and comes with a 14-day money-back guarantee on its monthly plan and a generous 45-day money-back guarantee on its 1-year, 2-year, and 3-year plans (this plan also includes 3 months of free service).
Try CyberGhost VPN (45 Days Risk-Free)
CyberGhost VPN Security Facts

Worldwide servers:6,800+

Protocols: OpenVPN, IKEv2, WireGuard

Data encryption: 256-bit AES

Specialty servers: No-Spy (based in Romania), P2P, streaming, split-tunneling

Leak protection: DNS, WebRTC, IPv4

Kill switch: Yes

No-logs policy: Yes

CyberGhost VPN Speed Tests

CyberGhost has 6,800+ servers in 90 countries - more than most other VPN providers. I tested CyberGhost VPN's connection speed in each country.
Here are some highlights:
Even though CyberGhost VPN isn't as fast as ExpressVPN, CyberGhost VPN only reduced my speed by an average of 32% (about the same as ProtonVPN - which is better than a lot of competitors). And I was still able to play games without any lag on each server I tried (even the most distant ones).
Try CyberGhost VPN Now
CyberGhost VPN Streaming, Torrenting + Government Bypassing

Streaming: Strong

CyberGhost has special servers that are optimized for unblocking 40+ streaming services, and the app tells you which server is good for which streaming service. For example, it tells you if a specific US server is good for accessing Hulu, if a separate US server is good for accessing Amazon Prime, if a certain UK server is good for accessing Netflix, and so on. In my tests, I was able to access streaming services on CyberGhost's designated streaming servers in several countries. And my videos on Netflix, Hulu, and other services streamed in HD without any interruptions.

Torrenting: Strong

CyberGhost allows torrenting and has designated P2P servers all over the world, so you'll be able to find a P2P server near your location with fast speeds no matter where you're located. I also really like that CyberGhost gives you the load percentage (amount of users on a server) for P2P servers - just select the closest server that has the lowest load in order to get the fastest download speed.

Government Bypassing: Weak

Unlike ExpressVPN, CyberGhost doesn't have obfuscated servers, which means CyberGhost isn't the best VPN for bypassing internet censorship in restrictive countries (and my colleagues from China confirmed that they were unable to use CyberGhost). But if you don't live or plan on traveling to a country with internet restrictions, CyberGhost VPN is still really good for unblocking geo-blocked content, gaming, torrenting, and keeping you and your online browsing anonymous.
Read the full CyberGhost VPN review >
CyberGhost VPN Plans + Pricing

CyberGhost VPN offers several plans, but its 3-year subscription offers the best value - it's cheap and it gives you 3 months of service for free. CyberGhost VPN's 1-year plan is reasonably priced, but I don't recommend the 2-year subscription plan because it basically costs the same as the 3-year plan. There is also a 1-month plan, which is pretty expensive.

The 1-year, 2-year, and 3-year plans include a very generous 45-day money-back guarantee. The 1-month plan is backed by a 14-day money-back guarantee. CyberGhost accepts payment with credit cards, PayPal, and Bitcoin.
Try CyberGhost VPN (45 Days Risk-Free)
4. TunnelBear - Best VPN for Beginners

TunnelBear is one of the most intuitive VPNs on the market - it's very easy to use (even if you've never used a VPN before) and it has a really cute design (there are cute bears all over the app).

TunnelBear is also very secure, provides decent speeds, and has all of the standard VPN security features, including a strict no-logs policy that is annually audited and verified by an independent cybersecurity company. TunnelBear also has a kill switch, stealth mode, and split-tunneling (only available for Android).

But unlike top competitors such as ExpressVPN and ProtonVPN, TunnelBear isn't always able to unblock popular streaming services. And I'm pretty disappointed that TunnelBear doesn't offer a money-back guarantee. However, if you're interested, you can try out TunnelBear with a free plan (only 500 MB available per month).
Try TunnelBear Now
TunnelBear Security Facts

TunnelBear Speed Tests

TunnelBear has servers in only 26 countries - fewer than many premium competitors, including ExpressVPN and CyberGhost VPN. However, TunnelBear's 1,500+ servers are spread out well across the globe in North, Central, and South America, Europe, and Australia, as well as in Singapore, Japan, and New Zealand. I connected to a server in every country to test TunnelBear's speed.
Here are some highlights:
Overall, TunnelBear only reduced my download speed by an average of 38%, which is still pretty good - but slower than ExpressVPN, ProtonVPN, and CyberGhost VPN. When I connected to a local server (USA), my browsing speed remained almost the same as without a VPN, and I was able to stream video without any lag (and my upload speed jumped!). But when I connected to a server in Germany and in the UK, my download speed and ping dropped significantly, which was noticeable during browsing and streaming. On the other hand, my download and upload speeds were pretty good when I was connected to an Australian server - almost as good as when I was connected to a local server.
Try TunnelBear Now
TunnelBear Streaming, Torrenting + Government Bypassing

Streaming: Mostly Weak

TunnelBear isn't a great choice for unblocking most popular streaming services. My colleagues in the UK confirmed TunnelBear couldn't unblock Netflix US or Amazon Prime, but they reported that TunnelBear was able to unblock HBO. In my testing, I was able to access Kodi with TunnelBear, but I couldn't gain access to BBC iPlayer.

Torrenting: Mostly Strong

Like ExpressVPN, TunnelBear allows P2P sharing on all of its servers. But because TunnelBear doesn't have the fastest speeds, I recommend that you connect to a server using the Fastest Connection option or manually select a server located in the closest country.

I ran several DNS leak tests and while it passed most of them, on occasion, the IPv6 protocol leaked - TunnelBear has some IPv6 protection, but there are some times when it slips through. But IPv6 is easy to disable.

Government Bypassing: Strong

TunnelBear has an obfuscation tool (GhostBear) which you can enable with just one click. TunnelBear's obfuscation tool is successful at bypassing government restrictions - and my colleagues in restrictive countries reassured me that TunnelBear is indeed able to overcome government-restricted blocks.
Read the full TunnelBear review >
TunnelBear Plans + Pricing

Unlike ProtonVPN that provides unlimited data for free users, TunnelBear's free plan includes only 500 MB per month - this is good enough just to try out TunnelBear's browsing speed (it's not enough for streaming or torrenting).

The paid Unlimited plan includes 3 subscription options, including 1-month, 1-year, and 3-year plans. All of the plans include up to 5 simultaneous connections.

TunnelBear accepts credit cards and Bitcoin (no PayPal), and according to the company website, you can also pay with jars of honey (but I didn't test this!). TunnelBear doesn't have a money-back guarantee.
Try TunnelBear Now
5. PrivateVPN - Good VPN for Streaming

PrivateVPN is fast, secure, and good at unblocking geo-restricted content. I tested PrivateVPN on Netflix, Hulu, BBC iPlayer, and a handful of other content sites, and PrivateVPN bypassed all geo-blocks with consistently fast speeds.

In addition to standard security features like 256-bit AES encryption, multiple connection protocols, and a kill switch, PrivateVPN also includes extra features like obfuscation for hiding the fact that you're using a VPN and Tor support for adding an extra layer of security while browsing the Tor network.

One PrivateVPN account covers 6 devices, there's a 30-day money-back guarantee, and there are flexible payment options (including payment with cryptocurrency).
Try PrivateVPN Now (30 Days Risk Free)
PrivateVPN Security Facts

PrivateVPN Speed Tests

There are over 150 servers on PrivateVPN's worldwide network. I tested a random server in each of its 62 countries and measured how much each server slowed down my baseline connection. I connected to each server in the desired country almost instantly.
Here are some highlights:
PrivateVPN has really good speeds (especially the L2PT protocol), and during my testing, no server's download speed dropped below 50% (the general metric for a high-quality overseas connection).

My speed tests show that PrivateVPN is very capable of streaming, downloading, and video calling. There was some slowdown in nearby connections, and there was only a little slowdown in overseas connections.
Try PrivateVPN Now
PrivateVPN Streaming, Torrenting + Government Bypassing

Streaming: Strong

PrivateVPN successfully unblocks Netflix, Hulu, Amazon Prime, BBC iPlayer, Disney+, and many other streaming services. It has pre-configured servers for specific streaming apps. For example, there are 25 dedicated Netflix servers located in 21 countries. And thanks to PrivateVPN's fast speeds, my videos were always crisp and clear - even when streaming content from the other side of the world.

Torrenting: Mostly Strong

PrivateVPN supports streaming on all of its servers (like ExpressVPN). I tested random servers with all of the major torrenting clients - uTorrent, BitTorrent, Bitport.io, and several more - and PrivateVPN was fully capable of downloading and sharing content from all of these clients.

I also ran PrivateVPN through a series of 10 DNS leak tests and there were 0 DNS leaks.

Government Bypassing: Strong

PrivateVPN is able to overcome government blocks in many countries with a government block on internet content - including China, Turkey, Iran, Russia, Indonesia, and Vietnam.

This is due to PrivateVPN's "Stealth Mode" feature, which is an obfuscation tool that masks your VPN traffic from the government.
Read the full PrivateVPN review >
PrivateVPN Plans + Pricing

PrivateVPN's 1-month and 3-month plans are a bit on the expensive side, but its 2-year deal is one of the cheapest on this list. PrivateVPN accepts 6 different credit cards (including JCB and Diner Club International), PayPal, and Bitcoin. Each payment plan is backed by a 30-day money-back guarantee.
Try PrivateVPN Now (30 Days Risk Free)
6. Private Internet Access - Flexible, Fast + Highly Versatile (with a Large # of Servers)

Private Internet Access (PIA) has an impressive 35,000+ servers located in 78 countries. Because of its huge server network, PIA is able to prevent the kind of overcrowding that many other VPN services' servers receive. And in terms of speed, PIA was among the fastest and most consistent.

My favorite thing about PIA is its strong commitment to user privacy - while most VPNs claim they don't log user data (but can't really back up that claim), Private Internet Access's claims of not logging user data have been tested in multiple court cases and verified to be true every time. PIA even releases regular transparency reports where it shows how it regularly doesn't produce logs to investigators. And since its apps are fully open-source, multiple IT professionals have examined the source code and verified that PIA's apps are some of the most secure VPNs out there.

Speaking of apps, PIA has the most flexible and customizable apps out of any other VPN on this list. All of its apps are well designed, highly intuitive, and offer tons of customization for advanced users - different levels of encryption, IP and app whitelisting, local port connections, automation rules, and a lot more. And like ExpressVPN, PIA has high-security features like port forwarding and its own DNS - yet another commitment to how it strives to maintain ultra-strong user privacy. It's clear that PIA's development team is committed, dedicated, and constantly working hard on making sure they give their users the most private and comprehensive VPN experience possible.

PIA allows up to 10 simultaneous connections and backs each purchase with a 30-day money-back guarantee.
Try Private Internet Access (30 Days Risk-Free)
Private Internet Access Security Facts

Worldwide servers:35,000+

Protocols: OpenVPN, WireGuard

Data encryption: 128-bit AES, 256-bit AES

Specialty servers: Port forwarding, Split-tunneling, SOCKS5

Leak protection: DNS, WebRTC, IPv4, IPv6

Kill switch: Yes

No-logs policy: Yes

Private Internet Access Speed Tests

PIA lists the ping for every server on its network, helping you pick the fastest server. I chose the server with the lowest ping when I tested PIA's connection speed in each country.
Here are some highlights:
PIA provides decent internet speed. When I tested PIA, my speed decreased by only 5% on the fastest servers. However, when I connected to PIA servers in Asia and South America, my speed dropped by almost 50%. This isn't great, but it's not worse than the average. Overall, PIA slowed down my internet connection by roughly 38%, which is in the same neighborhood as TunnelBear and ProtonVPN.
Try Private Internet Access Now
Private Internet Access Streaming, Torrenting + Government Bypassing

Streaming: Mostly Weak

PIA unblocks only some streaming apps, and not enough for me to recommend it if you're looking for a VPN to stream content with. During my tests, I was able to access content on popular sites like Netflix and Amazon Prime, but I couldn't access content on BBC iPlayer, Hulu, Disney+, or most other sites.

If you're looking for a VPN that unblocks more than 20 different streaming services, I recommend ExpressVPN or ProtonVPN.

Torrenting: Strong

PIA allows torrenting on every single server, so you don't have to search for or connect to a dedicated P2P server like you do with some other VPNs. I tested random PIA servers all over the world with uTorrent and BitTorrent, and I had no problems sharing files with either torrent client.

I put PIA through a number of DNS leak tests, and PIA passed each one with 0 leaks. I also really like that PIA automatically disables IPv6 traffic - I didn't have to worry about manually disabling it, like I did with TunnelBear.

Government Bypassing: Weak

PIA doesn't have obfuscated servers and is unable to unblock content on the internet in restrictive countries.
Read the full Private Internet Access review >
Private Internet Access Plans + Pricing

PIA has 3 payment plans that are all reasonably priced, and you get every feature with each plan (unlike ProtonVPN's tiered pricing plan). PIA has a monthly plan as well as 1-year and 2-year subscription options.

PIA accepts credit cards, PayPal, and cryptocurrencies like Bitpay, Bitcoin, Ethereum, and Litecoin. I also like how you can pay with an Amazon gift card to remain completely anonymous. PIA covers each plan with a 30-day money-back guarantee.
Try Private Internet Access (30 Days Risk-Free)
7. VyprVPN - Good VPN for Small Businesses

VyprVPN is fast, versatile, and offers a paritcularly good VPN service for business users. VyprVPN owns and operates all of its servers, it's based in Switzerland (which has strict privacy laws), and it doesn't keep logs of internet activity or files that you or your employees share.

It's also a pretty good choice for individual users - it supports a wide range of streaming services (including Netflix), allows torrenting, and maintains fast speeds with popular protocols like WireGuard and OpenVPN.

For individuals, VyprVPN provides up to 5 connections and a 30-day money-back guarantee.
Try VyprVPN (30 Days Risk-Free)
VyprVPN Security Facts

VyprVPN Speed Tests

VyprVPN has servers located in 70+ locations across the world. I tested VyprVPN's speed by choosing a server in each of VyprVPN's locations.
Here are some highlights:
VyprVPN provided me with excellent speeds when I connected to servers in the US and in Europe. However, VyprVPN's speed decreased more than I would have liked when I connected to servers in Asia and South America.

Overall, my average decrease in speed was 35%, but the speed reduction was much less with servers that were located close to my actual location.
Try VyprVPN Now
VyprVPN Streaming, Torrenting + Government Bypassing

Streaming: Strong

Using VyprVPN, I was able to stream content from Netflix, Hulu, Amazon Prime, AppleTV, Disney+, BBC iPlayer, and ESPN+. Thanks to VyprVPN's fast speeds, I didn't experience any interruptions and my videos streamed in HD.

Torrenting: Strong

VyprVPN is a torrent-friendly service and it allows P2P file sharing on all of its servers. I had fast speeds and a quick and seamless torrenting experience during my tests. VyprVPN also passed all of the DNS leak tests that I performed with 0 leaks.

Government Bypassing: Strong

VyprVPN has a special protocol called Chameleon that keeps VPN traffic undetectable from countries that restrict access to the internet. While some competitors like ExpressVPN use obfuscation tools or servers to bypass government censorship, VyprVPN hides your connection with a protocol technology - which is also very easy to enable on all of its apps.

My colleagues in restrictive countries reported that VyprVPN's Chameleon protocol was able to unblock government censorship, and they could visit practically any website they wanted.
Read the full VyprVPN review >
VyprVPN Plans + Pricing

VyprVPN offers three different individual plans with 1-month, 12-month, and 36-month subscription options. You can pay with a credit card, UnionPay, and PayPal (but not with cryptocurrency), and every plan includes a 30-day money-back guarantee.

VyprVPN has a VyprVPN for Business plan and a VyprVPN for Business Cloud plan. Both business plans come with a free trial.
Try VyprVPN (30 Days Risk-Free)
8. Mullvad VPN - High Privacy + Strong Security (and Simple Payment Plan)

Mullvad VPN offers a flat monthly rate for its service, regardless of whether you just want to use the VPN for a month, a year, or longer. And Mullvad hasn't increased the price of its monthly subscription since it was founded in 2009.

Unlike most competitors that ask for your email or other personal information when making a purchase, Mullvad gives you an account number to serve as your ID and password. Also, Mullvad is an open-source VPN, and it doesn't record or store any of your online activity. Mullvad also has good speed, allows torrenting, and is able to bypass internet censorship - but it's not a good choice for streaming.

Mullvad allows you to connect 5 devices simultaneously and has a 30-day money-back guarantee.
Try Mullvad VPN (30 Days Risk-Free)
Mullvad VPN Security Facts

Mullvad VPN Speed Tests

Mullvad scored well on my speed tests. I was connected to a server in under 10 seconds in each of the 36 countries where Mullvad has servers. And my connection speed never decreased by more than 50%.
Here are some highlights:
Mullvad has good speeds - it's not as fast as ExpressVPN or CyberGhost VPN, but it does maintain decent speeds even when connected to distant servers.
Try Mullvad VPN Now
Mullvad VPN Streaming, Torrenting + Government Bypassing

Streaming: Weak

Streaming is one of Mullvad's biggest weaknesses. In my tests, Mullvad VPN failed to unblock Netflix, Hulu, Disney+, BBC iPlayer, and every other service I tried.

If you're looking for a VPN that easily unblocks major streaming services, consider ExpressVPN, ProtonVPN, or CyberGhost VPN.

Torrenting: Strong

Mullvad allows P2P file sharing and torrenting on all of its 760+ servers. During my tests, I was able to download files with fast speed. Mullvad also has split-tunneling, but it's not as easy to set up as other VPNs on this list. For example, you only need a couple clicks to customize split-tunneling with ExpressVPN and ProtonVPN. But Mullvad requires you to complete a handful of steps that could be difficult if you aren't tech-savvy.

Government Bypassing: Mostly Strong

Mullvad uses a combination of "Bridge" servers (double VPN) and a Shadowsocks proxy (an open-source proxy designed to bypass internet firewalls) to counter countries that restrict access to the internet. While ExpressVPN provides obfuscation on all of its servers, Mullvad requires you to manually select your "Bridge" locations (but "Bridge" mode only works on desktop, not mobile).

My colleagues in restrictive countries all confirmed that Mullvad allowed them to access the internet and browse the web without any limitations.
Read the full Mullvad VPN review >
Mullvad VPN Plans + Pricing

Mullvad only offers one reasonably-priced monthly subscription - there are no long-term deals. Your payment will automatically roll over each month, or you can pay for a full year in advance at the same monthly rate.

Mullvad accepts credit cards, PayPal, cash, bank wires, and cryptocurrency. Your purchase comes with a 30-day money-back guarantee.
Try Mullvad VPN (30 Days Risk-Free)
9. CactusVPN - Unlimited Connections on Unlimited Devices

CactusVPN comes with lots of security features and is one of the few VPNs that allows connections on unlimited devices. It also has good speeds, a no-logs policy, and SmartDNS.

During my tests, I connected 8 devices to my CactusVPN account, and I maintained fast and consistent internet connections on every single device. I also accessed geo-blocked content on all major streaming services (Netflix, Hulu, Disney+, etc.), and I was able to download torrents without any speed issues.

There are 4 different payment plans, and all of them are backed by a risk-free 30-day money-back guarantee.
Try CactusVPN Now (30 Days Risk Free)
CactusVPN Security Facts

CactusVPN Speed Tests

CactusVPN provides 39 servers located in 22 countries (high-speed servers only), and I tested CactusVPN's speeds by connecting to every one of thee servers, including in countries like the US, UK, and the Netherlands that have multiple server locations.
Here are some highlights:
CactusVPN has good speeds - almost every server I tried was fast. There were a few times when I tried connecting to the Japanese and Australian servers where I experienced a few interruptions, but overall, my average drop in connection speed was 40% - which is comparable to most competitors on this list.
Try CactusVPN Now
CactusVPN Streaming, Torrenting + Government Bypassing

Streaming: Strong

CactusVPN claims to unblock 340+ websites from more than 12 countries. In my tests, I also accessed content on Amazon Prime, BBC iPlayer, TSN, France.TV, Fox Sports Australia, and many other streaming services without any interruptions.

While most videos started without any delay, it took a little bit longer than normal (up to 30 seconds in some cases) for videos to load on Netflix when I was connected to some of CactusVPN's servers - though the streaming was smooth and uninterrupted once a show started.

Torrenting: Mostly Strong

CactusVPN has dedicated P2P servers in 7 countries (Netherland, Germany, Switzerland, Spain, Latvia, Romania, and Malaysia). I tested each of CactusVPN's P2P servers (using all of the major torrenting clients like Vuze, BitTorent, and Deluge) and my files downloaded fast and without any glitches.

I also conducted a handful of DNS leak tests and there were never any leaks reported. But like some other VPNs on this list, CactusVPN doesn't support IPv6, so you need to manually disable it on your device.

Government Bypassing: Mostly Strong

CactusVPN claims that its VPN over ICMP (Internet Control Messaging Protocol) and DNS feature can possibly bypass internet censorship in countries that use packet filtering to block online content (some networks only allow ICMP and DNS packets to be routed through their servers) - but the results are mixed.

I consulted with my colleagues around the world, and they reported that CactusVPN unblocked government-induced internet censorship only some of the time in China, Russia, Turkey, and a few other countries.
Read the full CactusVPN review >
CactusVPN Plans + Pricing

CactusVPN offers a 1-month, 3-month, 1-year, and 2-year plan. CactusVPN gives you more than 10 different ways to pay for the service, including credit cards, PayPal, cryptocurrency, and other services such as AliPay and YooMoney (Yandex.Money). Each purchase is backed by a money-back guarantee for the first 30 days.
Try CactusVPN Now (30 Days Risk Free)
10. IPVanish - Good VPN for VoIP Calls

IPVanish lets you use VoIP services like Skype or WhatsApp without any restrictions. VoIP services are blocked in some countries, and it's also not uncommon for VoIP service providers to charge different fees for users in different countries.

I have a friend who works in the United Arab Emirates, and she regularly uses IPVanish to talk with family and friends via Skype and FaceTime. The last time I spoke with her, our voice call was pretty good and neither her nor I experienced any interruptions or weak connections.

IPVanish also doesn't set a limit on the number of devices you can connect, allows torrenting on all of its servers, and has split-tunneling (but only for Android and FireOS). The only thing I don't like about IPVanish is that it's not very good for streaming.

IPVanish offers monthly and yearly plans, and its yearly plans are backed by a 30-day money-back guarantee. Try IPVanish Now >

IPVanish Security Facts

IPVanish Speed Tests

IPVanish has over 1,600 servers in 75+ locations. To choose the best server for you, IPVanish gives you metrics such as the load and ping of every server.

To test IPVanish's speed, I connected to a server with the lowest load in 50+ countries.
Here are some highlights:
IPVanish connected me to each server almost immediately, and I maintained above average speeds throughout my speed tests.

Overall, my speed decreased by about an average of 28% - this is comparable to top competitors like ExpressVPN and CyberGhost. So, if you're looking for a VPN with good speeds, IPVanish is a pretty decent choice.
Try IPVanish Now
IPVanish Streaming, Torrenting + Government Bypassing

Streaming: Mostly Weak

IPVanish successfully unblocked Netflix, Hulu, Disney+, and other streaming sites in my tests, but I couldn't access Amazon Prime and BBC iPlayer. There are many other VPNs on this list that do a much better job at unlocking streaming services.

Torrenting: Strong

All of IPVanish's 1,600+ servers are P2P friendly. IPVanish also has SOCKS5 proxy servers that give you an even faster download speed because they don't encrypt your data. But I didn't need to use a SOCKS5 server - IPVanish's servers in many countries provided me with plenty of fast speed for torrenting.

Government Bypassing: Weak

Unfortunately, IPVanish isn't a reliable VPN to access the internet in restrictive countries.
Read the full IPVanish review >
IPVanish Plans + Pricing

IPVanish offers 4 payment plans. You can either get the VPN for a monthly or annual subscription, or opt for the VPN + 500 GB storage, which is also available as a monthly or annual subscription.

IPVanish accepts credit and debit cards and PayPal as forms of payment (cryptocurrency is not supported). You get a 30-day money-back guarantee on the 12-month plans.
Try IPVanish (30 Days Risk-Free)
Top Brands that Didn't Make the Cut:

HMA (formerly HideMyAss!). HMA has good speed, unblocks most of the major streaming providers, and supports torrenting on dedicated P2P servers. However, HMA has a history of logging users' personal data and handing that data over to law enforcement. Also, in 2017 it was discovered that the Mac version of HMA's proxy app contained several serious exploits which could allow a third-party to disable a Mac's firewall and take control over user accounts. While HMA now has a strict no-logs policy and has fixed the bug with Macs, I can't recommend HMA because of its history of privacy flaws.

Hola VPN. Hola VPN is a free P2P VPN which has good geo-unblocking capabilities and fast speed. But unlike most VPNs, Hola routes traffic through its users (instead of private servers) inside a peer-to-peer network - Hola replaces your IP address with another Hola user's IP address. This means someone can use your IP address to engage in all sorts of questionable or criminal activities. Hola is also a bad option because it doesn't have 256-bit AES encryption, a kill switch, and it blocks all BitTorrent traffic.

Avast SecureLineVPN. Avast is one of the most famous names in the cybersecurity industry, but it was caught selling user data, and for that reason, I don't really trust it. While Avast used its antivirus software (and not its VPN) to gather user information, I simply can't recommend any Avast products until the company can earn back my trust. You can read more about the whole scandal here.

What Did I Look For in this VPN Comparison?

Strong security. I only recommend VPNs that offer industry-standard security features like 256-bit AES encryption, secure VPN protocols (like OpenVPN and WireGuard), and a kill switch (that prevents your internet data from getting exposed if your VPN gets disconnected). I also look for additional features like split-tunneling (allows you to route some of your traffic through a VPN and some of your traffic through your local connections), an ad-blocker, and more. Not all of my top choices have all of these extras, but all of my top picks like ExpressVPN and ProtonVPN have strong security features.

No-logs policy. To stop a VPN from storing your personal information and internet activity (websites you browse and files you share), a VPN must have a strict policy that states it doesn't record any of your data - and all of the VPNs listed here have strict no-logs policies. And some VPNs (like ExpressVPN, ProtonVPN, TunnelBear, and VyprVPN) have even had their policies independently audited and confirmed.

Many worldwide servers. A good VPN provider should have at least hundreds of servers spread out all over the world. All of my top VPNs have a minimum of 700 servers and most have 1,000+ servers (Private Internet Access has the most on the list with 35,000+). Generally, the more servers a VPN has in a location, the faster the internet connection will be. When a VPN has a lot of servers in a location, it reduces the risk of overcrowding on a particular server, allowing for faster speed.

Fast speeds. Every VPN will slow down your internet connection, but the best VPNs will minimize the decrease in speed, even when you connect to distant servers. The VPNs on this list reduced my speed by no more than 50% - the fastest VPNs (like ExpressVPN and IPVanish) slowed down my connection by an average of only 15-25%, which is really good. In fact, even in cases where speeds were considerably slowed down, I was able to browse the internet, stream videos, or download files with a fast and stable internet connection with all of the VPNs on this list.

Streaming/torrenting/government bypassing. A good VPN should allow you to access geo-blocked streaming services, download files safely, and bypass government restrictions in countries that restrict internet content like China or Russia. Some of the VPNs on this list are unable to unblock streaming platforms or provide unrestricted internet access in countries with severe internet restrictions. But many of my top VPNs (like ExpressVPN) are good for streaming, torrenting, and government bypassing.

Great value. All of my choices allow you to connect 5-10 devices at the same time under a single account - and a few (like IPVanish and CactusVPN) even provide unlimited simultaneous connections. Most VPNs offer monthly and yearly subscription plans, flexible payment options (including cryptocurrency), and 30-day money-back guarantees (CyberGhost even has a 45-day money-back guarantee).

VPN Comparison Charts

Although there's a lot to consider when choosing a VPN, the color-coded charts below will show each VPN provider's features, privacy, pricing, customer support, and more.

Each column of the charts below represents an important part of each product, and there's a simplified color-coded system to show how each VPN performs in each of the testing categories.
What does this information show?

Virtually everything. Privacy, security, download and upload speeds, pricing, customer support, website usability, government data sharing and cooperation, technical specifications, and more.

There are two charts - a Simple VPN Comparison Chart and a Detailed VPN Comparison Chart.

The Simple Chart is great for non-technical users who want a quick look at what's good, what's bad, and what's ugly. However, the Detailed Chart gives a much more in-depth insight into each VPN service provider.

How to Use the VPN Comparison Charts:

Use the color-coded system. The color-coded system is used for both tables, and it helps to give you a quick insight into each aspect of a VPN provider. The simplified chart includes a 3-color system - Red (Major concern), Yellow (Some concerns), and Green (Good). The detailed chart adds two more colors - Orange (Not good) and Light Green (It's okay) - to make a 5-color system. For those who are color-blind, simply turn on the "▣ Version for color-blind" button.

Use filters. By clicking the "Filter" underneath the list of VPN providers, you can select a specific brand that you'd like to assess. By clicking Filter underneath each column, you can rearrange the table to show the best/worst VPNs for a specific feature.

Choose the number of entries. Navigate to "Show # ▾ entries" on the top-left of each chart, click the ▾ down arrow, and select the number of entries you'd like to see.

See list of term explanations. Underneath both the Simple and Detailed VPN Comparison Charts is a list of explanations stating what each term in the chart means.

Horizontal scrolling. Use horizontal scrolling to see each column in the chart. Horizontal scrolling is essential to see all of the columns in the Detailed VPN Comparison Chart.

Simple VPN Comparison Chart

The chart below gives a brief overview of each VPN brand. The chart shows information such as each VPN company's jurisdiction, logging policies, pricing, and more.
See the explanation infographics for a list of term definitions and why they're important.
Detailed VPN Comparison Chart

FAQ - Virtual Private Networks (VPNs)

What's the best VPN in 2021?

ExpressVPN is my #1 pick for the best VPN in 2021. It has a large network of fast servers, is very easy to use, and has excellent security features (its own DNS encryption service, TrustedServer Technology, and its own ultra-fast, secure protocol "Lightway"). It maintains user privacy with a strict no-logs policy, allows users to pay with crypto, and all of its servers run on RAM (not hard drives) so memory gets flushed often.It allows you to stream in HD on all major streaming sites, it supports P2P traffic on all of its servers, and it successfully unblocks content in restrictive countries like China. You can connect 5 devices at once, and ExpressVPN is backed by a 30-day money-back guarantee.
But all of the VPNs on this list are very good.
I really like that ProtonVPN has tons of privacy features (Secure Core VPN architecture and perfect forward secrecy) to keep user data safe, and CyberGhost VPN provides an overall excellent browsing, streaming, torrenting, and gaming experience. If you have never used a VPN before, you'll like TunnelBear's simple interface and user-friendly apps.

Again, all of the top VPNs are the best VPNs out there, so it's just a matter getting the perfect one for you.

Are VPNs legal?

VPNs are legal in most countries around the world. However, a few countries have banned VPNs, including China, Iran, Russia, Iraq, Belarus, North Korea, the United Arab Emirates, and Venezuela. If you are using a VPN in a country that doesn't allow VPNs, you may be breaking the law. And if caught, you may be prosecuted.

If you plan to live in or visit a country that restricts user content, you should buy a VPN now because you may be unable to access the VPN's website from inside that country. ExpressVPN is particularly good at bypassing government restrictions.

In countries where VPNs are legal, it is illegal to use a VPN to engage in criminal activity. As long as you follow all local laws, a VPN is a perfectly safe and legal tool to add security, privacy, and versatility to your online experience.

Is using a VPN against Netflix's 'Terms and Conditions'?
This is a tricky question, and the answer is yes and no.
In Netflix's terms and conditions, it states:
"You may view Netflix content primarily within the country in which you have established your account and only in geographic locations where we offer our service and have licensed such content."
So if you live in the US and connect to a VPN's US server to watch Netflix, you are within the boundaries of the streaming service's terms and conditions. However, if you're travelling outside of the country where you have registered your Netflix account, it seems that you'd be allowed to use a VPN to access content available in the country where your account is registered. Netflix also says you can watch in-country content (i.e. if you travel to Germany, you can access German Netflix).

Some VPNs are better than others at unblocking Netflix (and many other popular streaming sites). Most of my top VPNs can - ExpressVPN, CyberGhost, ProtonVPN, and PrivateVPN are all able to successfully unblock Netflix libraries in many different countries.

How does a VPN protect you on the internet?

A VPN mostly protects you in two ways. The most basic way is by routing your internet traffic through one of its own servers - instead of through your local network or a public Wi-Fi hotspot - thereby masking where your traffic comes from.

VPNs also encrypt all of this traffic in a tunnel, obscuring all of your browsing content. VPNs help secure your browsing data against third-parties observers like your internet service provider (ISP), the government, or a hacker. All of the VPNs on this list are capable of doing this.

# data[].attributes.attachment_link.title
10 Best VPN Services (2021): Security, Features + Speed

# data[].attributes.attachment_link.description
🥇 ExpressVPN (#1 in 2021) - it's got excellent security, ultra-fast speeds, and a great user experience. ExpressVPN maintains a strict no-logs policy, is full of features for streamers and torrenters, and protects all purchases with a 30-day money-back guarantee.

# data[].attributes.headline
The complete list of Infosec related cheat sheets

# data[].attributes.subject
The complete list of Infosec related cheat sheets

# data[].attributes.attachment_link.title
The complete list of Infosec related cheat sheets

# data[].attributes.attachment_link.description
I do not think I have collected them all yet, but here's what I have so far. Please suggest more. PENETRATION TESTING AND WEBAPP CHEAT SHEETS: * mobile application pentesting: https://www.peerlyst.com/posts/mobile-application-penetration-testing-che

# data[].attributes.headline
Investigating eCommerce Scammers on Amazon using OSINT

# data[].attributes.subject
Investigating eCommerce Scammers on Amazon using OSINT

# data[].attributes.attachment_link.readable_text
A keyboard vibration attack is a proof-of-concept (POC) exploit that involves placing a mobile device near to a computer keyboard in order to use the mobile device's accelerometer as a keylogger.

The accelerometer detects vibrations from the keyboard and an associated application translates them into the characters being typed. Although there have been no reports of keyboard vibration attacks in the wild, Georgia Tech researchers found a method to exploit the accelerometer in an iPhone to record keystrokes.

The researchers reported a captured character accuracy of 80 percent and claim that as accelerometers progress, the accuracy increases. They discovered this capacity by observing that the exploit functioned with higher accuracy on the newer generations of iPhones.

Although the research was conducted on Apple phones, the Georgia Tech researchers note that similar exploits could target other mobile devices and operating systems. The research follows similar investigations and discoveries involving the possibility of exploiting cameras, microphones and even status LED micro-pulses to reveal sensitive information such as passwords or financial details.

Continue Reading About keyboard vibration attack

Related Terms

Google Titan

Google Titan is a security chip designed to protect computers from firmware-based rootkits and other malware-infecting firmware. ... See complete definition

JavaScript

JavaScript is a programming language that started off simply as a mechanism to add logic and interactivity to an otherwise static... See complete definition

A rootkit is a program or, more often, a collection of software tools that gives a threat actor remote access to and control over... See complete definition

# data[].attributes.attachment_link.title
What is keyboard vibration attack? - Definition from WhatIs.com

# data[].attributes.attachment_link.description
A keyboard vibration attack is a proof-of-concept (POC) exploit that involves placing a mobile device near to a computer keyboard in order to use the mobile device's accelerometer as a keylogger. The accelerometer detects vibrations from the keyboard and an associated application translates them into the characters being typed.

# data[].attributes.attachment_link.description
Web scraping, web harvesting, or web data extraction is data scraping used for extracting data from websites. Web scraping software may access the World Wide Web directly using the Hypertext Transfer Protocol, or through a web browser. While web scraping can be done manually by a software user, the term typically refers to automated processes implemented using a bot or web crawler.

# data[].attributes.attachment_link.title
The Worst Passwords of 2018 50-1 | SplashData

# data[].attributes.attachment_link.description
"Most of us have day jobs. Identity thieves and scammers view grabbing our information and exploiting it for their gain as their day job. Always assume there is a never-ending riot overflowing with looters happening just outside your cyber house.

# data[].attributes.headline
Threat Intelligence tools list for hackers and security professionals

# data[].attributes.subject
Threat Intelligence tools list for hackers and security professionals

# data[].attributes.attachment_link.readable_text
Threat Intelligence Tools are more often used by security industries to test the vulnerabilities in network and applications. Here you can find the Comprehensive Threat Intelligence Tools list that covers Performing Penetration testing Operation in all the Corporate Environments.

Also Read: Lynis - Open Source Security Auditing & Pentesting Tool - A Detailed Explanation

Cyber Threat Intelligence Tools List

Formats

Standardized formats for sharing Threat Intelligence (mostly IOCs).

IDMEF (RFC4765)
Experimental - The purpose of the Intrusion Detection Message Exchange Format (IDMEF) is to define data formats and exchange procedures for sharing information of interest to intrusion detection and response systems and to the management systems that may need to interact with them.

The Structured Threat Information eXpression (STIX) language is a standardized construct to represent cyber threat information. The STIX Language intends to convey the full range of potential cyber threat information and strives to be fully expressive, flexible, extensible, and automatable. STIX does not only allow tool-agnostic fields, but also provides so-called test mechanisms that provide means for embedding tool-specific elements, including OpenIOC, Yara and Snort. STIX 1.x has been archived here.

The Vocabulary for Event Recording and Incident Sharing (VERIS) is a set of metrics designed to provide a common language for describing security incidents in a structured and repeatable manner. VERIS is a response to one of the most critical and persistent challenges in the security industry - a lack of quality information. In addition to providing a structured format, VERIS also collects data from the community to report on breaches in the Verizon Data Breach Investigations Report ( DBIR) and publishes this database online at VCDB.org.

Frameworks and Platforms

Frameworks, platforms and services for collecting, analyzing, creating and sharing Threat Intelligence.

Tools

All kinds of tools for parsing, creating and editing Threat Intelligence. Mostly IOC based.

Research, Standards & Books

All kinds of reading material about Threat Intelligence. Includes (scientific) research and whitepapers.
Credit: This Awesome Work is originally done by Herman Slatman. All the credits belongs to Original Author.

BALAJI is a Security Researcher (Threat Research Labs) at Comodo Cybersecurity. He is a Certified Ethical Hacker, Editor-in-Chief, Author & Co-Creator of GBHackers On Security

# data[].attributes.attachment_link.title
Cyber Threat Intelligence Tools List For Hackers & Security Professionals

# data[].attributes.attachment_link.description
Threat Intelligence Tools are more often used by security industries to test the vulnerabilities in network and applications. Here you can find the Comprehensive Threat Intelligence Tools list that covers Performing Penetration testing Operation in all the Corporate Environments.

# data[].attributes.headline
NSA/CSS Technical Cyber Threat Framework v2

# data[].attributes.subject
NSA/CSS Technical Cyber Threat Framework v2

# data[].attributes.headline
How to blow your online cover with URL previews

# data[].attributes.subject
How to blow your online cover with URL previews

# data[].attributes.attachment_link.readable_text
Published: January 2, 2019

URL previews are a nice feature found in most messaging applications. They allow you to paste a URL to a friend or colleague, and have a handy miniature view of the website you are about to view.

The downside is that a lot of applications generate these previews without you knowing what is happening behind the scenes. In some cases this can equate to you disclosing your public IP address in a manner that you likely wouldn't want.

Don't forget: when you browse to a website your public IP address is exposed. This is just how the Internet works unless you're using Tor or a VPN to hide it.

The difference with URL previews in messaging applications is that you are broadcasting to the website owner that you are discussing the website, as opposed to just browsing to it.

This small and subtle change in context is actually quite an important distinction. You'll see why very shortly...

A Little History

A few years ago I was on a penetration test where I was attempting to spearphish executives at a well known corporation in Europe. They had one of the most brilliant CISOs I had ever met and an absolutely amazing incident response team on staff.

After I sent the initial round of phishing emails I was monitoring my command and control server to look for connections from users, anti-virus, or anything else that might indicate that I was either having some success or was about to be caught.

After a few hours there was not a lot of activity until my web server received a connection from an IP address that resolved back to Skype. This was a WTF moment for me since my phishing server was brand new and there didn't seem to be a good reason why a Skype server would be touching it.

A few minutes later another hit from a different Skype server. Now I was really wondering what was going on.

Then it dawned on me. Someone was discussing my command and control system during a Skype chat, and Skype was generating previews of the phishing site I had setup.

I performed a couple of quick tests using my own Skype account, and sure enough, I could reproduce the issue easily. I now knew that the incident response team was on to me, and that it was time to switch tactics.

But this also raised a much larger issue in my mind when it came to online investigations, incident response and running covert online operations.

How Does This Apply to Online Investigations?

There are two viewpoints here: one is from an investigative standpoint and the second is from the standpoint of you running a covert operation through a website.

From the investigative standpoint, if you are passing URLs back and forth with a fellow investigator you may end up notifying your target that you are talking about them. This is exactly how I figured out that the incident response team was on to me during my penetration test. You likely don't want this to happen.

The second standpoint is where you are running a website for a covert online operation. You can monitor for these URL previews and determine that someone is discussing your site, potentially letting you know that your ruse is working or that you might be caught out (again, context is important and mission-dependent here).

Either way, it is a unique set of behaviours that can be observed that is not general browsing activity.

Test Results from Various Platforms

I did some quick testing of various messaging clients and services. The test was to simply setup a Python web server on a Digital Ocean droplet ($5/month plan is sufficient). The Python web server just printed out the IP address and headers of the connecting client.

I also setup a DNS record specific for this testing so that I could try using IP addresses vs. domain names. WhatsApp was the only service tested that responded differently for IP addresses vs. domain names. Every other service was happy to generate previews for an IP address. There was also no difference between using an HTTP vs. HTTPS URL.

Here is a summary of findings:

Slack

We, like many other companies, live on Slack so this was the first test I performed. Slack was happy to generate URL previews and identified itself with the following User-Agent:

User-Agent: Slackbot-LinkExpanding 1.0 (+https://api.slack.com/robots)

The IP address of the request was from my publicly facing IP address through my office connection in both mobile and desktop versions of Slack.

# data[].attributes.attachment_link.title
Hunchly - OSINT Articles - How to Blow Your Online Cover With URL Previews

# data[].attributes.attachment_link.description
Published: January 2, 2019 URL previews are a nice feature found in most messaging applications. They allow you to paste a URL to a friend or colleague, and have a handy miniature view of the website you are about to view.

# data[].attributes.headline
Tech trends 2019: 'The end of truth as we know it?'

# data[].attributes.subject
Tech trends 2019: 'The end of truth as we know it?'

# data[].attributes.attachment_link.readable_text
More than 200 firms contributed to our request for ideas on what the global tech trends will be in 2019. Here's a synthesis of the main themes occupying the minds of the technorati this year. You may be surprised.

This year it's all about data - a small, rather dull word for something that is profoundly changing the world we live in.

New technologies, from voice-controlled speakers to "internet of things" (IoT) sensors, connected cars to fitness wearables, are vastly increasing the amount of digital data we produce.

And artificial intelligence (AI), machine learning and cloud computing are transforming the way we store, analyse and apply it.

"In 2019 smart sensors will start to be found everywhere, automating data collection to satisfy the voracious appetite of AI," says Tim Harper, a former European Space Centre engineer and now founder of G2O Water Technologies.

AI could be a powerful force for good, improving healthcare and combating climate change, for example. But it also presents many dangers - to democracy, to financial markets, to the belief in objective truth.

Data in the wrong hands, used in the wrong way, could even threaten world peace, some commentators warn.

Fake news?

"Deepfakes" - manipulated digital videos that overlay another person's face onto a body or change what people actually said - pose a growing threat, argues Katja Bego, data scientist at innovation foundation, Nesta.

"2019 will be the year that a malicious 'deepfake' video sparks a geopolitical incident," she predicts.

"Though deepfakes are still a relatively new technology, they are evolving incredibly fast, making it harder and harder for the naked eye - or even digital forensics tools - to identify them. At the same time, they are also becoming ever easier and cheaper to create."

She envisages a nightmare scenario in which a world leader could appear to declare war or spread damaging propaganda, with potentially devastating results.

As fake news stories - often state-sponsored - continue to flood social media and China's Xinhua News Agency launches its first AI-created newsreaders, the lines between the fake and the real are becoming increasingly blurred.

If we cannot trust what we see or hear any more, is this "the end of truth as we know it?" asks Ms Bego.

Andrew Tsonchev, director of technology at cyber security company Darktrace Industrial, believes the internet's openness and lack of accountability - qualities its founders cherished - play into the hands of those with malicious intent.

"Ultimately, manipulating the public discourse might prove to be a greater cyber-risk than the hacking of our devices," he says.

"Controlling data may soon become more important than stealing it."

Under attack

Cybersecurity companies are notorious for scaring us witless in the drive to sell more of their products. But that doesn't mean their warnings are worthless.

And AI in the hands of criminal or state-sponsored hackers is certainly worth worrying about.

"2019 will see the first AI-orchestrated attack take down a FTSE 100 company," predicts Jason Hart, chief technology officer, data protection, at security firm Gemalto.

"A new breed of AI-powered malware will infect an organisation's systems, sit undetected gathering information, adapt to its surroundings, and unleash a series of bespoke attacks targeted to take down a company from the inside out."

AI will be needed to fight AI, many believe, particularly as the IoT vastly increases the number of potential weak points in this burgeoning network of connected devices.

Greg Day from Palo Alto Networks says: "AI on AI cyber-battles will begin. Cybersecurity will be a machine versus machine fight with humans alongside to help and adjudicate.

"While cybersecurity will look for new ways to spot adversaries and threats with AI, adversaries will use AI themselves and increasingly look to subvert machine learning and AI."

This will ramp up the stakes even further.

"We'll see the first example of a scaled-up mass IoT attack affecting critical infrastructure," predicts Darren Thomson, chief technology officer at cybersecurity firm Symantec.

Healthier lives

But it's not all bad news. AI unleashed on all our health data could herald a new era of personalised medicine, many believe.

"We predict that by mid-2020, two in three patients with any condition will be supported by AI and AI-related technologies, either as part of diagnostics, treatment, or administration," says John Gikopoulos, global head of AI and automation at Infosys Consulting.

AI-powered computers are getting better at analysing images and diagnosing cancers, and helping to identify molecules that could be turned into life-saving drugs.

Virtual doctors and chatbots are giving us health advice via apps.

"In 2019, for the first time ever, there will be more health data available outside health systems than inside them," says Othman Laraki, chief executive of Color, a San Francisco-based genetic testing company.

"Your Apple Watch can deduce your heart health, your mood, your sleep patterns. Your genome can tell you your risk for inherited cancer and heart disease and traits that impact everything from your caffeine sensitivity to your ability to metabolise medicine."

Data-driven healthcare, with an emphasis on prevention rather than cure, will have a "tremendous societal impact", he believes.

Taking back control?

In the wake of last year's Facebook-Cambridge Analytica scandal, which resulted in a maximum £500,000 fine for Facebook imposed by the UK's Information Commissioner's Office, how big companies use and abuse our data has been under much greater scrutiny.

As firms scramble to get their data privacy policies up to scratch now that the European Union's General Data Protection Regulation is in force, "2019 will be the year of GDPR fines", says Harrison Van Riper, a senior analyst at cybersecurity firm Digital Shadows.

Some commentators are predicting a consumer fightback.

"In 2019, I expect that consumers will start to reclaim control of their data and monetise it," says Phil Beckett, managing director of disputes and investigations at management consultancy Alvarez and Marsal.

Systems are being developed to allow us to control our health, financial, social, and entertainment data effectively, argues Paul Winstanley, chief executive of Censis, a centre of excellence for sensing and imaging systems.

"It is then an individual's choice whether they want to share that data with a third party, or not."

As consumer trust has been "severely dented", argues Mark Curtis, co-founder at design consultancy Fjord, firms will increasingly adopt a "data minimalism" approach, only asking for data they really need.
More Technology of Business
"They will have to clearly show the payback for users sharing their data, drawing a straight line from the act of sharing to receiving relevant products and services in return," he says.

All this consumer data, analysed by AI, will at least enable firms to personalise their services, argues Nigel Vaz, international chief executive of digital transformation agency Publicis.Sapient.

But rebuilding trust will be key, and this means consumers understanding how and why their data is being used, believes Ojas Rege, chief strategy officer at MobileIron, a mobile security company.

"Without transparency, there is no trust. Without trust, there is no data. Without data, there is no AI," he concludes.

The last word...

While data - how it is produced, stored, analysed and applied - is the key theme for 2019, developing technologies, such as voice control, superfast 5G mobile and connected cars, will gather pace through the year.

But these will only emphasise further how vulnerable our data is and how much harder we need to work to protect, own and value it.

# data[].attributes.attachment_link.title
Tech trends 2019: 'The end of truth as we know it?'

# data[].attributes.attachment_link.description
More than 200 firms contributed to our request for ideas on what the global tech trends will be in 2019. Here's a synthesis of the main themes occupying the minds of the technorati this year. You may be surprised.

# data[].attributes.headline
Collection of misc IT Security related whitepapers, presentations, slides - hacking, bug bounty, web application security, XSS, CSRF, SQLi

# data[].attributes.subject
Collection of misc IT Security related whitepapers, presentations, slides - hacking, bug bounty, web application security, XSS, CSRF, SQLi

# data[].attributes.attachment_link.description
Collection of misc IT Security related whitepapers, presentations, slides - hacking, bug bounty, web application security, XSS, CSRF, SQLi - bl4de/security_whitepapers

# data[].attributes.headline
A guide for amateurs pen testers and a collection of hacking tools

# data[].attributes.subject
A guide for amateurs pen testers and a collection of hacking tools

# data[].attributes.attachment_link.description
pushpin: A guide for amateurs pen testers and a collection of hacking tools, resources and references to practice ethical hacking, pen testing and web security. - sundowndev/hacker-roadmap

# data[].attributes.headline
Comparitech - Thousands of hours of in-depth tech research

# data[].attributes.subject
Comparitech - Thousands of hours of in-depth tech research

# data[].attributes.headline
What is Email Spoofing? How scammers forge fake emails

# data[].attributes.subject
What is Email Spoofing? How scammers forge fake emails

# data[].attributes.attachment_link.title
What Is Email Spoofing? How Scammers Forge Fake Emails

# data[].attributes.attachment_link.description
It looks like your email account has been hacked, but those weird messages you didn't send are actually due to email spoofing.

# data[].attributes.attachment_link.title
Information Security News|Data Breach Incidents|Hacking News

# data[].attributes.attachment_link.description
Information Security Newspaper covers all the news about computer information security, Hacking,data breach incidents, cyber security, malware,vulnerabilities

# data[].attributes.headline
How to find hidden cameras & spy gear like a professional: The Definitive Guide

# data[].attributes.subject
How to find hidden cameras & spy gear like a professional: The Definitive Guide

# data[].attributes.attachment_link.readable_text
The simple strategies that we are going to show you will effectively clear most rooms for hidden cameras and bugs without having to use super expensive countersurveillance gear or an outside company.

Most of the processes and steps that we are going to show you are adopted from some of our best government agencies, where countersurveillance is of a grave concern to them, so these techniques have been tried and tested

And the best part about this guide?

This post will reveal the exact step-by-step process that we use to sweep for covert spy gear and cameras
Sweeping For Hidden Cameras & Devices Is Becoming A Necessity
What Type of Device Could Be Used Against Me?
Just in the past couple of years, we have seen a rise in hidden cameras and spy gear being used in nefarious ways, targeting guests that stay on cruise lines, in hotel rooms, Airbnb houses, the list goes on. Unfortunately, this trend does not seem to be going away anytime soon, but you can, however, take measures to ensure that you are not a victim. In this post, we will show you exactly how to do that.

Before sweeping the room in question, you should first try to determine what type of surveillance equipment, if any, would be used against you in your specific situation.

For example, if you find yourself staying at a bed and breakfast or a hotel, you would most likely find surveillance equipment that would utilize video to capture compromising clips or photos of the occupants.

If you are in a business meeting environment like a conference room, you could assume that the intelligence being gathered would encompass important conversations and interactions between parties. The most likely device to be used in this situation and environment would be an audio recorder.
Break Your Bug Sweep Down Into These Steps: Step 1: Enter The Room Assuming You Are Under Surveillance
When sweeping a room for surveillance equipment, Keep this in the back of your mind and pay close attention to the areas of the room that are the most vulnerable and compromising.

If this is your first time staying in a new hotel or an Airbnb, automatically assume that you are currently being recorded and surveilled.

Odds are in your favor that you are not being monitored, but you still want to sweep your location to be 100% sure.

Think of it like riding in a vehicle and putting your seatbelt on. Chances are you won't need it, but you will be glad you put it on if you do.
Step 2: Split The Room Into Quadrants
So it is always best to just assume you are being recorded until you are 100% certain the room is clear of all surveillance equipment.

Start off by standing in the center of the room.

Next, split the room into quadrants.

Once you have identified your quadrants and your start points, go through each quadrant one at a time and clear it, using the techniques in this guide.

Splitting the room into sections will help you to systematically and meticulously go through the room and clear each section without skipping over any of the fine details.
Step 3: Start Off By Making Basic Observations

Perform a general scan and pay attention to anything that looks out of place or appears suspicious.

Are there duplicate items in the room? Such as clocks, smoke detectors or coffee pots.

Are there any unusual holes in the walls or ceiling?

Are any of the items in the room positioned in an unusual way?

Check all of the appliances like televisions, clocks, phones, hair dryers, and coffee pots for exposed wiring, suspicious lights, or anything that looks abnormal.
Step 4: Check Every Outlet And Identify What Is Plugged Into Each Socket

All surveillance devices require a power source; whether that power source is powered by an electrical outlet or a wireless battery may depend on how long you are expected to occupy the room and if the perpetrator has access to your room.

Devices that run on batteries have limited lifespans, however, those that run on electrical power can be used for constant and long-term surveillance.

Conduct a sweep of the outlets and identify everything that is plugged into them. Pay close attention to anything plugged in that may seem out of place.
What About Video Surveillance And Audio Recorders?

Any type of video surveillance device would be positioned in a way that would provide the best opportunity to capture footage.

For example, a video surveillance device would be aimed at the bathroom, in front of the dresser where one would get changed, or aimed at the bed. It is important to be aware of all choke points or high traffic areas in the room that would force occupants to take a certain path or occupy a certain area in the room.

Some areas to pay attention to are the bathroom door, the front door, and all hallways.

It is important to pay special attention to locations where conversations would take place.

If someone wanted to plant surveillance equipment in a room with the specific intent of capturing crystal clear audio of a conversation between parties, they would place the device(s) in any area people are expected to gather.
Objects Or Amenities That Could Be Vulnerable To Surveillance Equipment:

Some areas to pay close attention to are beds, tables, couches, chairs, desks, and balconies.

Do the devices and appliances in your room match the other devices and appliances in the rest of the room or house?

Are any of them placed in peculiar positions or locations?

Are these devices different from room to room?

Always keep an eye out for smoke detectors, thermostats, outlets, fixtures, and bulbs. Normally, common sense would suggest these devices should all match and remain relatively similar since they are usually original to the construction of the room or building.

This could suggest an anomaly that should be inspected further. More importantly, are there similar devices found from room to room that are placed in peculiar positions or locations?

This could also suggest an anomaly that should be inspected further. During your sweep, you should always ask yourself these questions and inspect further if warranted.

Does the artwork in the room match the décor or the theme of the room or house you are occupying?

Know The Ammenties That Are Offered

It is more common than not for hotels and rented rooms to have a common theme or décor pattern.

For example, a modern hotel would have mostly modern décor, fixtures, furniture, and appliances. A rustic Bed and Breakfast might have older furniture with an old world charm. Keep an eye out for fixtures and pieces of décor that seem out of place.

It is always recommended to be very knowledgeable and aware of the services and amenities of the location you are staying in and compare those standards to the devices and appliances in your room.

For instance, if the room is listed to have one coffee pot, but you see two in your room, inspect them both for anomalies.

If coffee is offered downstairs, is the coffee pot in your room supposed to be there?

Do you see more than one clock in your room?

Most websites will list expected room amenities and devices, but you can always call the front desk and ask if you are unsure of what devices and amenities should be in your room.

If your room has ceiling tiles, are they part of a drop ceiling system or are they build into the ceiling?

Are there any holes in them?

Do any of the tiles seem to stick out above the others or sit differently?

If your room has a drop ceiling where the ceiling tiles can easily be pushed up, inspect them and make sure there are not any surveillance devices hidden above them if you are suspicious.

It is always recommended to inspect every mirror in your room to ensure it is not a two-way mirror.

The best way to check for a two-way mirror is by using your fingertip. On most mirrors, if you place your fingertip on the mirror, the reflection of it will not touch. Instead, it will leave a quarter inch gap or so.

Let's Take A Deeper Look:
If you put your fingertip on the mirror and the reflection is touching your finger, you should inspect it further.
Step 1: Purchase A Radio Frequency (RF) Detector

It is important to note that some establishments like bars or gas stations may use a metal back with a mirror tint instead of using a real mirror, which will give the appearance of it being a 2 way mirror. This is meant to prevent the mirror from shattering and becoming a liability for the business.

Another technique is to shut off the lights and shine a flashlight through the mirror to see if there is anything behind it.

Once you have completed a visual and physical inspection, it is suggested to take a closer look at all suspicious objects, devices, or locations, using a few countersurveillance tools that are easy to use and best of all, affordable. They will be used to find the surveillance devices that you were unable to locate with a visual inspection.

Most long-term surveillance devices will need a way to transmit the information back to the surveyor.
Step 2: Pick Up A Camera Lens Detector
An RF detector works by scanning the area in search of devices emitting radio waves and once detected will produce an audible tone for the user that fluctuates as the device is detected closer or further away. This will continue until the user is ultimately able to locate the device emitting radio waves.

Commercial spy devices usually transmit in a range of 10 MHz to 8 MHz. Most RF detectors will detect them and scan from 10 hertz all the way to 24 GHz. Professional Grade RF detectors have an even broader RF range in addition to a ton of specialized features. However, these devices are expensive and could cost hundreds or even thousands of dollars.

Your specific situation will determine the level of detection you would need. The average person using an RF detector to simply sweep a hotel room or an AirBnB room can get away with a simple device that will detect and locate unknown RF transmissions. You can purchase a quality , such as the one below, that will get the job done for a little over $100.

RF detectors will only detect wireless devices that transmit information.

What about stand-alone devices that save the information to an SD card?

For that, it would be beneficial to have a camera lens detector at your disposal.
Step 3: Turn Off All Emitters Before Sweeping
A camera lens detector works by detecting the reflection of light off of the lens of a recording camera.

When using a camera lens detector, the lens of a camera will sparkle or illuminate on the viewing screen indicating to the user that a camera may be present.

If you are looking for an all-in-one device that has the ability to detect both RF and a camera lens, the Lawmate Defender DD802 would be an excellent choice. This is a professional grade device that will be very effective in detecting and locating both RF and camera lenses.

Step 4: Conduct Your Sweep "Painting" The Walls
Before beginning your sweep with an RF detector, it is important for you to ensure all devices that could possibly emit an RF signal be fully and completely powered down.

Be sure to power down all cell phones, Bluetooth devices, laptop computers, tablets, etc.

It is also a good idea to test your RF detector before your sweep by turning it on and sweeping over your cell phone. If your RF detector is able to detect the frequency being emitted from your cell phone, it is functioning correctly.

Pick the edge of one of your quadrants and start "painting" the walls.
Step 5: "Paint" The Walls Using A Camera Lens Detector
"Painting" the walls simply means to slowly and methodically walk up and down the walls and scan them visually and with your RF detector in a painting motion.
Step 6: Turn Off The Lights
While completing this process, you should also be visually inspecting the walls looking for any sort of disturbances or unusual anomalies, while at the same time keeping an ear out for your RF detector.

You will paint the walls until you have reached the end of your quadrant. If nothing was detected on that pass, you should mark that quadrant clear for any transmitting devices and move to the next one.

Step 7: Use Your Phone
Following the same "painting" method as before, repeat the same process in each quadrant using your camera lens detector.

Turn off the lights and look for any tiny lights that seem out of the ordinary.

Most spy cameras have indicator lights that will tell the user if the camera is recording or powered. If the surveyor neglected to turn these indicator lights off, you can use their mistake to your advantage by easily detecting and locating them.

What About Thermal Detection?
In order to record video at night, most spy cameras will need some type of Infrared (IR) technology to effectively illuminate the scene digitally so that the footage being recorded is visible in complete darkness.

True Infrared Radiation (IR) lighting is ideal for use in covert surveillance because it is not detectable by the human eye. The visible wavelengths are from approximately 390 to 700 nm while the Infrared spectrum range is 700 nm to 1000000 nm.

One quick and cost-effective way to detect IR light is by using the front-facing camera on your phone.

Unlike the rear-facing camera, the front-facing camera does not have an IR filter and can easily pick up IR lights in the dark.

To try this at home, grab your TV remote, which uses IR light to send information to your TV and open the front-facing camera on your phone. Next, point the front end of the remote at the camera and press any of the remote buttons. The IR light that is normally not visible will be completely visible on your camera screen. IR light is easy to conceal and hide from unsuspecting victims of surveillance. Keep this in mind when conducting your sweep.
What To Do If You Locate A Surveillance Device:
One more device to be aware of that will aid in the detection of surveillance equipment is a thermal imaging camera.

Any type of surveillance device, whether it is video, audio, or IR, it will emit some sort of heat signature that would be easily detected with a thermal imaging device.

Most surveillance cameras emit a fair amount of heat due to their small size and the fact that they are normally enclosed in something discreet that does not provide much ventilation.

FLIR® offers an outstanding device called the , that connects to your smartphone and allows it to be used as a thermal imaging camera.

A thermal imaging camera device like this will help you locate hot spots in the room directly on your phone.

If you locate a hot spot behind a wall, a picture, a smoke detector, or behind any other device or location that seems unusual or peculiar, you should be able to detect the anomaly. At that time, it would be appropriate to take a closer look and inspect for surveillance devices.

If you do encounter a surveillance device, do not disturb it. Immediately walk out of view of the camera and call the authorities.

Most of the newer surveillance cameras use motion detection with a loop-recording feature for the SD card. There have been quite a few cases of the perpetrator inadvertently recording themselves placing and walking away from the device because of this feature.

By staying out of the camera view, you reduce the chance of recording over any of the old footage should the SD card become full. If the perpetrator did record themselves on the camera, it is obviously best to minimize the chance of that footage becoming recorded over.

You may ask yourself what are the legalities of a hidden camera? Check out this post for more info.

I hope you find this blog useful. If you have any questions or comments feel free to leave a comment below.

# data[].attributes.attachment_link.title
How to Find Hidden Cameras and Spy Bugs (The Professional Way) - Sentel Tech Security

# data[].attributes.attachment_link.description
How to Find Hidden Cameras and Spy Bugs (The Professional Way) is an in depth guide on how to find and identify hidden cameras, GPS trackers, and secret audio bugs.

# data[].attributes.headline
How to secure yourself in a digital world

# data[].attributes.subject
How to secure yourself in a digital world

# data[].attributes.attachment_link.description
This post will focus on the following areas: Relevant Software Applications, Operating System Settings, Devices, Browsing Habits, and Online Accounts. Relevant Software Applications Install,...

# data[].attributes.headline
Tracking Illicit Transactions With Blockchain

# data[].attributes.subject
Tracking Illicit Transactions With Blockchain

# data[].attributes.attachment_link.readable_text
In recent years, cryptocurrencies such as Bitcoin have been used by terrorists to conduct funding campaigns, authoritarian governments to subvert its citizens' human rights, and GRU agents to hack the Democratic National Committee as well as the Clinton campaign.

Thankfully, such bad actors are not entirely anonymous, and here's why:

The blockchain, an open-source investigator's dream, cuts down on anonymity with regard to cryptocurrency use. The blockchain is a decentralized public ledger that contains every transaction ever made for a particular cryptocurrency. And while privacy coins and tumbler services complicate this matter, as a general rule, Bitcoin still dominates mainstream usage and its transactions can be traced.

In this article, I wish to provide a framework for OSINT investigators to track down transactions on the blockchain provided they have a particular address they want to look into or the date and amount of a transaction.

What You'll Need & What You'll Do

In the interest of saving time, let's say we keep on guessing block heights and try 400,000th which gets us to February 25, 2016. We now know we need to decrease the block height slightly more. Keep on inputting different block heights until you get to the first block made on February 1, 2016, which is block 396049 .
See video 1.
Now that we are on the first block of February 1, 2016, we need to go through all of the transactions for the entire day until we find transactions that match-up with 0.026043 BTC.
See video 2.
Keep on checking each block for the amount until you have gotten to the first block of February 2, 2016. This may take awhile as there are many blocks made every hour.

Eventually, you'll have flagged two blocks from that day that have roughly the amount 0.026043 - block 396060 and block 396123 . As you can see in the videos below, block 396123 has a transaction with exactly 0.026043 BTC, whereas block 396060 had a transaction for the amount of 0.02604322.
See video 3. See video 4.
Looking further into the transaction from block 396123 , at 11:13:42, 1LQv8aKtQoiY5M5zkaG8RWL7LMwNzVaVqR sent two different amounts of BTC to two addresses - 0.026043 BTC to 1NZ4MSeYcDKFiPRt8h7VK6XMhShwzhCzCp and 4.54325747 BTC to 1AK79g9gpvZ8jn2C9MsWQpijMFA5JaTdqP (click to enlarge below image):

Since 1LQv8aKtQoiY5M5zkaG8RWL7LMwNzVaVqR sent the exact amount to 1NZ4MSeYcDKFiPRt8h7VK6XMhShwzhCzCp, I think that this address is more likely to be connected to the Russian hackers than the other transaction in block 396060 .

To verify that this is the transaction referred to in the Mueller indictment, I repeated these same steps for January 31 and February 2 to make sure no other transactions resulted in the transfer of exactly 0.026043 BTC. As no others did, I feel very confident that the address 1LQv8aKtQoiY5M5zkaG8RWL7LMwNzVaVqR was used by the GRU agents in 2016.

Leave your answers in the comments below or tweet them to me at @bsmith_1853.

# data[].attributes.attachment_link.title
Tracking Illicit Transactions With Blockchain: A Guide, Featuring Mueller - bellingcat

# data[].attributes.attachment_link.description
In recent years, cryptocurrencies such as Bitcoin have been used by terrorists to conduct funding campaigns, authoritarian governments to subvert its citizens' human rights, and GRU agents to hack the Democratic National Committee as well as the Clinton campaign. Though many people utilize virtual currencies for legitimate purposes, the technology is an enticing tool for...

# data[].attributes.headline
What is Blockchain and how to deploy your own private ethereum

# data[].attributes.subject
What is Blockchain and how to deploy your own private ethereum

# data[].attributes.attachment_link.title
What is Blockchain and how to Deploy your own Private Ethereum

# data[].attributes.attachment_link.description
Blockchain is a complex topic and is difficult to learn from theory, so why not deploy our own Private Blockchain based on Ethereum for our Proof of concept. You can configure your own Private Blockchain on local network of PCs or Cloud (Amazon, Azure etc) but here we are going to use an Ubuntu machine for this purpose.

# data[].attributes.headline
Anonymous browsing guide: Silent Online Runnings in 2019

# data[].attributes.subject
Anonymous browsing guide: Silent Online Runnings in 2019

# data[].attributes.attachment_link.readable_text
As our world of tech becomes more interconnected, and messier as a result, privacy becomes a bigger concern. With tech titans such as Facebook playing fast and loose with people's data, the integrity of the companies we trust with our data has to be questioned. That's even ignoring the obvious privacy issues that come with internet service providers and government spying, too.

In this anonymous browsing guide, we're going to arm you with the knowledge and tools to protect your personal data from dubious collection practices and shady sales. After taking the steps we suggest, you'll not only be able to enjoy a more open internet, but also one in which you don't have to look over your shoulder.

Before diving into the specifics, you need to know this: there is no bulletproof way to be anonymous online. Though we're here to help protect you from the malicious data collection and exploitation that exists in our online world, the fact that you're using the internet means that you can't be safe from everything.

If you want true anonymity, close your browser and throw away your computer.

Though you can't be safe from everything, you can be safe from most things. True anonymity is a pipe dream, but you can block malicious advertisements, tracking beacons, network snooping and more. The purpose of this guide is damage control.

Why You Should Browse Anonymously

Though it's easy to chuckle at the ridiculous questions congressmen and women ask tech titans, such as Mark Zuckerberg and Sundar Pichai, they aren't on Capitol Hill without reason. Most websites, including Facebook and Google, use trackers to log how you interact with them. Those trackers can even follow you across websites.

Companies use the data to better sell advertisement space, get a hold on their demographic or just see what features may be useful on their website. Of course, the collection is usually outlined in the privacy policy and you're agreeing to the privacy policy by using the service.

It seems wholesome when put in that light. The line between simple audience research and malicious data mining is blurry, though. A viral story on Forbes, for example, shared how Target knew a young girl was pregnant before her father did.

After shopping online and buying certain products from Target, its automated system determined the girl may be pregnant and started sending advertisements to her home, where she lived with her father. Outraged, the father stomped down to Target, claiming its marketing team was encouraging his daughter to get pregnant. It turned out that she already was.

That type of data mining and profile attribution is underscored in the New York Times article "how companies learn your secrets." Marketers want the dirty details about you and they want to gather them without your knowledge. Privacy policies are hard to decipher, rife with legalese and designed to let organizations build as detailed a marketing profile about you as they want.

That's a clear violation of privacy, but it's not as egregious as the tracking the government does. In the U.S., the PRISM project caused a stir back in 2013, but no one has held the U.S. National Security Agency accountable during the six years since. Some European countries have better privacy laws, but many are just as bad if not worse.

Plus, it's creepy. Even without the world of Philip K. Dick looming above, data collection and tracking is immoral and gross. To make matters worse, even your browser tracks more data than you may think.

How Browsers Track You

Most people are familiar with cookies. On the web, cookies are meant to provide a mechanism for websites to remember information about a user and log their browsing activity. For example, cookies are used to store your email address at login or remember certain attributes about when you last browsed the website.

First-party cookies, which are made and implemented by the website you're browsing, are exclusive to the party that runs the website. That said, you'll also find cookies from third parties that track you across multiple pages. Usually, they are injected through ad networks.

For example, let's say you go to a website that had Google AdSense ads in the sidebar. You then leave that website and go to one that sells audio equipment. That company sells advertisements to Google AdSense, so, for a week afterward, you see a sale from that company before every YouTube video you watch.

In a study by Prince University, researchers found that 482 of the top 50,000 websites recorded every detail about your browsing data. That includes your name, credit card information, address, age and much more. If you want to know the details about what your browser sends, we recommend running a scan with Panopticlick.

Even without giving away personal data, you can be identified through browser fingerprinting. Your browser sends a lot of metadata with each request, including your operating system, browser plugins, screen resolution, language, platform, system fonts, time zone and more. Combined with your IP address, that can be used to determine where and who you are.

We ran a test with all privacy protection turned off for this guide. Panopticlick found that our browser fingerprint was unique among the 154,045 tests ran during the prior 45 days.

Securing Your Browser

The first step toward browsing anonymously is securing your browser. Though doing so won't protect you from the spying done by the government and your ISP, it can protect you from the malicious data collection by websites around the web.

Block Browser Data

If you want to go easy mode, it's worth it to ditch your browser and use a secure one, such as Brave. However, Chrome is still the most secure browser out of the big three, and there are tools you can install to help make it even more so.

The first tool is an ad and tracker blocker. You can read our guide to the best pop-up blockers for a full list, but we recommend uBlock Origin. It's an open source ad blocker that can be found in the Chrome, Firefox, Edge and Opera web stores. Though it does what it does well, uBlock Origin also shows the fewest number of privacy leaks out of top ad blockers.

uBlock Origin isn't the prettiest or easiest ad blocker to use, though. If you're looking for more options, read our piece on 99 free tools to protect your privacy.

There are a few other extensions you can install besides an ad blocker. For example, Privacy Badger is a tool for blocking invisible trackers across websites. It was developed by the Electronic Frontier Foundation - the creator of Panopticlick - and sends a Do Not Track signal whenever a cookie attempts to track you.

EFF also provides HTTPS Everywhere, which forces websites to load encrypted pages. Many websites default to unencrypted HTTP pages or redirect requests to unsecure domains. HTTPS Everywhere changes the requests you're sending to only load encrypted webpages.

There are a lot of privacy extensions, but most boil down to ad and tracker blocking. Experiment with different ones if you want and double-check if they're working with Panopticlick. If you don't want to go through the hassle, our recommendations should serve you well.

Hide Your Kids, Hide Your Passwords

Browsers have become more sophisticated as the number of accounts users stored with them has increased. That said, your browser's built-in password manager is the worst thing you could be using. Though Safari's integration with iCloud Keychain is better than Chrome's password storage, a dedicated password manager is better than both.

Password managers let you store, organize and fill your passwords online. They provide convenient access to your account credentials and help you stay more secure online by avoiding cybercrime. Because you have a dedicated spot to store your passwords, you can use long, unique combinations for your accounts, making it much harder for a hacker to access them.

The best password managers store your information in encrypted form, too, so it's next to impossible for a hacker to break in. Our top choice is Dashlane for its ease of use, superior password security and slew of features. You can learn more about it in our Dashlane review.

If you don't have the money, LastPass is the best free password manager. It comes close to Dashlane - you can see how close in our Dashlane vs. LastPass comparison - but, as you can read in our LastPass review, there are security breaches on record.

Erase Your Search History

There are many reasons to delete your search history - we can think of at least one - but it's an annoyance and can easily fall into the category of things you wish you did but never kept up with. Instead of doing it manually, the better option is to use a search engine that doesn't keep your history in the first place.

Search engines are among the most data-hungry services on the web, with Google being a particularly terrible offender. Privacy-focused search engines usually use Google, Yahoo and Bing to combine results and display them for you. Because nothing is gathered about you, the results aren't personalized, either.

Perhaps the most famous privacy-focused search engine is DuckDuckGo. In addition to providing its services for free, DuckDuckGo is a strong defender of privacy and has donated over $1 million to various privacy organizations over its 11 years in business. You can make it the default search option in Safari and Firefox, but, unsurprisingly, Google has not integrated it.

Securing Your Social Media

If you want to be anonymous, you shouldn't have social media. If you run a business or want to connect with friends and family, it's a necessary evil, though. Most of the steps for securing social media are the same as securing your browser, so make sure you start there.

If you're using a tracker-blocking plugin, you should be covered on social media. That said, those blockers don't protect information you willingly give away. Using social media doesn't mean everything on your account needs to be accurate. Phony security answers, birth dates and addresses are good ways to throw a wrench in the data collection machine.

There's a unique aspect to social media, though: external links. There's a ton of - wave your hands with us - fake news on social media. Though the Zuckerbergs of the world are cracking down on it, you'll still have to use your judgment to separate what's real and what isn't.

Thankfully, there are tools that can help you do that. Windscribe, which is the best free VPN, includes a tool that allows you to check links before clicking them. It will show you information like the number of ads and trackers on the page, and give you an overall score for privacy. You can learn more about that in our Windscribe review.

Securing Your Internet Connection

Now that your browser and social media are locked down, it's time to secure the source. No amount of browser extensions and tracker-blocking can protect the data that flows through your ISP and, with internet providers selling user browsing history, that's a scary thought.

Many people think using a proxy is the best way to secure your connection, usually because free ones are available. As explained in our VPN vs. proxy vs. Tor guide, proxies are best when used for low-risk web tasks where you want to mask your IP address. They're a bad option, though, because they don't provide encryption and can come with unintended consequences.

It's a better idea to use a virtual private network. A VPN secures your internet connection by encrypting the data you send and anonymizing it before moving the request to your ISP and the larger web. VPN security is a complex topic, but for the purposes of this guide, it's the best way to secure your internet connection.

The best VPN providers offer top-notch AES 256-bit encryption and strict no-logging policies. In short, instead of routing requests to your ISP's DNS servers, the requests are sent to the VPN provider for routing. Since no logs are kept there, you essentially become invisible when using the internet.

Unfortunately, it's not as simple as choosing a VPN that claims it keeps "no logs." Providers such as HideMyAss and IPVanish claimed not to, then were found to be lying in court. You can learn about those incidents in our HideMyAss review and IPVanish review.

The providers we rank highly in our VPN reviews, have proven that they don't keep logs, though. Our top pick is ExpressVPN for its ease of use, security and strong stance on privacy. You can learn more about it in our ExpressVPN review.

Final Thoughts

Though using the internet is going to compromise your anonymity, you can take steps to secure most of your personal data. The most offensive practices are cross-website tracking and data collection by ISPs and government agencies. Thankfully, you can fight against both.

Ad and tracker blockers will take you some of the way, but a VPN is an essential tool for online privacy. It protects everything at the source, so you won't have to worry about requests slipping through the cracks and exposing your identity.

What steps are you taking to protect your browsing? Let us know in the comments below and, as always, thanks for reading.

# data[].attributes.attachment_link.title
Anonymous Browsing Guide: Staying Safe Online in 2019

# data[].attributes.attachment_link.description
A very important part of staying safe on the internet is anonymous browsing. After all, if they can't find you, they can't catch you. In this guide, we explain the hows and whats, as well as the limitations, of going dark on the web.

# data[].attributes.headline
7 essential privacy settings for Chrome OS and Google Chrome

# data[].attributes.subject
7 essential privacy settings for Chrome OS and Google Chrome

# data[].attributes.attachment_link.title
7 Essential Privacy Settings for Chrome OS and Google Chrome

# data[].attributes.attachment_link.description
Using a Chromebook, but concerned about privacy? Tweak these 7 settings in the Chrome browser on Chrome OS to stay secure online.

# data[].attributes.attachment_link.description
star: A collection of awesome lists, manuals, blogs, hacks, one-liners, cli/web tools and more. - trimstray/the-book-of-secret-knowledge

# data[].attributes.headline
Hiding from the Internet Eliminating Personal Online Information Fourth Edition

# data[].attributes.subject
Hiding from the Internet Eliminating Personal Online Information Fourth Edition

# data[].attributes.headline
Countries Where You’ll Need a VPN to Bypass Censorship

# data[].attributes.subject
Countries Where You’ll Need a VPN to Bypass Censorship

# data[].attributes.attachment_link.readable_text
If you live in a country with free and open Internet, you probably take it for granted that you can open any site you want and expect that you can say whatever you want without censorship. This is not the direction the Internet is headed in, though; the number of countries implementing content filtering and censorship is actually growing.

This may be largely invisible to many travelers since a lot of the blocking tends to be related to domestic politics, but depending on the country, you may find a lot of foreign news sources and services blocked as well. Facebook and other social media are common targets, and depending on the country, many VPNs may also be inaccessible.

These controls are not impenetrable, however. Many countries' blocking measures can easily be bypassed by connecting to a VPN outside the country. Of course, many countries with restrictive Internet policies also take a dim view of VPNs and try to block them and/or outlaw them, but short of blocking the entire Internet and forcing the country to use a domestic intranet instead, there's no way for them to catch everything.

Technically, you should have a VPN no matter which country you're in, since it helps secure your data when you're on a public connection, can help you access geoblocked content, and keeps your browsing private, but if you're visiting any of the below countries, a VPN is an extra-good idea.

Related: The Best Secure VPNs You Should Use in 2019

China

What's blocked: Many major apps and web services, from Google to Discord, are inaccessible.

Surveillance: Very high.

VPN legality: Only government-approved VPNs allowed (they keep logs), but this is loosely enforced.

You probably knew this one already. China's " Great Firewall " has essentially fueled the development of a whole separate Internet ecosystem, with Chinese apps and services replacing their blocked counterparts. Visitors to China will definitely need a VPN if they want to continue using services from their home country. Non-approved VPNs are technically not allowed, so it would be wise to double-check that whatever VPN you choose to use is guaranteed to work.

Russia

What's blocked: LinkedIn, Telegram, and other sites that got on the government's bad side.

Surveillance: Very high.

VPN legality: Non-approved VPN users/providers may be fined.

The Russian Internet is gradually becoming more closed: the government habitually blocks sites and services it doesn't like (most famously LinkedIn and Telegram) and does not allow unapproved VPNs to be operated or used. Plans for a China-like closed-off Russian Internet are currently in discussion, as are increasingly restrictive laws concerning user data, VPNs, and encryption.

Iran

What's blocked: Most major services and apps, as well as some keywords.

Surveillance: Very high.

VPN legality: Non-approved VPN users may get jail time, but this is mostly enforced on political dissenters.

Iran is a fairly closed-off country in many ways, and their Internet is no exception. They maintain a large list of blocked foreign content, banned for moral and political reasons, and also censor content based on certain keywords that it doesn't like. This can result in some unintended consequences, such as the banning of sites containing the word "embassy" due to "ass" being part of the word. They have their own domestic intranet, which is much cheaper than foreign Internet access, and throttle users' speeds down to a few megabits per second, both frustrating users and making it easier for them to conduct deep surveillance. Technically, accessing a non-approved VPN is illegal, but this rule is usually enforced as a way to suppress political dissent.

Related: Not All VPNs Are Safe - How to Tell If a VPN Is Secure

Saudi Arabia

What's blocked: A rotating list of websites and services, particularly ones critical of the Saudi government.

Surveillance: Very high.

VPN legality: Not illegal, but may be blocked

Saudi Arabia censors a lot of content, much of it reported by its own citizens for being immoral or politically dissident, though popular services such as Skype and WhatsApp have also been banned at certain times. All its traffic is routed through a single main hub, where it is filtered by IP, domain, and keyword. Using a VPN shouldn't raise any legal issues, but the government would naturally prefer that you not circumvent its measures, so they block many VPNs as well.

Pakistan

What's blocked: Politically dissident and "immoral" content, occasionally including social media.

Surveillance: High

VPN legality: Legal

Pakistan filters a lot of sites based on keywords as well as blocking individual addresses. Most major foreign services, like YouTube and Facebook, are usually accessible, but have been blocked in the past.

Turkmenistan

What's blocked: A lot. Most social media is inaccessible, alongside dissident websites and news media.

Surveillance: High.

VPN legality: Mostly blocked, probably illegal, but many still work.

This central Asian country doesn't get a lot of attention, but it runs a fairly authoritarian (and expensive!) Internet regime. A lot of major foreign websites are blocked, and the government continues to add sites to the list as it finds new unapproved content. Travelers should be safe using VPNs, but the government has expressed a desire to crack down.

(Dis)honorable mentions

Vietnam: Ranks very low on measures of Internet freedom but doesn't block outside content as much as it does domestic political content.

Syria: Very authoritarian Internet policies, even blacking out the Internet for the whole country at times, but it's not much of a travel destination at the moment.

Uzbekistan: Very much not free Internet, but it doesn't block much outside content.

North Korea: It's not so much censorship as it is "no Internet." Most of the country can't even get on the outside Internet, and not many people travel there. Even if you were to go, using a VPN might not be advisable.

Finding the right VPN

Every country uses different filtering software and blocks different things, so a VPN that works in one may not work in another. If you're travelling to a country that you know has strict Internet controls, you'll want to look for a VPN that has been specifically tested and shown to work in that country (like ExpressVPN and NordVPN). Many of these countries also engage in high levels of Internet surveillance and may or may not impose penalties on VPN use, though, so be sure you know about local laws before you try getting online. It's unlikely that travelers using VPNs could be identified since the traffic should be encrypted and anonymous, but long-term residents and locals should take care.
Image credits: Freedom House Freedom on the Net Report 2018
Is this article useful? Yes No

# data[].attributes.attachment_link.title
Countries Where You'll Need a VPN to Bypass Censorship - Make Tech Easier

# data[].attributes.attachment_link.description
If you live in a country with free and open Internet, you probably take it for granted that you can open any site you want and expect that you can say whatever you want without censorship. This is not the direction the Internet is headed in, though; the number of countries implementing content filtering and censorship is actually growing.

# data[].attributes.headline
Cyber Analyst SOC Sherpa. Your guide up a mountain of information!

# data[].attributes.subject
Cyber Analyst SOC Sherpa. Your guide up a mountain of information!

# data[].attributes.attachment_link.description
Read writing from InfoSecSherpa on Medium. Cyber Analyst SOC Sherpa. #Librarian turned #InformationSecurity professional. SANS #GSEC certified. Your guide up a mountain of information!.

# data[].attributes.attachment_link.readable_text
The revelations that Facebook had lazily slathered user data around, and that Cambridge Analytica had weaponized it, shocked the world in 2018. It will likely be a turning point for how all of us think about sharing data online, but despite the discussions raised about privacy, we're still not talking about a bigger problem: the very news sites reporting on these scandals are slathering your movements online everywhere.

It's been great to watch the media start taking data breaches seriously, and begin reporting on it regularly, but the hypocrisy is flabbergasting. Most news companies, including the startups, send information about you to a slurry of ad networks, social networks, and other platforms, while simultaneously telling you about the importance of privacy.

Here's an example: The Verge, reporting in February about app makers sharing personal information with Facebook but not telling their users sends information about you to more than 90 unique domains when you open it. Why does it need to do that? It's unclear from the Vox website what purpose these tags serve, or how they affect me as a user-it just all happens transparently behind the scenes.

The list includes Facebook, Twitter Ads, Outbrain, Amazon Ads, Google Ads, Scorecard Research and many more. The irony is palpable, but do they care? I'll go out on a limb here and say that the money they get from ads is more important.

When you're signed into your Facebook account, or any other social media tool, this practice allows these companies to associate your travels around the web with your profile. Facebook then knows what you're reading, the products you're looking at, or the topics you're interested in-and the news sites are just giving it to them directly.

This is when I started wondering: how do the other big players reporting on these big data breach stories fare? Here's a short sample of how these sites are doing, and the worst of the bunch:

The New York Times' original story about Cambridge Analytica, blowing the lid off the scandal: 30 trackers, including Yahoo, Facebook, Twitter Ads, Google Ads, Pinterest, Oracle, and, strangely enough, Snapchat. Here's your data breach, served with an extra side of tracking!

The Guardian's story, launched alongside the NYT coverage, about the same scandal: 22 trackers including Facebook, Twitter Ads, YouTube, Scorecard Research, Google Ads and so on. Irony, truly, given the content of the story.

The UK's Channel4, which worked with The Guardian and NYT to launch the coverage: 13 trackers, the lowest I could find, and including only Google Analytics, Scorecard Research and a handful of smaller companies. The only player not sharing information with Facebook or the other social media companies.

What astounded me is that it's impossible to evade these social networks' reach while reading the news, and it's incredibly difficult to actually tell that these websites are receiving the data when you read them. Would the average user know that The New York Times is helping Facebook build a habit profile? Absolutely not.

It's even more disappointing that the technology media, which should lead the way in this debate, is staying incredibly quiet about this. A precursory look at the trackers used by the top 15 technology publications as listed by Techmeme is revealing:

Click image for live spreadsheet

When I finished this, it was something of a holy shit moment for me. Across these sites, only two didn't send data to Facebook, and all but one send information on visits to Google in some form (be it DoubleClick, Google Analytics, or even just Google Fonts). I also learned that ScorecardResearch is used ubiquitously, and is the third most common tracker on the web... despite it being incredibly unclear what news publishers stand to gain from it.

The web is sick and we need to fix it. I'm not saying that all trackers are bad-there are some genuinely useful ones, and I use a small handful such as Google Analytics-but I'd bet that if visitors knew just how much data they were leaking to other sites, they'd be appalled.

I know how these business models work, and what makes them tick (which is why I made a paid subscription instead of running advertising), but it just can't keep going like this: users deserve and want better from the industry. Techmeme, interestingly enough, just launched non-invasive advertising that actually seems to work, so it's not like there aren't other ideas out there.

It's particularly shocking, because I view these sites as the leaders in technology, but yet they're leaning on shady trackers and sharing data to make their business models work. I don't want Facebook building a shadow profile of my habits, and I'd assumed it wasn't happening as much in this industry.

Perhaps tracking data is the next digital oil spill. What happens when it leaks? I only looked at the top websites, but if these are the absolute best foot forward for the industry, I hate to think what the lower-end, smaller websites are doing with trackers.

So, what can you do? Well, for one, pressure your favorite sites to offer a way to pay and remove the advertising/trackers! If that doesn't work, use an extension like Disconnect or uBlock to remove trackers, or go for the full nuclear effect and install a network-wide blocker like Pi-Hole.

But, just know this: until publisher habits change, or there's external motivators from readers like you and me, they'll keep slathering on the trackers. Why not? It doesn't seem to hurt anyone, right?

# data[].attributes.attachment_link.title
Reading about privacy breaches? News sites are tracking your every...

# data[].attributes.attachment_link.description
The revelations that Facebook had lazily slathered user data around, and that Cambridge Analytica had weaponized it, shocked the world in 2018. It will likely be a turning point for how all of us think about sharing data online, but despite the discussions raised about privacy, we're still not talking about a bigger problem: the very news sites reporting on these scandals are slathering your movements online everywhere.