By Owais Sultan
More and more businesses see the value of investing in knowledge management software, which benefits both the organization…
This is a post from HackRead.com Read the original post: Learning Management System: What is it and Why do you need it?

More and more businesses see the value of investing in knowledge management software, which benefits both the organization and its trainees. It’s clear why workers enjoy e-learning, corporate training, and other forms of training management software. 

Online training is advantageous because it allows workers to learn at their own pace, eliminates the need to attend tedious in-person sessions, and keeps workers interested through interactivity. 

This article will define a Learning Management System (LMS), highlight its essential features and advantages, and explain why it is essential for businesses to use an LMS to maximize their training and education programs.

**What Exactly Is an LMS?**

A learning management system (LMS) is a piece of software designed to facilitate the management and distribution of educational opportunities within an organization. Because of its web-based nature and lack of software installation, a learning management system (LMS) is ideal for today’s students.

Since LMSs are mobile-friendly, businesses can develop their solution by hiring an LMS development company and reach employees no matter where they are and provide them with the training resources they need. Scalability and customization are two critical features of a successful learning management system. Most significantly, it facilitates the integration of different instructional approaches.

**Why Do You Require a Learning Management System?**

**Efficiency in Education**

An LMS is a consolidated system that facilitates education for instructors and students alike. Students may study at their speed and on their own time thanks to the accessibility of online training resources. On the other side, administrators have a centralized location from which to administer and distribute training materials, monitor progress, and report on results.

**Cost-Effectiveness**

Businesses may save money on training by switching to an LMS since it eliminates the need for costly printed materials, rented classroom space, and paid teachers. As a bonus, training materials may be easily updated and revised, cutting down on maintenance expenditures.

**Efficient Administration and Management of Training**

A Learning Management System streamlines the paperwork involved in managing training. An LMS streamlines the administrative operations involved in teaching, from developing and arranging courses to registering students and monitoring their progress. There will be better results from training when administrators can readily track student progress, pinpoint areas of weakness, and implement individualized solutions.

**Interactive Learning**

A well-designed learning management system supports free speech in a digital classroom. They may network with classmates to learn from one another, exchange ideas, and work together on projects. In addition, they are always aware of what their teachers and classmates are up to. Additionally, connectivity with other technologies, such as live chat, can allow administrators and students to communicate without physically meeting.

**Personalized and Flexible Learning**

LMSs promote individualized education by letting businesses modify course materials for specific students. Students have the freedom to select their courses of study, read only those resources that are most pertinent to them, and take only those tests designed specifically for them. An LMS’s adaptive learning capabilities make use of data and analytics to make real-time changes to the learning environment, tailoring content suggestions and interventions to each student.

**What Is the Typical Cost of LMS Development?**

Several variables affect how much it will cost to create a learning management system, such as the size and scope of the project, the features prioritized, the degree of customization required, the degree of integration required, and the method of development chosen (from scratch or by adapting an existing platform).

A fair estimate would put the price tag in the tens or hundreds of thousands of dollars. You could talk to professional developers or development firms to receive a more precise estimate tailored to your needs. A customized cost estimate that fits your budget and goals may be derived after they evaluate the project’s complexity and learn about any customizations you require.

**Conclusion**

A Learning Management System (LMS) is software that facilitates the development, administration, and distribution of educational content. Organizations can unlock the full potential of their workforce and achieve sustainable growth in the digital era of learning by utilizing an LMS for employee onboarding, compliance training, and continual professional development.

**RELATED ARTICLES**

1.  Top learning management system (LMS) software for small businesses
2.  How is mLearning the Future of On-The-Go Dynamic Training Programs?
3.  Global cybersecurity market is poised to reach nearly $420 billion by 2028

Learning Management System: What is it and Why do you need it?

By Habiba Rashid
The campaign, which began at the start of August 2023, revolves around malicious packages impersonating the legitimate noblox.js,…
This is a post from HackRead.com Read the original post: Luna Grabber Malware Hits Roblox Devs Through npm Packages

The campaign, which began at the start of August 2023, revolves around malicious packages impersonating the legitimate noblox.js, a popular Node.js Roblox API wrapper.

*   **Roblox developers are being targeted by a new malware called Luna Grabber**

*   **The malware is being distributed through malicious npm packages that impersonate legitimate software.**

*   **Luna Grabber is capable of stealing sensitive data from victims’ web browsers, Discord applications, and local system configurations.**

*   **The malware was downloaded approximately 1000 times, but its impact was relatively low due to the security measures in place to protect developers on the npm repository.**

*   **The incident highlights the growing trend of malicious actors employing typo squatting to exploit developers’ trust in legitimate software packages.**

Cybersecurity firm ReversingLabs has uncovered a sophisticated cyber attack targeting developers on the Roblox gaming platform. Malicious actors have been distributing malicious packages through the npm public repository, attempting to exploit users by mimicking legitimate software while incorporating malicious payloads that steal sensitive information from victims’ systems.

**Malware Campaign Overview**

The campaign, which began at the start of August 2023, revolves around malicious packages impersonating the legitimate noblox.js, a popular Node.js Roblox API wrapper. By infiltrating the npm public repository, attackers capitalized on unsuspecting developers seeking to interact with the Roblox gaming platform using scripts.

ReversingLabs researchers identified several malicious packages during the campaign, including noblox.js-vps, noblox.js-ssh, and noblox.js-secure. These packages were engineered to deliver multi-stage malicious payloads that targeted victims’ local web browsers and Discord applications. The most notable payload identified was Luna Grabber, an open-source malware designed to extract sensitive data.

**Malware Execution and Strategy**

Attackers meticulously designed the malicious packages to closely resemble the legitimate noblox.js package. By mirroring the original code and adopting similar naming conventions, the attackers aimed to deceive developers into downloading and using the compromised software.

The malicious packages leveraged a variety of techniques to compromise victims’ systems, including the incorporation of a separate file named postinstall.js. This post-installation script triggered the execution of a malicious payload after the package installation was completed. The malware then determined whether the victim was operating a Windows machine and proceeded to download and execute the Luna Grabber malware from Discord’s Content Delivery Network (CDN).

**Luna Grabber: Information Stealing Malware**

The research revealed that the primary payload of the malicious packages was Luna Grabber, a highly customizable malware capable of stealing information from victims’ web browsers, Discord applications, and local system configurations. The malware was also equipped with features that enabled it to detect virtual environments and initiate a self-destruct mechanism if necessary.

Interestingly, the attackers behind the campaign took advantage of the user-friendly nature of Luna Grabber’s builder application, simplifying the process of creating and configuring the malicious executable.

Screenshot shared by ReversingLabs shows Luna Grabber builder

While Luna Grabber’s open-source nature allowed attackers to tailor the malware to their needs, the choice of targeting developers on the Roblox platform suggests a focus on a specific user group.

**Limited Impact and Lessons Learned**

Despite the campaign’s sophistication, its impact remained relatively low. The malicious packages were downloaded approximately 1000 times, signalling that the security measures in place to protect developers on the npm repository were successful in limiting the reach of the attack.

The incident sheds light on the growing trend of malicious actors employing typo squatting to exploit developers’ trust in legitimate software packages. This approach has been previously observed in other campaigns, such as the IconBurst and Brainleeches campaigns.

Fake noblox.js-ssh’s npm website page (ReversingLabs)

While multi-stage malicious packages are common on certain open-source platforms, such as PyPI, their presence on npm—where this campaign took place—represents the ongoing challenge of maintaining secure open-source repositories and the importance of cautiousness in choosing software packages for development purposes.

1.  CISA warns of trojanized JavaScript library’s NPM package
2.  Discord.io Admits Data Breach: Info of 760K Users Sold Online
3.  6 official Python repositories plagued with cryptomining malware

Luna Grabber Malware Hits Roblox Devs Through npm Packages

By Habiba Rashid
TP-Link Tapo L530E Smart Bulb found vulnerable, putting user WiFi credentials at risk.
This is a post from HackRead.com Read the original post: TP-Link Smart Bulb Users at Risk of WiFi Password Theft

The vulnerabilities of the smart bulb were identified by cybersecurity researchers from Italy and the United Kingdom.

**Summary**

*   Security researchers have found vulnerabilities in the TP-Link Tapo L530E smart bulb and the corresponding Tapo app.

*   These vulnerabilities could allow attackers to steal users’ WiFi passwords and gain unauthorized access to their networks.

*   The vulnerabilities are rated as high and medium severity, and affect both the hardware and software of the smart bulb.

*   TP-Link has acknowledged the vulnerabilities and is working on a fix.

*   In the meantime, users are advised to update the firmware of their smart bulbs and use strong passwords.

In the era of expanding home automation, the convenience of controlling devices remotely and optimizing energy consumption is met with an emerging concern: the security of interconnected smart devices.

A recent investigation by security researchers from Italy and the UK has illuminated potential vulnerabilities in the popular TP-Link Tapo L530E smart bulb and the corresponding Tapo app, exposing users to the risk of having their WiFi passwords stolen by malicious actors.

The TP-Link Tapo L530E smart bulb, a common sight in homes and available on major marketplaces such as Amazon, has become a focal point for researchers due to its extensive adoption. The study (PDF), conducted by experts from the Universita di Catania and the University of London, talks about broader security risks prevalent in the expansive world of Internet of Things (IoT) devices, many of which exhibit subpar authentication safeguards and insecure data transmission practices.

The following four distinct vulnerabilities have been identified within the TP-Link Tapo L530E smart bulb and the Tapo app, each presenting its unique security implications:

**Improper Authentication: **

The primary vulnerability is rooted in improper authentication during the session key exchange process. This flaw permits attackers in close proximity to the device to impersonate it, resulting in the compromise of Tapo user passwords and control over Tapo devices. With a high-severity CVSS v3.1 score of 8.8, this exploit represents a substantial risk.

**Hard-coded Weakness:**

The second vulnerability, also high-severity with a CVSS v3.1 score of 7.6, is a result of a hardcoded short checksum shared secret. Malicious actors can exploit this flaw by engaging in brute-forcing techniques or by decompiling the Tapo app. 

**Predictable encryption_:_**

The third flaw, rated with a medium severity, pertains to the predictable nature of symmetric encryption due to a lack of randomness in its application. 

**Replay Attacks:**

Lastly, the fourth vulnerability allows attackers to conduct replay attacks, effectively replicating previously intercepted messages to manipulate device functions.

Keeping in mind the vulnerabilities above, the researchers showcased several scenarios which a malicious actor may be inclined to employ. In the first scenario, an attacker exploits the first and second vulnerabilities to impersonate the smart bulb and compromise a user’s Tapo account.

By infiltrating the Tapo app, the attacker can extract critical WiFi information, including the SSID and password, enabling unauthorized access to all devices linked to the same network. Though this attack requires the device to be in setup mode, attackers can easily disrupt the bulb’s functionality and prompt a reset, thus enabling the execution of the attack.

For the second scenario, the researchers delved into Man-in-the-Middle (MITM) attacks, showcasing the potential for attackers to intercept and manipulate communications between the Tapo app and the bulb.

By exploiting the first vulnerability, attackers can capture RSA encryption keys, which are then exploited to decode further data exchanges. Moreover, unconfigured Tapo devices can be utilized in MITM attacks to extract sensitive information during the setup process.

TP-Link Tapo L530E smart bulb on Amazon – The data extracted by researchers

In a comment to Hackread.com, Andrew Bolster, Senior R&D Manager for Data Science at Synopsys Software Integrity Group told Hackread.com that, “These new vulnerability notices demonstrate again that while consumers want to believe that the smart devices that we bring into our homes and make part of our lives are somehow completely isolated and secure, security is not that simple.”

Andrew warned that “As Synopsys previously demonstrated with last year’s Vulnerability Advisory on IKEA smart bulbs, these assistive and clever devices can be the weak-link into the trusted home environment; A beachhead for malicious actors to then gain horizontal access to other devices behind the ‘secure’ firewall. And as we add increasingly smart devices, be it fridges, voice assistants, heating controllers, vacuum cleaners, etc, opportunity for security failures to spread expands exponentially.”

“As with any modern security threat model, defence-in-depth and trust-but-verify stand; smart devices should be kept on separate WiFi networks from personal devices where possible, and the inbound/outbound connections into this network should be heavily restricted,” he emphasised.

The findings of this investigation have been responsibly disclosed to TP-Link, prompting acknowledgement from the vendor. Assurances have been made that fixes for the vulnerabilities will be implemented in both the app and the bulb’s firmware. However, specific details about the availability of these fixes and the versions still susceptible remain undisclosed.

Here are some additional safety guidelines that users should follow:

*   Only connect your smart bulbs to trusted networks.
*   Keep your smart bulbs up to date with the latest firmware.
*   Be careful about what information you share with smart bulb apps.
*   Use strong passwords and enable multi-factor authentication for your smart bulb accounts.
*   If you think your smart bulb has been compromised, change your passwords and reset your devices.

In light of these vulnerabilities and the expanding realm of IoT devices, isolating such devices from critical networks, updating firmware and app versions, and bolstering account protection through strong passwords and multi-factor authentication remains the recommended practices.

**RELATED ARTICLES**

1.  IoT devices could help authorities solve criminal cases
2.  Hackers can use flaw in Philips smart light bulbs to spread malware
3.  Hackers can clone your lock keys by recording clicks from smartphone
4.  Whitehat hacker shows how to detect hidden cameras in Airbnb, hotels
5.  Lamphone attack recovers secretive conversations via hanging light bulb

TP-Link Smart Bulb Users at Risk of WiFi Password Theft

By Deeba Ahmed
Hundreds of impacted retailers could not process payments, complete orders, or trade online due to the attack on Swan Retail.
This is a post from HackRead.com Read the original post: Cyberattack on UK IT Firm Swan Retail Affects 300 Retailers

1.  **Swan Retail IT Outage:** On August 13, 2023, UK’s Swan Retail faced major technical glitches due to a cyberattack by an unauthorized third party, causing significant disruptions across 300 retailers.
2.  **Response and Investigation:** Swan Retail swiftly alerted internal IT, retailers, and authorities. The UK NCSC, Action Fraud, and others are investigating the incident.
3.  **Retailer Impact:** Diverse independent retailers, from fashion to sports equipment, suffered financial losses due to suspended services and disrupted launches.
4.  **Growing Cyberattack Trend:** Eduard Doroskevic from Adarma noted the rising trend of coordinated cyberattacks across industries, emphasizing the need for collaborative defense.
5.  **Securing the Digital Chain:** Doroskevic stressed securing the digital supply chain, suggesting constant vigilance, risk mitigation, and resource prioritization to protect against evolving threats.

On Sunday, 13 August, 2023, a UK-based Retail Management and EPOS Solutions provider called Swan Retail observed ‘technical difficulties,’ in several back-office systems causing ‘significant’ service disruptions.

According to a statement from the company’s representative, its systems were targeted by an unauthorized third party to which the company responded quickly by alerting its internal IT team, affiliated retailers, and law enforcement authorities.

However, around 300 retailers have been affected by this attack. The company didn’t disclose what kind of attack took place that resulted in such an extensive outage of services.

For your information, Swan Retail is part of Swan Group, acquired by ClearCourse in November 2020. The company supplies stock control and account systems, payment gateways, online ordering, and other IT solutions to retailers all across the UK. ClearCourse is a conglomerate of numerous tech brands offering integrated software solutions and payment platforms.

The cyberattack on Swan Retail has impacted a wide range of independent retailers from almost all sectors, such as fashion, homewares, furniture, departmental stores, sports/pets/outdoor equipment dealers, stadiums, and garden centers.

Many vendors failed to bring in new collections and suffered heavy financial losses. Their services have remained suspended since Sunday with no clarity over when the services will be back online.

The company claims that the issue will be resolved soon. The incident is under investigation by the UK National Cyber Security Center (NCSC), Action Fraud, and other agencies.

About this incident, Eduard Doroskevic, Principal Consultant at Adarma told Hackread.com that the industry is experiencing a systematic wave of cyberattacks, to address which well-coordinated efforts are mandatory.

“Businesses can no longer operate in isolation. Cyber risks are systemic and can extend beyond a business’s perimeter, allowing adversaries to infiltrate partnering organizations. Addressing this challenge requires a coordinated effort,” said Doroskevic.

Doroskevic warned that “Incidents like this are rising in frequency, highlighting the importance of securing the digital supply chain. Employing an ongoing strategy of discovery, assessment, and validation is essential to ensure organizations maintain constant vigilance and uphold their risk tolerance thresholds within acceptable boundaries.”

Through a comprehensive approach encompassing risk mitigation, resource prioritization, and continuous surveillance, enterprises can reinforce their supply chains and protect their vital assets in response to evolving threats,” he advised.

1.  Retail giant Claire’s online store hacked after closing 3000 stores
2.  Electronics retail giant CeX hacked; data of 2 million customers stolen
3.  Gun Retailer Airsoft GI’s Forum Hacked; 65,000 User Accounts Leaked
4.  Fashion retailer BrandBQ exposes 1 TB of customers, contractors data
5.  South Korean Retail Giant Lotte’s Website Hacked After US Military Deal

Cyberattack on UK IT Firm Swan Retail Affects 300 Retailers

By Waqas
Bronze Starlight hackers have been cleverly utilizing a valid Ivacy VPN code-signing certificate to target the Southeast Asian gambling industry.
This is a post from HackRead.com Read the original post: Chinese Hackers Using Stolen Ivacy VPN Certificate To Sign Malware

*   **Chinese APT group Bronze Starlight uses stolen Ivacy VPN certificate to sign malware for the Southeast Asian gambling sector**.

*   **Stolen certificate makes malware appear legitimate, bypassing security and blending in with regular software.**

*   **Attacks began in March 2023, linked to earlier Operation ChattyGoblin discovered in 2022.**

*   **Bronze Starlight, known for political campaigns, deploys malware via chat apps and fake software versions.**

*   **Malware targets vulnerable software, and avoids execution in some Western countries; DigiCert revoked certificate; no statements from PMG PTE LTD or Ivacy VPN.**

SentinelLabs researchers have discovered that a Chinese APT group known as Bronze Starlight has been signing off malware with a valid certificate. This certificate is used by Ivacy VPN, and the hackers’ target is the gambling industry in Southeast Asia.

Using this technique, hackers can ensure that malware bypasses all security measures without raising suspicion and invades target devices. It can also easily blend into legitimate software traffic.

It is worth noting that the issue was first reported by MalwareHunterTeam on X (previously known as Twitter) on 29 May 2023 and later analyzed by SentinelLabs. According to researchers, this stolen certificate belongs to Singapore-based VPN vendor PMG PTE LTD, the developer of Ivacy VPN.

In SentinelLabs’ blog post authored by Aleksandar Milenkoski, the first wave of attacks was observed in March 2023; however, it could be a continuation of an already ongoing hacking campaign dubbed Operation ChattyGoblin (discovered by ESET in late 2022).

Bronze Starlight (aka DEV-0401 and SLIME34) is a Chinese ransomware group that mostly runs espionage and politically motivated campaigns instead of financially motivated ones. The group’s primary weapon is ransomware, including LockFile, LockBit 2.0, NightSky, AtomSilo, Pandora etc, as reported previously by SecureWorks and Microsoft.

The attack starts with delivering .NET executables such as AdventuresQuest.exe onto the targeted device through compromised chat applications. This particular file was first observed by MalwareHunterTeam’s cybersecurity expert, and they later reported it on X.

Per MalwareHunterTeam’s observation, the certificate used in this attack was similar to the one used in authentic Ivacy VPN installations.

> "PMG PTE. LTD." signed "AdventureQuest.exe": 43fb2d2e7596bed395bba6e012d0ee13ed61856cd63db47bf94160881d3e3ac7  
> www.100helpchat\[.\]com  
> 🤔 pic.twitter.com/OqLfTPwdGX
> 
> — MalwareHunterTeam (@malwrhunterteam) May 29, 2023

The executables then retrieve password-protected ZIP archives from Alibaba storage repositories through fake or infected versions of popular programs vulnerable to DLL hijacking, such as Microsoft Edge, Adobe Creative Cloud, and McAfee VirusScan.

Further research from SentinelLabs revealed that the executables used geo-restrictions for preventing malware from getting executed in certain, pre-defined Western countries, e.g., the USA, France, Germany, Russia, India, Canada, and the UK. This could be because the hackers are either not interested in targeting these regions or are deliberately avoiding them to raise the chances of this campaign’s success.

Researchers believe that the VPN vendor doesn’t seem involved in this hack even though Ivacy VPN’s certificate has been used, also available on the PMG PTE LTD website.

> _“It is likely that at some point the PMG PTE LTD signing key has been stolen – a familiar technique of known Chinese threat actors to enable malware signing.”_
> 
> Aleksandar Milenkoski – Senior Threat Researcher at SentinelLabs

This is a common practice as VPNs frequently become targets of APT groups because of the trove of sensitive data and communications these may offer. It is unclear what kind of data Chinese hackers could be obtained through Ivacy VPN. For your information, the certificate has now been revoked by DigiCert.

Surprisingly, neither PMG PTE LTD nor Ivacy VPN has issued any official statement regarding this issue.

1.  TeamViewer was Targeted by Chinese Hackers in 2016
2.  Chinese VPN app Quickfox caught exposing 1 million users’ data
3.  Chinese APT group spying on Vietnam military with FoundCore RAT

Chinese Hackers Using Stolen Ivacy VPN Certificate To Sign Malware

By Waqas
Contrary to the typical cyberattack narrative, this breach stems from a whistleblower leak, revealing sensitive information to the German media outlet Handelsblatt.
This is a post from HackRead.com Read the original post: Whistleblower Leak Reveals Tesla Data Breach, Affects 75,000

*   **– Tesla discloses data breach affecting 75,000 individuals.**

*   **– Whistleblower leak exposes personal info to German media outlet.**

*   **– Former employees violate data protection policies, sharing data.**

*   **– Leaked ‘Tesla Files’ contain employee details and production secrets.**

*   **– Legal actions initiated, highlighting data protection challenges.**

Electric vehicle giant, Tesla has recently revealed a data breach that has affected approximately 75,000 individuals. Contrary to the typical cyberattack narrative, this breach stems from a whistleblower leak, revealing sensitive information to the German media outlet Handelsblatt.

**Unveiling the Breach:**

Tesla’s disclosure to the state of Maine’s attorney general office has shed light on a data breach that occurred in May 2023. The breach led to the exposure of personal information, including social security numbers, of over 75,700 individuals. The compromised data encompasses names, contact information, and employment records of both current and former employees.

**Whistleblower Revelation:**

The breach’s origins trace back to two former Tesla employees who allegedly shared confidential company information with Handelsblatt.

The automaker stated that these ex-workers had “misappropriated the information in violation of Tesla’s IT security and data protection policies.” This breach incident highlights the challenge companies face in maintaining data security even after employees leave their roles.

**Compromised Information:**

The data leaked to Handelsblatt, colloquially referred to as the ‘Tesla Files,’ contained an extensive array of information. The leaked data reportedly encompassed details about more than 100,000 current and former employees, including customer banking information, production trade secrets, and customer complaints related to driver assistance systems.

**Legal Ramifications and Protective Measures:**

Tesla swiftly responded to the breach by initiating legal action against the responsible employees. Court orders were secured to prevent further dissemination and use of the stolen data, under threat of criminal penalties.

The leaked data is not intended for publication by Handelsblatt, reducing the immediate risk of data misuse. However, Tesla is taking additional measures to safeguard affected individuals by offering credit monitoring and identity protection services. A template letter written by Tesla’s Data Privacy Officer, Steven Elentuk, revealed the following information:

A foreign media outlet (named Handelsblatt) informed Tesla on May 10, 2023 that it had obtained Tesla confidential information. The investigation revealed that two former Tesla employees misappropriated the information in violation of Tesla’s IT security and data protection policies and shared it with the media outlet. The outlet has stated that it does not intend to publish the personal information, and in any event, is legally prohibited from using it inappropriately.

Tesla immediately took steps to contain the incident, understand the scope, and protect your information. Among other things, we identified and filed lawsuits against the two former employees. These lawsuits resulted in the seizure of the former employees’ electronic devices that were believed to have contained the Tesla information. Tesla also obtained court orders that prohibit the former employees from further use, access, or dissemination of the data, subject to criminal penalties. Tesla cooperated with law enforcement and external forensics experts and will continue to take appropriate steps as necessary.

**Future Implications:**

Although not a malicious cyberattack, the breach has raised concerns about data protection and the security of confidential data within the company. The breach underscores the critical importance of data protection and cybersecurity within organizations.

Even without the traditional hallmarks of a cyberattack, the vulnerability posed by insider threats and data leaks remains significant. Companies, especially those dealing with sensitive and confidential information, must strengthen their data protection policies and employee exit protocols to mitigate the risk of such incidents.

1.  Sensitive user data found in Tesla car parts sold on eBay
2.  Bug bounty: Hack Tesla Model 3 to win your own Model 3
3.  Musk: Russian hacker tried hiring Tesla worker for malware attack
4.  Russian hacker pleads guilty to planting malware in Tesla Gigafactory

Whistleblower Leak Reveals Tesla Data Breach, Affects 75,000

By Habiba Rashid
Foreign cyber spies are targeting the US space industry for secrets and technology, warns the FBI, NCSC, and AFOSI.
This is a post from HackRead.com Read the original post: FBI and NCSC Warn of Foreign Cyberattacks on US Space Sector

*   **Authorities warn of foreign cyber spies targeting the US space industry.**

*   **Beijing and Moscow are major sources of cyber threats, according to the US.**

*   **Tactics include cyberattacks, investments, and recruitment, says the FBI.**

*   **The US space sector’s significance increases vulnerability.**

*   **Advisory stresses safeguarding data and reporting suspicions.**

In a joint advisory published on Friday, the Federal Bureau of Investigation (FBI), the National Counterintelligence and Security Center (NCSC), and the Air Force Office of Special Investigations (AFOSI) issued a warning about the escalating threat of nation-state-sponsored cyber espionage targeting companies within the US space industry.

The report underscores the heightened risks posed by cyberattacks and other covert methods employed by foreign intelligence entities to pilfer research, trade secrets, and sensitive information related to the burgeoning sector.

Beijing and Moscow, the advisory points out, loom large as the main sources of these threats, with the FBI and other intelligence agencies identifying these capitals as prime actors in these ongoing campaigns. 

“We anticipate growing threats to this burgeoning sector of the US economy,” a counterintelligence official emphasized in a statement to Reuters.

As the global space economy is predicted to surge from $469 billion in 2021 to over $1 trillion by 2030, with the United States driving this growth, the vulnerability of the US space industry to foreign espionage has intensified, the report stated. 

Foreign intelligence entities are employing a multifaceted approach to access sensitive information crucial to their respective space programs. Techniques include cyberattacks, strategic investments, supply chain node targeting, and manipulation of joint business ventures and acquisitions.

The advisory also sheds light on espionage agents attending industry conferences and even requesting visits to industry facilities in pursuit of confidential data.

The report also highlights a tactic involving the recruitment of individual employees through offers of overseas work or consulting positions, along with direct offers of payment in exchange for intellectual property. The agencies underscore the importance of vigilance among US space companies and recommend immediate contact with the FBI or AFOSI in case of suspicious activities.

“Foreign intelligence entities recognize the importance of the commercial space industry to the US economy and national security,” the advisory states. It highlights that not only does the industry contribute significantly to emergency services, energy, financial services, telecommunications, transportation, food, and agriculture, but its role is also pivotal in supporting critical infrastructure that underpins these domains.

US authorities, while not naming any specific countries, highlight the persistent and well-documented threats from Chinese hackers in the aviation, space, and satellite technology sectors. Chinese ambitions to challenge the United States space supremacy have been evident for years, with the Chinese government openly outlining its intention to lead the world in space exploration and technology by 2045.

In light of these intensifying espionage campaigns, the joint advisory urges safeguarding sensitive information and proprietary technologies within the US space industry.

FBI and NCSC Warn of Foreign Cyberattacks on US Space Sector

By Owais Sultan
Onboarding new hires is not as simple as saying, “Welcome Aboard!” You have to navigate this tricky process…
This is a post from HackRead.com Read the original post: Ultimate New Hire Onboarding Checklist: Your Roadmap to Success

**Onboarding new hires** is not as simple as saying, “Welcome Aboard!” You have to navigate this tricky process – from setting up their first day in the office to making sure they feel welcomed and have all of the tools needed for success. This post will guide you on the onboarding checklist for new Hires.

**1\. Pre-Onboarding**

Before you even set foot in the office, it’s essential to make sure everything is ready for your newbie’s arrival. Inform them about what to expect during their first day(s), such as company culture or dress code policy; send out some fun swag ahead of time, like branded shirts or mugs with clever sayings \[take a note from Mailchimp here\].

First impressions do last a lifetime, so don’t let your new hire show up with no desk space or computer/tablet setup if that’s required within their role. Additionally, ensure they have everything necessary, such as mouse pads or specialized software, before arriving.

**2\. Day One & Beyond**

One thing more daunting than being a newcomer is coming into an environment where everyone else knows each other already. Help ease anxiety by appointing someone on your team (e.g., culture ambassador) whose primary responsibility is to welcome newcomers!

A good starting point after introductions would be to provide detailed information about job responsibilities followed by expectations from both parties moving forward (new hire manager). Schedule regular check-ins throughout probationary periods allowing ample time for addressing any concerns promptly.

**3\. Welcoming New Staff**

Let’s face it – we all like feeling special and appreciated when starting something new, a job included. Set up small gestures such as a shoutout at weekly meetings or introduce them to other departments to expand their network and encourage engagement throughout. Speaking from experience, things like an office tour with designated spots of interest or even a scavenger hunt can create a sense of fun and excitement.

**4\. Training**

Familiarization doesn’t happen overnight. Ensure that the formal training schedule has been developed prior, ensuring the emphasis is placed on meeting company standards while demonstrating individual growth potential. Make sure your new hires comprehend concepts before moving on.

**5\. Set up access**

**Information Security**– our favourite, right? Ensure access rights granted to relevant software/apps conform with the position held by the new hire(s). You may consider writing out a detailed authentication process before beginning so that no loose ends are untied post-hire.

**6\. Technology Update**

When grappling with tech-related issues, make certain pertinent information for trouble-shooting readily available as part of your **IT checklist for new hires** to avoid causing unnecessary frustrations. A troubleshooting guide detailing steps for key concerns should suffice – simple ‘catch-ups’ can prevent issues from snowballing.

**7\. Buddy System/Mentorship programs**

Starting Fresh consumes huge buckets of energy; hence most people prefer having co-workers they trust guiding them through uncharted waters through support systems **such as mentors** or buddies—allowing time to foster lasting relationships, especially when introducing friends outside work circles!

**8\. Generation Z onboarded**

One thing little thought about is catering makes a difference in how one approaches prospective hire’s preferences; younger folks prefer differently compared to millennial counterparts! **According to** Forbes Magazine,” Gen-Z seeks autonomy \[autonomy allows independence when working\] and positive and negative feedback. You’ll find meaningful appeal in emphasizing these points clearly during introductions.

So with all of the above in mind, write up your checklist for onboarding new hires. Every company has different cultures, personalities, and expectations – cater to those differences as you plan. And most importantly: have fun! It’s a learning curve for both parties- let them grow together!

Ultimate New Hire Onboarding Checklist: Your Roadmap to Success

By Habiba Rashid
Malware-Driven Proxy Servers Exploit Unsuspecting Users.
This is a post from HackRead.com Read the original post: New Malware Turns Windows and macOS Devices into Proxy Nodes

*   **Malware transforms Windows and macOS devices into proxy nodes.**
*   **Compromised machines reroute traffic as covert proxy exit points.**
*   **Malicious actors exploit infected systems for proxy requests.**
*   **Windows and macOS devices were repurposed for unauthorized activities.**
*   **AT&T Alien Labs reveals an alarming malware-driven proxy phenomenon.**

The cybersecurity researchers at AT&T Alien Labs have shed light on an alarming phenomenon where malicious actors are harnessing malware-infected Windows and macOS machines as proxy exit nodes to reroute proxy requests.

These actors, utilizing a proxy server application, are covertly leveraging compromised systems to establish proxy exit nodes, enabling them to redirect proxy requests. It appears that these proxy exit nodes are not exclusively originating from users who have knowingly agreed to participate, as the proxy service’s website claims.

The attack vector involves delivering proxy servers through various malware strains that target unsuspecting users enticed by offers of cracked software and games. The proxy application, coded using the versatile Go programming language, ensures compatibility across multiple operating systems, including macOS and Windows.

One striking observation is the difference in the detection rates between macOS and Windows systems. While the Windows version of the proxy application effortlessly evades security measures due to its signed nature, the macOS variant is more easily detected. 

According to AT&T’s blog post, Once executed on a compromised system, the malware discreetly installs the proxy application, sidestepping user interaction and simultaneously introducing additional malware or adware components. To achieve this covert process, the malware creators employ Inno Setup, a widely-used Windows installer. This tool enables the creation of packed executables, facilitating the proxy’s seamless installation and persistence within the system.

The nature of the malware-driven proxy server extends to its communication with the command and control server (C&C). The proxy application not only relays specific parameters to the C&C but also collects critical information about the compromised system, including processes, CPU and memory usage, and even battery status. This adaptive data collection ensures the proxy’s optimal performance and responsiveness while evading suspicion.

The monetization of malware-infused proxy servers through affiliate programs poses a significant challenge. The proxy application, packaged with Inno Setup, persists through multiple mechanisms, including registry keys and scheduled tasks, enabling the proxy to continually function as a covert channel for unauthorized financial gains.

Collected information being sent to C&C server (Screenshot: AT&T Alien Labs)

The campaign’s disclosure builds upon previous findings by AT&T Alien Labs, in which macOS systems infected with AdLoad adware were repurposed as exit nodes for a vast residential proxy botnet.

This pattern potentially points to operators of AdLoad orchestrating a pay-per-install campaign. AdLoad, a notorious adware strain masquerading as legitimate applications, has been capitalizing on unsuspecting users to navigate them towards malicious websites, ultimately profiting from these schemes.

This evolving threat landscape is particularly concerning for macOS users, as the dark web has seen an exponential rise in the advertisement of information stealer strains and sophisticated tools aimed at bypassing macOS security mechanisms.

The past few years have witnessed an intensified focus on targeting macOS devices due to their growing prevalence in corporate environments, coupled with the high potential for earnings from malicious activities.

New Malware Turns Windows and macOS Devices into Proxy Nodes

By Owais Sultan
An anonymous Bitcoin wallet makes it possible to extend the level of anonymity when transferring cryptocurrencies to a…
This is a post from HackRead.com Read the original post: Benefits of Using an Anonymous Bitcoin Wallet in 2023

An anonymous Bitcoin wallet makes it possible to extend the level of anonymity when transferring cryptocurrencies to a large degree. When using an anonymous wallet, you’ll get all the same advantages as a regular wallet but with more privacy and security.

At the core of cryptocurrencies and decentralized finance is anonymity. But as crypto has grown bigger and more widespread in various areas of society, anonymity has become a concern. For obvious reasons, it can lead to unfortunate situations if everyone can be completely anonymous in financial transactions. Therefore it’s challenging to spend crypto entirely anonymously. 

Using an anonymous wallet is the best way to get the most considerable amount of anonymity. Just remember to choose one of the best anonymous Bitcoin wallets that will ensure your privacy to the greatest extent possible. These anonymous wallets, also called privacy wallets, have some advantages for crypto investors appreciating privacy.

****Enhanced security and anonymity** **

Obviously, the main point of using an anonymous Bitcoin wallet is enhanced privacy and safety. Anonymity is provided by encrypting the wallet and concealing information, such as usernames. Even though you can’t conceal your information completely due to regulations, you will be given a pseudonym that will still provide a great deal more privacy. In addition to this, anonymous Bitcoin wallets also have enhanced security when it comes to keeping your private keys safe.

Anonymous crypto wallets have all the same features as regular crypto wallets. You can customize your wallet and separate your funds. You’ll eliminate every middleman, such as banks or other financial institutes. You can store your cryptocurrencies safely and make quick, direct transfers. By choosing an anonymous one, you’re also backing the main visions of decentralized digital finance—freedom and privacy. So, by selecting an anonymous wallet, you’ll get all the same features as a regular wallet, just anonymously.

****A new decentralized financial reality****

It’s no question that cryptocurrencies will continue to grow as time goes on. The vision behind decentralized finance is appealing to people all over the world. People want sovereignty over their own funds and to keep their money safe, away from prying eyes and malicious hands. They don’t want to be controlled by centralized financial systems deciding how much their money is worth. All this, including inconvenience and privacy, is possible within the realms of the crypto world.

Source

HackRead