By Habiba Rashid
The data leak originated from a database owned by the Southern Association of Independent Schools, Inc. (SAIS).
This is a post from HackRead.com Read the original post: Data Leak Exposes 572 GB of Student, Faculty Info from Accreditation Org

**IN SUMMARY**

*   **It was a database misconfiguration-related data leak.**
*   **The sensitive information spanned from 2012 to 2023.**
*   **The data leak contained 512 GB of data, with 682,438 records.**
*   **The database was open to public access without any password.**

Cybersecurity researcher Jeremiah Fowler has revealed a significant data breach that has raised serious concerns about the security of sensitive information in the education sector. Fowler stumbled upon an unprotected database containing a staggering 682,438 records related to educational institutions.

The exposed data belonged to the Southern Association of Independent Schools, Inc (SAIS), a prominent non-profit organization providing support to schools and educators across the United States and several other countries.

**The Scope of the Breach:**

The data leak contained a vast array of sensitive information, spanning from 2012 to 2023, making it a treasure trove for potential cyber criminals. The compromised documents encompassed multiple categories, including student and teacher records, health information, social security numbers (SSN), active shooter and lockdown notifications, school maps, financial budgets, and more.

Of particular concern were confidential third-party security reports, assessing weaknesses in school security, camera locations, access points, and other vital information that could pose a real-world security risk to students and faculty.

Documents in the leaked data (Image: Jeremiah Fowler – Website Planet)

**Sensitive Records Exposed:**

The sheer volume of data in the breached database totalled an astounding 572.8 GB, comprising various file formats, such as PDF, Excel, PPTX, doc, docx, png, jpg, and pages.

According to Fowler’s blog post, among the exposed records, were personally identifiable information (PII) and private medical information of students, teacher background checks, salary details, and interview information. Moreover, the breach revealed budgets, financial reports, vehicle registrations, insurance policies, tax records, training documents, and numerous other miscellaneous files.

**Potential Risks and Implications:**

The exposed data presented a host of potential risks, ranging from straightforward extortion to more sophisticated identity theft and financial crimes. Criminals with access to such sensitive records could exploit the information for fraudulent activities, including obtaining loans or credit in the name of educational institutions.

Additionally, the leaked emergency response plans and school security details could be used by malicious actors to plan attacks on schools, endangering the safety of students and staff.

**Recommended Measures for Enhanced Security:**

To mitigate future risks, schools, educational organizations, and accreditation bodies must prioritize implementing basic security protocols, such as firewalls, encryption, and multi-factor authentication.

Furthermore, conducting regular staff training on cybersecurity best practices and establishing comprehensive incident response plans can better address and manage data breaches, should they occur.

**SAIS’s Response and Data Protection Compliance:**

Upon receiving the responsible disclosure notification from Jeremiah Fowler, SAIS acted swiftly to secure the exposed database and expressed gratitude for the researcher’s timely warning. However, it remains unclear whether the potentially affected individuals or relevant authorities were promptly notified of the data exposure.

It is essential for educational institutions to adhere to data protection laws, including the Family Educational Rights and Privacy Act (FERPA) and the Children’s Online Privacy Protection Act (COPPA), to safeguard sensitive information and uphold the privacy of students, teachers, and parents.

**RELATED ARTICLES**

1.  100s of schools at risk after Magecart attack on Wisepay
2.  13-year-old student arrested for hacking school computers
3.  School hackers steal data of half a million students and staff
4.  Malware found in UK Govt-funded laptops for homeschoolers
5.  Iranian APT group hits schools, universities in phishing attacks

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Data Leak Exposes 572 GB of Student, Faculty Info from Accreditation Org

By Waqas
In a message on its dark web breach blog, Cl0p Ransomware claims that The company (Deloitte) doesn't care about its customers; it ignored their security.
This is a post from HackRead.com Read the original post: Cl0p Ransomware Strikes Deloitte, Company Refutes Breach

**IN SUMMARY**

*   **The Cl0P ransomware gang claims to have breached Deloitte.**
*   **Deloitte has refuted the claims made by the gang regarding the breach.**
*   **The Cl0P ransomware gang is actively exploiting the MOVEit vulnerability.**
*   **Deloitte is among the firms using the vulnerable MOVEit Transfer software.**

The infamous **Cl0p Ransomware** has struck again, this time claiming to have targeted the multinational professional services network Deloitte. The ransomware gang, known for its high-profile attacks, claimed responsibility for breaching Deloitte’s infrastructure in a recent post on its dark web data breach blog. While Deloitte’s response refutes the claims, the incident highlights the ongoing risk posed by the **MOVEit vulnerability**.

Deloitte’s denial of the breach comes with a strong statement from the company’s Global spokesperson. In an exclusive response to Hackread.com, Deloitte stated that they found no evidence of any breach of client data during their analysis.

According to Cl0P, “The company doesn’t care about its customers, it ignored their security!!!” (Screenshot: Hackread.com)

The company took immediate action upon discovering the zero-day vulnerability, applying security updates and mitigating actions as per the vendor’s guidance. Furthermore, Deloitte claimed that their global network’s use of the vulnerable MOVEit Transfer software is limited, and their analysis revealed no impact on client data.

> Immediately upon becoming aware of this zero-day vulnerability, Deloitte applied the vendor’s security updates and performed mitigating actions in accordance with the vendor’s guidance. Our analysis determined that our global network use of the vulnerable MOVEit Transfer software is limited. Having conducted our analysis, we have seen no evidence of impact on client data.
> 
> Deloitte Global Spokesperson

The Cl0p Ransomware group has been on a hacking spree, exploiting the MOVEit vulnerability to target major companies worldwide. Previous victims include renowned names like PWC business consulting firm, TD Ameritrade, Aon, Kirkland, and Ernest & Young, among others. The gang is now also notorious for **using clearnet websites to publish stolen data** from its victims.

**MOVEit vulnerability**

The MOVEit vulnerability is a critical security flaw that was found in the MOVEit Transfer software, which is a managed file transfer (MFT) solution developed by Progress Software. The vulnerability allows attackers to execute arbitrary SQL commands on the MOVEit Transfer server, which can be used to steal data, install malware, or take control of the server.

The vulnerability was first disclosed in May 2023, and Progress Software released a patch to address it on June 1. However, by that time, the vulnerability had already been exploited by the CL0P ransomware group to target hundreds of organizations around the world.

As of July 2023, it is estimated that more than 200 organizations have been targeted in the MOVEit attacks. These organizations include government agencies, financial institutions, healthcare providers, and tech companies. The attacks have resulted in the theft of millions of personal and financial records, as well as the disruption of critical business operations.

The MOVEit vulnerability is a serious reminder of the importance of keeping software up to date with the latest security patches. Organizations that use MOVEit Transfer should immediately apply the patch that was released by Progress Software to protect themselves from attack.

**MOVEit vulnerability Facts**

*   The vulnerability is a SQL injection vulnerability, which means that attackers can inject malicious SQL code into the MOVEit Transfer server.
*   The vulnerability affects all versions of MOVEit Transfer prior to 2023.2.1.
*   The vulnerability can be exploited to steal data, install malware, or take control of the MOVEit Transfer server.
*   The vulnerability was first disclosed in May 2023, and Progress Software released a patch to address it on June 1.
*   As of July 2023, it is estimated that more than 200 organizations have been targeted in the MOVEit attacks.

Nevertheless, as the investigation into the Deloitte breach continues, the cybersecurity community and affected organizations remain vigilant, keeping a close eye on Cl0p Ransomware’s actions and fortifying their defences against potential vulnerabilities.

**RELATED ARTICLES**

1.  Clop ransomware leak 4.75 GB data on Indiabulls conglomerate
2.  IT Security firm Qualys extorted by Clop gang after data breach
3.  UK’s Ofcom confirms attack as PoC exploit for MOVEit is released
4.  Clop ransomware hits Software AG, demands $20 million+ ransom
5.  Clop ransomware gang leaks Jones Day law firm data on dark web

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Cl0p Ransomware Strikes Deloitte, Company Refutes Breach

By Habiba Rashid
Internet-Connected Gym Equipment Raises Concerns Over Security Vulnerabilities!
This is a post from HackRead.com Read the original post: Vulnerabilities exposed Peloton treadmills to malware and DoS attacks

The security vulnerabilities found in Peloton treadmills left them susceptible to a wide range of attacks, jeopardizing user data and opening the door to unauthorized access.

In the age of advancing technology and increasing connectivity, internet-connected gym equipment has gained significant popularity among fitness enthusiasts. However, this convenience comes with a new concern – potential security threats.

As the usage of these smart workout machines rises, experts have begun to explore their vulnerabilities, with the widely known Peloton Treadmill coming under scrutiny. It is worth noting that this is not the first time Peloton products have been found to have security vulnerabilities. Previously, researchers found a vulnerability that **exposed Peloton bikes and treadmills to malware attacks**.

The cybersecurity researchers at Check Point Technologies conducted an investigation into the security vulnerabilities associated with internet-connected gym equipment, focusing on the Peloton Treadmill. The findings revealed potential risks in three main attack vectors: the Operating System, the Applications, and the Malware.

**The Operating System:**

The Peloton Treadmill operates on the Android 10 operating system, which may be susceptible to over 1100+ potential vulnerabilities from recent years. Additionally, leaving USB debugging enabled could increase the attack surface, making it a prime target for malicious hackers seeking to compromise sensitive information.

**The Applications:**

Apps on the treadmill were found to have certain security flaws, such as rooting detection mechanisms that could be bypassed and hardcoded sensitive information stored in cleartext. These vulnerabilities could lead to unauthorized access, exploitation of personal data, and even denial-of-service attacks (**DoS attacks**).

**Malware:**

According to CPR’s **blog post**, The presence of standard APIs in the treadmill’s operating system poses a risk of malware installation, potentially turning the device into a zombie IoT that can be remotely controlled by attackers. Such a compromise could result in eavesdropping attacks and unauthorized access to the local area network.

The potential security risks are not limited to technical aspects alone. A hypothetical scenario was presented, where a high-profile individual’s treadmill is targeted by a malicious actor. Social engineering tactics were used to gain access to the individual’s network, paving the way for various cyber attacks, including stealing personal information, launching ransomware attacks, and accessing corporate credentials.

For example, during their testing, the researchers successfully compromised the **built-in webcam** and microphone in one of the Peloton treadmill models by using a mobile remote access tool (MRAT). This, effectively converted the treadmill into a “zombie” Internet of Things (IoT) device, under remote control from a command and control (C&C) center.

The MRAT provided the researchers with unfettered access to the treadmill’s functionalities, enabling them to not only record audio and capture images but also access geolocation data and exploit the network stack. Such unauthorized access allowed the researchers to infiltrate the local area network and carry out a multitude of malicious activities.

This is the image captured by researchers through the MRAT (Image: CPR)

**Responsible Disclosure**

The security findings were responsibly disclosed to Peloton, who acknowledged the reported issues. They emphasized that the concerns raised require an attacker to have physical access to the device and stated their commitment to top-level security.

To ensure the **security of IoT devices**, including the Peloton Treadmill, a comprehensive cybersecurity strategy is vital. Organizations can leverage solutions like Check Point’s Quantum IoT Protect, which enhances IoT device security by addressing vulnerabilities and protecting against various cyber threats.

**RELATED ARTICLE**

1.  Electronic Skateboards Are Easy To Hack
2.  Hackers send explicit messages to riders on hacked e-scooters
3.  Exercise tech firm Kinomap leaks 40GB database with 42M records
4.  US Military Targeted by Unsolicited Smartwatches Linked to Breaches
5.  Hackers Can Disable House Arrest Ankle Bracelet without Raising Alert

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Vulnerabilities exposed Peloton treadmills to malware and DoS attacks

By Owais Sultan
Unlocking the Power: Key Benefits of Java and Hiring a Java Web Application Development Company.
This is a post from HackRead.com Read the original post: Benefits of hiring a Java web application development company

In this article, we will explore the various advantages of hiring a Java web application development company and how it can contribute to the growth and success of your business. Let’s dive into the ins and outs of it!

Are you considering developing a Java web application? While you may have the skills to do it yourself, have you considered the benefits of hiring a professional Java web application development company?

Java is one of the most widely used programming languages for web application development. Developing a high-quality, efficient, and secure Java web application requires expertise and knowledge of the latest technologies and best practices.

Hiring a professional Java web application development company can ensure that your project is completed successfully and meets your specific requirements.

In today’s competitive digital landscape, having a well-designed and functional web application is crucial for the success of your business. Hiring a Java web application development company can provide you with numerous benefits, including access to a team of experienced developers, cost and time efficiency, and the ability to focus on your core business activities.

In this article, we will explore the various advantages of hiring a Java web application development company and how it can contribute to the growth and success of your business. Are you interested in web development and looking to expand your programming skills? If so, then learning Java web application development might be the next step for you.

Java is a versatile programming language that is widely used for building robust and scalable web applications. In this article, we will provide an introduction to Java web application development and guide you on how to get started in this exciting field.

**Understand the Basics of Java**

Before diving into web application development, it is essential to have a solid understanding of the Java programming language. Familiarize yourself with the syntax, data types, control structures, and object-oriented programming concepts. There are numerous online tutorials, courses, and books available that can help you learn the fundamentals of Java.

**Learn Java Servlets and JavaServer Pages (JSP)**

Java Servlets and JSP are the building blocks of Java web applications. Servlets are Java classes that handle HTTP requests and generate responses, while JSP allows you to create dynamic web pages by embedding Java code within HTML. Mastering these technologies will enable you to create interactive and dynamic web applications.

**Choose a Development Framework**

To streamline the development process and enhance productivity, it is recommended to use a Java web development framework. Some popular frameworks include Spring MVC, JavaServer Faces (JSF), and Apache Struts. These frameworks provide a set of libraries, tools, and best practices that simplify web application development and promote code reusability.

**Set Up a Development Environment**

To start building Java web applications, you need to set up a development environment. Install Java Development Kit (JDK) and an Integrated Development Environment (IDE) such as Eclipse, IntelliJ IDEA, or NetBeans. These tools provide a user-friendly interface, code editor, and debugging features that facilitate the development process.

In today’s digital age, security is of utmost importance, especially when it comes to web applications. With the increasing number of cyber threats and data breaches, implementing secure authentication and authorization in Java web applications has become a necessity. This article will guide you through the steps to ensure that your Java web application is protected and only accessible to authorized users.

*   **Understand the Basics of Authentication and Authorization:** Authentication is the process of verifying the identity of a user, while authorization determines what actions and resources a user is allowed to access. It is crucial to have a clear understanding of these concepts before implementing security measures in your Java for web development. 
*   **Use a Secure Password Storage Mechanism**: One of the most common security vulnerabilities is storing passwords in plain text. Instead, use a secure password storage mechanism, such as hashing algorithms like bcrypt or PBKDF2, to store passwords securely. These algorithms convert passwords into irreversible hashes, making it difficult for attackers to retrieve the original password.
*   **Implement Two-Factor Authentication (2FA)**: Two-factor authentication (2FA) adds an extra layer of security by requiring users to provide two separate forms of identification, typically a password and a one-time code sent to their mobile device. Implementing 2FA can significantly enhance the security of your Java web application and protect against unauthorized access.

**RELATED ARTICLES**

1.  What Programming Languages Do Ethical Hackers Use?
2.  How to Teach Your Child Coding: A Gift for Their Digital Future
3.  How to Create a Mobile Application for Android OS Step by Step?
4.  Top Benefits of Using Flutter for Cross-Platform App Development
5.  Development of Corporate Applications Based on Artificial Intelligence

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Benefits of hiring a Java web application development company

By Habiba Rashid
So far, Spyhide app collected 3.3 million texts and 1.2 million call logs from compromised Android devices.
This is a post from HackRead.com Read the original post: Iranian Stalkerware ‘Spyhide’ Steals Data from 60,000 Android Devices

Cybersecurity researcher Maia Arson Crimew, who identified the shady data collection of the Spyhide app, noted that the compromised Android devices span across every continent, with Europe, Brazil, and the US being the most heavily targeted regions.

In recent news, an Iranian stalkerware app named Spyhide has been silently gathering sensitive data from over 60,000 compromised Android devices worldwide since 2016.

The app, which functions as a stealthy phone surveillance tool, silently uploads personal data including contacts, messages, photos, call logs, and precise location in real-time.

Swiss developer and cybersecurity researcher maia arson crimew exposed the extensive data breach after gaining access to the app’s poorly coded backend databases.

Stalkerware apps, like Spyhide, are designed to spy on individuals secretly, posing a significant threat to personal privacy and safety. While some such apps market themselves as parental monitoring tools, they are commonly used by domestic violence abusers to stalk and monitor their partners without consent.

Upon investigating Spyhide’s poorly secured web-based dashboard, crimew discovered a massive trove of stolen phone data. TechCrunch, having verified the information, found that the compromised Android devices span across every continent, with Europe, Brazil, and the US being the most heavily targeted regions.

Among the alarming findings were more than 3,100 compromised devices in the US, with one device having uploaded over 100,000 location data points alone. Furthermore, the database contained records of around 750,000 users who had signed up to use Spyhide but did not necessarily compromise a phone or pay for the service.

The stolen data amounted to over 3.3 million text messages, including sensitive information such as 2FA codes and password reset links, as well as 1.2 million call logs and 312,000 call recording files. Additionally, as TC noted, the database held details of 925,000 contact lists, 382,000 photos, and an astonishing 6,000 ambient recordings surreptitiously collected from victims’ microphones.

The developers behind Spyhide attempted to conceal their identities, but the source code revealed two Iranian developers, Mostafa M. and Mohammad A., as potential culprits. Despite numerous attempts, both developers remained unresponsive to TechCrunch’s inquiries.

While Google Play Store bans stalkerware apps, Spyhide’s sideloading approach allowed it to evade Google’s security checks. However, Google Play Protect can serve as a protective measure against such threats for users who enable it.

The investigation brought to light Spyhide’s operations and led to the app’s domain becoming inaccessible shortly after. The hosting provider, German-based Hetzner, asserted that they do not permit the hosting of spyware.

With stalkerware posing a severe threat to personal privacy and security, it is crucial for users to remain vigilant and cautious when downloading apps from unverified sources. Awareness and adoption of protective measures like Google Play Protect can help thwart potential threats posed by stalkerware and malicious apps.

In conclusion, the exposure of Spyhide’s massive data breach highlights the need for increased security measures, user awareness, and stringent regulations to protect against the abuse of stalkerware and uphold personal privacy rights in the digital age.

**RELATED ARTICLES**

1.  Android Stalkerware MonitorMinor spies, steals & evades
2.  Hacker erase 1TB of data from spyware developers server
3.  Google Removes Swing VPN Android App Exposed as DDoS Botnet
4.  Popular Android Screen Recorder iRecorder App Revealed as Trojan
5.  Goldoson Android Malware Found in 60 Apps with 100M Downloads

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Iranian Stalkerware ‘Spyhide’ Steals Data from 60,000 Android Devices

By Deeba Ahmed
The new discovery could have far-reaching implications for Physical Access Control Systems and sensitive facilities.
This is a post from HackRead.com Read the original post: AXIS A1001 System Flaws Expose Secure Facilities to Unauthorized Access

The high-severity vulnerability has been confirmed by the Cybersecurity and Infrastructure Security Agency (CISA), while Axis Communications has issued security patches, urging consumers to install them.

Leading OT cybersecurity firm OTORIO has discovered (PDF) a high-severity heap-based buffer overflow vulnerability in the AXIS A1001 system from Axis Communications. This system ensures secure access control, but the vulnerability exposes sensitive networks to various risks, including remote code execution. 

For your information, Axis Communications AB is a Swedish manufacturer of network cameras, video encoders, and other surveillance products.

In an exclusive report shared with Hackread.com, the company explained that the buffer overflow flaw was discovered while communicating over OSDP. OTORIO researchers Ariel Harush and Roy Hodir wrote that the flaw is found in the pacsiod process, which handles the OSDP communications.

The high-severity vulnerability, tracked as CVE-2023-21406, allows message data to be written outside the heap-allocated buffer by appending invalid data to the OSDP message. Later, the data can be used for executing arbitrary code.

AXIS A1001 is an open, non-proprietary system designed for access management. Each door installs the controller individually, and the data is synchronized automatically between all existing system controllers. The controller support almost all RS 48 and Wiegand OSDP readers and comes with built-in software allowing access management for up to 33 controllers and an open API for larger installations.

The exploit for this flaw involves gaining physical access to the RS-48 twisted pair cable located at the rear end of an access control reader. The reader is positioned at the entrance of a security facility/perimeter. OTORIO’s researchers successfully demonstrated that a tamper protection bypass could further aggravate the risk.

What makes CVE-2023-21406 an issue of concern for the cybersecurity community is that attackers may exploit it for conducting RCE (remote code execution) on the internal access controller from outside the facility. An adversary may exploit the serial channel that enables reader-controller communication to gain unauthorized access and open doors. They may also tamper with logs on the access controller. In addition to that, the flaw can serve as a potent gateway to the internal IP network regardless of its air-gapped or segmented status.

The vulnerability impacts AXIS A1001 version 1.65.4 or earlier and is categorized as high severity with a CVSS score of 7.1. AXIS has already released a patch for the impacted devices to improve the OSDP message parser’s robustness. Users must immediately update the AXIS device software available here.

The research highlights the potential risks fortified OT networks could be exposed to. In its security advisory published on 25 July 2023, the Cybersecurity and Infrastructure Security Agency (CISA) in the United States confirmed this vulnerability and noted that commercial entities must minimize network exposure for control system devices/systems and ensure these aren’t accessible through the internet.

Nevertheless, these devices/systems must be isolated from business networks and protected via firewalls. Moreover, VPNs should be preferred when remote access is required.

1.  Stellar Cyber Safeguards OT Environments Alongside IT
2.  A Malware can fully compromise building control systems
3.  100s of Russian Building Controllers Can be Remotely Hacked
4.  Controller flaws let hackers physically damage moving bridges
5.  Grids to Airports: TETRA Radio Hacking Risks Global Infrastructure

AXIS A1001 System Flaws Expose Secure Facilities to Unauthorized Access

By Waqas
Ilya Sachkov was accused of treason by Russian authorities for providing classified cybersecurity data to a foreign intelligence firm.
This is a post from HackRead.com Read the original post: Group-IB Founder Ilya Sachkov Jailed for 14 Years in Russia

****Despite the charges, Ilya Sachkov pleaded not guilty to all accusations, while Group-IB expressed their disappointment over the trial, describing it as “an unreasonably rushed trial that was held entirely behind closed doors.”****

Ilya Sachkov, a renowned cybersecurity expert and founder of Group-IB, a Singapore-based cybersecurity firm, has been convicted of treason and sentenced to 14 years in prison by the Russian government.

The verdict, **reported** by the Russian news agency TASS, has sent ripples through the cybersecurity community, raising concerns about the challenges faced by independent cybersecurity firms.

Ilya Sachkov (Image credit: Group-IB)

Group-IB, once a Russian cybersecurity company, had exited from Russia in April 2023, leaving Sachkov no longer associated with the Singaporean branch. However, it is crucial to note that he still retains ownership of shares in its Russia-based operation.

Sachkov, known for his remarkable contributions to the industry and efforts in combatting cyber threats, had previously received awards from Russian President Vladimir Putin for his outstanding work in 2019. Nevertheless, **in September 2021**, he was detained by the Russian Federal Security Service on treason charges.

The allegations centered around accusations of providing the U.S. government with classified cybersecurity data and sensitive information about the notorious “Fancy Bear” hackers, believed to have influenced the 2016 United States presidential election. Despite the charges, Ilya Sachkov **pleaded not guilty** to all accusations.

The verdict has drawn significant attention, with Group-IB expressing their disappointment over the trial, **describing it** as “an unreasonably rushed trial that was held entirely behind closed doors.” The lack of transparency in such a high-profile case has raised concerns about the fairness of the judicial process.

This event highlights the challenges faced by cybersecurity firms globally, striving to operate independently and provide valuable insights to safeguard against cyber threats. **Group-IB itself recently revealed** that it had become a prime target of Chinese hackers, underscoring the growing concern of state-backed actors limiting the freedom of information security research.

The case is reminiscent of previous incidents in other countries where cybersecurity experts have faced legal repercussions for their efforts to protect digital infrastructure. In Hungary, an ethical hacker and computer specialist **was accused** of infiltrating a leading telecom firm’s database, Magyar Telekom, while attempting to report security vulnerabilities. Such actions emphasize the delicate balance between recognizing ethical hackers’ vital role and ensuring compliance with legal frameworks.

Similarly, in the United States, cybersecurity company Kaspersky, with its Russian roots, has encountered resistance from both the government and military establishment. In March 2022, the company was **added to the list of firms** deemed threats to the national security of the United States.

As the global cybersecurity landscape evolves, the case of Ilya Sachkov and Group-IB serves as a reminder of the challenges faced by cybersecurity experts and firms in their pursuit of securing digital spaces while navigating complex geopolitical landscapes.

The verdict raises questions about the future of independent cybersecurity research and the delicate relationship between infosec professionals and governments worldwide.

**RELATED ARTICLES**

1.  Legendary Hacker Kevin Mitnick Passes Away
2.  Kaspersky Willing to Share Its Source Code with US Govt
3.  German Authorities Warn Against Using Kaspersky Products

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Group-IB Founder Ilya Sachkov Jailed for 14 Years in Russia

By Owais Sultan
Are you considering developing a Java web application? While you may have the skills to do it yourself,…
This is a post from HackRead.com Read the original post: Benefits of hiring a Java web application development company

Are you considering developing a Java web application? While you may have the skills to do it yourself, have you considered the benefits of hiring a professional Java web application development company?

Java is one of the most widely used programming languages for web application development. Developing a high-quality, efficient, and secure Java web application requires expertise and knowledge of the latest technologies and best practices. Hiring a professional Java web application development company can ensure that your project is completed successfully and meets your specific requirements.

In today’s competitive digital landscape, having a well-designed and functional web application is crucial for the success of your business. Hiring a Java web application development company can provide you with numerous benefits, including access to a team of experienced developers, cost and time efficiency, and the ability to focus on your core business activities.

In this article, we will explore the various advantages of hiring a Java web application development company and how it can contribute to the growth and success of your business. Are you interested in web development and looking to expand your programming skills?

If so, then learning Java web application development might be the next step for you. Java is a versatile programming language that is widely used for building robust and scalable web applications. In this article, we will provide an introduction to Java web application development and guide you on how to get started in this exciting field.

*   **Understand the Basics of Java**

Before diving into web application development, it is essential to have a solid understanding of the Java programming language. Familiarize yourself with the syntax, data types, control structures, and object-oriented programming concepts. There are numerous online tutorials, courses, and books available that can help you learn the fundamentals of Java.

*   **Learn Java Servlets and JavaServer Pages (JSP)**

Java Servlets and JSP are the building blocks of Java web applications. Servlets are Java classes that handle HTTP requests and generate responses, while JSP allows you to create dynamic web pages by embedding Java code within HTML. Mastering these technologies will enable you to create interactive and dynamic web applications.

*   **Choose a Development Framework**

To streamline the development process and enhance productivity, it is recommended to use a Java web development framework. Some popular frameworks include Spring MVC, JavaServer Faces (JSF), and Apache Struts. These frameworks provide a set of libraries, tools, and best practices that simplify web application development and promote code reusability.

*   **Set Up a Development Environment**

To start building Java web applications, you need to set up a development environment. Install Java Development Kit (JDK) and an Integrated Development Environment (IDE) such as Eclipse, IntelliJ IDEA, or NetBeans. These tools provide a user-friendly interface, code editor, and debugging features that facilitate the development process.

In today’s digital age, security is of utmost importance, especially when it comes to web applications. With the increasing number of cyber threats and data breaches, implementing secure authentication and authorization in Java web applications has become a necessity. This article will guide you through the steps to ensure that your Java web application is protected and only accessible to authorized users.

**Understand the Basics of Authentication and Authorization.** Authentication is the process of verifying the identity of a user, while authorization determines what actions and resources a user is allowed to access. It is crucial to have a clear understanding of these concepts before implementing security measures in your Java for web development. 

**Use a Secure Password Storage Mechanism.** One of the most common security vulnerabilities is storing passwords in plain text. Instead, use a secure password storage mechanism, such as hashing algorithms like bcrypt or PBKDF2, to store passwords securely. These algorithms convert passwords into irreversible hashes, making it difficult for attackers to retrieve the original password.

**Implement Two-Factor Authentication (2FA).** Two-factor authentication adds an extra layer of security by requiring users to provide two separate forms of identification, typically a password and a one-time code sent to their mobile device. Implementing 2FA can significantly enhance the security of your Java web application and protect against unauthorized access.

By Waqas
Why Coding for Kids is Vital – Importance & Benefits Explained! In an era dominated by rapid technological…
This is a post from HackRead.com Read the original post: Empowering Future Minds: The Indispensable Role of Coding for Kids

**Why Coding for Kids is Vital – Importance & Benefits Explained!**

In an era dominated by **rapid technological advancements**, the clamour for equipping the next generation with essential skills is louder than ever. Amidst this digital renaissance, an educational revolution is taking place, with an increasing number of voices advocating for coding to be an integral part of every child’s learning journey.

As we delve deeper into the importance of coding for kids, it becomes evident that this skill is not just about programming computers; it’s about empowering young minds to conquer the challenges of tomorrow.

**Fostering Creativity and Problem-Solving Skills**

Coding, at its core, is a language of innovation. It encourages creativity, turning abstract ideas into concrete reality. By introducing kids to coding at an early age, we provide them with a unique medium to express their creativity, instilling the confidence to tackle problems head-on.

Coding is essentially problem-solving in action, and learning to code equips children with the tools to break down complex issues into manageable parts, thereby honing their critical thinking skills.

Presently, numerous websites and applications offer block-based coding lessons to kids and teenagers. Popular platforms like Thunkable and **code.org** provide tailored learning experiences, allowing you to select the most suitable resource for your needs.

**Building Resilience and Perseverance**

Coding is a process riddled with trial and error, where even the most seasoned programmers face challenges and setbacks. Teaching children to code instils resilience and perseverance in the face of adversity. As they debug errors and refine their code, they learn that failure is merely a stepping stone towards success. This invaluable lesson equips them with the mental fortitude needed to embrace challenges in any area of life.

**Enhancing Computational Thinking**

**According to** ISTE, Computational thinking is the bedrock of coding, encompassing problem decomposition, pattern recognition, abstraction, and algorithm design. When kids learn to code, they unknowingly develop and enhance their computational thinking skills. This type of thinking goes beyond coding and permeates other subjects and real-life scenarios. From mathematics to science to everyday decision-making, the ability to think computationally empowers kids to approach problems systematically and efficiently.

**Future-Proofing Career Prospects**

The job market is evolving at breakneck speed, and technology continues to disrupt traditional industries. By introducing coding into the educational landscape, we equip children with the tools to navigate the shifting job market of the future. Whether they end up as software engineers or not, the understanding of coding opens doors to a myriad of opportunities across various sectors, where digital literacy is increasingly becoming a prerequisite.

**Fostering Collaboration and Communication**

In the digital age, collaboration and communication have transcended geographical boundaries. Coding encourages teamwork, as young coders often collaborate on projects, sharing ideas and learning from one another.

Moreover, coding necessitates clear communication, as coding concepts are often conveyed through written code and explanations. These vital soft skills not only aid children in their academic endeavours but also prepare them for the interconnected global workplace.

Incorporating coding into the curriculum promotes inclusivity and diversity within the tech industry. By introducing children from all backgrounds to coding, we break down barriers and encourage participation from underrepresented groups. The more diverse the minds involved in coding, the more innovative and inclusive the solutions created will be.

In conclusion, teaching kids to code is not about creating an army of programmers, but rather about empowering them with essential skills that will serve them in any path they choose. Coding fosters creativity, problem-solving abilities, computational thinking, and collaboration – attributes that will shape these young minds into the innovators, leaders, and change-makers of tomorrow.

As educators, parents, and society as a whole, it is our collective responsibility to ensure that coding takes its rightful place in the realm of education, unlocking the full potential of future generations.

If you’re a beginner wondering **how to start coding**, there are numerous resources that can guide you through the process, suitable for all ages, not just children and teenagers. It’s essential to start with understanding the basic concepts and gradually progresses to more advanced topics. In doing so, you can build a solid foundation in coding, making it easier to pick up different programming languages and techniques in the future.

**RELATED ARTICLES**

1.  How Internet can get smarter by combining AI and ML
2.  What Programming Languages Do Ethical Hackers Use?
3.  How to Develop Complex Marketing Op with “No Code” Tools
4.  How to Teach Your Child Coding: A Gift for Their Digital Future

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Empowering Future Minds: The Indispensable Role of Coding for Kids

By Waqas
FraudGPT: Yet Another AI-Driven Chatbot Assisting Cybercriminals in Malicious Activities.
This is a post from HackRead.com Read the original post: Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime

FraudGPT is up for sale on Dark Web marketplaces apart from Telegram at a starting price of $200 per month and up to $1,700 for an annual subscription.

Recently Hackread shared **details** of a malicious chatbot, WormGPT, created to help cybercriminals carry out illegal activities. Now, another chatbot has emerged on the Dark Web called FraudGPT. It is a subscription-based, AI-driven chatbot that can perform various functions for cybercriminals to help them successfully launch phishing campaigns and scams.

Regenerative AI models have dramatically changed cyberspace, with one after another chatbot surfacing on the web. It was, therefore, impossible for threat actors to ignore their rising popularity and extensive reach. That’s why we keep hearing about **fake versions of ChatGPT**, and now cybercriminals prefer generative AI jailbreaking for creating malicious chatbots to cause further devastation.

According to a **blog post** from Netenrich’s threat researchers, authored by Rakesh Krishnan and published on 25 July 2023, FraudGPT surfaced on Telegram Channels on 22 July 2023. FraudGPT is a malicious AI bot crafted to facilitate spear phishing emails, create cracking tools, and carding.

In addition, it can assist attackers in writing enticing emails to trap targets. Moreover, FraudGPT is efficient enough to select the best services or sites to target and defraud users. Here’s a breakdown of its key features.

*   Assisting in hacking
*   Locating carding sites
*   Writing malicious code and scam letters or pages
*   Creating undetectable malware, phishing pages, and hacking tools
*   Finding targetable sites/pages/groups, vulnerabilities, leaks, and non-VBV bins

FraudGPT is up for sale on Dark Web marketplaces apart from Telegram at a starting price of $200 per month and up to $1,700 for an annual subscription. FraudGPT creator claims to have secured 3000 sales and reviews for the chatbot.

It is worth noting that the creator is new on Telegram. Reportedly, the threat actor created their Telegram channel on 23 June and launched the malicious chatbot later. The actor is a verified vendor on numerous underground dark web marketplaces, including WHM, Empire, AlphaBay, World, Versus, and Torrez.

Given the ease with which these platforms get scammed, the FraudGPT creator is looking for a seamless revenue stream through Telegram. The creator is registered on a Dark Web form with a Gmail email address.

The emergence of malicious chatbots like FraudGPT and WormGPT is a concerning sign. Cybercriminals can now use AI for their nefarious objectives and ensure a higher success margin for **phishing scams**. These tools can help attackers generate malicious texts and lure targets to BEC or many other email-based attacks.

**RELATED ARTICLES**

1.  DarkBERT: Enhancing Cybersecurity Efforts on the Dark Web
2.  100,000 Hacked ChatGPT Accounts Discovered on Dark Web
3.  Researcher create polymorphic Blackmamba malware with ChatGPT

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism