Tag Archives: Cyber Security

User Privacy: Chrome Floc is going to block third party cookies. Not good for ads business

Abstract

If Google sticks to its roadmap, by this time next year Chrome will no longer allow websites to use third-party cookies, which are cookies that come from outside their own domains. The change theoretically makes it vastly more difficult for advertisers to track your activities on the web and then serve you targeted ads.

Because of course Google doesn’t want to kneecap the online ad industry — the one it dominates and from which it makes all its money. Instead, Google wants to replace the third-party tracking cookie with a complicated set of (bird-themed) technologies that are meant to let ad companies target specific demographics like age and location, while at the same time allowing the people who are targeted to remain anonymous. 

Read more in

Good Read: API First Security Strategy

Every software in the world is either an API or uses API. API (Application programming interface) has enabled the world to connect digitally and advances the broader use of IoT devices.

As APIs’ popularity rises, so does their prevalence as an attack vector for cybercriminals because bad actors have always loved the most target-rich technologies. Gartner forecasts that APIs will become the most common attack vector by next year. Yet despite higher awareness of the need for API security, breaches continue to happen.

Abstract

What does an API-first security strategy look like? Here are five observations:

1. High visibility is crucial. An API-first approach is all about acknowledging the API as a first-class citizen in an application’s design. Given the increase in vital work that the API does in communicating between applications, APIs must have the same scrutiny of access controls that a superuser (e.g., an IT administrative specialist with unlimited privileges) would.

2. REST APIs are a growing target. REST (REpresentational State Transfer) is the duct tape of technology — it defines how systems can be connected to (and interact with) each other by using HTTP requests to access and use data. REST API usage has become so widespread in enterprise application development that many companies have difficulties defining a clear picture of all their deployments. These visibility gaps make APIs harder to protect.

3. Encryption of all data is key. This is true not just when data is at rest, but also in transit. In this encryption scenario, the API would use TLS and authorization tokens to transmit data securely, and the data that the API is accessing should also be encrypted.

4. Credential stuffing is still a huge problem and an evolving threat. Credential stuffing is the practice of using an automated injection of stolen credentials to gain unauthorized access. Companies have gotten better at securing their front-end applications and webpages to defend against credential stuffing. Still, hackers increasingly have been targeting back-end APIs that historically tended to have fewer implemented security controls.

5. Automated checks should be standard practice. I’m seeing how rarely I see automated security checks as part of a CI/CD pipeline, if they are implemented at all. A mature application security team should work with the engineering squads to design and incorporate security into pipelines and allow an organization to scale security with its product offerings.

Reference

https://www.darkreading.com/application-security/5-objectives-for-establishing-an-api-first-security-strategy/a/d-id/1340622?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New Form of terrorism: a hacker tried to poison the drinking water

A hacker gained entry to the system controlling the water treatment plant of a Florida city of 15,000 and tried to taint the water supply with a caustic chemical, exposing a danger cybersecurity experts say has grown as systems become both more computerized and accessible via the internet.

The hacker who breached the system at the city of Oldsmar’s water treatment plant on Friday using a remote access program shared by plant workers briefly increased the amount of sodium hydroxide by a factor of one hundred (from 100 parts per million to 11,100 parts per million), Pinellas County Sheriff Bob Gualtieri said during a news conference Monday…..

….

Fortunately, a supervisor saw the chemical being tampered with — as a mouse controlled by the intruder moved across the screen changing settings — and was able to intervene and immediately reverse it, Gualtieri said. Oldsmar is about 15 miles (25 kilometers) northwest of Tampa.

Read more in

https://apnews.com/article/hacker-tried-poison-water-florida-ab175add0454bcb914c0eb3fb9588466

CyberNews: 533 million Facebook users’ phone numbers leaked on hacker forum

The mobile phone numbers and other personal information for approximately 533 million Facebook users worldwide has been leaked on a popular hacker forum for free.

The stolen data first surfaced on a hacking community in June 2020 when a member began selling the Facebook data to other members. What made this leak stand out was that it contained member information that can be scraped from public profiles and private mobile numbers associated with the accounts. Read more in

The initial sale of Facebook data in June 2020

Read more in

All about Faraday Bags: Faraday bags is a way to protect phone from any hack

A Faraday bag is a type of Faraday cage. It protects electronics from being damaged by radio frequency interference (RFI) or from an electromagnetic pulse (EMP) by not allowing radio frequency or electromagnetic pulse waves to pass through the material.

It goes by a lot of names such as RFID bag, RFID blocking bag, or EMP bag.

How a Faraday bag works?

It creates a completely enclosed space that is surrounded by a mesh of conducting materials. When an electrical field on the outside of the Faraday cage interacts with the material, it causes the charges within the protected space to be distributed in a way that cancels the effects. It also works to protect against radio frequency interference.

This way the hackers, thieves, or government agencies who are trying to track your phone or any other device will not be able to get to it because of the outer layer of the Faraday bag.

Read more in

https://privacypros.io/faraday-bags/