Tor Project loses a third of staff in coronavirus cuts: Unlucky 13 out as nonprofit hacks back to core ops – The Register

Roundup This week in The Reg's security roundup of the notable bits beyond what we've already covered, the Tor Project has cut back to its core team, Zoom has called in the big security guns, US tech firms are taking on its Congress and more.

First off, it has been a bad weekend for 13 staffers at the nonprofit Tor Project after they were let go as the team was reduced to core operations only.

"Like many other nonprofits and small businesses, the crisis has hit us hard, and we have had to make some difficult decisions," it said in a statement.

"We had to let go of 13 great people who helped make Tor available to millions of people around the world. We will move forward with a core team of 22 people, and remain dedicated to continuing our work on Tor Browser and the Tor software ecosystem."

Such drastic cuts are surprising, given Tor's relatively small overheads and prominent supporters, including the US government and DARPA. Tor hasn't released any more details at the moment.

After spending the last month or so as the clown atop the dunk tank in the IT security world, Zoom has called in some help with its bug bounty program.

Luta Security has been tapped to help the videoconferencing giant set up a bug bounty program so that it can get its future security lapses cleaned up and rewarded before they go public. Actually, this has been in the works for some time - Luta founder and CEO Katie Moussouris told The Register the project began months before the Coronavirus outbreak.

This is not just an empty gesture, either. Luta boss Moussouris is something of a legend in the bug bounty space, having helped launched the programs at Microsoft and the US Department of Defense. She also does not do half-assed bounty programs, so you can bet there will be a well-trained team on Zoom's end to deal with the bug reports and get issues fixed.

Earlier in the month Zoom also recruited Alex Stamos, the former CSO of Yahoo! and Facebook, as well as noted security mavens Matthew Green, professor of Computer Science at the Johns Hopkins Information Security Institute and Lea Kissner, the former head of privacy tech at Google.

A group of tech advocacy groups are asking the US Congress to earmark money for IT spending in the next Coronavirus pandemic stimulus bill. Local, state and federal government's IT systems are in desperate need of modernization, they argue.

"The COVID19 pandemic exposes the need to redouble efforts to digitize federal forms and reduce reliance on hand-processing paperwork for high priority response and relief efforts," the letter [PDF] reads.

"In addition, the rapid transition to remote telework during the pandemic has also created new challenges for many government agencies, including increased cybersecurity threats, an inability to leverage commercial capabilities (which reduces program effectiveness), and important continuity of government operations."

Two of the states who opted to go it alone in their suits over the Equifax data theft will be getting a combined $37.7m in settlement payouts.

The states of Massachusetts and Indiana separately announced this week that they had settled their claims for $18.2m and $19.5m, respectively.

Indiana says the settlement cash will be paid out to citizens as restitution, while Massachusetts says it plans to carve off a portion for consumer aid programs.

Semiconductor manufacturers in Taiwan are being targeted by an organized foreign hacking operation aimed at lifting intellectual property.

Security company CyCraft says it was called in to investigate the matter, and soon concluded that what was going on was a sophisticated, highly-organized APT operation that used, among other things, a particularly nasty "skeleton key" attack to infiltrate the networks and get to sensitive documents.

"The main objective of these attacks was the exfiltration of intellectual property, such as documents on integrated circuits (IC), software development kits (SDKs), IC designs, source code, etc," the company writes.

"The motive behind these attacks likely stems from competitors (or possibly even nation-states due to the advanced nature of the attacks) seeking to gain a competitive advantage."

As misconfigured database left a Clearview AI database containing, among other things, source code and secret keys, was left accessible to the general public.

Middle Eastern security shop SpiderSilk spotted the database, which was protected by a password. However, the firm claims, anyone could log in as a new user and get access to the crown jewels of the company, including access to its online storage buckets.

The exposure was spotted by a researcher and was since taken down, though the researchers and ClearView seem to be at odds over how the disclosure was handled.

Akamai security research ace Larry Cashdollar (yes that is his real name) delivered a sobering look at what sort of attacks will target your typical Docker image in a given day.

Cashdollar's Docker image honeypot, left out for 24 hours, was exposed to a number of automated intrusion attempts and was infected with things like a Mirai botnet payload and a crypto-mining malware.

A recent update to Windows Defender is said to be causing some problems, as users are reporting their security software is crashing while trying to perform scans.

The security software can be restarted manually and hopefully an update from Microsoft to fix the bug is already in the works.

Ever wonder what does into a Linux kernel flaw? The security team at ZDI has provided an inside look at CVE-2020-8835, a kernel privilege escalation flaw.

Fortunately, there shouldn't be much in the way of risk to users and admins, as the flaw has been known of for months and was patched some time ago. But it's worth checking out how easy it is to subvert systems sometimes.

Sponsored: Practical tips for Office 365 tenant-to-tenant migration

Read the original:

Tor Project loses a third of staff in coronavirus cuts: Unlucky 13 out as nonprofit hacks back to core ops - The Register

A Bright Side to the Dark Web – Cryptonews

Source: Adobe/manuelhuss

The dark web typically conjures up thoughts of criminal activity. While there are undoubtedly unsavory characters leveraging the darknet for illegal pursuits, there are also virtuous uses of the hidden internet.

As reported, per data from blockchain analytics provider Chainalysis, over USD 600 million worth of bitcoin (BTC) moved on darknet markets in Q4 of 2019. (However, the darknet still accounts for less than 1% of all BTC transactions.)

In this article, we will highlight the bright side of the dark web and discuss instances where it has played a role in making positive change.

In the last decade, there have been several high-profile whistleblowers who have exposed criminal actions by governments, such as spying on their own citizens. While whistleblowers have played pivotal roles in exposing the crimes of governments, they typically do so at great risk.

For example, in June 2013, The Guardian published an explosive article revealing that the American government, through the National Security Agency (NSA), had been spying on its citizens by accessing records pertaining to their phone calls. At the time, the data was said to be from an anonymous informer. However, former government contractor, Edward Snowden, eventually outed himself as the source of the leak.

Laura Poitras, the journalist who Snowden reached out to in order to share the information with the public, credits Tor, the infamous dark web browser, as one of the main tools which made the entire endeavor possible. In a Reddit AMA, she stated:

"It would have been impossible for us to work on the NSA stories and make "Citizenfour" without many encryption tools that allowed us to communicate more securely. In fact, in the credits, we thank several free software projects for making it all possible. It's definitely important that we support these tools so the creators can make them easier to use. They are incredibly underfunded for how important they are. You can donate to Tails, Tor and a few other projects at the Freedom of the Press Foundation."

Additionally, In 2015, President Obama signed an Executive Order barring donations to people or parties that may affect national security. The loose wording of the Order led to beliefs that it applied to whistleblowers like Snowden.

In response, people began to donate to The Snowden Defence Fund in bitcoin, exceeding any amount previously donated to the fund over a similar period of time. WikiLeaks also accepts donations in bitcoin and anonymous submissions over Tor.

While the dark web is considered to be a playground for shadowy figures peddling illegal wares, a University of Surrey research paper found that only 60% of websites on the dark web were of an illegal nature.

The rest of the dark web is utilized by law-abiding citizens who simply want to protect their privacy. This is especially true in the case of citizens living in repressive regimes where there is significant censorship. Totalitarian regimes typically limit access to the internet by throttling the bandwidth or more severe blanket website restrictions and blockages.

Cindy Cohn, the executive director of US e-rights campaign group EFF, explained the connection between legitimate sites with dark web mirrors and censorship resistance saying:

Facebook has a Tor instance for people in repressive regimes. We see Tor use go up whenever a dictatorship takes over or a coup occurs. Tibetans, United Arab Emirates, Tunisia, Egypt. The list goes on and on.

The dark web, accessed through Tor, can be an invaluable tool for those seeking to counter repressive regimes and their machinations. For instance, grassroots efforts leading to the adoption of the Tor browser in Mauritania led to the government abandoning the filtering of websites in 2005.

Additionally, when the government of Venezuela began to impose internet restrictions, citizens took to Tor to communicate. While the government eventually banned access to Tor through the state-owned internet service provider, some citizens were able to leverage their access to crypto to hedge themselves from inflation, conserve the value of their assets, and provide themselves with some liquidity on an as-needed basis.

Chainalysis noted in a recent report focused on the relationship between the COVID-19 pandemic, the bitcoin price correction, and activity on darknet markets that spending has slowed down.

"Darknet market revenue has fallen much more than wed expect following bitcoins recent major price drop...Perhaps darknet market customers arent buying as many drugs given the public health crisis," the Chainalysis report explained.

This state of affairs is not unique to darknet marketplaces as businesses across the world are reporting significant dips in profit. However, given the lockdown effective in many areas of the world, people are not frequenting bars, clubs, pubs, festivals or other such social situations where drugs are typically consumed. Thus, people just likely don't have the need for drugs, which is one of the biggest revenue drivers for the darknet vendors.

Despite the marked fall in profits for darknet vendors, many seem to be standing in solidarity with the rest of the world. The cybersecurity firm Digital Shadows reveals that many of the actors on dark web marketplaces are echoing information found on the surface web in regards to staying safe and flattening the curve.

Additionally, some hackers are even rejecting calls for ideas through which they can exploit the general public during the pandemic. Digital Shadows states:

As weve seen time and time again, cybercriminals will find ways to take advantage of peoples fears and uncertainties in the wake of major disasters and emergencies. However, the gravity of the COVID-19 pandemic has shown some benevolent reasoning has emerged on some platforms that are typically used for crime: Users urging others to avoid taking advantage of an already dire situation.

Originally posted here:

A Bright Side to the Dark Web - Cryptonews

Install the privacy-focused Tor Browser on your Chromebook in 4 simple steps – Chrome Unboxed

More and more, security and privacy are becoming important factors for users looking to choose a web browser. While most major browsers such as Chrome, Firefox and Edge will allow users to limit the amount of data that is shared and what traces are left from browsing, that isnt the default behavior. For those wanting a more private browsing experience with the addition of relative anonymity, Tor Browser has become one of the most popular alternatives out there.

Im not that familiar with the internal workings of the Tor Browser but Ive seen a lot of users wanting to install it on their Chromebooks. So, Ive done a little research on how the Tor Browser works and why youd want to use it and threw together a quick tutorial on how to install it on a Linux-enabled Chromebook. First, well cover what Tor is not. The Tor Browser does NOT block ads like browsers such as Brave. The Tor Browser will protect your personal data, browsing history and behavior which will eliminate curated advertising but you will still see ads on websites.

The Tor Browser anonymizes user traffic with a network of circuits that sends as receives encrypted data that essentially hides the source IP. Tor also deletes all site data and cookies when the browser is closed and users can customize how much if any personal data can be utilized by the browser and websites that are accessed. Combined with a VPN like NordVPN, the Tor Browser is a powerful tool to help users stay completely anonymous online. Theres a lot more to the Tor Browser than I care to cover here but Toms Guide has a great breakdown of how Tor works and even how you can host a Tor relay to help expand the entire network.

While Tor may have gained popularity with some of the darker corners of the web, its equally useful for those who are simply concerned about privacy. As a matter of fact, an increasing number of government agencies are using Tor to assist in victim advocacy as the nature of the browser makes cyber-stalking quite difficult. Anyway, were here to figure out how to install the Tor Browser on a Chromebook. So, lets get started.

Shop All The Latest Chromebook Deals

This may be beating a dead horse but I never want to assume that someone reading this has already setup Linux on their Chromebook. If you are new to installing Linux (Beta) on Chrome OS, you can find the quick and simple setup guide here. Now, the Tor Browser doesnt live in the main Buster repository but thats okay. Where theres a will, there is a way and I have a way. You can technically install Tor using the tarball but it gets a little tricky once its unpacked. The method were going to use today only requires four commands in the terminal and then, youll be up and running.

First, we will have to add the repository that contains the Tor Browser. For this, were going to add the Buster backports. Whats a backport? Essentially, Debian backports are packages taken from the next release of the distro. Chrome OS users Debian 10 a.k.a. Buster. The next release, Debian 11, is named Bullseye. The backport for Buster comes from Bullseye. You can add the backports by editing the sources.list with a text editor but the easiest way is to run the following command.

Next, we will update the packages and install the Tor Browser. You can do this as two separate commands or in one single line. For our purposes, I will list the single line that will perform both functions. Paste the following into the terminal and hit enter.

All we have to do now is launch Tor and go through the initial setup. Once youve done this, you will find the desktop icon in your app launcher. Start Tor from the terminal with the following command. If youre a Firefox user, Tor may feel a bit familiar to you as it is built off of the same engine.

Note: If you want to remove the backports after installation, run this command in the terminal. sudo rm /etc/apt/sources.list.d/backports.list

This is another great example of how the addition of Linux apps has exponentially increased the capability of Chrome OS and in turn, opened the door to a wide range of new users. I know Ive said it before but I love tinkering with Crostini. If you have an app youd like me to test out, drop a comment or shoot us an email. I find a lot of these applications by simply poking around the web and looking at what users are trying to do on their Chromebooks. Its awesome to find ways to install and use these apps so users can get the most out of their devices.

The rest is here:

Install the privacy-focused Tor Browser on your Chromebook in 4 simple steps - Chrome Unboxed

Apple blocks third-party cookies in Safari – ZDNet

Image: Nobbby

Starting today, with the release of Safari 13.1 and through updates to the Intelligent Tracking Prevention (ITP) privacy feature, Apple now blocks all third-party cookies in Safari by default.

The company's move means that online advertisers and analytics firms cannot use browser cookie files anymore to track users as they visit different sites across the internet.

But Apple says the move isn't actually a big deal, since they were already blocking most third-party cookies used for tracking anyway.

"It might seem like a bigger change than it is," said John Wilander, an Apple software engineer. "But we've added so many restrictions to ITP since its initial release in 2017 that we are now at a place where most third-party cookies are already blocked in Safari."

Apple's Safari has now become the second browser -- after the Tor Browser -- to block all third-party cookies by default for all its users.

However, while Apple was quicker to block third-party cookies in Safari, Google is actually the one who pushed browser makers towards making this move in the first place, in a May 2019 blog post.

At the time, Google announced plans to block third-party cookies by default in Chrome and in the Chromium open-source project, on which multiple other browsers are built.

Google released Chrome v80 at the start of February with support for third-party cookie blocking (under the name of SameSite cookies), but the feature won't fully roll out to all Chrome's users until 2022.

Microsoft's Edge, which runs a version of Google's Chromium open-source browser has also begun gradually blocking third-party cookies as well, but the feature is not enabled by default for all its users either.

Apple's decision today doesn't mean that Safari now blocks all user tracking, but only tracking methods that rely on planting a cookie file in Safari and (re-)checking that cookie time and time again to identify the user as he moves from site to site.

Other user tracking solutions, such as user/browser fingerprinting, will most likely continue to work.

Nonetheless, this is a major step in the right direction. With Google, Safari, Microsoft, and all the other Chromium-based browsers on board, now, the vast majority of current web browsers block third-party cookies or are on their way towards full blocks.

Besides blocking cookie-based tracking, Apple's decision today also has a benefit beyond privacy, and namely towards security.

By blocking third-party cookies, Apple has now also blocked an entire range of web attacks known as CSRF (cross-site request forgery).

More on the move and what it means to developers and website owners is available in the WebKit team's blog post.

See original here:

Apple blocks third-party cookies in Safari - ZDNet

Dark Web A cyber heaven of criminal activity – The Financial Express BD

Md Hafez | Published: March 20, 2020 20:36:23 | Updated: March 20, 2020 20:37:54

The Internet refers to the global system of interconnected computer networks that use the Internet protocol suite (TCP/IP) to link devices worldwide. It has brought massive revolution in our communication system and made our life easier. In almost everything we do, we use the Internet ordering a T-shirt, buying a mobile phone, sharing a moment with a friend, sending a picture over instant messaging. Before the Internet, if we wanted to keep up with the news, we had to walk down to the newsstand when it opened in the morning. But today a single click is enough to read local paper and any news source from anywhere in the world, updated up to the minute. According to Bangladesh Telecommunication Regulatory Commission (BTRC), the total number of Internet subscribers has reached 165.615 million at the end of January, 2020 from 157.544 million at the end of January, 2019.

At a first glance, the internet may seem like a cyber haven for the common people but reality is entirely different. Actually, it works as a double-edged sword, where the opportunity cost of convenience is cascading threats of cyber crimes; around 2,044 cases were filed with different police stations and the cyber tribunal over last six years, according to Cyber Tribunal (Bangladesh) data but the number of cybercrime cases was only three in 2013. Therefore, it is a high time to thoroughly understand this cyber world, spotlighting the cautionary tales.

The internet has three main parts namely surface web, deep web, and dark web. The surface web makes up about 10% of the whole internet, and includes anything that anyone can find by entering terms in a search engine like Google or Yahoo. The deep web is simply where information is stored that is not easily accessible by anyone. This includes anything that is protected by a password such as personal email, online banking, or other such sites. This section actually makes up the majority of the web. The dark web, a subset of deep web, is anything that is not accessible by standard browsers like Google Chrome or Firefox. Any type of information can reside on the dark web, it's merely dark because of its more limited accessibility.

The dark web attracts users who seek anonymity when conducting business. Motives of such anonymity can be noble, such as with journalists seeking to interview citizens of repressive countries, where communications are monitored. Contrarily, the anonymity of the dark web attracts criminal actors like drug-dealers, hackers, and child pornography peddlers. There is also a growing service economy within the dark web in which hit-men and other illegal operatives advertise their services in ways they could not do over conventional channels. These aspects should be enough for law enforcement agencies in Bangladesh, especially Counter-terrorism and Transnational Crime unit, to seriously keep an eye out on what's happening on the Dark Web. Any negligence would be the serious blunder.

People who are unaware about the mysterious Dark Web may think that complicated coding procedure is required to enter the dark web. Getting to the dark web is actually a lot easier than we might think. It's simply done by downloading a special software named as TOR browser (The Onion Router) which is totally free of cost. The dark web site is different from other website in terms of top level domain suffix. For example, the normal web site address ends with .com or .org but dark web address ends with .onion. 'TOR" servers are undetectable from search engines and offer users complete anonymity while surfing the web. These more secured features of anonymity in dark web attract criminals to perform commit crimes frequently. The dark web has flourished by bitcoin, the crypto-currency that enables two parties to conduct a trusted transaction without knowing each other's identity.

Surprisingly, 23 October, 2019, the BBC launched an .onion version (bbcnewsv2vjtpsuy.onion) of its news website on the TOR anonymizing network aimed at readers based in countries that ban its services. In October 2014, Facebook announced that users could connect to the website through a TOR onion service using the privacy-protecting TOR browser and encrypted using HTTPS. Now anyone with a TOR-enabled internet browser can visit https://facebookcorewwwi.onion/ to get a secure connection to Facebook's servers that provides end-to-end encryption. Ideally, this means that TOR users, some of whom may be using the software to circumvent government restrictions of the internet in places such as China, Iran, will be able to get onto Facebook reliably and without worrying about leaking their identifying information. For instance, if you open a Facebook account from Bangladesh using "facebookcorewwwi.onion"- it can appear that you're in U.S.A. Thus, it will create a safe cyber heaven for hackers and crackers who can fulfill their evil interests.

In Bangladesh, everyday many teenagers are victimized by a group of hackers who use TOR server to hack Facebook account and start blackmailing in different ways. The victims don't get help from the law enforcement agencies because they can't identify hackers. Therefore, it is a right time to take initiatives by law enforcement agencies in Bangladesh to increase surveillance on what is happening on the dark web. Otherwise, militants, terrorists, fundamentalist groups and hackers come back strongly which will be out of control.

Md. Hafez is Assistant Professor, at the School of Business, Ahsanullah University of Science and Technology, Email: hafez_du94@hotmail.com

See the rest here:

Dark Web A cyber heaven of criminal activity - The Financial Express BD

NetAbstraction Announces Support for Private and Secure Access to the Dark Web #48955 – New Kerala

NetAbstraction has expanded the number of network egress nodes available to customers to include a TOR egress node, which enables private, secure and isolated access to Dark Web sites via a native Firefox, Google Chrome or Safari browser.

NetAbstraction's malware-protected browsing solution provides end-to-end privacy and security for online research, investigations and Dark Web activities. Leveraging browser isolation technology and NetAbstraction's obfuscated network, customers can isolate their Internet activity to a one-time use Virtual Machine (VM), and insulate their networks and devices from cyber threats, tracking cookies and Internet privacy risks. NetAbstraction's TOR egress node enables customer to browse dark-web sites, in a private and isolated fashion, directly within their native web browser.

For commercial organizations and government agencies interested in performing investigative research, intelligence collection or other activities on the Dark Web, it is clear; simply using the TOR browser does not protect anonymity or local networks from cyber threats. NetAbstraction's Malware Protected Browser solution and disguised network connectivity provide the isolation and network segmentation needed to prevent traceability while operating on the Dark Web.

NetAbstraction Capabilities

NetAbstraction is a cloud-based Network Privacy-as-a-Service offering that makes businesses a difficult target for hackers, search engine optimization companies and adversaries by disguising and dynamically shifting network communications.

NetAbstraction does this by transparently distributing communications within and across multiple clouds, and regularly churning the underlying network infrastructure.

This process obscures enterprise information, origination location and identity, and enables enterprises to confidently conduct secure business on the internet.

Key Features

Interface agnostic currently supporting Lightweight Browser Plugin, OpenVPN, Mobile routers, and Custom User-Defined solutions.Carrier-class network performance enables lossless streaming video and real-time access to all forms of Internet content.Leverages multiple cloud providers for ingress and egress to provide a range of persona management options.NetAbstraction is NOT a Proxy!

Here is the original post:

NetAbstraction Announces Support for Private and Secure Access to the Dark Web #48955 - New Kerala

Young Hackers Are The Future Of Cybersecurity Lets Treat Them As Such – Forbes

Kirill Kukhmar/TASS

In February, a poster that featured the Metropolitan Police and National Crime Agency logos, created to warn parents about children and cybercrime, came under scrutiny. It warned parents against various online tools, including Tor Browser and Kali Linux, claiming the presence of such tools was a sign their child "could be a hacker". Both organizations said they had no involvement with the poster and rightly distanced themselves but it points to a worrisome attitude towards tech education in the UK.

If young people are vilified for honing their cyber skills, we risk alienating them from the tech industry. Associating legitimate software such as Kali Linux with cybercrime perpetuates a stereotype of young coders as potential hackers. While its easy to laugh this poster off as ignorance, there is a serious risk to young talent. At the very least they could be disincentivized from pursuing technical skills and at a time when there is a global deficit of cyber experts.

Technical ability is the future of work, which is why the British government has implemented policies such as the National Retraining Scheme. If our economy is to flourish, interest in these programs should be encouraged, not discouraged; we should be welcoming and encouraging hackers. (ISC)2 found that the number of unfilled IT security roles is more than four million and increasing by a million year-on-year. Tapping into the next generation of cyber-curious individuals is integral to plugging the gap.

This security talent deficit is already having an effect on security teams. A recent Marlin Hawk study found that 66% of CISOs are struggling to recruit senior talent because candidates either lack the right level of technical knowledge (34%), dont have the right experience (30%), or are not the right cultural fit (10%). This is especially prevalent in the APAC region, where 91% find it difficult to find the right talent, compared to 61% in the UK and 54% in the US. Encouraging young people to see tech, and especially cybersecurity, as a viable career path is essential. The outside the box thinking required to be a hacker is what cybersecurity firms are desperate for; new threats come in all shapes and sizes, so the industry needs people who can predict and counter such attacks.

There is also a trend of neurodiverse individuals succeeding in cybersecurity, and they are at risk of being put off by posters such as the one that appeared in February, as many of these individuals eschew formal education in favor of developing skills independently. Neurodivergent individuals possess unique insight, so we should encourage them to learn in a way that suits them. This is the exact reason they suit cyber roles: by thinking differently, neurodiverse people can spot things that others might miss and bring different problem-solving approaches which might otherwise be overlooked. This includes desirable skills such as focus, pattern recognition and methodical and logical thinking. It is no coincidence, then, that the National Cyber Security Centre (NCSC) and GCHQ actively seek members of the neurodiverse community when hiring.

The tech community needs to correct the narrative when it comes to young hackers. The term hacker has a natural association with criminality, when, on the most simplistic level, what hackers do is by definition something that others thought impossible. Whether for positive or nefarious ends, being a hacker requires an innovative mindset. By creating an atmosphere of negativity around those involved in hacking from an early age, we risk driving them to the fringes perhaps even criminality. Telling children with strong computer skills that their interest in technology is bad can force them to be secretive about it and result in them being pushed into cybercrime. They need an outlet for their skills.

The employment gap in cybersecurity and many other parts of the tech industry is not going anywhere. The solution to this is staring us in the face: we must encourage, not admonish, those with the technical abilities to transform industries. Whether it be neurodivergent people, the young or indeed the elderly, we need to encourage the tech-savvy among us to be a force for good.

So the next time parents see a poster warning them that their child could be a hacker, we must ensure that both parent and child see it as a badge of honor the mark of someone who could one day be on the frontline, protecting us from the rising tide of cyber threats.

Read more here:

Young Hackers Are The Future Of Cybersecurity Lets Treat Them As Such - Forbes

Paedophile used ‘sophisticated’ methods to avoid detection by police – Liverpool Echo

A paedophile who employed "sophisticated" means to prevent police from detecting his internet use was jailed at Liverpool Crown Court today.

The court heard how Adam Johnston, 30, of Ampthill Road in Aigburth, had used a VPN network to hide his computers IP address and a TOR browser that prevents a users internet activity from being tracked.

Johnston had previously pleaded guilty to four counts of making and possessing indecent videos and images of children at an earlier hearing.

Prosecuting, Paul Blasbery, told the court that on June 21 2019, police had attended Johnstons previous address in Liverpool City Centre and seized a laptop and a pen drive from his flat.

They were later found to contain 237 indecent images of children, made between March 15 2015 and July 19 2018.

142 of the images were category A considered the worst kind which included 116 videos and 26 still images, some which featured children as young as 12 to 18 months old.

The remaining 185 images consisted of both category B and C images and videos of children.

The court also heard that Johnston had eight previous convictions for 23 offences dating from 2004 to 2011.

Mr Killen, defending, told the judge that Johnston wanted to "move away from his past".

He said: "In committing these offences he [Johnston] had relapsed and failed.

"He had been working away and began to drink alone which made him go back to his old ways."

Mr Killen added that Johnston was "a good candidate for rehabilitation" and that imposing a jail sentence on his client would have a "catastrophic effect on his training and housing and likely leave him vulnerable to re-offending".

Sentencing, Judge Robert Warnock told Johnston: "Those children were as young as 12 to 18 months old.

"The equipment you used was sophisticated and intended to frustrate those investigating.

"It is clear that you retain a sexual interest in young children and I have an obligation to protect the public."

Johnston was sentenced to 12 months in prison and made subject to a sexual harm prevention order for 10 years.

Read more:

Paedophile used 'sophisticated' methods to avoid detection by police - Liverpool Echo

Digital surveillance threats for 2020 – The Star, Kenya

From sophisticated spyware attacks to mass phishing via smartphones and the rise of facial recognition technology, the range and reach of surveillance threats to human rights defenders is growing.

For security teams trying to keep activists safe, it is a cat-and-mouse game as attackers rapidly adapt to developments aimed at protection.

When cyber-attackers see people are switching to using (messaging app) Signal, for example, then they will try to target Signal. If people start changing to VPN technology, they will start blocking VPN technology. If people are using Tor browser, they will target Tor traffic, says Ramy Raoof, a tactical technologist with Amnesty Tech.

Raoof says one of the main focuses for 2020 will be tackling customised targeting of smartphones, which hit headlines in 2019. Last October, messaging app WhatsApp, owned by Facebook, launcheda high-profile caseagainst surveillance company NSO Group for spyware attacks on more than a thousand of its users.

Malicious digital attacks will be in the spotlight this week, when alegal actionbrought by Amnesty and other rights groups comes to court in Tel Aviv. The activists are seeking to force Israels defence ministry to revoke the export licence of NSO, whose products have been used to target activists globally.

More advanced techniques now no longer require a target to actively click on a link to infect a device, explains Amnesty Tech security researcher Etienne Maynier. An attack using NSO spyware on an activist in Morocco covertly intercepted the activists web browsing to infect their phone with spyware. Instead of waiting for you to click on a link, they instead hijack your web browsers traffic and redirect you to a malicious website which tries to secretly install spyware, says Maynier.

Successful targeting of well-protected phones is becoming more common and security teams are under added pressure from a burgeoning industry in so-called zero-day exploits, in which unscrupulous hackers seek to find unknown vulnerabilities in software to sell.

InMay 2019, NSO Group exploited a zero-day vulnerability in WhatsApp that was used to target more than 100 human rights activists across the world with spyware.

Phishing attacks

Amnesty Tech is also trying to combat less hi-tech attacks which are nonetheless effective and can hit large numbers of victims within minutes.

Mass phishing via SMS or within applications on smartphones is a low-cost method that is more common and too often succeeds.

Phishing looks to trick people into providing personal information such as passwords. The attacks often come in the form of a password reset request and link, which mimics a mobile phone operator or social media company as the sender. Other times, attackers pose as a friend or contact of the victim and will share a link to an app which is already embedded with malicious code.

Maynier adds that attacks like these often use some kind of social engineering, pressurising the user to click on a link or open a document by, for example, pretending to represent a trusted organisation that purports to want to work with the target.

Its very cheap and very efficient and you can scale this type of attack very easily, says Raoof, who predicts the new wave of phishing will be a threat to human rights defenders globally in 2020 as they become increasingly dependent on mobile phones.

How to keep safe

For iPhone or Android:Only download apps from official app stores to prevent your personal information from being accessed without your consent and to minimise the risk of attacks. Update your system and apps frequently to ensure they have the latest security patches. Enable account recovery in case you lose access to your phone. Choose a mobile screen lock that is not easily guessed, e.g. 8-digit pin or an alphanumeric code.

Password management:Using a password manager means you dont have to worry about forgetting passwords and can avoid using the same ones. Its a tool that creates and safely stores strong passwords for you, so you can use many different passwords on different sites and services. There are various password managers such asKeePassXC,1PasswordorLastpass.Remember to back up your password manager database.

Messaging apps:When we advise human rights defenders about messaging apps, we assess each app on its policies (such as terms of service, privacy agreement), its technology (if open source, available for review, has been audited, security) and finally the situation (if provides features and functionality that fits the need and threat model). Generally speaking,SignalandWireare two apps with strong privacy features. [Signal requires a SIM card to register, while Wire just requires sign up with a username/email.]

Public Wi-Fi and VPNs:When you connect to Wi-Fi in a cafe or airport your internet activities are routed through that network. If attackers are on the network, they could capture your personal data. By using a VPN app on your devices, you protect your online activities on public connections, preventing your internet activities from being seen by others on the same network. If you want to explore options, tryNordVPNandTunnelBear.

Read the original:

Digital surveillance threats for 2020 - The Star, Kenya

The Ultimate Guide to Tor Browser (with Important Tips) 2019

If youre curious about Tor browser, then you already know how important your privacy and anonymity online can be. And yes, Tor browser is a great tool that can help keep you safe. But theres a lot of confusion about its pros and cons, and especially, about how it relates to VPNs.

This guide will answer those questions and more.Were going to explain how this powerful tool works and what to consider when deciding if its right for you.

Tor browser is similar to a normal web browser in many ways. Its no more difficult to use than Google Chrome or Microsoft Edge. The difference is that Tor browser connects you to the internet through the Tor network.

Tor is free, open-source software that helps you stay anonymous online. When you browse the internet using Tor browser, your traffic is randomly directed through a network of servers before you reach your final destination, in order to protect your location and identity.

The name Tor is short for The Onion Router. This refers to the way that Tor protects your data by wrapping it in multiple layers of encryption like an onion.

Tor browser and VPNs are both tools for protecting your privacy online. Theyare not the same thing, however.They are two very different technologies that protect you in different ways.

When you use a VPN, all of your data is secured with end-to-end encryption. Its then directed through a safe channel to a remote server that connects you to the website you are trying to visit.

Tor browser protects your privacy in a different way, which we explain below.

The important thing is that Tor browser is not a VPN, but you can use the two tools together to maximize your security and privacy.

Despite the browsers complex system behind the scenes, it is actually very easy to use. You simply download and install Tor browser, then connect to the internet just like you would with any other browser.

Tor usesa unique system that was developed by the US Navy to protect government intelligence communications.

Your data is bundled into layers of encrypted packets before it enters the Tor network. It is then routedthrough a series of volunteer-operated servers called nodes or relays.

Each time your data passes through one of these relays, a layer of encryption is removed to reveal the location of the next relay. When you reach the final relay on your path, known as the exit node, the last layer of encryption is removed and your data is sent to its final destination.

Each relay only decrypts enough data to know the location of the previous and next relays. Since each path is randomly generated and none of the relays keep records, its nearly impossible for your activity to be traced back to you through Tors complex network.

Tor browser is very effective at hiding your location and preventing your traffic from being tracked. Its almost impossible for your online activity to be traced through Tors network back to you.

However, Tor browser is not entirely secure. The system has a few weaknesses. Since each server in the Tor network is volunteer-operated, you never know whos behind the relays your data travels through.

Generally, this isnt an issue because each relay can only access the location of the previous and next relaysexcept for the exit node.

The exit node removes the final layer of encryption on your data. It cant access your original location or IP address, but it is possible for an exit node to spy on your activity if you visit an unsecured HTTP website.

Torbrowser is also vulnerable to the same attacks that other browsers are. Its a good idea to turn off the browsers plugins and scripts if you are trying to stay anonymous, because these can be exploited to reveal information like your IP address.

The biggest drawback to using Tor browser is speed. Because your data has to travel through multiple relays before reaching your final destination, browsing can be very slow.

Tor browser is not the best choice for streaming and downloading, and its creatorsstrongly discourage torrenting as well. Not only is torrenting painfully slow, but your torrent traffic will not be protected and can expose your IP address.

If youre looking for a way to stream or torrent, a VPN is much better protection.

Another disadvantage of using Torbrowser is that it can draw attention to you. Your ISP cant see what youre doing, but it can see that youre connected to Tor. This by itself can be enough to raise suspicion about what youre doing.

Even if youre only using Tor browserto legally browse the internet, the fact that you are connected to Tor can potentially turn you into a target for government surveillance. US government agencies like the NSA and FBI are very invested in trying to find ways to track Tor users activity.

Tor browser is an effective tool, but it doesnt offer the same level of security and safety that a VPN does. Luckily, you dont have to choose between the two. You can use Tor browser and a VPN together to combine their powers and maximize your privacy.

There are two main ways to combine Tor browser and a VPN. Were going to walk you through both methods and explain the pros and cons of each.

With this method, you connect to your VPN first and then access the Tor network. There are a few advantages to this method, starting with the fact that its very easy. Yousimply connect to your VPN and then open Tor browser.

In most cases, this configuration provides more than enough security and privacy to protect you.

Some VPNs make it even easier by offering a built-in Tor service. One great example is NordVPNs Onion over VPN service, which allows you to connect to Tor without Tor browser.

Instead, NordVPN can route your traffic through one of its secure VPN servers and then directly to the Tor network. The NordVPN service can protect all of the traffic on your device, not just your browser activity.

Another benefit of Tor over VPN is that all of your data is securely encrypted by your VPN before entering the Tor network. This means that Tors volunteer-operated servers cannot access your real IP address.

Since VPNs hide your activity from your ISP, connecting to a VPN before accessing Tor also prevents your ISP from detecting your use of Tor.

Tor over VPN also gives you a measure of privacy from your VPN provider, since they are unable to see what you are doing within the Tor network. On the other hand, if your VPN provider keeps logs of your activity, Tor over VPN doesnt hide your real IP address or the fact that youre using Tor.

The other downside of this method is that it doesnt protect you from malicious exit nodes, since your traffic is unencrypted by the time it reaches your final destination.

With this method, you connect to the Tor network first and then go through your VPN. This method is more complicated than Tor over VPN because in most cases,you have to manually configure your VPN to work with Tor in this way.

The biggest benefit of VPN over Tor is that you areprotected from the Tor exit nodes. Your traffic doesnt go directly from an exit node to your final destination, but rather is routed from the exit node to a secure VPN server.

Thats why this configuration is ideal for communicating sensitive information.

The downside is that your ISPand therefore government agencies as wellwill be able to see that you are using Tor, although your activity will be hidden.

This method also keeps your true IP address hidden from your VPN provider.But witha transparent, no-logs VPN, you shouldnt have to.

Despite its flaws, Tor browser is a powerful, effective tool for protecting your privacy online. Combining Tors anonymity with a VPNs security and safety gives you the best of both worlds.

We strongly recommend that you use a VPN, if you are planning on giving Tor browser a try.

Its also good to keep in mind that a VPN by itself can provide excellent security and anonymity, without the significant speed decrease that you will notice with Tor browser.

If youre looking for a trustworthy, reliable VPN to protect your online privacy, check out our list of the best VPN deals and coupon codes.

Tor vs. VPN

Best Verified No-Log VPNs

5 Best VPNs for Tor Browser

Read the original here:

The Ultimate Guide to Tor Browser (with Important Tips) 2019

Sunday Digest: Bitcoin Price And A New Decade – Bitcoinist

2020 arrived with a bang this week, although the 100,000 revelers who paid for a ticket to the firework display in London complained that they didnt see it because of the smoke from the fireworks. Experts blamed a lack of wind, something that is sorely needed on the other side of the globe where too much wind is hampering efforts to control the unprecedented Australian bushfires. AS$20 million has been raised in just 48 hours to support our friends down under, and you can even donate bitcoin to the cause.

Bitcoin seemed to be ending 2019 on a bit of a lull, started to get the January blues, and then picked up again just in time for the weekend.

At $7400 early in the week, analysts suggested that the rangebound BTC price needed to break through $7800 to signal a new bullish trend.

Price trickled down to $7.2k, but as the year drew to a close, it was hard not to see 95% overall gains in 2019 as a positive.

Network fundamentals were also looking great, with hash rate still high, record UTXO growth, and $673 billion of on-chain transactions in 2019.

Then a delayed hangover kicked in and bitcoin price dropped through $7k and as low as $6850 on some exchanges; its lowest for two weeks.

Thankfully the dip was short-lived, and a big bounce on Friday saw us move back into the comfortable $7500 range.

It hasnt been a great week for Ethereum, news-wise. First, it was reported that the Shitcoin Wallet browser extension for Chrome injected malicious code to steal Binance, MyEtherWallet, and other data.

Then the Parity client announced that users should implement an urgent update to counter a potential attack on nodes running its software.

Only 80% of clients were reportedly ready for the Muir Glacier hard fork which was implemented on January 2nd. Following which ETH followed BTC down the swanny, lurching towards a price of $125.

Block times were reduced by 25% after the fork, meaning a faster network, but also an increased inflation rate.

Thankfully, the price of Ether bounced back up to finish the week roughly where it started at around $136. Which all in all, seems a pretty good result.

South Korean traders got a late Christmas present this week, as the Ministry of Finance announced that crypto trading gains are not recognized as taxable events under current legislation. However, some thought that this announcement foreshadowed new legislation on its way to close this loophole.

The International Monetary Fund (IMF) puts itself forward as a potential advisor to nations considering a Central Bank Digital Currency (CBDC).

Authorities in Sichuan, China, are reportedly pressuring bitcoin miners to scale back operations to prioritize domestic use, due to reduced hydro-electric power production during the dry season.

Europol announced that it cannot trace Monero payments when combined with the use of the Tor browser. Good news for privacy-concerned users, but potentially bad news for regulated exchanges who still support the token.

Friday was the second annual Proof-of-Keys daywhen Bitcoiners are encouraged to assert their financial sovereignty and move coins out of exchanges and into a private wallet.

The date was chosen as it marks the eleventh anniversary of Bitcoins Genesis Block.

With the number of illiquid exchanges, hacks, dead CEOs, exit scams, and generally dishonest people out there this year, it never hurts to take precautions.

Remember, Not your keys, not your coins. Oh, and Happy New Year!

What are your bitcoin plans for the new year, and the decade? Let us know in the comments below!

Image via Shutterstock

See the original post:

Sunday Digest: Bitcoin Price And A New Decade - Bitcoinist

Teejayx6 Will Steal Your Identityand Rap About It – WIRED

All while scamming, Teejayx6 always wanted to rap. In his teens, he gave it a whirl. At first, on early tracks that didn't get traction, he was just punching out predictable lines about drug-dealingstuff he wasnt even really doing. And everybody in the world damn near does that. Its nothing to stand about drug dealing. So he pivoted to putting his scams on the tracks, and he became a part of a wave.

Charting the scam rap scenes rise, Vices Ryan Bassil points to Detroit as the nexus, Bossman Rich as the progenitor, and Bossmans 2017 track Juggin Aint Dead as the index case. Writing about the scene at Pitchfork, Alphonse Pierre paid respect to the more obscure bits of the internet from which these dudes draw inspiration: Every Detroit rapper definitely prefers Ask.com over Google. Scam rap has become a small media darling. Maybe thats because it sounds made-up. Or maybe thats because its so particular. In its insularity, and its strangeness, and its fledgling-ness, theres a very appealing purity.

For me, Teejayx6 stands out from the scene. Hes more audacious and more single-minded. Bar after bar are lessonsliteral details of his own (alleged? alleged-ish?) scammery. He blurs the lines as much as possible. On his Instagram, hes offered to sell verses (at $500 a pop) and scam tutorials (at a much more reasonable $25 per).

At a so-called scammer convention in New York, as Pitchfork's Pierre reported, a kid with two iPhone 10s told Teejayx6, with apparent sincerity, I wouldnt have this sauce without you. One of the top comments on Teejayx6s video for Apple reads, This aint even a song this just a felony with a beat.

You know how lifer comedy writers end up so inured to standard misfortune that they can only laugh at the saddest, darkest shit? I would have to admit theres an element of that operating here, with love for Teejayx6. The dude is just so, so weird. At times, Teejayx6 free-associates himself into very unexpected places. On Violin, he brags, I know the terrorists who did 9/11 back in New York. On Twitter, hes teased a future lyric: My uncle said in World War2 he shot at a T-Rex.

But through it all, his tracks pack an unexpected hookiness. Since I first heard Dark Web a few months back, its opening linesThe government tried to ban me from the dark web / I downloaded Tor Browser then got back inhave been on a near-constant loop inside of my head.

Sometimes, Teejayx6 raps about scamming people and places who most certainly deserve it. Walmart, for one. The New England Patriots Tom Brady, for another. Teejayx6 has a more nihilistic streak, though. Other victims of his scams have supposedly included tenuously employed forward Carmelo Anthony, his barber, his grandma, and a little kid who he think[s] is Arthur.

Do you ever, like, feel bad? I ask Teejayx6.

Sometimes, he says. It depends on the situation. Like around Christmas last year, a lot of people were telling me I was taking their last money for Christmas gifts. Thats really the only time I was feeling bad.

So you wont do that again?

He says he most certainly will be doing that again. Im picking up new scams every day, he adds. Fans and peers send him tips and ideas. I get a lot of DMs every day and a lot of people coming up to me.

But wait. Even with the Christmas money people. You dont feel bad?

Let me ask you a question, he says. You think Donald Trump scammed his way into office?

Read this article:

Teejayx6 Will Steal Your Identityand Rap About It - WIRED

How can I search the internet without being tracked? – Business MattersBusiness Matters

Our Internet provider can have access to anything that we browse into and we are also at the mercy of hackers trying their best to tap into our computers.

If you have information that is highly sensitive on your computer or your browser, then this might be very dangerous for you. You need to find a way to become untraceable.

But how can you browse the Internet without being tracked? Can you actually enjoy the benefits of the Internet all while keeping your identity and activity private to the eyes of someone that might be looking? No matter if you decide to buy a proxy server or use a secured platform, here are our tips for you.

The detailed answer might change depending on the person but in most cases, it all boils down to privacy. For instance, lets say that you are looking for a job while you are at work, and you do not want your current employer to see that you are planning to leave. Anonymous browsing will simply erase any signs of that search for the job.

Or lets say that you wish to look for some information on a prescription drug. When you browse for that drug on the mother website, there is a chance that your information (such as your e-mail or IP address) will be taken. This will give them the chance to send you advertisements and spam you with their content regarding that particular medicine. Anonymous browsing should prevent that from happening.

Anonymous browsing can also be very useful if you are in a country with very restrictive web policies, where you cannot view particular pieces of content. So, if you see that your access has been denied based on the country of origin, anonymous browsing might confuse the mother website about the country of origin.

So, you have decided that you wish to go forward with browsing anonymously how do you even start to do that? Well, here are a few tips for you.

A web proxy might be a great way for you to browse anonymously, as it hides your IP address and makes it seem like you are somewhere else. It takes you through a dummy server, so to speak, so that the hosting website does not know where you are coming from. You may get one at proxy-store.com, and you can use it to make your browsing private.

If you use a VPN, you may also keep your browsing private and unable to be tracked. It is similar to a proxy, in a way but it is in many ways different and superior. It is very useful when you want to keep pretty much everything encrypted protecting not only your browsing history, but also your messaging, file sharing, and everything else.

There are several web browsers out there that are very efficient to use in regard to private browsing. Granted, we are all used to Internet Explorer or Google Chrome but Tor Browser, for instance, is very good when you wish to keep your browsing private, as it encrypts your Internet traffic and passes it through many other servers.

Google and Bing are indeed very useful but are not really privacy-minded. In this case, you may want to go for search engines such as DuckDuckGo, as it works well to keep your search history private and block the advertising trackers.

This is something that every browser has. On some, it goes by a private window and in others, its called incognito mode. Regardless of its name, this mode does not track your data and it also prevents your history from being stored.

In the end, you may choose to go incognito or simply opt for a proxy of all websites. Regardless of your choice, there are several ways for you to keep your searches private.

See original here:

How can I search the internet without being tracked? - Business MattersBusiness Matters

Need the Tor Browser on iOS? Try Onion Browser – The Mac Observer

Need a Tor browser on iOS? Onion Browser is the only iOS app recommended on the Tor Projects website. Starting out at the U.S. Naval Research Lab, Tor is a special network that helps people browse the internet with as much privacy as possible. You should note there are a couple of security advisories on its website:WebRTC/Media leaks: Due to iOS limitations, WebRTC and media files leak outside of Tor and are routed over the normal internet. This will reveal your real IP address to sites using these features. (If you are using a VPN, the VPN IP address is revealed instead.) To defend against this, you may set Strict security mode in Host Settings, which will disable Javascript. More information here.OCSP leak: Visiting EV Green Bar HTTPS sites may leak information that can be used to reveal the domain name of the website you are visiting. This is handled within iOS and cannot be changed by Onion Browser. There is no known workaround. A detailed report can be found here. App Store: Free

Check It Out: Need the Tor Browser on iOS? Try Onion Browser

Tags: Onion Browser, privacy, security, TOR, tor browser

Related

Add a Comment

Log in to comment (TMO, Twitter, Facebook) or Register for a TMO Account

Follow this link:

Need the Tor Browser on iOS? Try Onion Browser - The Mac Observer

How to take a screenshot privately on chat without being detected – The Android Soul

With so much content being shared online, its sometimes tempting to want to take screenshots of whatever you see. But you never know if the app youre browsing through is sending notifications to the other person whose pictures you might be taking screenshots of.

Starting with Snapchat and gradually moving over to Instagram (and discontinued later), social media apps started alerting users when their pictures, videos or chats were being screenshotted of. While theres nothing stopping you from taking a screenshot, it might sometimes be embarrassing when the other user is being alerted of your screenshots.

To save you from such a scenario, weve now found a way to take screenshots secretly on Snapchat and any app that detects screenshots and notifies the other user.

Note: Every time you need to take screenshots secretly, you need to run the Private Screenshots app, let it record everything, go to Snapchat/similar app, take a screenshot using its screenshot button (only!), and then come back Private Screenshots app to stop the recording.

Private Screenshots has a presentation mode that captures a phone screens content for the time its switched on for. The screenshot button then saves the picture into an image file and the entire process ensures no broadcast message has been sent about the screenshot.

Another quirky feature about the app is that the files saved by Private Screenshots cannot be accessed by other apps on the phone. This is because the app saves all the images into a hidden directory inside your storage.

Note:

Private Screenshots does not work on Netflix, private chats on Telegram, Tor Browser or Incognito mode inside Chrome. The app will instead display a black screen or an error when capturing.

Continue reading here:

How to take a screenshot privately on chat without being detected - The Android Soul

Are You Sharing Your Disney+ Account? Thousands of Accounts Hacked and Sold on Dark Web – Grit Daily

In the first 24-hours, Disney+ gained 10 million plus subscribers throughout the U.S., Canada, and the Netherlands. However, the platforms immediate and predictable success came with some not so exciting news with respect to its customers also finding homes on the dark web.

On the first-day alone, Disney+ crashed when users attempted to sign up and login. The company tweeted that it had an overwhelming response and apologized.

Following the pattern of any new technology that is unveiled to a mass number of consumers, a very lucrative employment sector is hard at work, hiring and receiving just as much if not more money than what its shelling outthe dark web and black hat hackers.

Upon the immediate launch of Disney+, thousands of customers accounts were stolen and then put up for sale on the dark web.

The dark web is a part of the internet (deep underground) that isnt indexed by search engines, operating as a criminal hotbed, for encrypted online content and transactions that are not tracked or traceable (ideally). In order to access and engage in transactions on the dark web, it requires specific software, configurations, and/or authorization to access itusually through the TOR browser. Many may be familiar with the usage of the dark web back from The Silk Road investigation and Ross Ulbricht.

Initially reported by ZDNet, the ever-flowing number of complaints flooded social media networks including Twitter and Reddit. Even more frustrating is that users were actually getting emails LETTING THEM KNOW their Disney+ account was changed (presumably by the hacker).

When first reported, hacking forums were flooded with Disney+ accounts selling anywhere from $3 (2.30).per account to $11which is of course more than the legitimate price a Disney+ account is priced at$7 (5.40) per month.

The majority of these compromised accounts are labeled as FRESH CRACKED, PREMIUM/ANNUAL, and many other variations. Screenshots below indicate the formatting:

For those who immediately signed up for the streaming service on November 12, many experienced a series of technical issues, taking to social media to express their frustrations. Others indicated they were locked out of their accounts and had no idea as to why. And customer support hasnt been too helpful in addressing these issues.

Thousands of these stolen accounts show what kind of subscription the person signed up with and when it expires. For example, one websites post included the language:

Disney+ USA Service launches on 12th November 2019. These accounts will be ones where people have pre-paid for either 2 or 3 ears. Warranty is 2 months, but may last much longer.

In addition to ZDNets investigation, BBC jumped in with the assistance of a cyber-security researcher, finding several hacked customer accounts for sale on the dark web, which at the time of its findings, included over 4,000 customer accounts.

Unfortunately, Disney+ does not have two-factor authentication incorporated into its streaming platform, which surprisingly enough, should have been considered from the beginning, considering the massive (and successful) marketing campaign Disney has been putting on for many months.

Many customers are also concerned that their now compromised accounts will also grant black-hatters access to other products and services Disney provides, such as the Disney store and its recreation parks.

So if you are sharing your account with friends, family, co-workers, or unknowingly a hacker(s), it may be smart to change your account information just for the sake of it.

This news comes at a similarly troubling time for Google as its data collection practices have been heavily scrutinized. Several Fitbit users have expressed their distrust for Google, and are getting rid of their devices.

See the rest here:

Are You Sharing Your Disney+ Account? Thousands of Accounts Hacked and Sold on Dark Web - Grit Daily

Why Skip Ad must die on the Brains Byte Back podcast – The Sociable

1234Skip ad. You can probably relate to this, waiting a few seconds to skip to the content you actually want to see.

We are bombarded with ads all over the internet, but how many successfully get your attention, probably just a small few right?

Listen to this podcast below and onSpotify,Anchor,Apple Podcasts,Breaker,Google Podcasts,Overcast, andRadio Public.

It takes a very special ad to connect with us, arguably something we rarely see in the modern world of digital ads. But there are companies out there that want to give consumers a better advertising experience while enabling companies to better communicate their message.

One of which is Streann, an SaaS platform that empowers content providers with innovative distribution, engagement and monetization tools for a better end-user experience.

Joining us on this podcast is the companys CEO, Giovanni Punzo, to explain how they are making an impact on the digital advertising industry. In this episode, you will learn about the current digital advertising landscape, where it is heading, and how companies can successfully connect with users without them counting down to the skip ad button.

And for our Good News feature, we have a story about the BBCs new page on the dark web.

Adverts from Punzo:

#EatLikeAndyThe Whole Whopper

2018 Lincoln Navigator: Uncharted Waters (Official Commercial) | Lincoln

ULTRA Pure Gold Super Bowl Commercial with Zoe Kravitz ASMR

Good News Link:

Instead of visitingbbc.co.uk/newsorbbc.com/news, users of the Tor browser can visit the newbbcnewsv2vjtpsuy.onionweb address. Clicking this web address will not work in a regular web browser.

Disclosure: This episode includes a client of an Espacio portfolio company

View original post here:

Why Skip Ad must die on the Brains Byte Back podcast - The Sociable

Law debated allowing confiscation of Bitcoin by the police – ZDNet

Russia is considering a change in the law that would permit law enforcement to confiscate cryptocurrencies including Bitcoin (BTC).

As reported by local media publication RBC, Russia's Ministry of Internal Affairs aims to develop a form of "legal mechanism" for the seizure of cryptocurrency and other "virtual assets" by 2021.

Proposals are being developed at present by the ministry, the Federal Financial Monitoring Service (Rosfinmonitoring), the Prosecutor General's Office, the Justice Ministry, and customs service, alongside other agencies.

See also:Fake Tor Browser steals Bitcoin from Dark Web users

Tracking cryptocurrencies can be difficult, but it is not impossible. Assets can be 'washed' in which otherwise 'tainted' cryptocurrencies can be cleaned up through services that convert coins into other types but otherwise, if computer systems are confiscated, law enforcement may be able to find and access active wallet addresses.

However, keys may not be recoverable and the police would need to prove a wallet is owned by a suspect, leading to a raft of potential technical and legal challenges in cryptocurrency seizure.

CNET:IBM calls for regulation on facial recognition tech instead of bans

In order to bypass some of the challenges with virtual asset seizure, officials have suggested that coins stored on exchanges could be subject to requests by law enforcement to freeze an account or to transfer funds to a state-owned wallet address.

Such requests, as cryptocurrency exchanges do not operate inside Russian territory, could still be ignored.

During investigations, equipment including PCs and mobile devices may be seized, and according to Nikita Kulikov, a member of the State Duma's council as quoted by RBC, such seizure should also apply to virtual assets.

The publication added that cryptocurrencies are in a gray area in Russia, and so would need to be recognized legally as either a "commodity or a cash equivalent."

TechRepublic:How boot camps may fill the need for more white hats in the US

A draft law has been in development since 2017. The State Duma has adopted its first reading and a second is underway.

Russia's attitude to cryptocurrency appears to be in a constant state of flux. The country has previously introduced the CryptoRuble, a stablecoin intended to rival Bitcoin, and yet, the central bank and President Vladimir Putin have deemed cryptocurrencies a serious risk to existing financial systems and little more than a tool for criminal activity.

Have a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0

Go here to read the rest:

Law debated allowing confiscation of Bitcoin by the police - ZDNet

Dogolachan And The Ghost Of Massacres Past – bellingcat – bellingcat

On March 13, 2019, two young men entered their former high school in the small city of Suzano in So Paulo, Brazil. The first one in, Guilherme Taucci, age 17, immediately opened fire with a .38 revolver. Luiz Castro, 25, followed him inside. So began the eighth massacre in Brazilian schools since 2002.

Five students and two employees were killed that day. Many others who managed to survive were injured by bullets and an axe swung by the killers. After the police stormed the building, eight minutes in, Taucci killed Castro and then committed suicide.

Yet the bloody trail followed them even outside the school. Before the attack, both men had killed Tauccis uncle and stolen his car.

While the Suzano Massacre, as it came to be known, caused tremendous sorrow and grief, it gained little international attention. Yet the Suzano Massacre was destined to become part of the same web of international fascist violence that includes the massacres in Christchurch, Halle (Germany) and El Paso. While those shootings were all tied together by the website 8chan, Suzano became wrapped up in the sordid tale of a website similar to 8chan: Dogolachan.

In December, 2013, Marcelo Valle Silveira Mello founded Dogolachan on the surface web as a haven for his particular brand of free speech. He had been an active user of the social network Orkut since 2005, regularly posting his support for pedophilia and racism, and sharing pictures of violent crimes.

Prior to founding Dogolachan, Mello had a history of launching online hate campaigns. In 2009, he was the first person in Brazil to be formally condemned for the crime of racism. His lawyer successfully appealed, stating that his client had mental issues. Because of that, Mello avoided prison at that time.

Three years later, in 2012, Mello was finally arrested by Brazilian Federal Police (BFP)along with his cohort Emerson Setimfor a series of hateful websites they created and managed. These sites spread a bevy of racist and sexist articles directly aimed at several universities with articles like How to rape a girl at [insert University], attributing their authorship to various individuals the chan community considered their enemies, a tactic used to this day.

The websites were a form of an extremely high pressure harassment campaign targeting both people and institutions, disrupting classes and the well-being of said communities in coordinated efforts at intimidation that only grew over the years.

The equation of online anonymity as a weapon to be used against opponents, not to mention the excuse of humour and irony , all made worse by a lack of police power to monitor forums like these, resulted in a spike in hate websites. Safernet, a Brazilian non-governmental organization that combats Internet crime, says that at least five domains linked to Dogolachan users generated, in their lifespan, more than 160,000 complaints.

The BFP also stated that Marcelo and Emerson were planning a massacre against leftist students at the Universidade de Braslia (UNB). This planned shooting was inspired by the deadliest school massacre in Brazilian history; the murder of 12 children (including 10 girls) at the Tasso da Silveira Municipal School in Rio de Janeiro by a mentally ill man. The murderer had known links to online hate communities, like the ones frequented by Mello.

The duo spent a little over a year in federal prison and was released in May 2013. Just a few months later, they created Dogolachan.

The original picture that became the Dogola meme was snapped in Russia

Inspired by 4chan, 8chan, and numerous other chan-style image boards, the name Dogolachan is a reference to the dogola meme, a picture taken in Russia and embraced by Brazilians. It is frequently spammed in online discussions. The countrys online culture is known for its memes and online trolling.

While the dogola meme, as it is commonly known, was fairly innocuous in its Russian form, it quickly spread as a forced meme, winning the hearts of spammers and shitposters worldwide, especially in Brazil, where it became the visual basis for the mascot of the newly created chan.

From the beginning, the forum was a hate site on par with 8chans /pol board. It focused on inspiring and celebrating attacks, flamebaiting and trolling campaigns, with doxxing of women, minorities and leftists. Mello and his fellows on Dogolachan also advocated mass harassment of individuals they saw as enemies.

One such enemy is Dolores Aronovich, known publicly as Lola, an English literature professor at the Federal University of Cear and author of the most influential feminist blog in Brazil, online since 2008. For her advocacy in fighting against hate crimes in digital communities, Aronovich has received countless threats, mainly linked to mens rights activists or Dogolachan users. Aronovich was the inspiration behind a congresswomans bill, named after Lola herself, that allows the federal police to take over any investigation into online crime of a misogynistic nature. Aronovich was recently nominated for the 2019 Press Freedom Award by Reporters Without Borders.

Channers also celebrate mass shooters. This was a common practice on 8chans /pol board. They saluted shooters inspired by the board by declaring them Saints and co-opting religious iconography:

Likewise, on Dogolachan, users honour the saint acts (actum sanctus) of those they call saint men (homini sanctus), like Wellington Rodrigues, the perpetrator of the Rio de Janeiro Massacre. While the attacks inspired by this site have not garnered widespread global attention, Dogolachans users see themselves as members of an international movement, since they also award this title to foreign murderers, like Elliot Rodgers and Anders Breivik

On June 16, 2018, Dogolachan moderator Andr Luiz Gil Garcia, known online s Kyo, posted about his suicidal feelings. He then went out and sexually harassed a young woman, Luciana de Jesus do Nascimento. The womans response to the harassment was not to his liking, so he shot her in the back of the head as she tried to get away from him. Andr fled the scene and committed suicide when the police arrived. The victim would die twenty days later as a result of her injuries.

On the original thread, printed below, Anes (a self-deprecated version of the word anon that mingles its meaning with the Portuguese translation for people with dwarfism) lamented that Garcia had not been able to kill more women. In the months following the murder/suicide, the rhetoric on Dogolachan grew more violent and radical.

Translation: Kyo here folks. A note for everyone: I am quitting this world. The impures do not touch me. It was good while it lasted, but I have not been feeling a part of this world anymore. the sorrow I feel made me blue for life. To those that hurt me I curse you while searching for you in hell, I will be watching over the pure ones. Marcelo, when you get out of prison, be happy, something that I was never able to do.

Many of the members began referring to themselves as falhos, or flawed, a term which seems to have broadly similar connotations on Dogolachan as incel does in English-language chans. Falhos saw their lives as essentially over, and urged each other to take the scum with you or take the cattle with you, when committing suicide, as it is written in the highlighted part above.

8chans /pol board is well known for its role in inspiring at least three mass shootings. After the El Paso shooting in the summer of 2019, the website was forced off of the Internet under the weight of public outrage though it is doing its damnedest to come back.

Dogolachan is still online, albeit in the deep web due to Mello transferring control of the site to other people when he was sent to prison for a variety of crimes, including transmission of pedophilic images, incitement to commit crimes and terrorism.

After Mello was finally sentenced to 41 years behind bars, the chan, nonetheless, continued. Over the years, it has evolved its own repertoire of terror tactics that allow it to function as something very much like a melting pot for terrorists, creating an atmosphere of what some are calling stochastic terrorism.

The Suzano Massacre in March, 2019, for example, was carried out by two young men who are widely believedalthough not confirmedto have been channers. The only proof of their involvement are the statements made by one of the anonymous administrators in the forum itself on the day of the massacre, saying that the killers were definitely members. No further proof was presented, but the media was thirsty for any answers that could help complete the picture.

In the main Dogolachan board, /b/, journalists found a thread with a screengrab of a suspected secret board inside the forum. In the screengrab, dated seven days before the massacre, the killers thanked the administrator in helping them plan their rampage, stating they would post a secret warning in the form of music lyrics before acting. The screengrab and translation are as follows:

Translation: Thanks for the counseling and the orientation DPR (the administrator). We hope to not commit this act in vain. We, and mainly the precinct (Dogolachan) will be cited and remembered. We were born flawed but will go out as heroes. This contact brought us everything according to plan. We were flabbergasted with the quality, Hollywood like. Unfortunately there were no places to test and we will do it naturally, on the spot. Stay with God, my mentor. The sign will be music and 3 days later well be with God, together with our 7 virgins. We will take this message with us.

Two days before the shooting, someone translated and posted the lyrics of Foster The Peoples hit Pumped Up Kicks which is sung from the perspective of a troubled young person with homicidal thoughts and is frequently described as a song about school shootings and this was interpreted by the press and the Brazilian online community as a confirmation of their suspicions:

Even though no news outlet nor the police could confirm the existence of this secret board and its content, the attack is to this day connected to Dogolachan, which widely celebrated the massacre. The chan moderators claim that the audience of their deep web website (only accessible via a Tor browser) skyrocketed since Suzano due to the press bringing attention to their forum.

It is possible that members fabricated the connection between the chan and the massacre to achieve Lulz (basically, for fun). Its also possible they co-opted the shooting to raise the profile and notoriety of their site, so future threats made by members would be taken more seriously. Police investigating the Suzano case confirmed that the shooters were assisted in the planning stage by another minor (now detained) who did not participate in the attack, and who told journalists that the killers did not know what Dogolachan was.

This same tactic was used later, in August, when members of the forum planned to falsify the authorship of a school attack. They suggested members to retroactively create a fake post in order to bait the school, the police, and the press into believing a channer had forewarned his friends about an imminent massacre.

Its also known that the individuals involved were deeply influenced by the Columbine shooting, which has inspired dozens of copycat attacks around the world. Just this October, a Florida woman was arrested with 24 pipe bombs. Materials found at her house indicated an obsession with the crime.

Its important to remember that these massacres and threats of massacres are all part of a connected campaign of international fascist violence, even though the movement behind these killings is completely decentralized. It consists of different nodes, including 8chan and Dogolachan, which work in predictable ways. After Christchurch, 8chan users took to giving one another advice on weaponry and bomb-making tactics:

Meanwhile, in the immediate wake of the Suzano Massacre, a user on Dogolachan posted this question: How can I engage in such a Saint Act without money or guns?. The main collective wet dream of the channers, according to screengrabs provided by Lola Aronovich, is easier access to guns and ammunitions. Historically, these have been very hard to acquire legally in Brazil.

Translation of highlighted parts: Elliot Rodgers life was not in vain. It motivated others and opened the hearts for a beta uprising. Do not commit suicide yet, NOT NOW. Wait for Bolsonaro to legalize gun carryingDegeneration will always happen, and more and more will occur. Whenever youve done everything you want with your life, get a gun and shoot the scum. Die fighting the cops. And always shoot women to KILL. The life of a man has no value in matriarchal society. A 7/10 whore is worth more than a 1000 betas. The world revolves around them.

Those regulations are currently being relaxed by President Jair Bolsonaro. The far right politician was passionately supported by channers long before he even launched his campaign due to his history of hateful, misogynistic, racist and anti-left statements. Marcelo Mello, the founder, even created a fork of litecoin called Bolsocoin to be used by channers.

According to UOL, after Suzano, at least 18 universities throughout Brazil received threats of all types, mostly explained by the copycat effect. Not all of them could be directly linked to Dogolachan, but at least six have been independently confirmed by the authors as tracing back to the forum or its users.

In fact, Suzano is just another chapter in a broader campaign that Dogolachan users have embarked on since the original site owner began acting out in criminal ways in 2005. This harassment against individuals and institutions have been unprecedented in its scope and scale, at least in Brazil, as Safernet claims showed.

All the hyperlinks belowexcept for threeoriginated in the Brazilian press and were translated automatically by Google. This is just a selection of the most pertinent threats, not a comprehensive list:

Sept, 23, 2016: Federal University of Minas Gerais A Dogolachan user posts a direct threat, which includes a picture of the Columbine shooting and expresses a desire to target leftists. The perpetrator states his desire to kill men and torture women. Many students refuse to attend class, for several days. Security at the school is heightened.

May 29, 2017: New York City, Atlanta, Asheville (NC) Dozens of bomb threats are faxed to seemingly random businesses, demanding $25,000 in ransom. Emerson Setim (Mellos former partner) is identified in the faxes as the sender. But this is almost certainly not the case. Setim and Mello had a well-known falling out after their time in jail and these faxes were likely an act of revenge against Emerson. Several businesses are evacuated as a result of the threats.

March 21, 2019: Federal University of Rio Grande do Sul A threat written directly by someone posting in Dogolachan. After a post threatening a massacre somewhere in the state of Rio Grande do Sul, a fellow channer suggests the UFRGS university as a target, citing supposed security breaches. Even though the institution does not cancel classes or activities, many teachers and students skip classes for several days. Security is reinforced.

April 10, 2019: Federal University of Paran Threat directly written by someone posting in Dogolachan, showing a picture of a handgun and listing places where the purported shooter planned to execute black people, women, and people with AIDS. All classes are postponed for one day.

June 8 2019: Federal University of Pernambuco Threat directly written by someone posting in Dogolachan. Targets leftist students and claimed to have an AR-15 to kill the stoners that criticize Bolsonaro. Classes are not postponed, but many students choose to skip classes.

June 16, 2019: Federal University of Espirito Santo Threat directly written by someone posting in Dogolachan. Shows an image of a handgun and of known places at said university, targeting leftist students. Security is reinforced, and more students choose to skip classes.

October 14, 2019:UNICARIOCA (CARIOCA UNIVERSITY) A small private university in Rio receives direct threats of a massacre via Dogolachan. A Dogolachan user says they would go to campus to supposedly get revenge on everyone who bullied them, showing off pictures of weapons.

The anons of Dogolachan have committed far fewer killings than their ideological comrades on 8chans /pol board. Even their supposed milestone crime the Suzano school massacre is not confirmed to have been their doing.

But despite a relative lack of actual violence on their record, Dogolachans users have managed to mount a high pressure campaign of harassment against their enemies. Universities and businesses have been shut down, classes disrupted, and lives severely impacted by a mixture of coordinated attacks from its core members and a decentralized campaign of intimidation against generalized foes, such as leftists, women or any progressive figure.

What Dogolachan seems to have done, very successfully, is to build a reputation that other disaffected and violent people identify with. This has allowed them to outsource their brand and their portfolio of attacks in the press and social media. Now individuals make threats in Dogolachans name simply because they know they will get a reaction. We see evidence of this with the template threat copied by a criminal that menaced the Federal University of Gois (UFG).

In this, the anes of Dogolachan may have found a way to artificially magnify the ghosts of past massacres, in Brazil and elsewhere. They celebrate this reputation in much the same manner 8chan has done, by adopting the slogan Embrace Infamy. For Dogolachan, even unfulfilled threats produce real consequences to real people and institutions. Given the difficulty of acquiring firearms in Brazil, it may be statistically unfounded to fear massive attacks like El Paso or Poway from Dogolachans users. But countless anes are waiting in the wings for laxer gun laws, so they can graduate from threats to body counts.

Research and concept by Leonardo Coelho, edited and organized by Robert Evans.

Read this article:

Dogolachan And The Ghost Of Massacres Past - bellingcat - bellingcat

How Microsofts censorship of GitHub will affect Bitcoin – Decrypt

Software hosting platform Github yesterday took down the APK of a protest organization app utilized by the Tsunami Democrtica group advocating Catalonian independencefollowing a court request.

This marks another time that GitHubwhich was acquired by Microsoft in June, 2018has censored its platform, after it suddenly blocked developers in Iran, Syria and Crimea from using its services. But theres a wider issue here for the entire cryptocurrency ecosystem. Github is a repository for almost every piece of code in the cryptocurrency sector. And some developers think this is such a worrying problem that it is only a matter of time before the Bitcoin repository will have to be moved.

"It only took a few months for Microsoft to destroy GitHub culture and openness. Such a shame," Andreas Antonopoulos, author of Mastering Bitcoin, tweeted.

Antonopoulos pointed out that the underlying protocol, known as git is decentralized, which means Microsoft cant stop it with the press of a button. But, what he described as the collaboration platform is still on GitHubthe place where everyone discusses what pieces of code should be implemented and requests to add new code are made. And if this were to happen, it would be a nuisance. Wouldn't be surprised if GitHub de-platformed Bitcoin devs at some point, he added.

In response, a GitHub spokesperson told Decrypt that compliance with government officials was sometimes mandatory to ensure operational integrity within a given territory. He said, Although we may not always agree with those laws, we may need to block content if we receive a valid request from a government official, so that our users in that jurisdiction may continue to have access to GitHub to collaborate and build software."

Be the first to get Decrypt Members. A new type of account built on blockchain.

But this hasnt come as a surprise to Bitcoin developers. Wladimir van der Laan tweeted back in June, 2018, that the Bitcoin repository should move because of Microsofts acquisition. However, he added, No real hurry, but I expect this is the beginning of a long painful road of [GitHub] toward [obsolescence], possibly ending the same way as codeplex did. (Codeplex being a code sharing platform that Microsoft shut down in 2017)

But if the Bitcoin repository on GitHub should move, where should it go?

One option is GitHubs main competitor, GitLab. Its an open source project and has tools for self-hosting repositories, enabling teams to keep full control over their own projects.

Some cryptocurrencies have already moved over. Last year, Sia cryptocurrency migrated over to GitLab and hasnt looked back since.

GitHub has become something of a backbone for open source projects over the past few years. This is ironic, as GitHub itself is closed source and centralized, David Vorick, CEO of Sia, said, in a blog post at the time. GitLab on the other hand has aligned themselves much more with the true open source philosophy.

Alternatively, there is a version of the Bitcoin repository available on Tor, maintained by van der Laan himself. Tor is a network for anonymous communication, accessed via the Tor browser.

Other developers are experimenting with peer-to-peer technology to fill the void beginning to open in the light of Githubs recent moves. Developers have built platforms like Radicle, which offers peer-to-peer code communication but is still in beta mode.

GitHubs actions serve as a warning to those building decentralized platforms, that they should stay wary, to prevent elements of centralization from seeping through. On Tuesday, the founder and inventor of the World Wide Web, Sir Tim Berners Lee, reminded us that, since it started, the first Internet has been constantly subverted and that its time to fight for the web we want. The time is now.

Read more from the original source:

How Microsofts censorship of GitHub will affect Bitcoin - Decrypt