# data[].attributes.headline
BazarLoader Adopts New Delivery Mechanisms

# data[].attributes.subject
BazarLoader Adopts New Delivery Mechanisms

# data[].attributes.attachment_link.title
BazarLoader Adopts New Delivery Mechanisms | Cyware Hacker News

# data[].attributes.attachment_link.description
BazarLoader is using new delivery methods including compromised software installers and ISO files in its new version to avoid system detection. Click to read more!

# data[].attributes.headline
Facebook shutdown cost up to $230 million in 6 hours

# data[].attributes.subject
Facebook shutdown cost up to $230 million in 6 hours

# data[].attributes.attachment_link.readable_text
For six hours Monday afternoon, Facebook and its subsidiaries Instagram and WhatsApp disappeared.

The Facebook webpage said it could not locate its server. Instagram's app showed no content. WhatsApp would not connect.

The economic results could have been significant.

An online tool jointly developed by the nonprofit Internet Society and NetBlocks, a global internet monitor, estimated that the shutdown - lasting from the moment Facebook went offline just before noon Monday, to when it came back close to 6 p.m. - cost the United States' economy more than $230 million.

The Cost of Shutdown Tool, its creators say, is based off the research of the Brookings Institute, a public policy think tank, as well as open-source data from the World Bank, United Nations and European Statistical Office.

As a free service, Facebook makes much of its money selling advertisements that display on its website, or on Instagram. A company or political party might purchase ad space from the social media giant, which will then put the buyer's content in front of users as they scroll through their feeds.

Thus, when Facebook goes offline, not online is it losing its own revenue - it is also costing those who count on the public to see their advertisements.

Outside the U.S., the effects of losing WhatsApp could have been even further reaching. Many individuals and services from pharmacies to nonprofits protecting domestic abuse victims rely heavily on the messaging app, the New York Times reported.

Issues began at Facebook around 11:45 a.m. with the disruption of its main website, in addition to the Instagram and WhatsApp applications, both of which the company owns.

Facebook tweeted - Twitter, owned by a different company, remained online - a short while later that it was aware of the issue and working to fix it.

Speculation was rampant of why Facebook was offline. Was it a routing issue, in which the digital pathway to Facebook's servers had been deleted? Was it a hack?

For the company, it continued a difficult stretch of 24 hours. The previous evening, a whistleblower asserted on 60 Minutes - with the backing of tens-of-thousands of pages of internal Facebook documents - that the company was aware of a disastrous effect it had on global democracies and mental health of young people, yet chose repeatedly to downplay the issues in search of profits.

At Facebook, stock dropped by 5% as the shutdown of its services dragged on. For its founder, Mark Zuckerberg, that meant a loss of more than $6 billion.

# data[].attributes.attachment_link.title
Facebook shutdown cost up to $230 million

# data[].attributes.attachment_link.description
For six hours Monday afternoon, Facebook and its subsidiaries Instagram and WhatsApp disappeared. The Facebook webpage said it could not locate its server. Instagram's app showed no content. WhatsApp would not connect. The economic results could have been significant.

# data[].attributes.headline
'Waning immunity?' Some experts say term leads to false understanding of COVID-19 vaccines

# data[].attributes.subject
'Waning immunity?' Some experts say term leads to false understanding of COVID-19 vaccines

# data[].attributes.attachment_link.readable_text
The idea of waning immunity has picked up steam in recent weeks, with some countries using it to justify rolling out third-dose COVID-19 vaccine boosters to their populations. But immunologists say the concept has been largely misunderstood.

While antibodies - proteins created after infection or vaccination that help prevent future invasions from the pathogen - do level off over time, experts say that's supposed to happen.

And it doesn't mean we're not protected against COVID-19.

Jennifer Gommerman, an immunologist with the University of Toronto, said the term "waning immunity" has given people a false understanding of how the immune system works.

"Waning has this connotation that something's wrong, and there isn't," she said. "It's very normal for the immune system to mount a response where a ton of antibodies are made and lots of immune cells expand. And for the moment, that kind of takes over.

WATCH | Waning immunity sparks debate about need for COVID-19 booster shots:

"But it has to contract, otherwise you wouldn't have room for subsequent immune responses."

Antibody levels ramp up in the "primary response" phase after vaccination or infection, "when your immune system is charged up and ready to attack," said Steven Kerfoot, an associate professor of immunology at Western University in London, Ont.

Memory of pathogen remains

They then decrease from that "emergency phase," he said. But the memory of the pathogen and the body's ability to respond to it remain.

Kerfoot said B-cells, which make the antibodies, and T-cells, which limit the virus's ability to cause serious damage, continue to work together to stave off severe disease long after a vaccine is administered. While T-cells can't recognize the virus directly, they determine which cells are infected and kill them off quickly.

Recent studies have suggested the T-cell response is still robust several months following a COVID-19 vaccination.

"You might get a minor infection ... [but] all of those cells are still there, which is why we're still seeing very stable effectiveness when it comes to preventing severe disease," Kerfoot said.

A pre-print study released this week by Public Health England suggested that protection against hospitalization and death remains much higher than protection against infection, even among older adults.

So the concept of waning immunity depends on whether you're measuring protection against infection or against severe disease, Kerfoot said.

Ontario reported 43 hospitalized breakthrough cases among the fully vaccinated on Friday, compared with 256 unvaccinated hospitalized infections. There were 795 total new cases in the province that day, 582 among those who weren't fully vaccinated or had an unknown vaccination status.

British Columbia, meanwhile, saw 53 fully vaccinated COVID-19 patients hospitalized over the last two weeks, compared with 318 unvaccinated patients.

"You'll hear people say that vaccines aren't designed to protect infection, they're designed to prevent severe disease," Kerfoot said. "I wouldn't say necessarily it's the vaccine that's designed to do one or another ... that's just how the immune system works."

Moderna, Pfizer back need for booster

Moderna released real-world data this week suggesting its vaccine was 96 per cent effective at preventing hospitalization, even amid the more transmissible delta variant, and 87 per cent effective at preventing infection - down from 94 per cent efficacy seen in clinical trials last year.

Moderna CEO Stéphane Bancel said that dip "illustrates the impact of waning immunity and supports the need for a booster to maintain high levels of protection."

Pfizer-BioNTech has argued the same with its own data, and an advisory panel to the U.S.-based Food and Drug Administration voted Friday to endorse third doses for those aged 65 and older or at high risk for severe disease.

However, the panel rejected boosters for the general population, saying the pharmaceutical company had provided little safety data on extra jabs.

The University of Toronto's Gommerman said the efficacy data presented by Moderna doesn't signal the need for a third dose.

"The fact it protects 87 per cent against infection, that's incredible," she said. "Most vaccines can't achieve that."

Bancel said Moderna's research, which has yet to be peer reviewed, suggested a booster dose could also extend the duration of the immune response by re-upping neutralizing antibody levels.

Looking beyond the antibody response

But Dr. Sumon Chakrabarti, an infectious disease physician in Mississauga, Ont., said looking solely at the antibody response is misleading and could be falsely used as justification for an infinite number of boosters.

Israel, which has opened third doses for its citizens, recently talked about administering fourth doses in the near future.

"This idea of waning immunity is being exploited, and it's really concerning to see," Chakrabarti said. "There's this idea that antibodies mean immunity, and that's true ... but the background level of immunity, the durable T-cell stuff, hasn't been stressed enough."

While some experts maintain that boosters for the general population are premature, they agree some individuals would benefit from a third jab.

The National Advisory Committee on Immunization has recommended boosters for the immunocompromised, who don't mount a robust immune response from a two-dose series.

Other experts have argued that residents of long-term care homes, who were prioritized when the rollout began last December, may also soon need a third dose. The English study suggests immunity could be waning in older groups but not much - if at all - among those under age 65.

Chakrabarti said a decrease in protection among older populations could be due more to "overlapping factors," including their generally weaker immune systems and congregate-living situations for those in long-term care.

Immune cells live for years within bone marrow

"These are people at the highest risk of hospitalization," he said. "Could [the length of time that's passed following their doses] be playing a role? Yeah, maybe."

While we still don't know the duration of the immune response to COVID-19 vaccination, Gommerman said immune cells typically continue to live within bone marrow and make small amounts of antibodies for "decades."

"And they can be quickly mobilized if they encounter a pathogen," she said.

# data[].attributes.attachment_link.title
'Waning immunity' term can lead to false understanding of COVID-19 vaccines, experts say | CBC News

# data[].attributes.attachment_link.description
The idea of waning immunity has picked up steam in recent weeks, with some countries using it to justify rolling out third-dose COVID-19 vaccine boosters to their populations. But immunologists say the concept has been largely misunderstood.

# data[].attributes.headline
Destruction and integrity cyber attacks on the rise

# data[].attributes.subject
Destruction and integrity cyber attacks on the rise

# data[].attributes.attachment_link.readable_text
Cyber attacks aimed at destroying or manipulating data have become more frequent during the Covid-19 pandemic, with organisations now experiencing such attacks more than 50% of the time, according to VMware's seventh annual Global incident response threat report.

Cyber criminals are launching these attacks - known as destructive or integrity attacks - by using emerging techniques that enable them to "distort digital reality", says the report.

This includes, for example, the manipulation of time stamps through Chronos attacks, or the deployment of deepfake content in business communications compromise (BCC) or business email compromise (BEC) operations, whereby attackers gain access to communication application or email accounts to impersonate the owners' identity.

"Business communication platforms are the perfect delivery mechanism for deepfakes, because organisations and users implicitly trust them and they operate throughout a given environment," said Rick McElroy, principal cyber security strategist at VMware.

"At the same time, crypto-mining technology, which draws on computing power from across a network, can easily be repurposed by cyber criminals to generate malicious deepfakes. These deepfakes can be hard to detect, and executives should have an out-of-bounds communications channel to verify the integrity of a message before they trust it."

McElroy added that, by manipulating time stamps, attackers can "disrupt entire network operations by changing the times of routers and switches, they can interrupt a defender trying to threat hunt, they can even take advantage of microtransactions before a stock dips and potentially alter the value of capital or trades".

In its latest Modern bank heists report, VMware noted that 41% of financial institutions had observed the manipulation of time stamps, while 60% of the cyber security professionals surveyed for the threat report said they had also observed such attacks.

The report, which is based on a survey of 123 cyber security professionals, said targeted victims now experience integrity and destructive attacks 51% of the time, while nearly one-third saw such attacks more than 80% of the time.

VMware attributed the uptick in integrity and destructive attacks to an increase in the use of cloud technologies and a shift to remote working environments during the pandemic.

For example, 43% of respondents said more than one-third of attacks were targeted at cloud workloads, and 22% said more than half were.

The shift to remote working and greater use of cloud has also led to an increase in attackers using the cloud to "island hop" along the victim's supply chain, which means an organisation's infrastructure is hijacked to target the intended victim. The report said 49% of all reported attacks targeted the victim this way.

"If 2020 was the year of island hopping, where cyber criminals infiltrate large company networks by targeting third parties with lower levels of protection, then we should expect cloud-jacking through public clouds to go mainstream in 2021, particularly with the mass migrations to public clouds to support distributed workforces," said Tom Kellermann, head of cyber security strategy at VMware.

As well as broadening the attack surface, the pandemic has also provided the time, capital and opportunity for cyber crime to industrialise, he added.

"These groups are collaborating on the dark web to form pseudo-legitimate businesses that sell network access points and RaaS [ransomware-as-a-service], and create affiliate programs to reward partners for assisting in malware delivery," said Kellermann.

"The activity of these groups heightens the need for proactive threat hunting and continuous monitoring to limit exposure and mitigate vulnerabilities."

In its 2021 Mid-year security report, Check Point noted that there had been a 93% surge in ransomware attacks during the first half of this year, compared with last.

It said this had largely been fuelled by a rise in "triple extortion" operations, whereby attackers, as well as stealing sensitive data from organisations and threatening to release it publicly unless a payment is made, also target the organisation's customers, vendors or business partners in the same way.

Meanwhile, the broadening of the attack surface that cyber security and incident response professionals are having to manage has seen a high proportion of them experience extreme stress or burnout.

The report noted that of the 51% of respondents who had experienced extreme stress or burnout during the past 12 months, 65% said they had considered leaving their job because of it, while 67% had had to take time off work.

"Burnout is a huge issue with incident response teams, who are handling a spike in engagements in what is still a largely remote environment," said McElroy. He added that it is more important than ever for leaders to take proactive measures to ensure teams are not only productive, but more able to withstand the stresses of the job.

"Those measures could run the gamut, from one-on-ones to hear team members out, to encouraging them to take leadership and professional development courses, to adopting non-standard activities such as walking meetings and mindfulness training," he said.

"On the technical side, give your team the time to operationalise a piece of technology before implementing a new one, offer real breaks, and consider rotations of work that assure individuals that their careers are progressing."

# data[].attributes.attachment_link.title
Destruction and integrity cyber attacks on the rise

# data[].attributes.attachment_link.description
Cyber attacks aimed at destroying or manipulating data have become more frequent during the Covid-19 pandemic, with organisations now experiencing such attacks more than 50% of the time, according to VMware's seventh annual Global incident response threat report.

# data[].attributes.headline
The personal data of 38 million people has been exposed following a breach of Microsoft’s PowerApps.

# data[].attributes.subject
The personal data of 38 million people has been exposed following a breach of Microsoft’s PowerApps.

# data[].attributes.attachment_link.title
Microsoft software breach makes millions of users' data vulnerable

# data[].attributes.attachment_link.description
Some 38 million pieces of personal data and information were badly kept due to a configuration defect in a software.

# data[].attributes.headline
IndiaMART seemingly has had a data leak where over 38 million records of its users were up for grabs on a forum

# data[].attributes.subject
IndiaMART seemingly has had a data leak where over 38 million records of its users were up for grabs on a forum

# data[].attributes.attachment_link.readable_text
Agencies
Listing services like IndiaMART give out personal data of their customers with the intent to connect the right buyers to suppliers, but such data in aggregate terms does pose threats of serious misuse.

India's largest B2B marketplace,

seemingly has had a data leak where over 38 million records of its users were up for grabs on a forum.

On Monday, Troy Hunt, creator of data-breach record index Have I Been Pwned, put out a tweet asking for the coordinates of the security contact at IndiaMART.

When ET Primereached out to Hunt, he revealed that he came across a huge data dump two days ago and had immediately contacted the company via Twitter and Facebook, as there doesn't seem to be a direct point of contact at IndiaMART for such incidents.

Hunt sent IndiaMART a message saying, "A huge amount of data allegedly taken from your system is presently being circulated in hacking forums. On initial review, I believe it's likely you've had a significant data breach." However, he got a very non-committal response.

This would be the second time since 2020 that the company has come under the radar for having its users' data dumped on cybercrime forums. Last year in June, a data breach of over 40,000 suppliers on IndiaMART was reported by threat-monitoring platform CloudSEK.

ET Prime reviewed the forum where the data dump was shared and saw that a post titled 'indiamart.com 38 million business data' was put up by an individual on August 20 along with a link to the entire data set.

The post read: "Details Include: first_name, last_name, designation, email1, email2, company_name, country, add1, add2, city, locality, landmark, state, zip, website, glusr_usr_ph_area, glusr_usr_ph_number, glusr_usr_ph_mobile, glusr_usr_ph_mobile_alt, glusr_usr_mobile_country, mobile1, contact_address, city_state_zip."

A snippet from the data set shared by Hunt shows that information like phone numbers, e-mail addresses, company name, and contact addresses, were a part of the data set.

By the time ET Prime saw the post, the data set was removed from the forum.

Hunt, who went through the entire data set, said that there were over 38 million records,which contained 20 million unique e-mail addresses. While ET Prime could not independently verify whether the data belonged to IndiaMART users or not, Hunt says that he sees a lot of reference to the word

'Indiamart' in the data set in different places. "I see 'Indiamart' everywhere from the domain of e-mail addresses to a lot of people using 'Indiamart' as the alias of their e-mail address with their own custom domain, which is not unusual; I've done the same thing with my domain."

Hunt explains that websites have enumeration vectors, like features of the website where a user can ask whether an e-mail address exists on the servers or not, and these are the most convincing in terms of verification of the source of data. "For example, if you go to the password-reset feature and put in an e-mail address that doesn't exist on a service, you get a response that says, 'This email address doesn't exist', and if you enter one that does exist, it says, 'We've just sent you an e-mail to receive a password'."

After testing several e-mail addresses with the 'password-reset feature' from the data set, Hunt says he got many hits, which suggests that the data set has accounts that do exist on the website.

Data breach, theft or scraping?

IndiaMART denies any data leak or breach. "We would like to confirm that our preliminary investigation into the alleged data leak suggests that there was no leakage.Further, we would like to clarify that sellers'/users' basic contact information like phone number, postal address, company details, are public information and are advertised on the website www.indiamart.com, like any other printed directory, Internet portals, and search engines. There is no sensitive personal information of the seller that is displayed on the platform. IndiaMART believes in the safety and security of its

and is heavily invested in technology to protect its database. Further, our data framework and information-security management system are in accordance with the internationally recognised ISO 27001:2013," an IndiaMART spokesperson says.

Hunt says that while a lot of personal-user data is available, the data dump does not contain passwords. "Lots of data breaches expose passwords and I don't see that here, which does raise some interesting questions in terms of how this information is obtained."

IndiaMART, being a listing platform, has the contact details of its customers visible on its website for anyone who may want to reach out to the company, but having such a huge pile of data readily up for grabs raises concerns on whether there was a data breach, or someone internal actor stole and dumped the data, or whether a third-party actor scraped the data from the website itself.

Data scraping or Web scraping is the process of extracting large data from websites on to a spreadsheet. It is usually done for the purpose of research and analysis, but scraping confidential information from a site and selling to others for a profit is illegal.

Listing services like IndiaMART give out personal data of their customers with the intent to connect the right buyers to suppliers, but such data in aggregate terms does pose threats of serious misuse.

From identity theft to precise phishing attacks, once such data is leaked in bulk, it continues to be churned in the alleys of the Dark Web or cybercrime forums, as it is not an exhaustive commodity. This can also be bad for IndiaMART's own business, as a list of its customers can be sold to competition, leading to loss of market share.

# data[].attributes.attachment_link.title
Data breach or data scraping? With over 38 million records up for grabs, IndiaMART has some answering to do

# data[].attributes.attachment_link.description
India's largest B2B marketplace, seemingly has had a data leak where over 38 million records of its users were up for grabs on a forum. On Monday, Troy Hunt, creator of data-breach record index Have I Been Pwned, put out a tweet asking for the coordinates of the security contact at IndiaMART.