By Deeba Ahmed
In a blog post published Wednesday, OpenSea said the issue was caused by an employee of Customer.io, which is…
This is a post from HackRead.com Read the original post: NFT Marketplace OpenSea Suffers Data Breach- Users’ Email IDs Leaked

****In a blog post published Wednesday, OpenSea said the issue was caused by an employee of Customer.io, which is OpenSea’s email delivery vendor.****

OpenSea is a popular NFT marketplace that is the latest victim of a data breach. According to OpenSea’s blog post published Wednesday, the issue was caused by an employee of Customer.io, which is OpenSea’s email delivery vendor.

Reportedly, the employee misused their access to download/share email IDs of OpenSea users and the company’s newsletter subscribers with an unauthorized third party. The company claims it is in touch with Customer.io, and an investigation is underway. Law enforcement authorities have been informed about the incident.

> An employee of our email vendor, https://t.co/6vM4WAcJal, misused their employee access to download & share email addresses with an unauthorized external party.
> 
> Email addresses provided to OpenSea by users or newsletter subscribers were impacted.https://t.co/Osb6qqkqZZ
> 
> — OpenSea (@opensea) June 30, 2022

**Customer.io Response**

A representative of Customer.io stated that the company believes that the employee had abused “role-specific access privileges,” however, they don’t believe any other data of their clients was compromised.

> “The employee in question has had all-access removed and has been suspended pending the conclusion of our investigation.”
> 
> Customer.io

**Data Breach Impact**

This data breach’s impact is massive. As per data collected by an open-source crypto evaluation platform, Dune Analytics, around 1.8 million users made purchases via the Ethereum network on OpenSea.

The company explained that whoever shared an email address with the platform, even in the past, would be impacted. Unfortunately, an email delivery vendor could not secure the only thing they are supposed to protect, customers’ email addresses.

Emails sent by OpnSea.io to impacted customers (Screenshot via @Econoar/Twitter)

**How to Stay Safe?**

This data breach isn’t as devastating as some previous data breaches affecting other crypto startups since only email IDs were leaked. Still, because it is a crypto-related breach, every user of OpenSea becomes vulnerable to phishing emails.

OpenSea urges users to only open emails from the domain Opensea.io and not to download any attachments present in OpenSea email. Moreover, users must refrain from sharing secret wallet phrases or passwords with anyone.

> “Please be aware that malicious actors may try to contact you using an email address that looks visually similar to our official email domain, ‘opensea.io’ (such as ‘opensea.org’ or some other variation).”
> 
> OpenSea

**More NFT and Crypto Breaches**

*   Official website of Banksy hacked for a fake NFT scam
*   Hackers Hijacked Official Ferrari Subdomain to Host NFT Scam
*   Phishing scam: NFTs Worth $1.7 Million Stolen from OpenSea Users
*   Hackers Exploit Harmony’s Horizon Blockchain Bridge to Steal $100 Million
*   Rarible NFT Market Vulnerability Authorized Attackers to Transfer Crypto Assets

NFT Marketplace OpenSea Suffers Data Breach- Users’ Email IDs Leaked

By Owais Sultan
Learn why registering in a digital strategy course is an effective way for leaders to strike a balance…
This is a post from HackRead.com Read the original post: Importance of Digital Strategy and Automation for Businesses

****Learn why registering in a digital strategy course is an effective way for leaders to strike a balance of old vs. new business methods.****

Striking the perfect balance between old and new methods in business is a challenge for modern businesses. They’re stuck trying to stick with what works while also making sure they don’t miss out on new and exciting opportunities. This includes those that digital technologies can bring.

With that in mind, today, we’ll share helpful strategies for finding this balance, including the importance of learning as much about digital technology and how one of the best ways to do this is by registering in a digital strategy course.

**What is a Digital Strategy?**

Digital technology is changing the business world, and businesses must have a digital strategy if they want to stay (or get) ahead of the competition. But what exactly is a digital strategy?

A digital strategy is an overall plan that helps a business determine how best to use digital technologies to achieve its goals. This can include anything from using social media to improve customer service to developing new products and services that take advantage of digital platforms.

It can also involve rethinking how a business operates, taking advantage of digital tools to streamline processes, and becoming more efficient.

**Why is Having a Digital Strategy Important?**

In today’s digital world, customers expect businesses to be available online and accessible through digital channels. If a business doesn’t have a digital presence, it risks being left behind by its competitors.

A digital strategy can help a business:

*   Reach new customers: By using digital marketing techniques, businesses can reach new audiences that they wouldn’t otherwise be able to reach.
*   Increase sales: A well-executed digital strategy can lead to increased sales and revenue for a business.
*   Improve customer service: Digital tools such as live chat and social media can be used to provide better customer service and build stronger relationships with customers.
*   Marketing: Improve customer reach and awareness of products and services.
*   Operations: Increase efficiency and productivity with digital tools.
*   Product development: Develop new products and services that take advantage of digital technology.

But this doesn’t mean every business needs to go entirely digital. There are ways to find a balance between the old and new that can still help a business reach its goals.

Before we get into those methods, let’s consider some examples of old versus new methods to give you an idea of where your business could make changes.

**Old vs. New Business Methods**

Older or traditional business models tend to include things like brick-and-mortar stores, face-to-face customer service, and print marketing. They can also be slower to adapt to change and may be less efficient.

Newer or digital business models are based on digital platforms and technologies. They’re often more agile and can be more quickly adapted to change. They also tend to be more efficient, thanks to digital tools and automation.

Here are some examples of old versus new methods in common business areas:

*   Marketing: Traditional marketing methods include print ads, TV commercials, and direct mail. Digital marketing methods include content marketing, search engine optimization (SEO), and social media marketing.
*   Operations: Traditional methods for running business operations include manual processes, paper documents, and face-to-face meetings. Digital methods include process automation, cloud-based collaboration tools, and digital data storage.
*   Product development: Traditional product development methods include market research and focus groups. Digital product development methods include user feedback loops and rapid prototyping.

Evidently, there are several ways businesses can modernize their methods to include more digital tools and technologies. But it’s not always as simple as just swapping out old methods for new ones. Sometimes, a business needs to find a balance between the two to be successful.

**Finding a Balance Between Old and New Business Methods**

The key to finding a balance between old and new methods in business is to make sure your digital strategy is aligned with your overall business goals. That way, you can be sure you’re not missing out on any opportunities while also ensuring you’re not investing too much in new digital technologies without a clear return on investment.

Here are some tips for striking the perfect balance.

**Define your goals**

What does your business want to achieve? Is it looking to increase sales, reach new customers, or improve customer service? Once you’ve defined your business goals, you can start to develop a digital strategy that will help you achieve them.

**Do your research**

Not all digital technologies will be right for your business. It’s important to do your research and find the ones that will work best for you and help you achieve your goals.

**Consider your budget**

Digital technologies can be expensive, so it’s helpful to consider your budget when developing your digital strategy. Make sure you’re not overspending on new digital tools and technologies and that you’re getting a good ROI for them.

**Test and measure**

Once you’ve implemented your digital strategy, it’s time to test and measure the results to ensure it’s working. Regularly review your goals and objectives to see if you’re on track to achieve them.

**Make adjustments**

As your business grows and changes, so too should your digital strategy. Be prepared to make adjustments to ensure your digital strategy remains relevant and effective.

**Don’t ditch everything old**

Just because something is new doesn’t mean it’s better. There are still many benefits to using old-school methods in business, so don’t ditch everything old in favor of new digital technologies.

However, this doesn’t mean your business should be stagnant. The key is moving forward but doing so strategically and finding the right balance between modern and traditional business methods.

**Learn More in a Digital Strategy Course**

Registering in a digital strategy course can help you learn more about how digital technology can be used to achieve business goals. It can also provide you with the skills and knowledge you need to develop an effective digital strategy for your business.

When business leaders register in a digital strategy course, they help empower their organizations with the ability to harness digital tools and technologies to reach new levels of success.

A digital strategy course can provide you with the skills and knowledge you need to develop an effective digital strategy for your business, as well as help you understand how digital technology can be used to achieve business objectives.

**Conclusion**

Digital technology is changing businesses in fundamental ways, and companies need to have a digital strategy that aligns with their overall goals. However, it is also important for businesses to find a balance between old and new methods, as not all digital technologies will be right for every business. A digital strategy course can help business leaders develop the skills and knowledge they need to create an effective digital strategy that yields results.

Importance of Digital Strategy and Automation for Businesses

By Waqas
The new phishing scam uses malicious and fake chatbots to steal login credentials of unsuspected Facebook users through…
This is a post from HackRead.com Read the original post: Facebook Phishing Scam: Crooks Using Messenger Chatbots to Steal Login Data

****The new phishing scam uses malicious and fake chatbots to steal login credentials of unsuspected Facebook users through Facebook Messenger.****

A new phishing campaign has been discovered by Trustwave security researchers, which involves using Facebook Messenger chatbots while the campaign’s objective is to steal user credentials.

According to Trustwave’s analysis of this new phishing campaign, the chatbots impersonate customer support staff of the social network. These bots then hijack pages by compelling page managers to enter credentials for that Facebook page. The malicious chatbots and websites were quickly taken down after Trustwave’s report.

Chatbots are basically specially designed programs that provide customer support and answer user queries as live support staff before the question is forwarded to a human employee. These bots are generally used by businesses that offer live chat or customer support services.

**Attack Scenario Explained**

This phishing attack started with an email informing the recipient that Facebook would delete their page after 48 hours for violating Meta community standards. When the recipient clicked on the Appeal Now link, they were redirected to a fake Messenger support page hosted by Google Firebase, where they had to interact with chatbots. 

Fake Support chatbot (Image: Trustwave)

Researchers noticed that the phony support chatbot profile was a fan/business page that didn’t have any followers or posts. However, the attackers used the official Messenger logo on the profile page to make the bot appear legit. In the Appeal form, the user entered their name, surname, email ID, page name, and mobile number. 

They were also prompted to complete 2FA authentication, and the OTP could be of any length. As soon as the user clicked on Submit button, the attackers received the form, and the credentials were compromised while the user was redirected to Meta’s official intellectual property and copyright guidelines page.

Password stealing and Fake OTP Page (Image: Trustwave)

**How was the Scam Exposed?**

Concerns were raised when researchers identified many errors in the email, which hinted at its malicious nature. Such as, a dot was missing after the third sentence, and there was incorrect capitalization of the word Page.

The email header also contained several errors pointing to the email’s illegitimacy. For instance, Policy Issues was written in the sender’s name, and the sender domain didn’t belong to Facebook/Meta.

> “The fact that the spammers are leveraging the platform that they are mimicking makes this campaign a perfect social engineering technique.”
> 
> Trustwave

In conclusion, it is imperative that social media users be cautious when opening such warning notices and always check for red flags before giving away sensitive information. Moreover, it is always best to be cautious when engaging with someone on Facebook or social media in general. If you are unsure about the legitimacy of a user or bot, do not provide any personal information and report them to Facebook.

**More Facebook Phishing News**

*   URL Padding: Facebook Mobile Users Hit by Phishing Scam
*   Facebook ads used in spreading Facebook Messenger phishing scam
*   Facebook Last Warning Phishing Scam Stealing Login, Credit Card Data
*   “I think you appear in this video” phishing scam hijacks Facebook accounts
*   Microsoft, PayPal & Facebook most targeted brands in phishing scams: Report

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Facebook Phishing Scam: Crooks Using Messenger Chatbots to Steal Login Data

By Waqas
RansomHouse first appeared in cyberspace in December 2021. So far, the gang has claimed six victims, including Gaming…
This is a post from HackRead.com Read the original post: RansomHouse Claims Stealing 450GB of Data from Semiconductor Giant AMD

****RansomHouse first appeared in cyberspace in December 2021. So far, the gang has claimed six victims, including Gaming Authority (SLGA), Saskatchewan Liquor, and Shoprite Holdings.******AMD Suffers Data Breach**

Leading US-based chipmaker AMD is the latest alleged victim of a targeted data breach. The company’s spokesperson confirmed investigating a cyberattack from data cybercrime gang RansomHouse. The gang reportedly extorted data from AMD, however, the incident is currently under investigation.

List of targets claimed by the RansomHouse ransomware gang (Image: Hackread.com)

**How Much Data was Stolen?**

It is worth noting that RansomHouse hasn’t provided evidence of the data except for files containing AMD’s Windows domain information, which includes a CSV with a list of around 70,000 devices belonging to AMD’s internal network.

The hackers are pretty active on Telegram and brag about successfully targeting a three-letter company, the name of which starts with an A. AMD spokesperson stated that the attackers claim to have stolen around 450 GB of data, which they now threaten to sell.

RansomHouse on Telegram (Image: Hackread.com)

The group also added AMD to its data leak website and confirmed stealing 450 GB worth of data. RansomHouse stated that the stolen data includes financial and research-related information.

**Details of the Incident**

RansomHouse stated that they attacked AMD on 5 January 2022 and blamed the company’s weak security practices for the incident. The hackers revealed that they compromised AMD quickly as it used weak passwords on all its networks, such as ‘password’, ‘P@ssw0rd’, ‘amd!23’, and ‘Welcome1.’  

Screenshot from the official Dark Web domain of the RansomHouse ransomware gang (Image: Hackread.com)

Furthermore, the group confirmed that their associates attacked the AMD network last year, but the data was stolen in January 2022, and afterward, RansomHouse lost access to the company’s network.

The group also noted that they didn’t use ransomware during the attack and never contacted AMD for ransom. However, they intend to sell the data to interested parties and threat actors, which in their opinion, would be more profitable.

**More Ransomware News**

*   Iran’s COBALT MIRAGE Threat Group Behind Ransomware Attacks in US
*   GoodWill Ransomware demands food for the poor to decrypt locked files
*   Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware
*   Cyber Security Giant Mandiant Denies Hacking Claims By LockBit Ransomware
*   PoC Shows IoT Devices Can Be Hacked to Install Ransomware on OT Networks

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

RansomHouse Claims Stealing 450GB of Data from Semiconductor Giant AMD

By Deeba Ahmed
In the fourth wave of Operation 404, the Brazilian law enforcement agencies blocked/shut down around 226 websites and…
This is a post from HackRead.com Read the original post: Hundreds of Websites and Piracy Apps Seized in US-Brazil’s Operation 404.4

In the fourth wave of Operation 404, the Brazilian law enforcement agencies blocked/shut down around 226 websites and 461 piracy applications. In this anti-piracy initiative, the authorities made several arrests.

**Seizure Details**

The operation was a joint effort from the USA and Brazilian authorities. The US Homeland Security Investigations and the US Department of Justice (DoJ) seized six website domains (Corourbanos.com, Corourbano.com, Pautamp3.com, SIMP3.com, flowactivo.co, and Mp3Teca.ws) operating from the Eastern District of Virginia for streaming and facilitating illegal downloads of copyrighted music in the USA.

Conversely, around 266 additional websites were taken down in Brazil, which were part of the same network along with 15 social network profiles. Moreover, six people were arrested after 30 searches and seizures countrywide.

At the time of publishing this article, all seized domains displayed the following message on their homepage:

> This domain name has been seized by Homeland Security Investigations (HSI) pursuant to a warrant issued by the United States District Court for the Eastern District of Virginia under the authority of, interalia, Title 18, United States Code, Section 2323.

**About Operation 404**

The operation was initiated as an extensive anti-piracy campaign in late 2019. Brazilian law enforcement agencies launched this operation and codenamed it Operation 404 after the HTTP error code.

The authorities collaborated with law enforcement agencies in the UK and the USA. Since then, several waves of the operation ensued under the names Operation 404.2 and Operation 404.3. The operation spanned eleven states. So far, hundreds of pirate sites and streaming apps’ domain names have been blocked.

The latest wave of the operation was titled Operation 404.4. However, the authorities never named the suspects or the sites taken down, but they confirmed that the apps alone were downloaded ten million times. Sources also confirmed that all of them were music-related apps.

Homepage of the seized websites

**The Metaverse Link**

According to a TorrentFreak, issued by Brazilian authorities, the operation against pirated sites and apps was expanded to the metaverse. Brazil’s Cybercrime group of the Secretariat of Integrated Operations (Seopi) coordinator, Alessandro Barreto, explained that criminals created events and maps on platforms like Roblox to market their pirated services and invite interested parties to their video platforms.

However, the authorities didn’t specify how they entered the metaverse. The DoJ noted that four illegal broadcast channels were shut down along with the deactivation of 90 pirated videos.

*   Authorities dismantle online piracy hackers network Sparks Group
*   Pirate Bay Founder Invents Piracy Gadget to Cripple Music Industry
*   3 arrested, 30,000+ piracy sites shut down in global operation IOSX
*   US COVID-19 relief bill to make copyrighted content streaming a felony
*   Flight Sim Lab installed Chrome passwords stealer in piracy check tool

Hundreds of Websites and Piracy Apps Seized in US-Brazil’s Operation 404.4

By Owais Sultan
If you’re the manager of a business with employees, you know how hard it can be to schedule…
This is a post from HackRead.com Read the original post: 3 Ways an Employee Scheduling App Can Streamline Your Business

If you’re the manager of a business with employees, you know how hard it can be to schedule everyone’s shifts correctly. The staff may not want to work on certain days, or you may need extra employees to cover peak hours when your business sees an influx of customers.

And if someone calls in sick, scheduling an emergency replacement could prove difficult if you don’t have the time to go through the employee files manually and cross-reference them with open shift times. Luckily, there are employee scheduling apps that can streamline this process and make your job easier than ever before.

**1) Automatic updates and reminders**

Once you sign up for an employee scheduling app, every member of your team is immediately updated with open shifts and appointment availability. Managers can access shift changes on their schedule from anywhere using a mobile device, tablet, or computer.

Using employee scheduling software is one of those small business tasks that you should never have to worry about again. Shift reminders are sent out automatically by email and text, keeping everyone informed about changes in shifts at all times.

Whether it’s adding or removing employees from specific shifts or modifying their attendance, these reminders help make sure your workers get notified as soon as possible, even if they don’t check their schedules daily or have forgotten to enter them into their calendar.

**2) Automated schedule adjustments**

It’s no secret that automated employee scheduling helps businesses avoid crunch time by making sure they always have enough employees to handle a sudden rush of customers. But even though it can be really helpful, many business owners don’t realize that it can also make their everyday lives easier by giving them more control over scheduling.

For example, you might use it to set extra coverage for certain days or hours and adjust your schedule throughout the week as needed. The result is fewer last-minute changes and less scrambling when things don’t go according to plan!

And with a bit of forward-thinking and planning, you can also set up automated schedule adjustments so your employees are scheduled for as much work as possible during busy times—without taking on unnecessary expenses during slower times.

**3) Free up time for employees**

By implementing a scheduling app, you free up employees’ time and allow them to focus on doing their best work. Moreover, employees can access their schedules from anywhere at any time, and they can check updates with one simple click.

A scheduling app also streamlines your business by enabling managers to post schedules in real-time. If your team is constantly changing its schedule or needs to reschedule frequently, using a scheduling app will help keep everyone informed and provide your employees with more stability.

**The Bottom Line**

The most important consideration when determining whether an employee scheduling app is right for your business is making sure it can work with your existing systems and help increase efficiency. When you’re just starting out, that means a lot of manual entry; an automated system will save time down the road when you’re working with a more complex schedule.

If you want to save money on employee payroll costs and avoid having to hire another full-time member of staff to handle your scheduling, consider trying an employee scheduling app as part of your back-office software suite.

*   How to Teach Your Employees About Cybersecurity
*   4 Ways For Employees To Distinguish Phishing Attacks
*   Employee training is key to keeping your enterprise safe
*   Why your remote employees may underperform? Top 10 problems
*   WordPress security: Steps to assess an employee before granting admin access

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

3 Ways an Employee Scheduling App Can Streamline Your Business

By Deeba Ahmed
The attack seems to be a retaliatory effort from Killnet following the diplomatic tensions between the two countries.…
This is a post from HackRead.com Read the original post: Pro-Russia Killnet Group Hit Top Lithuanian websites with Massive DDoS Attacks

****The attack seems to be a retaliatory effort from Killnet following the diplomatic tensions between the two countries.****

Pro-Russia threat actors Killnet have targeted Lithuania government institutions and networks in a series of highly disruptive DDoS attacks (distributed denial of service attacks). The country’s National Cyber Security Center (NKSC) confirmed the attack impacted the Secure National Data Transfer Network and private and public sector firms.

This “intense” attack occurred on 27 June 2022 and prevented users from accessing services. Although the attack has been managed now, and most of the sites are back online, the possibility of another attack cannot be ignored.

> “It is highly probable that such or even more intense attacks will continue into the coming days, especially against the communications, energy, and financial sectors.”
> 
> Jonas Skardinskas – Director NKSC

**The Bone of Contention- Kaliningrad**

The attack seems to be in reaction to the diplomatic row between Russia and Lithuania regarding the Russian exclave of Kaliningrad. For your information, it is situated on the Baltic Sea shores and was previously a part of Germany before WWII and then a part of the Soviet Union. Kaliningrad was later cut off from Russia after Lithuania became independent in 1990 as there were no ground routes.

After Russia’s invasion of Ukraine, Lithuania supported the EU ban on Russian exports after it was implemented across EU territories and blocked the transport of key materials like metals, coal, and construction materials to Kaliningrad, infuriating Kremlin. 

**Killnet Response**

The Russia-aligned hacktivist group Killnet claimed responsibility for the DDoS attack in a video and added that the group would again target the country until it lifted the blockage on Russian exports.

The group’s spokesperson told Reuters that Killnet demolished 1,652 web resources and plans to cause more damage soon. As seen by Hackread.com, Killnet is currently active on Telegram posting a list of Luthinian sites targeted by the group. In one of its statements in the Russian language, the group claimed the following:

> In 39 hours, we achieved the isolation of 70% of the entire network infrastructure in Lithuania. I will explain on the fingers: Web integration of Lithuanian websites and electronic systems is in the “Blockade”, that is, “Geo block”, web traffic and other means of communication are available only within the republic. Thus, we are disrupting Lithuania’s network interaction with the rest of the world. At the moment, Lithuania is in sadder conditions than Kaliningrad. And we keep our promise! 😉

**Impact of the Attack**

Lithuania’s government stated that the DDoS attack flooded several institutions’ websites with malicious traffic. Some of the websites taken down by Killnet include Lithuania’s State Tax Inspectorate (STI) and the country’s leading accounting services provider B1.lt among others.

The attack disrupted the Secure National Data Transfer Network, which is among the most critical components of the country’s national security in the cyberworld, particularly during wartime. Lithuania’s Core Center of State Telecommunications is currently identifying the impacted sites to offer DDoS mitigation.

Killnet on Telegram

**Previous Coverage**

Killnet angered the hacktivists collective Anonymous after declaring allegiance to Russia after the latter invaded Ukraine and started a war. Since the allegiance, Killnet has been active on its Telegram channel ‘We Are Killnet.’ 

Flashpoint researchers observed chats between the group members in which they mentioned a large-scale, coordinated attack on June 27th 2022, which they referred to as Judgment Day.

The attackers selected Lithuania as its target for closing transit routes to Kaliningrad. The group has also targeted European institutions. Hackread.com previously reported that the group leaked private info of Killnet hacktivists in a data dump and took the group’s website Killnet.ru offline.

**More Cyber Attack News**

*   Cloudflare Thwarted Largest Ever HTTPS DDoS Attack
*   Cloudflare Successfully Thwarted One of The Largest DDoS Attacks
*   DDoS Attacks by Hacktivists Disrupted Russian Alcohol Supply Chain
*   Pro-Iran Group ALtahrea Hits Port of London Website by DDoS Attack
*   President Putin’s Economic Forum Speech Delayed due to DDoS Attack

Pro-Russia Killnet Group Hit Top Lithuanian websites with Massive DDoS Attacks

By Owais Sultan
Application testing is a process that helps ensure the quality and safety of your software applications, whether the…
This is a post from HackRead.com Read the original post: How SAST Will Improve Your Overall Security: Intro

Application testing is a process that helps ensure the quality and safety of your software applications, whether the app is for a mobile or desktop device. Of course, it’s easy to understand why assessing & inspecting the security of an application can be beneficial. The process of testing can be used to find bugs and vulnerabilities, as well as to evaluate the overall security health of an application.

There are various types of testing that can be performed on an application, and the most popular ones are SAST, DAST, and IAST, but Static Application Security Testing (SAST) is one of the most effective ones.

Namely, SAST is a type of testing that analyzes an application’s source code rather than its binaries or executables. Many online security platforms like Mend SAST allow for an in-depth analysis of the application and can often find vulnerabilities that would otherwise be missed with other methods of testing.

**What is SAST?**

As we mentioned previously, SAST (Static Application Security Testing) is a type of security testing that analyzes your source code for vulnerabilities. This is in contrast to other forms of security testing, which focus on analyzing the behavior of running applications.

Regarding SAST, the method of testing can be used to find a wide variety of security issues, including SQL injection flaws, cross-site scripting (XSS) vulnerabilities, and unsafe coding practices that could lead to buffer overflows or attacks.

Thus, most experts believe that SAST is an important part of any security program, as it can help find vulnerabilities that other types of testing might miss. For example, a web application firewall (WAF) will only be able to detect and block SQL injection attacks if the attacker uses a specific type of payload that the WAF is configured to look for. However, SAST can find SQL injection flaws regardless of the payload that is used, as it analyzes the source code to look for insecure coding practices.

**Comparing SAST with IAST and DAST**

As we mentioned above, SAST is one of three main types of application security testing. The other two are Interactive Application Security Testing (IAST) and Dynamic Application Security Testing (DAST).

In its approach, IAST is similar to SAST in that it also analyzes the source code of an application. However, IAST tools are typically used while the application is running in order to provide more accurate results. This can make IAST more intrusive than SAST, as it can potentially interfere with the regular operation of the app.

On the other hand, DAST is different from both SAST and IAST as it focuses on analyzing the behavior of an application rather than its source code. DAST tools work by directly sending requests to the application and observing its response.

**Benefits of SAST**

There are many benefits of using SAST to improve the security health of your application, including:

*   **Improved overall security:** SAST can find vulnerabilities that other types of testing might miss. This means that your applications will be overall more secure.
*   **Reduced false positives:** since SAST analyzes the source code rather than the binaries or executables, it is less likely to produce false positives than its counterparts.
*   **Easier to use:** many SAST tools are easy to use and do not require a lot of training. This makes them ideal for organizations with somewhat limited resources.
*   **Faster results:** Unlike DAST and IAST, SAST tools can often find vulnerabilities much more quickly than other types of testing like manual code reviews.
*   **Lower costs:** SAST is usually less expensive than other types of testing, especially when comparing it to more intrusive methods like penetration testing.

**The Effect SAST Has On Security**

When it comes to testing the security of an application, SAST is an integral part of the security assessment, as it can find vulnerabilities testing methods might miss. Unlike other types of testing tools that can be used much later in the application’s software development lifecycle, SAST tools can test the security from the moment when the first lines of code are written.

This is why SAST has an incredibly positive effect on security – it can help the team of developers fix the problem even before it becomes one. For the vast majority of developers & applications, it is much easier to patch a vulnerability in its early stages and fix the line of code where it happens than to build a massive application only to remodel the code afterward.

**Conclusion**

We can conclude that SAST is incredibly beneficial & should be regarded as an essential part of the security assessment of an application. It can also help find vulnerabilities that other types of testing (like IAST and DAST) might miss, and it’s often faster and less expensive than its counterparts. So, if you are looking to improve the security of your applications, SAST is a great place to start.

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

How SAST Will Improve Your Overall Security: Intro

By Deeba Ahmed
The arrests were made in Spain, Portugal, and France in a coordinated effort by Brazilian Federal Police and…
This is a post from HackRead.com Read the original post: 10 Arrested for Involvement in Online Sexual Exploitation in Europe

****The arrests were made in Spain, Portugal, and France in a coordinated effort by Brazilian Federal Police and European law enforcement agencies.****

European and Brazilian police joined hands to take down an organized crime group for its involvement in human trafficking and online sexual exploitation.

In this operation, French Border Police, the Spanish National Police, the Brazilian Federal Police, and the Portuguese Judicial Police participated in the operation with the support of Europol.

Those suspected of involvement in the criminal networks’ malicious activities were arrested after raids in Spain, France, and Portugal.

**Details of the Arrests**

The law enforcement agencies surveyed fourteen locations between 20 and 23 June 2022, during which they interviewed eight victims of sexual exploitation and arrested ten individuals.

Among the arrested individuals, one was a Spanish national, while nine were Brazilian. The authorities seized electronic equipment, vehicles, hard drives, SIM cards, payment cards, documents, around forty mobile phones, and €20,000 in cash.

According to Europol’s press release, this was a well-organized operation where the suspected utilized a “complex financial” mechanism for directing their earnings from France to Brazil through banks in Spain and Portugal.

**Investigation Details**

The investigation started back in March 2021. However, investigators are certain that the group was operating much before that. This criminal network mainly comprised Brazilians, whereas the victims lived in Spain, France, and Portugal. Further probe reveals that this network had targeted around 100+ victims.

> “The investigators identified that the 13 main suspects were located in Brazil, Portugal, and Spain. Two suspects based in France formed a branch while exploiting the same victims controlled by the main criminal group.”
> 
> Europol

The gang advertised the victims on specific websites and managed their online accounts. For their sexual exploitation activities, the criminals rented hotel rooms and apartments for an entire week. More than 60 such locations were identified in France, and the gang made around €120,000 per month through these activities.

**More Cyber Crime News**

*   Man jailed after attempting to buy 3-year-old girl on dark web
*   Man sought dark web hitman to murder child victim of sexual abuse
*   Leader of biggest online sextortion ring ‘Nth Room’ jailed for 40 years
*   9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos
*   2-year prison for pervert who hacked webcams to spy on underage girls

10 Arrested for Involvement in Online Sexual Exploitation in Europe

By Deeba Ahmed
The targeted company, Khouzestan Steel Company (KSC), has acknowledged the cyberattack but claimed the attack was successfully thwarted.…
This is a post from HackRead.com Read the original post: Iran’s Largest Steel Producer Hit By Crippling Cyberattack

****The targeted company, Khouzestan Steel Company (KSC), has acknowledged the cyberattack but claimed the attack was successfully thwarted.****

Iran’s largest steel production firm is the latest victim of a cyberattack on Monday, marking the largest cyberattack on the country’s industrial sector. According to a report from The Associated Press, the attack forced the company to halt its operations.

**Attack Details**

The targeted company was the Iranian government-owned Khouzestan Steel Company (KSC). After the attack, its website became unavailable, and operations were suspended immediately. At the time of writing, the website was still offline.

The company’s CEO, Amin Ebrahimi, stated that the company stopped the cyberattack and was able to avoid internal damage to the manufacturing department to prevent supply chain disruption. Ebrahimi claims that due to “time and awareness,” this attack was successfully thwarted.

Khouzestan Steel Company acknowledged the cyberattack in an Instagram post (In picture: Amin Ebrahimi, CEO of Khouzestan Steel Company)

Furthermore, the CEO claims that their website will be restored and back online soon. However, Jamaran, Iran’s local news channel, stated that the attack didn’t work because when it happened, the factory was non-operational due to a power outage.

**Who is the Perpetrator?**

According to the AP, the company didn’t point out or put the blame on any particular group for the attack on the country’s most high-profile steel manufacturer based in Ahvaz, Khuzestan province. However, after sanctions on Iran, it was forced to downsize its reliance on imported parts, which affected its business.

This attack is not the first one targeting Iran’s critical infrastructure. Last year, as reported by Hackread.com, the country’s fuel distribution system was targeted in a cyberattack that disrupted operations at gas stations across Iran, prompting massive public outrage.

In another incident, train stations were hit with fake delay messages, and in another one, surveillance cameras at different locations in Iran were targeted. In these previously documented attacks, the Iranian government accused Israel and the USA of targeting its infrastructure.

In August 2021, a group going by the online handle of “Edaalate Ali” (Ali’s Justice or Ali’s Court) claimed responsibility for targeting prison computer systems and security cameras in Iran. The group also leaked CCTV footage showing grim conditions and grave human rights violations taking place at a prison facility in northern Tehran.

**More Cyber Attacks and Related News**

*   Iran’s Top Tier Airline Mahan Air Hit by Cyberattack
*   US seizes official website of Iranian state-owned Press TV
*   52k Iranian ID cards with selfies sold on dark web & hacking forum
*   40GB of leaked videos expose how Iranian hackers hijack email accounts
*   Personal details & phone numbers of 42M Iranians sold on a hacking forum