3 Steps to Stop Departing Employees from Pocketing Your Data

It takes more than policies to prevent staffers from taking customer information, price lists, marketing plans, sales data, and competitive intelligence when they leave for greener pastures.

Consider Sandra – a hypothetical marketing executive who has worked for the same company for over a decade. When Sandra joined the firm, she brought hundreds of documents --business cards, phone numbers and notes – that she added to her new employer’s customer relationship management software. When she decided to leave, she believed she was entitled to take the entire database with her. Not true. 

According to David A. Smith, a CISSP, in a recent whitepaper, How UEBA mitigates IP Theft By Departing Employees, while employees like Sandra may believe that they have a legitimate claim to customer information they brought in and personally worked cultivating, "all the information in the CRM actually belongs to the employer" and the transfer of an employer’s "valuable and confidential digital assets is theft."

While this particular incident is hypothetical, similar situations – whether inadvertent as Sandra’s situation was or deliberate – happen far too often. For example, a recent security survey showed that 87% of departing employees take data they worked on, including confidential customer information, price lists, marketing plans, sales data, and competitive intelligence; 28 percent take data created by others. The loss of this intellectual property (IP) can be devastating.

So, what steps can you take now to prevent this type of theft when employees decide they’re ready to move on? 

1. Establish – and Enforce - Corporate Policies:

While some employees who share proprietary data with outside sources or take it with them to their next place of business might do so maliciously, others might simply be unaware that it doesn’t belong to them. Having a strong, plainly written Confidentiality and Intellectual Property Agreement in place can help to alleviate the gray areas that exist when employees involved in the creation of IP perceive they have an ownership stake in it; reviewing that Agreement with an employee when they are departing acts as something of a deterrent against IP leaving with them. (See the white paper, 3 Steps to Protect Your Data During The High Risk Exit Period)

Ensure that the confidentiality and IP agreements outline what data employees can take with them when they leave and what needs to stay behind, as well as any consequences for its removal. And ensure that the document is written in terms that people who do not work with legal contracts as part of their everyday role will readily understand. 

2. Monitor Behavior:  

While it’s possible for humans to get an idea of when changes in an employee’s behavior might indicate an increasing probability of IP theft, it would be "impractical, if not outright impossible, for an organization’s cybersecurity staff to observe and monitor each employee," Smith wrote. Instead, companies should implement technology such as user and entity behavior analytics (UEBA) – with advanced machine learning algorithms –  to help define what is normal behavior for each user so any anomalies will be easier to detect and investigate.

UEBA compares each user’s real-time activities against their recorded behavior baseline, and alerts the designated response team (likely cybersecurity) so it can investigate more closely. When coupled with user activity monitoring (UAM) software, security can see if the employee is emailing or otherwise transferring data he doesn’t normally transfer, is downloading lists onto external devices,or is logged into the IT server at 2 a.m.

To help with this process, the insider risk team should quantify employee risks, giving employees a score of 1 to 10. For example, some employees may have a low score, meaning they do not need to be monitored as closely because they do not have access to as much proprietary information, and higher level executives (even security itself) a high score, meaning they should be monitored more closely. When employees tell their managers or HR that they’re planning to leave, the risk score should be set to 10, triggering a review of 30 days worth of online and communications activity. The 30 days leading up to notice of resignation is the high-risk exit period during which IP is most at risk.

3. Limit Data Access: 

Only give employees access to data they need to do their jobs. This will keep them from accessing other corporate information, and, according to Smith, "in most cases it will also prohibit the installation of any hardware or software that can be used for the exfiltration of data (i.e., being able to transfer files to cloud storage, or to copy data to a thumb drive).” To prevent users from transferring data they shouldn’t, the organization should also consider configuring firewalls that block malicious websites or those which can be used to transfer data, encrypting all data at all stages of storage and transport, and requiring user authentication to utilize encrypted data.

Fortunately, having strict policies in place, and communicating these policies (and any consequences for breaking them) will deter many departing employees from taking datathat doesn’t belong to them. However, being able to analyze employee actions and behavior, detect whether any anomalous behavior poses an actual threat, prioritize which behaviors might be most damaging to a company, and then respond appropriately, could be even more critical to preventing valuable IP from leaving when your employees do.

Source:  Darkreading.com 

Ransomware Is Going More Corporate, Less Consumer

Cybercriminals on average charge $544 for ransom per device, signaling a new sweet spot for payouts.

Ransomware is on track to surpass last year's wave of attacks, and businesses are getting hit with ransomware nearly as much as consumers, according to Symantec's Internet Security Threat Report released today.

Based on the 319,000 Symantec-blocked ransomware incidents that occurred during the first half of this year, the security giant is anticipating 2017 to easily surpass last year's 470,000 incidents, says Kevin Haley, director of Symantec's Security Response team.

"You have to give a lot of credit to WannaCry and Petya, but even without those two the numbers are increasing," Haley says. "WannaCry and Petya provide guideposts to other malware authors who see worms as an effective way for propagation."

Ransomware Worms Its Way Onto Corporate Networks

Ransomware deployed as worms tends to hit companies far harder than consumers, given that malicious malware can shoot through corporate networks with great speed. Consumers, on the other hand, are usually not connected to a network.

As a result, WannaCry and Petya helped push corporations to account for 42% of all ransomware incidents in the first half of the year, compared to 30% of ransomware incidents for all of last year and 29% in 2015, according to the report.

"Once a worm is in a corporate network, it's like shooting fish in a barrel," Haley says, adding he expects to see more cybercriminals launch worm-related ransomware attacks going forward.

He advises enterprises and organizations that want to shore up their defenses against ransomware worms to heavily safeguard their firewalls and institute a policy of frequently patching critical vulnerabilities.

"Worms take advantage of vulnerabilities, but a lot of people chose not to patch," he says, pointing to the damage that WannaCry spawned. "Gateways are also another important form of protection. But maybe people have become lackadaisical since we have not seen worms for such a long time, people need to re-evaluate their firewalls."

Ransomware ROI

The average ransom demand during the first half of the year settled in at $544 per infected device, according to the report. That's in stark contrast to the threefold increase last year, when the average ransom demand soared to $1,077 per device from $294.

The ransomware industry is apparently undergoing a stabilization in pricing, with expectations that only the "pros" will remain in the game, Haley predicts.

With prices for ransomware demands reaching a stabilized point, the return on investment for some ransomware malware writers may not be worth the effort, Haley notes.



For more, head over to the source link
Source:  Darkreading.com 

Instagram Flaw Exposes Stars’ Phone Numbers & Email Addresses

Social networking site Instagram has revealed a flaw in its systems which exposed a number of celebrities’ phone numbers and email addresses to cyber-attackers.

As reported by the BBC, the Facebook-owned photo-sharing service, used by some 700 million people around the globe, believed that “one or more” attackers had targeted high-profile celebrities in an attempt to access their contact information. Instagram stated it has already got in touch with verified members to make them aware of the incident and fixed the bug in its application programming interface.

It is also believed that no passwords had been stolen, but users are advised to be on the lookout for unusual or suspicious activity on their accounts.

“High-profile Instagram users can breathe a small sigh of relief after the Facebook-owned social network yesterday revealed that no passwords had been swiped in the recent breach of the photo-sharing site,” said Lee Munson, security researcher at Comparitech.com. “They’ll need to catch their breath quickly though as other sensitive information has fallen into the hands of those responsible for the hack.”

With telephone numbers and email addresses out in the wild, he added, superstars and Z-list celebrities alike will need to be on their guard in the coming weeks as the attackers may use those contact details for other nefarious purposes. “To be on the safe side, rich and famous Instagram users should probably change their login credentials anyway, remembering to make their passwords complex and unique to each online account they have.”

The more individuals allow access to their data through social media, like Instagram, the more avenues there are for attackers to try, added Mark James, security specialist at ESET.

“It’s good to remember that social media sites view people merely as a source of income. They are only concerned with the security of your data to the extent that the law requires. This is why it is critical for users to take responsibility of their own security.”



Source:  infosecurity-magazine 

Hackers release more HBO episode shows: Report

(Reuters) - Hackers have released more unaired episodes of popular HBO shows but the latest leak did not include anything on the hit series "Game of Thrones," the Associated Press reported on Sunday.

The hackers, who broke into HBO's computer network and have released stolen information for several weeks, provided more unaired episodes, including the popular show "Curb Your Enthusiasm, " which returns in October.

They also leaked episodes of "Insecure," "Ballers" and "The Deuce," according to the Associated Press.

Time Warner Inc's HBO said Sunday in an emailed statement that it was "not in communication with the hacker, and we're not going to comment every time a new piece of information is released."

"It has been widely reported that there was a cyber incident at HBO," it said. "The hacker may continue to drop bits and pieces of stolen information in an attempt to generate media attention. That’s a game we’re not going to participate in."

HBO acknowledged the hack earlier this summer. It said the thieves had been leaking stolen materials and asking for a multi-million-dollar ransom.

The hack came at a sensitive time for HBO parent Time Warner as it awaits regulatory approval to sell itself to AT&T Inc in a $85.4 billion deal announced in October.


By Jilian Mincer for Start Magazine

WireX DDoS Botnet: An Army of Thousands of Hacked Android SmartPhones

Do you believe that just because you have downloaded an app from the official app store, you're safe from malware?
Think twice before believing it.
A team of security researchers from several security firms have uncovered a new, widespread botnet that consists of tens of thousands of hacked Android smartphones.

Dubbed WireX, detected as "Android Clicker," the botnet network primarily includes infected Android devices running one of the hundreds of malicious apps installed from Google Play Store and is designed to conduct massive application layer DDoS attacks.

Researchers from different Internet technology and security companies—which includes Akamai, CloudFlare, Flashpoint, Google, Oracle Dyn, RiskIQ, Team Cymru—spotted a series of cyber attacks earlier this month, and they collaborated to combat it.

Although Android malware campaigns are quite common these days and this newly discovered campaign is also not that much sophisticated, I am quite impressed with the way multiple security firms—where half of them are competitors—came together and shared information to take down a botnet.

WireX botnet was used to launch minor DDoS attacks earlier this month, but after mid-August, the attacks began to escalate.
The "WireX" botnet had already infected over 120,000 Android smartphones at its peak earlier this month, and on 17th August, researchers noticed a massive DDoS attack (primarily HTTP GET requests) originated from more than 70,000 infected mobile devices from over 100 countries.
If your website has been DDoSed, look for the following pattern of User-Agent strings to check if it was WireX botnet:

After further investigation, security researchers identified more than 300 malicious apps on Google’s official Play Store, many of which purported to be media, video players, ringtones, or tools for storage managers and app stores, which include the malicious WireX code.
Just like many malicious apps, WireX apps do not act maliciously immediately after the installation in order to evade detection and make their ways to Google Play Store.

Instead, WireX apps wait patiently for commands from its command and control servers located at multiple subdomains of "axclick.store."
Google has identified and already blocked most of 300 WireX apps, which were mostly downloaded by users in Russia, China, and other Asian countries, although the WireX botnet is still active on a small scale.

If your device is running a newer version of the Android operating system that includes Google's Play Protect feature, the company will automatically remove WireX apps from your device, if you have one installed.
Play Protect is Google's newly launched security feature that uses machine learning and app usage analysis to remove (uninstall) malicious apps from users Android smartphones to prevent further harm.
Also, it is highly recommended to install apps from reputed and verified developers, even when downloading from Google official Play Store and avoid installing unnecessary apps.

Additionally, you are strongly advised to always keep a good antivirus app on your mobile device that can detect and block malicious apps before they can infect your device, and always keep your device and apps up-to-date.

Android malware continues to evolve with more sophisticated and never-seen-before attack vectors and capabilities with every passing day.

Just at the beginning of this week, Google removed over 500 Android apps utilising the rogue SDK—that secretly distribute spyware to users— another malicious Android SDK ads library, dubbed "Xavier," found installed on more than 800 different apps that had been downloaded millions of times from Google Play Store.

Source:  TheHacker News 

Someone Hacked Selena Gomez Instagram, Shared Nude Justin Bieber Photos

The highest followers account on Instagram owned by Selena Gomez has recently been hacked with unknown hackers posting a bunch of nude photographs of her ex-boyfriend Justin Bieber on her account.

The latest hack is not part of the ongoing Fappening events affecting a majority of celebrities by targeting their iCloud accounts, rather in the case of Selena, some hacker managed to breach her Instagram account and posted Bieber's photos.

Bieber's three full-frontal shots of naked photos were visible to Selena's 125 million Instagram followers for a short duration of time, after which her account was swiftly taken down Monday night.
A post from Selena's official Instagram account went up Monday showing 3 pics of Bieber with a caption that read:

"LOOK AT THIS N***A LIL SHRIMPY."

Selena's team has since re-secured her Instagram account, which was back online minutes after it was taken down, with the photos of Bieber deleted.

The Bieber nude images were not part of any stolen celebs photo dump, instead, they were clicked during his 2015 holiday in Bora Bora and also published online in 2015, when Bieber was dating model Jayde Pierce.

At that time, censored photos of Bieber were published by several websites, but uncensored versions also reached the Internet, which was posted on Selena's hacked Instagram account, claims Variety.

There's no detail about hackers or how they got into Selena's Instagram account available at the moment, but as we have previously seen many celebrities tricking into handing over their account credentials in phishing emails, the same could be the case with the "Good For You" singer.

It seems like celebrities are not taking the security of their accounts seriously, which once again resulted in the hack of social media account of an A-listed celebrity.

Just last week, dozens of intimate photos of Anne Hathaway, Miley Cyrus, Kristen Stewart, Katharine McPhee, and golfer Tiger Woods reportedly surfaced on the Internet after unidentified hackers gained access to celebs' iCloud accounts and stole their private photos and videos.

Today it's Selena, but tomorrow it could  be you. So, users are highly recommended to enable two-factor authentication on your accounts and always secure your accounts with a strong and different password.

Also, avoid clicking on any suspicious link or attachment you received via an email and providing your personal or financial information without verifying the source properly.



News first published on  TheHacker News 

WhatsApp Hacker Busted!

By Linda Tenyah-Ayettey

The Cyber Crime Unit of the Criminal investigation Department (CID) of the Ghana Police Service has apprehended a mobile phone repairer who allegedly hacks into people’s social media accounts and uses the information for his nefarious activities.

The suspect, David Sam-Essandoh, according to police reports, had connected the WhatsApp application of his victims through WhatsApp web to a MacBook Pro laptop and had been monitoring their conversations.

He was nabbed when one of the victims detected that her WhatsApp conversation was being monitored, and reported the matter to the police.

The director in-charge of the unit, Chief Superintendent Dr Gustav Herbert Yankson, confirmed to DAILY GUIDE that Sam-Essandoh was arrested on 15^th August, 2017 in Accra.

On 10^th August, a complaint was received at the Cyber Crime Unit from a victim that she suspected her WhatsApp conversation was being monitored.

On receipt of the complaint, Chief Superintendent Yankson said the victim’s mobile phone was examined and it revealed that the WhatsApp application had been connected through WhatsApp web to a MacBook Pro laptop.

David Sam-Essandoh was subsequently arrested while accessing the victim’s conversation via WhatsApp web on his laptop.

Upon interrogation, the suspect was said to have admitted the offence and stated that he only connected the victim’s WhatsApp application to his laptop to find out her conversations about him (suspect).

Further investigations revealed that sometime in July this year, the complainant/victim had a problem with her phone and gave it to the suspect for repairs.

After the repairs, the suspect allegedly did the connection mentioned above without the complainant’s authorization and was intercepting her conversations.

The police also discovered that Sam-Essandoh had connected the WhatsAppapplication of two other ladies on the same computer using different browsers without the knowledge of the victims, and was monitoring their conversations as well.  When he was questioned, he reportedly gave the same excuse that he wanted to know what both ladies had said about him.

He is being processed for court for prosecution but investigations are still ongoing.

Source:  Daily Guide Africa 

Members on Trump's cybersecurity advisory council have resigned en masse

Eight out of the 28 members on the White House's National Infrastructure Advisory Council, which is responsible for overseeing the US' response to emerging cyber threats, resigned last week.


The letter that advisers - many of whom were Obama-era appointees - submitted to the White House was published by Nextgov and cited several reasons for leaving, including President Donald Trump's controversial response to the riots in Charlottesville that were sparked by white supremacists; Trump's decision to withdraw from the landmark Paris climate deal; and his "insufficient attention" to possible cyber threats posed to American infrastructure, including its election systems.


Trump's actions, the letter said, "have threatened the security of the homeland I took an oath to protect." It added that the administration's actions "undermine" the "moral infrastructure of our Nation" which "is the foundation on which our physical infrastructure is built."


Though Trump has at times spoken about addressing "the cyber," he has been reluctant to address perhaps the most pressing cybersecurity threat the US currently faces: Russia.


Historically, the US "has been inadequate" when it comes to addressing potentially devastating cyberattacks from a nation state like Russia, said Carbon Black national-security strategist and former FBI counterterrorism operative Eric O'Neill. "This inadequacy has carried over into the current administration, where our president's understanding of technology is limited to Twitter," he added.


Head over to the source link for more info >>>
 BusinessInsider 

known Android DDoS malware infects phones in 100 countries

Last year, a series of record-setting attacks hitting sites including KrebsOnSecurity and a French Web host underscored a new threat that had previously gone overlooked: millions of Internet-connected digital video recorders and similar devices that could easily be wrangled into botnets that challenged the resources of even large security services.


Now, for one of the first times, researchers are reporting a new platform recently used to wage powerful denial-of-service attacks that were distributed among hundreds of thousands of poorly secured devices: Google's Android operating system for phones and tablets. The botnet was made up of some 300 apps available in the official Google Playmarket. Once installed, they surreptitiously conscripted devices into a malicious network that sent junk traffic to certain websites with the goal of causing them to go offline or become unresponsive.

At its height, the WireX botnet controlled more than 120,000 IP addresses located in 100 countries. The junk traffic came in the form of HTTP requests that were directed at specific sites, many of which received notes ahead of time warning of the attacks unless operators paid ransoms. By spreading the attacks among so many phones all over the world and hiding them inside common Web requests, the attackers made it hard for the companies that defend against DDoS attacks to initially figure out how they worked. The attacks bombarded targets with as many as 20,000 HTTP requests per second in an attempt to exhaust server resources.


A volume of 20,000 requests per second may not sound like a big attack, but, depending on where they are directed, they can be significant. By funneling them into a target's search page, for instance, the malicious requests can consume major amounts of computing power. Justin Paine, a researcher with one of seven security organizations that helped to neutralize WireX, said he and his colleagues believe the takedown came as the botnet was still in its infancy, as operators were in the process of increasing its firepower.


"We believe we identified this botnet and took action while it was still in the early stages of growing," Paine, who is head of trust and safety at content delivery network Cloudflare, told Ars. "Luckily, the efforts of this group detected and took action against this botnet before it had a chance to grow much larger."


The other companies involved in the takedown are: Akamai, Flashpoint, Google, Oracle-owned Dyn, RiskIQ, and Team Cymru.


Move over, Mirai and Bashlight


The takedown was the result of researchers from all seven organizations pooling individual pieces of data they had access to in an attempt to figure out what was causing a series of attacks that is believed to have started on August 2. The researchers quickly found that all of the browsers involved identified themselves with the 26 lowercase English letters in random orders. That clue helped researchers discover that all the attacks were coming from malicious apps running on Android devices. The researchers soon identified the app name twdlphqg_v1.3.5_apkpure.com.apk. Searches eventually identified the 300 apps so that Google could block them from the company-hosted marketplace and remove them from infected devices.


In many cases, the apps masqueraded as media players, storage managers, or ringtones. Behind the scenes, the infected devices sent the requests to targeted sites in lockstep with other infected devices. The apps were programmed to run in the background so that infected devices participated in attacks even when the apps weren't actively being used. The researchers aren't disclosing the names of the malicious apps. Antivirus products for Android will identify the malicious apps as the "Android Clicker" trojan, a reference to an earlier period when the malware was used in click-fraud scams that generate revenue by causing devices to click on ads. A report the companies published Monday also provides command-and-control servers and other details that may be helpful indicators of compromise to more technically experienced end users.


Paine said WireX is "one of the first, and certainly one of the biggest, Android-based DDoS botnets." Last year, researchers from DDoS-mitigation service Incapsula reported a separate Android-based DDoS botnet.


With the advent of botnet software with names including Mirai and Bashlight, poorly secured digital video recorders and other so-called Internet of things devices have emerged as key threats to Internet stability. The blight is largely the result of several manufacturing decisions, including having the same default administrative password in each device and, in some cases, featuring remote administrative control that's turned on by default. By infecting Android apps available in Google Play, DDoS attackers are now exploiting an age-old weakness in another widely used platform.



Dan Goodin,  Arstechnica 

Cybersecurity 101: How universities are dealing with hackers

It's back to school season, and hackers have plenty of tools to go after students.

As thousands of freshmen move into their dorms for the first time, there's plenty of thoughts rushing through their minds: their first time away from home, what cringey nickname they're gonna try to make a thing, if there are any parties before orientation kicks off.


But one thing that probably isn't on their minds is whether they're going to get hacked.

That's all Carnegie Mellon University's IT department thinks about. Back to school season means hordes of vulnerable computers arriving on campus.


The beginning of the semester is the most vulnerable time for a campus network, and every year, with new students coming in, schools have to make sure everything runs smoothly. Carnegie Mellon's network gets hit with 1,000 attacks a minute -- and that's on a normal day.


Cybersecurity is an increasingly important aspect of our everyday lives, with technology playing a massive role in nearly everything we do. Universities have been vulnerable to attacks in the past, with cybercriminals stealing student and faculty databases and hackers vandalizing university websites.  


Students are often targets for hackers, even before they're officially enrolled. Considering how much money flows into a university from tuition costs, along with paying for room and board, criminals are looking to cash in on weak campus cybersecurity. An added bonus for hackers: Admissions offices often hold data with private information like student Social Security numbers and addresses, as well as their families' data from financial aid applications.

It's how thieves were able to steal $30 million from the IRS and put nearly 100,000 people at risk of identity theft, thanks to a vulnerability with a financial aid application tool. Even as an alumnus, I still get warning emails from my alma mater, Syracuse University, about phishing attempts.


School of phish

Phishing attacks are when hackers steal passwords by sending links to fake websites that look like the real deal. It's how Russians hacked the Democratic National Committee during the presidential election, and it's a popular attack to use on universities as well.

A phishing warning I received from my alma mater, Syracuse University, even two years after I graduated. Alfred Ng/ CNET

The latest warning, sent Monday, called out malware hidden in a document pretending to be from Syracuse University's chancellor.


Digging through my old emails, I found about 20 phishing warnings that had gone out during the four years I'd been there. Syracuse University declined to comment on phishing attacks against the school, but in a 2016 blog post, it said the attacks were "getting more frequent, cunning and malicious."


The school is not alone. Duo Security, which protects more than 400 campuses, found that 70 percent of universities in the UK have fallen victim to phishing attacks. Syracuse University, which uses Duo Security, prevents phishing attacks with two-factor authentication, which requires a second form of identity verification like a code sent to your phone. But it just rolled out the feature last year.


Kendra Cooley, a security analyst at Duo Security, pointed out that students are more likely to fall for phishing attacks because they haven't been exposed to them as frequently as working adults have. Also, cybercriminals know how to target young minds.


"You see a lot of click-bait phishing messages like celebrity gossip or free travel," Cooley said.


All students at Carnegie Mellon are required to take a tech literacy course, where cybersecurity is a focus, said Mary Ann Blair, the school's chief information security officer. The school also runs monthly phishing campaigns: If a student or faculty member falls for the friendly trap, they're redirected to a training opportunity.


When your network is being hit with at least two phishing attempts a day, Blair said, it's a crucial precaution to keep students on guard.


"It's just constantly jiggling the doorknobs to see if they're unlocked," Blair said. "A lot of it is automated attacks."


Cleaning the campus


It's not just the thousands of new students that have university IT departments bracing for impact, it's also their gadgets.


"All these kids are coming on campus, and you don't know the security level of their devices, and you can't manage it, because it's theirs," said Dennis Borin, a senior solutions architect at security company EfficientIP. A lot of university IT teams have their hands tied because they can't individually go to every student and scan all their computers.


Borin's company protects up to 75 campuses across the United States, and it's always crunch time at the beginning of the semester.


"If I was on campus, I wouldn't let anybody touch my device," Borin said. "So, if somebody has malware on their device, how do you protect against an issue like that?"


Instead of going through every single student, Borin said, his company just casts a wide net over the web traffic. If there's any suspicious activity coming from a specific device, they're able to send warnings to the student and kick him off the network when necessary.


Keeping school networks safe is important for ensuring student life runs smoothly. A university that had only two people on its team reached out to EfficientIP after it suffered an attack.


All of the school's web services were down for an entire week while recovering from the attack, Borin said.

Some of the apps targeting "back to school" that've been blacklisted by security company RiskIQ.

App attacks

Scam artists love to take advantage of timing, and the back to school season is a great opportunity for them.


There was an influx of fake ransomware protection apps when WannaCry hit, as well as a spike in phony Pokemon Go apps stuffed with malware during the height of the game's popularity. If there's a massive event going on, you can bet people are flooding the market with phony apps to trick victims into downloading viruses. A quick search for "back to school apps" in August found 1,182 apps that were blacklisted for containing malware or spyware, according to security firm RiskIQ.   


Researchers from the company scanned through 120 mobile app stores, including the Google Play store, which had more than 300 blacklisted apps. They found apps for back to school tools; themes and wallpapers for your device; and some apps that promised to help you "cheat on your exams."


Though most of the blacklisted apps are poorly made games, others pretend to help you be a better student. Take, for instance, the myHomework Student Planner, which RiskIQ found on Mobile24's app store. The app comes from the company "Free Android Apps," as if that's not already suspicious, and claims to be a "planner for English-speaking students." It had been blacklisted for hiding a Trojan, but it's still available in some app stores.


Other warning signs to watch out for when it comes to sketchy apps are poorly written reviews and developers using public domain emails for contacts, Risk IQ said. For any educational apps, like Blackboard Learn, you should always check the sources and look for the official versions.  


New students coming to school have enough to worry about. Let's hope a crash course in cybersecurity is enough to ensure they make it to graduation without getting hit by hacks.




Source:  CNET 

Ransomware 2.0: Spora now steals your credentials and logs what you type

English language Spora ransom note. Image: Malwarebytes

A vicious strain of ransomware has been upgraded to enable it to steal browsing information and record keystrokes from infected PCs.


Spora ransomware -- one of the most common families of the file-locking malware -- appears to be following in the footsteps of Cerber, which recently gained the ability to steal passwords and currency from Bitcoin wallets.


By stealing credentials from victims, criminals are ensuring a double payday, because not only can they make money from extorting ransoms, they can also potentially sell stolen information to other criminals on underground forums.

All of this is achieved with the aid of a complex encryption process, which Spora has become known for, that combines an AES key and an RSA public key to lock files on the victim's computer.


In addition, the ransomware also uses Windows Crypto API to encrypt temporary data and Windows Management Instrumentation to delete backup copies of all encrypted files.


Essentially, Spora was already a powerful form of ransomware before gained the ability to steal data. The new variant was spotted by security researchers at Deep Instinct.


This version of Spora -- distributed during a 48-hour campaign that began on August 20 -- is spread by a phishing campaign that sends targets a Word document claiming to be an invoice.


In order to see the contents of the file, the user is asked to enable a Windows Script File, which allows the document to drop its malicious payload. It's the first time Spora has been embedded in a document, rather than pulled from a web server.

The malicious payload asking for permission to run. Image: Deep Instinct.

Once executed, the payload is similar to earlier versions of Spora, in that it carries out the encryption, without adding or changing extension names, and deletes the shadow copies before presenting the victim with a ransom note.

Researchers say this latest version of Spora also collects browsing history and credentials from users' web histories and cookies, and has the ability to capture keystrokes.

While many other forms of ransomware, such as Cerber, are coded not to attack Russian users, Spora appears to be targeting Russia specifically. However, it's currently unknown who is behind Spora or where in the world they're operating from.

While the cryptography behind Spora is particularly strong, the phishing email messages are somewhat basic, meaning a user educated about threats should be able to avoid falling victim.

"Since Spora's attack vector relies on user interaction, users' awareness can play a significant role in stopping the threat. The basic rule of thumb is to pay special attention to unsolicited emails, attachments and avoiding from running or allowing any kind of content from an untrusted source," said Guy Propper, cyber intelligence researcher at Deep Instinct.

Before Spora or even Cerber, there were instances of ransomware families stealing data from victims, but the functionality is now finding its way into some of the most common ransomware families.


Source:  zdnet.com 

Replacement touchscreens could be hacked to hijack your smartphone

A new study has found that when replacement touch screens are embedded with a malicious chip, they can be used to compromise your smartphone. Ars Technica reports that a new paper, published by the Ben-Gurion University of the Negev, includes simulated attacks on two Android devices: a Huawei Nexus 6P and LG G Pad 7.0. Researchers were able to take control of the devices by using a malicious chip embedded into a third-party touch screen.


Phones with a malicious touch screen could essentially record your photos and app data, or direct users to phishing websites to exploit vulnerabilities and gain control of the device. The attack is very difficult to detect, as anti-virus programs can’t flag it and the hardware survives operating system updates and factory resets. In the study, researchers used a hot air blower on the phone’s touch controller connection to access and solder on their malicious chips. “Our attack assumes that the phone’s touch controller had been replaced with a malicious component, but that the rest of the hardware and software on the phone is authentic and trusted,” the researchers wrote.

“A well motivated adversary may be fully capable of mounting such attacks in a large scale or against specific targets. System designers should consider replacement components to be outside the phone’s trust boundary, and design their defenses accordingly.”

More than half of people who own a smartphone have damaged their phone screen at least once, so the idea of exploiting third party touch screens is pretty conceivable. However, most modern smartphones are compact, making it difficult to access the devices’ innards for manipulation. Apple’s iPhones also have secure modules to block features like Touch ID from being tampered with.



Source:  The Verge 

WhatsApp Beta for Windows Phone now sports “Delete for Everyone” feature

If you have been looking for a way to delete last night’s drunk texts you now have to look for a slightly different menu entry.

WhatsApp has pushed out an update to the beta version of their app, taking the app to version 2.17.246.0.

The update renames the Recall feature to Delete for Everyone, which seems a rather sensible change. For now Android and IOS users are yet to get the upgrade, hopefully you won't be waiting too long to catch up on the train.

Whatsapp watcher WABetainfo has not noted any other significant change. The update should eventually wind its way to the full mainstream version of the app.

In the mean time, you can get the latest version of the beta app in the windows store here Whatsapp Beta





Source: Mpoweruser

AfricaCom launches new technology arena to develop the blueprint for Africa 4.0

To celebrate its 20th anniversary, AfricaCom, the continent’s largest and most influential technology, media and telecoms (TMT) event is launching a brand-new technology arena. Located in the recently expanded and soon to be opened, CTICC wing, this entire exhibition hall will be dedicated to tech innovation and Africa’s journey towards the fourth industrial revolution.

Incorporated into this bustling zone between 7th and 9th November 2017, will be an Innovation Stage featuring visionary insights on future tech trends that also includes energetic discussions on the Internet of Things (IoT), Smart Cities, Big Data, Fintech, Blockchain, E-Health and Artificial Intelligence. Add in wearable tech, drones, a host of augmented and virtual reality gadgets, games and applications, all housed in one comprehensive really smart space.

This buzzing hive of activity, will be home to more than 100 technology focused exhibitors as well as the centrepiece of the arena, AfricaCom 20/20. This is a brand-new show floor feature dedicated to accelerating Africa’s digital transformation. As the centrepiece of the Technology Arena, AfricaCom 20/20 will host the Technology Arena Launch Party to kick off the 20th-anniversary celebrations on Monday evening 6th November 2017, as well as acting as the base for all other 20th anniversary celebrations.

Underpinning the importance of this event and this stream, Microsoft has signed on as a lead sponsor. Expect a vibrant showcase of new digital solutions presented by AfricaCom’s top 20 innovators, and thought-provoking conference content built around the theme ‘providing clarity of vision on future tech trends’.

As if Valley, Cloud Development Lead – Microsoft South Africa, commented on the company’s involvement in this year’s event saying: “Digital transformation is critically important to the success of businesses across Africa, and Microsoft is focused on helping our customers successfully achieve their digital business transformation. Powered by our people and our mission to empower every person and every organisation on the planet to achieve more, we have been driving cloud innovation and growth across Africa for a number years.

“We also recently announced a significant investment into data centres in the African region, which expands on our existing investments aimed at: unleashing innovation to solve some of the biggest problems facing humanity; building and developing small businesses; and alleviating unemployment and poverty on our continent”.

Also on display in the new TA will be especially created demo pods will also enable delegates (over 13 000 are expected this year), to interact with next generation technologies, to help shape their own thoughts and possibilities of what is to come and what might be.

Underpinning the entire show and a narrative that will particularly dominate the technology arena, are the questions: What are the skills needed to accelerate Africa’s digital transformation – what infrastructure, policy, partnerships and collaborations are required to turn Africa into a global digital giant? What will the next 20 years of digital transformation in Africa look like and how will this transformation impact different vertical markets – manufacturing, utilities, agriculture, education, government, banking and beyond.

Some of the solutions will need to include novel uses of technology to solve socio-economic challenges in Africa, as well as Innovative business models to stay ahead of the game in an age of digital disruption and transformation as we march ever closer to digital inclusion.

Providing some of the answers to these questions and shining a light on potential solutions, is this year’s AHUB, also conveniently located in the TA.

The AHUB will showcase talent and facilitate ICT partnerships, and is geared to once again unleash the power of the start-up ecosystem across Africa. New in 2017, is a programme that has been designed to highlight the critical role of entrepreneurship in fuelling the continent’s digital economy. This will feature briefings for both start-us and investors, as well as live pitch sessions. Also in the mix for the first time, is the AHUB Start-up Academy with skills workshops and sector snapshots covering FinTech, E-Health, AgriTech, clean energy and ICT4D. Critical for entrepreneurs, will be a series of panel discussions aimed at helping them understand investor mentalities and also how to develop a disruptive mindset.

“AfricaCom has always been the event to come to futureproof one’s business, getting the inside track on systems that will affect growth and development as well as the opportunity of meeting other like-minded and complementary businesses involved in the sector.

“It has evolved over the years from being a purely telecommunications based event, to one where technology commands the stage. As it underpins everything, it seemed only fitting that we create an exhibit in which, to centrally house some of the most exciting tech and ideas that will impact on Africa’s digital advancement,” commented Tom Cuthell, Portfolio Director at KNect365.

Source:  ITNewsAfrica 

Global hunt for Nigerian cyber criminal spreading malware

A Nigerian working alone around Abuja  has stirred a global hunt as he orchestrated numerous malware infection campaigns targeting more than 4,000 organisations globally over the past four months, a cyber security company claimed.

www.Securityweek.com quoting Check Point security researchers said the attacks targeted various companies in industries such as oil & gas, manufacturing, banking, and construction, in an attempt to steal data and commit fraud.

Many of the companies are leading international names and some have had their defenses breached by the attacks, the security researchers reveal.


According to Check Point, at least a dozen companies confirmed they have been infected during the campaign, including a marine and energy solutions company in Croatia, a transportation company in Abu Dhabi, a mining company in Egypt, a construction company in Dubai, an oil & gas firm in Kuwait, and a construction organization in Germany.

Despite the large scale campaign, behind it is not an expert gang of cybercriminals or a nation state actor, but “a relatively unskilled man in his mid-20s, operating from a location near the capital of Nigeria,” Check Point discovered.

Working on his own, the Nigerian  uses fraudulent emails seemingly coming from oil and gas giant Saudi Aramco, the world’s second largest daily oil producer. The phishing messages target financial departments within companies in an attempt to trick employees into revealing company bank details or into opening a malware-infected attachment.

The malware used in these attacks includes NetWire, a remote access Trojan that provides its operator with full control over infected machines, and Hawkeye, a software for logging key strokes (malware already associated with Nigerian cybercriminals). The attacks eventually resulted in a total of 14 successful infections. The cybercriminal ended up earning thousands of dollars in the process, the researchers said.

Despite showing a low level of cyber-skills, using crude and unsophisticated fraudulent emails, with almost no research or social engineering involved in creating them, the attacker was successful in his attempts.

The attacker used generic email titles, phrased as “Dear Sir/Ms,” sent the same email to numerous targets, “all in blind carbon copy, urging victims to send back banking details, perhaps for future scams.” He sent the emails from email addresses sale.cement_till_tw@yahoo.com, and cciticarinternational@yahoo.com.

The fraudster used old, generic and readily available online malware, as well as freeware to ‘scrape’ email addresses from corporate websites and used them as targets for his campaigns.

“The fact that the campaign was still effective, despite using only basic cyber-criminal techniques, highlights just how much of a problem these business email compromise (BEC) attacks have become,” Check Point said.

Since uncovering the campaign and establishing its origins, Check Point’s research team has notified law enforcement authorities in Nigeria and internationally and shared its findings with them.

Checkpoint said the Nigerian in his 20s operates  social media accounts, where you he uses the motto: ‘get rich or die trying’.

His attack campaign uses fraudulent emails which appear to originate from oil and gas giant Saudi Aramco, the world’s second largest daily oil producer, targeting financial staff within companies to trick them into revealing company bank details, or open the email’s malware-infected attachment.

Last year, the FBI revealed that losses caused by BEC scams exceeded $3.1 billion. Victims are estimated to lose between $25,000 and $75,000 on average, per attack. However, it’s not only financial losses that victims should be concerned about, but also the fact that “the malware used by the criminal to infect organizations gives remote control over infected machines, and can perform keylogging functions. This enables harvesting of a variety of information from infected machines, such as details on the companies’ operations, assets and intellectual property.” Such details could be worth much more than the thousands of dollars obtained by fraud, Check Point says.

Another alarming aspect was that some of the targets are energy and infrastructure companies, which the unsophisticated cybercriminal was able to easily breach. Not only was the attacker able to compromise the networks of several large organizations, but he also managed to distribute his malware globally and remain under the radar for a long while.

“This highlights the need for all organizations to improve their security to protect against phishing and business email compromise scams, and to educate their employees to be cautious about opening emails, even from companies or individuals that they recognize,” Check Point said.

Source:  NAN 

The US Vs Hackers - America's Crusade Against Cybercrime

Cyberattacks across the world have grown ever-larger in scale, inflicting billions of dollars of damage – and the US is spearheading the quest to make hackers pay, wherever they are, sometimes with exceedingly tough jail terms.
The US government is pulling no punches when it comes to prosecuting cyber criminals, often seeking extradition orders and, in most cases, dedicating countless man hours and hundreds of thousands of dollars relentlessly pursuing some of the world’s most notorious hackers.

Its latest catch, though, is a reputed white hat hacker — that is, a ‘good’ security expert whose hacking bears no ill intent. He helped stop a global cyberattack in its tracks, potentially saving the global economy millions of dollars in the process – and is now charged in a separate malware-related case.

Read more about him and others in RT’s list of some of the most notable hackers the US has pursued and attempted to extradite since 2000, with varying degrees of success.

Marcus Hutchins aka ‘MalwareTech’ (2017)

Marcus Hutchins, 23, the young British cybersecurity expert who discovered the kill switch that stopped the global WannaCry ransomware attack, was arrested on August 2 by the FBI at Las Vegas International Airport as he was about to board a flight back to his home in London.

He has been charged in connection with “creating and distributing the Kronos banking trojan,” first discovered in 2014, which targets banking systems and harvests credit card data and private customer information once an email attachment has been opened on a target computer.

“He admitted he was the author of the code of Kronos malware and indicated he sold it,” prosecutor Dan Cowhig told the federal court.

Hutchins is accused of collaborating with an unnamed co-defendant who maintained and advertised the malware on the now defunct AlphaBay marketplace on the Dark Web. The Malware was sold for $3,000 according to the indictment, though IBM researchers saw it advertised with a $7,000 price tag.

Hutchins has posted the $30,000 bail but Judge Nancy Koppe ordered him to surrender his passport and he has been banned from using devices with internet access upon his release on August 7, according to his attorney, Adrian Lobo, as cited by Reuters.

Lauri Love (2013 - present)

Lauri Love, 32, of dual Finnish-British citizenship is alleged to have hacked the US Federal Reserve Bank, NASA, the US Army, the FBI, and the Environmental Protection Agency, and faces extradition to the US with multiple indictments for arrest spanning three different court districts in three different states.

Love was initially arrested on October 25, 2013 and again on July 15 2015. The UK's National Crime Agency (NCA) tried to force Love to hand over his passwords and encryption keys so it could access his computers that were seized following his initial arrest.

He is currently appealing his extradition, granted by Westminster Magistrates' Court in September 2016, with a hearing scheduled for November of this year.

Love faces up to 99 years in prison, and would be the first British citizen to be extradited to the US for cyber crime.

Russian Roman Seleznev aka ‘Track2’/’2pac’/’nCuX’ (2009 - 2013)

The son of a Russian member of parliament, Seleznev, 32, was sentenced to 27 years in prison, a US record for cybercrime, for his role in hacking thousands of US businesses and operating an identity theft ring based in southeast Asia.

He was arrested by the US Secret Service in the Maldives in July 2014.

Seleznev was convicted of hacking into point-of-sale computers to steal credit card information which resulted in up to $169 million losses for the 500 businesses that were successfully hacked, Reuters reported.

Moscow viewed Seleznev’s arrest and extradition as ‘kidnapping.’ A Foreign Ministry statement at the time said there had been no contacts with the Russian authorities normally required when a Russian citizen is being extradited. The Maldives don’t have an extradition agreement with the US, but local police helped the Secret Service get him anyway.

“This message the United States sent today is not the right way to show Vladimir Putin, Russia or any other government in this world how justice works in a democracy,” Seleznev wrote in a statement following his sentencing.

Seleznev also faces separate federal charges which are pending in both Nevada and Georgia.

Vladimir Drinkman (2005 - 2012)

Vladimir Drinkman, 34, of Syktyvkar, Russia and four co-conspirators allegedly stole more than 160 million credit card numbers in what US authorities described at the time as the “largest known data breach conspiracy ever prosecuted.”

He and his crew hacked into the databases of companies such as NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Heartland, Wet Seal, Commidea, Dexia, JetBlue, Dow Jones, Euronet, Visa Jordan, Global Payment, Diners Singapore, and Ingenicard, among others.

Drinkman was arrested in the Netherlands on June 28, 2012 and extradited to New Jersey in 2015.

“This hacking ring’s widespread attacks on American companies caused serious harm and more than $300 million in losses to people and businesses in the United States,” said Assistant Attorney General Caldwell.

Drinkman faces up to 30 years in federal prison. He was originally due to be sentenced in June but the verdict has been delayed until September 22.

Gary McKinnon aka ‘Solo’ (2001 - 2002)

McKinnon, 51, from Scotland was accused of hacking almost 100 US military and NASA computers over 13 months between 2001 and 2002.

He is perhaps most famous for his brazen taunt of the US military following a hack which shut down the Army’s network of 2,000 computers for a 24-hour period. A message that read “Your security is crap” was displayed on the military’s website. US authorities estimated the cost of the hack at $700,000.

In 2012, then-UK Home Secretary Theresa May ruled that McKinnon would not be extradited to the US given that he, like Lauri Love would be later, had been diagnosed with Asperger’s syndrome and was at risk of committing suicide.

McKinnon also claimed to have uncovered evidence of a secret US Navy Space program during his hacks.

In addition, McKinnon says he unearthed a massive government conspiracy to photoshop proof of aliens here on Earth out of images and video, as well as a major cover-up of alien technology such as antigravity and zero-point (read: free) energy.

“A NASA photographic expert said that there was a Building 8 at Johnson Space Center where they regularly airbrushed out images of UFOs from the high-resolution satellite imaging,” McKinnon told Wired in a 2006 interview.

Marcel Lehel aka ‘Guccifer’/‘Small Fume’ (2012 - 2014)

Marcel Lehel, 44, was indicted on nine counts including three counts of accessing protected computers. He was arrested in Bucharest in January 2014 and an 18-month temporary extradition order to the US was approved by Romania's top court, Reuters reported.

He posted unofficial emails sent to former US Secretary of State Hillary Clinton as well as artwork produced by former US President George W. Bush, including self-portraits in the bathtub, online.

He stands accused of hacking “into the email and social media accounts of high-profile victims, including a family member of two former U.S. presidents, a former U.S. Cabinet member, a former member of the U.S. Joint Chiefs of Staff and a former presidential advisor,” according to a federal indictment.

It is unclear what kind of punishment awaits Lehel if found guilty.

Source: RT News 

Ransomware attacks hit small businesses the hardest - Engadget

By Swapna Krishna

It’s just one of the grim findings in Malwarebytes’ new ransomware report.

If it seems like reports of ransomware attacks -- malicious software that holds data hostage unless a ransom is paid to the person or organization behind it -- are increasing, Malwarebytes agrees with you. 

The company released its Second Annual State of Ransomware Report recently. Among the findings is that 22 percent of small business that were hit with ransomware attacks were crippled to the point they had to cease operations immediately.

It's a somewhat staggering figure, but it makes sense once you think about it; large corporations often have the resources to work around (or, let's be real, pay off) these types of attacks. Small businesses, especially ones that rely on day-to-day operations to function, can't cope in the same way. "To make matters worse, most of them lack the confidence in their ability to stop an attack, despite significant investments in defensive technologies," said Marcin Kleczynski, CEO of Malwarebytes, in the press release. The survey also found that small business owners and operators are less likely to pay a ransomware demand.

According to the report, 75 percent of organizations included in the survey saw ransomware as a high priority, but less than half had even moderate confidence they could deal with such an attack. When they are attacked, email is the primary infection method. This affect US-based companies more than European companies according to the report.

If you want to check out the entire report for yourself, it's worth the read if you're concerned about ransomware. If you aren't worried about it and you own, operate or work at a small business, well, you should be. The numbers in the report are somewhat grim, and it seems as though these attacks are increasing in frequency and scale. ""Companies of all sizes need to remain vigilant and continue to place a higher priority on protecting themselves against ransomware," said the director of Malware Intelligence for Malwarebytes, Adam Kujawa.

Source: Engadget

Petya Ransomware Running Rampant: How to turn off SMBv1 in Windows to make sure you’re safe

Petya ransomeware as reported last month also known as “Petwrap,” is spreading rapidly, “shutting down computers at corporates, power supplies, and banks across Russia, Ukraine, Spain, France, UK, India, and Europe and demanding demands $300 in bitcoins,” and has affected over 300,000 computers in only 72 hours.

Petya does not encrypt files one by one in its attempt to elicit those Bitcoin payments, but uses an even more nefarious method:

Instead, Petya reboots victims computers and encrypts the hard drive’s master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk. Petya replaces the computer’s MBR with its own malicious code that displays the ransom note and leaves computers unable to boot.

Microsoft issued a series of patches for this type of exploit back in April, including taking the unusual step of patching the unsupported Windows XP operating system, so if you’re current on updates you should be ok. 

However the company also recommends removing the unused but vulnerable SMBv1 file sharing protocol from your systems.

It’s pretty easy to do, and well worth it for the peace of mind it could bring as yet another ransomware exploit powered by leaked NSA hacking tools runs amuck. Our colleague over at ZDNet, Ed Bott, runs through the procedure for Windows 10 machines:

• Open the Control Panel (search for it from the      Start Menu).
• Click Programs and Features, and then on the left hand column.
• Click Turn Windows Features on or off.
• Scroll down to SMB 1.0/CIFS File Sharing support, Uncheck it, and reboot.

This works for Windows 10 and Windows 8.1, Ed has further instructions if you’re still on Windows 7. As he says, there’s simply no reason for you to be running SMBv1, and Microsoft is planning to remove it entirely in the Windows 10 Fall Creators Update.

For now, governments and industries are grappling to fight the ransomware and perhaps looking at their penchant for running older unpatched systems, as the dirty tricks of the NSA continue to come back to haunt us.

Source: OnMSFT

HBO Hacked - Game of Thrones script and Ballers Land online

THIS WEEKEND, THE same email landed in the inboxes of an untold number of entertainment journalists. “1.5 TB of HBO data just leaked!!!” screamed the subject header, while the email itself, addressed "to all mankind," promised “the greatest leak of space era” and a link to a site that hosts an unreleased Game of Thrones script and not-yet-aired episodes of Ballers, Insecure, Room 104, and Barry.

According to the hackers, there’s plenty more where that came from.

HBO has confirmed that an attack happened, though not the scope. “There has been a cyber incident directed at the company which has resulted in some stolen proprietary information, including some of our programming,” wrote HBO chairman and CEO Richard Plepler in an email to employees. With streaming hacks like this one, though, it remains to be seen if size correlates with impact.

The Hack

On Sunday morning, an email from an unnamed group—though they appear to have adopted the tagline “HBO is falling”—went out to reporters, telling them, “You are lucky to be the first pioneers to witness and download the leak. Enjoy it & spread the words.”

In addition to the link mentioned above, the email also included contact information for HBO communications VP Jeff Cusson.
Details of the hack itself are scarce, and HBO declined to comment on what it deemed an ongoing investigation. But unlike other recent high-profile Hollywood hacks, which relied on lax third-party security systems, the HBO hackers claim to have compromised HBO itself.

“We successfully penetrated HBO’s huge network and gathered most imporatnt [sic] files and films & scripts and so on,” one of the hackers wrote in an email to WIRED, promising both full episodes of Game of Thrones and upcoming feature films (presumably HBO originals). The hacker, identified in the email as “Mr. Smith,” also claimed to have “obtained alot [sic] about HBO’s staff and internal stuff.”

None of this has been verified, and hackers frequently overstate their claims. If true, though, this may ultimately resemble the Sony hack of 2014 more than Netflix’s recent Orange Is the New Black leak—which would be especially troubling for HBO.

For more details head over to the source link >>>
 WIRED