Sep 19 2023
Welcome to Gone Phishing, your daily cybersecurity newsletter that stands up to the scammers and the hackers, the crypto-jackers, source code-crackers and spyware trackers and screams: “I’m as mad as hell, and I’m not going to take this anymore!” ???????????? #Network
Today’s hottest cybersecurity news stories:
⚠️ Beware of new wave of DDos attacks coming for your IoT devices ????
???? Google will pay $93 million to state of California over privacy violations ????️
???? Boomers beware! Nodestealer’s coming for your Facebook accounts ????????
If you are a techie and/or in to compliance and security then this newsletter will be right up your street. Its a well written newsletter with great content on software and websites for developers and businesses that use software or rely on 3rd party suppliers for services with a security and compliance focus, lets be honest all business should have a security and compliance focus ????
Sponsored
Highlighting companies with fresh new security and compliance certifications ⚡️
IoT’s popularity is soaring, but it’s also making our devices vulnerable! ???? Poorly secured IoT gadgets are prime targets for attackers, turning them into unknowing members of botnets. These botnets can launch various attacks, from DDoS to data theft, without you even knowing. ????
Hang on, wtf are IoT devices again?! ????
Here’s a short list of examples of Internet of Things (IoT) devices:
????️ Smart Thermostat: Devices like the Nest Thermostat can be controlled remotely and adapt to your heating and cooling preferences.
???? Smart Lock: These locks can be controlled via a smartphone app, allowing you to lock and unlock your doors remotely.
???? Smart Light Bulbs: Bulbs like Philips Hue can be controlled and programmed to change color and intensity via a mobile app.
❤️ Fitness Trackers: Devices like Fitbit monitor your physical activity, heart rate, and sleep patterns, providing valuable health data.
???? Smart Home Security Cameras: Cameras from companies like Ring or Arlo offer remote monitoring and alert notifications.
❄️Smart Refrigerator: Some modern refrigerators can send alerts when you’re low on groceries and even create shopping lists.
???? Connected Cars: Cars with IoT capabilities can provide real-time diagnostics, GPS tracking, and in-car entertainment options.
⌚ Smartwatches: Devices like the Apple Watch can track fitness, display notifications, and run apps.
Almost every appliance and gadget in your house now has a ‘smart’ equivalent from smart washing machines to smart toasters (seriously! ????). Needless to say, some of these inventions are more game-changing than others…
???? Why Worry About IoT Botnets? ????
With over 16 billion IoT devices in 2022 (expected to double by 2025), they’re a goldmine for attackers. Many devices lack updates or secure settings, making them easy prey. ????
???? How IoT DDoS Attacks Happen ????
Attackers command botnets through a server, targeting victims. Bots flood the target with requests, causing service failures. When essential systems are hit, lives can be at risk! ????
???? Incorporating IoT Devices into Botnets ????
Hackers compromise new IoT devices, expanding botnets. They use a loader server to install malware, turning devices into bots. ????
⚠️ Current IoT DDoS Threat ⚠️
IoT-driven DDoS attacks surged 300% in H1 2023, causing $2.5 billion in losses. 90% of complex attacks are botnet-based. This trend isn’t slowing down. ????
???? Alarming Projections for 2023–2024 ????
As IoT grows, so will botnet attacks. Experts predict a significant threat as IoT devices climb to 27 billion by 2025. Brace yourselves! ????
????️ Defensive Measures: Strategies and Best Practices ????️
Educate users about IoT safety
Collaborate and share threat info
Keep devices updated
Implement multi-layer security
Invest in specialised DDoS protection
Defending against IoT-driven DDoS attacks is a constant battle. By staying informed, investing in protection, and fostering collaboration, we can create a safer digital world. ????????
Join Discord
I came across ZZZ money club during the crypto market bull run when everyone’s a winner, even during the bear market this discord group has been amazing at giving information on projects and ways to make passive income in various ways.
The group is very active and everyone in this private discord group is very chatty and helpful.
Its run by Yourfriendandy and Decadeinvestor, you can find them here on YouTube, both top guys with great content.
If you are interested in joining the group you can through the link below.
giphy.com
Google is settling a lawsuit with California for $93 million, addressing allegations of misleading location-privacy practices and violations of consumer protection laws. ????
???? California Attorney General Rob Bonta revealed that Google promised users it would stop tracking their location when they opted out but continued to do so for commercial purposes. The company was accused of collecting location data through other means and deceiving users about their ability to opt out of location-based ads. ????
???? Google’s revenue topped $220 billion in 2022, largely from advertising. This settlement follows previous ones with 40 U.S. states ($391.5 million), Indiana, Washington, D.C. ($29.5 million), and Washington state ($39.9 million) for similar location-tracking issues. Texas has an ongoing lawsuit. ????
???? Google, while not admitting wrongdoing, cited outdated policies and pledged greater user control and transparency over location data. ???? Excuses, excuses, eh?
???? In related news, Google-owned Fitbit faces privacy complaints from Austrian non-profit NOYB for compelling new app users to consent to data transfers outside the EU. NOYB alleges users can’t easily withdraw consent without deleting their accounts. ????♂️????
Every few weeks, we carefully select three hot newsletters to show you. Reputation is everything, so any links we share come from personal recommendation or carefully researched businesses at the time of posting. Enjoy!
???? HealthHack: Tech is making it easier than ever to reach your fitness goals, from wearable devices to nutrition apps, this newsletter does the research for you, get all the latest health tech gadgets delivered to your inbox.
₿ Crypto Nutshell: A well written and beautifully designed newsletter giving you the lowdown on crypto and web3, highly recommend if interested to get up to date info on the crypto/web3 market.
???? Big Brain: Trending AI news, jobs and tools delivered in 3 minutes per day.
Let us know what you think!
makeagif.com
A persistent campaign is aiming at Facebook Business accounts, tricking victims with deceptive messages to harvest their credentials. This attack employs a Python-based variant of NodeStealer, with the potential to seize control of accounts for further malicious activities. ????
???? Campaign Scope and Origins ????
Mainly impacting Southern Europe and North America, this campaign targets various sectors, especially manufacturing services and technology. NodeStealer, initially discovered by Meta in May 2023, started as a JavaScript malware stealing cookies and passwords to compromise Facebook, Gmail, and Outlook accounts.
???? Python Version Emerges ????
Palo Alto Networks Unit 42 disclosed an attack wave in December 2022 that used a Python version of NodeStealer, including versions with cryptocurrency theft capabilities.
????️ Vietnamese Threat Actors Suspected ????️
Netskope suggests that Vietnamese threat actors may be behind these attacks, possibly adopting tactics used by other adversaries from the same country with similar objectives.
???? Messenger-Based Attack Vector ????
Fraudulent messages via Facebook Messenger are also being used to distribute the NodeStealer malware. These messages deliver ZIP or RAR archive files, baiting users with images of defective products to convince them to download the malware payload.
???? Malware Delivery and Execution ????
When victims execute the malware, it opens the Chrome web browser and secretly runs a PowerShell command to retrieve additional payloads, including the Python interpreter and NodeStealer malware. This versatile malware captures credentials, cookies, and system metadata, which it exfiltrates over Telegram.
???? The Danger and Future Threats ????
This campaign could lead to more targeted attacks since attackers gather valuable information. Stolen Facebook credentials could enable fraudulent transactions through legitimate business pages. Vigilance is crucial to stay protected! ????????️
So long and thanks for reading all the phish!
