By Deeba Ahmed
The issue was caused by the software architecture used in Google Home devices.
This is a post from HackRead.com Read the original post: Google Home Vulnerability: Eavesdropping on Conversations

Matt Kunze, an ethical hacker, reported wiretapping bugs in Google Home Smart Speakers, for which he received a bug bounty worth $107,500.

Google Assistant is currently more popular among smart homeowners than Amazon Alexa and Apple Siri, given its superior intuitiveness and capability to conduct lengthy conversations. However, according to the latest research, a vulnerability in **Google Home Smart speakers** could allow attackers to control the smart device and eavesdrop on user conversations indoors.

**Findings Details**

The vulnerability was identified by Matt Kunze, a security researcher using the moniker DownrightNifty Matt. The researchers revealed that if exploited, the vulnerability could allow the installation of backdoors and convert Google Home Smart speakers into wiretapping devices. Moreover, Google fixed the issue in April 2021 following responsible disclosure on 8 January 2021 and developing a Proof-of-Concept for the company.

**Possible Dangers**

The vulnerability could let an adversary present within the device’s wireless proximity install a backdoor account on the device and start sending remote commands, access the microphone feed, and initiate arbitrary HTTP requests. All of this could be possible if the attacker is within the user’s LAN range because making malicious requests **exposes the Wi-Fi password** of the device and provides the attacker direct access to all devices connected to the network.

**What Caused the Issue?**

Matt discovered that the problem was caused by the software architecture used in Google Home devices as it let an adversary add a rogue Google user account to their target’s smart home devices.

A threat actor would trick the individual into installing a malicious Android application to make the attack work. It will detect a Google Home automation device connected to the network and stealthily start issuing HTTP requests to link the threat actor’s account to the victim’s device.

In addition, the attacker could stage a Wi-Fi de-authentication attack to disconnect the Google Home device from the network and force the appliance to initiate a setup mode and create an open Wi-Fi network. Subsequently, the attacker can connect to this network and request additional details such as device name, certificate, and cloud\_device\_id. They could use the information and connect their account to the victim’s device.

According to Matt’s **blog post**, the attacker could perform a range of functions, such as turning the speaker’s volume down to zero and making calls to any phone number apart from spying on the victim via the microphone. The victim won’t suspect anything because just the device’s LED turns blue when the exploitation happens, and the user would think the firmware is being updated.

Matt successfully connected an unknown user account to a Google Home speaker. He created a **backdoor account** on the targeted device and obtained unprecedented privileges that let him send remote commands to the Home mini smart speaker, access its microphone feed, etc. Watch the demo shared by the researcher:

It is worth noting that there’s no evidence this security loophole was misused since its detection in 2021. Being an ethical hacker, the researcher notified Google about the issue, and it was patched. Matt received a **bug bounty** worth $107,500 for detecting this security flaw.

1.  **Google Home Mini Secretly Recorded Conversations**
2.  **Voice assistant devices manipulated with ultrasonic waves**
3.  **Comcast voice remote control could be turned into a spying tool**
4.  **Using laser on Alexa and Google home to unlock your front door**
5.  **DolphinAttack: Voice Assistant Apps Siri and Alexa Can Be Hacked**

Google Home Vulnerability: Eavesdropping on Conversations

By Deeba Ahmed
3Commas' CEO, Yuriy Sorokin, has acknowledged the breach.
This is a post from HackRead.com Read the original post: 3Commas API Database Leaked by Anonymous Hacker

The Federal Bureau of Investigation (FBI) has launched an investigation into the hacking incident targeted against an Estonian crypto trading platform, 3Commas.

**Incident Details**

The hack occurred in early December 2022, during which the hacker gained access to the trading service’s system via the Application Programming Interface (**API**). How they compromised and accessed the platform’s systems is still a mystery.

Reportedly, 3Commas discovered the hacking on December 10th 2022 and an investigation was launched to determine the scale of damage and perpetrators. The FBI was duly notified. Two service users were contacted by the bureau’s Cincinnati Field Office on Thursday in connection to the incident. 

**A Case of Misses Alarm?**

In a **blog post** published December 11th, 2022, 3Commas CEO rubbished the claims from hackers and labelled them as “Bad faith actors” who are “making accusations using falsified evidence.”

Additionally, within the past few months, many 3Commas users discovered their funds were traded on different crypto exchanges they had linked to their accounts without their consent.

**According to** Coin Desk, One of the affected groups comprising sixty members contacted the US Secret Service and other agencies to report their missing funds. As per this group’s leader Edmundo Pena, the losses amounted to over $20 million. However, the platform **claimed** these users became targets of a phishing attack and there wasn’t anything wrong with the service.

**Leaked Data**

3Commas’ API data was the key target in this breach. An initial probe suggested that an anonymous entity leaked around 100,000 Binance and KuCoin API keys belonging to 3Commas. 

Leaked data includes usernames, hashed passwords, and email IDs, but it is unclear if cryptocurrency assets were stolen or financial information was accessed during the breach. According to the API database leaker, the 3Commas keys were sold by an insider. 

> — db (@tier10k) December 28, 2022

However, 3Commas CEO Yuriy Sorokin stated that there was no evidence to believe that any of their employees were involved in the attack. While the investigation is underway, 3Commas has urged users to protect their private and financial data and change their passwords.

Furthermore, they must enable 2FA authentication and monitor their accounts for any unusual activity. Binance CEO Changpeng Zhao aka CZ suggests that users may disable 3Commas API keys because of the leaks.

> I am reasonably sure there are wide spread API key leaks from 3Commas. If you have ever put an API key in 3Commas (from any exchange), please disable it immediately.
> 
> Stay #SAFU.
> 
> — CZ 🔶 Binance (@cz\_binance) December 28, 2022

1.  **The Most Common API Vulnerabilities**
2.  **Cloud Hacking – Why API Remains the Biggest Threat?**
3.  **Urlscan.io API Inadvertently Leaked Sensitive Data and URLs**
4.  **Google reveals unpatched 0day vulnerability in Microsoft’s API**
5.  **Millions impacted as payment API flaws exposing transaction keys**

3Commas API Database Leaked by Anonymous Hacker

By Deeba Ahmed
An EarSpy attack is a proof of concept of a new type of attack on Android devices that exposes users to eavesdropping.
This is a post from HackRead.com Read the original post: EarSpy Attack Can Use Motion Sensors Data to Pry on Android Devices

A technical paper titled “EarSpy: Spying Caller Speech and Identity through Tiny Vibrations of Smartphone Ear Speakers” has revealed how snoopers can exploit motion sensors installed inside **Android** cellphones can help adversaries eavesdrop on the user’s conversations.

**Startling Facts About Motion Sensors**

A team of researchers from different universities, including Rutgers University, Texas A&M University, Temple University, New Jersey Institute of Technology, and the University of Dayton, conducted the research.

The research team comprised Ahmed Tanvir Mahdad, Cong Shi, Zhengkun Ye, Tianming Zhao, Yan Wang, Yingying Chen, and Nitesh Saxena.

Dubbing this side-channel attack EarSpy, researchers noted that motion sensors could be used for registering ear speaker reverberations so that the attacker can determine caller identity and gender and listen to their private conversations.

This research has substantiated the assumption that eavesdropping through capturing motion sensor data is possible.

**How does EarSpy Attack help in Snooping?**

Researchers wrote that the **study** (PDF) was based on the belief that smartphones’ built-in motion sensors can let attackers collect data on indoor locations and touchscreen inputs along with listening to audio conversations without needing explicit permissions before collecting raw data.

Initially, they thought generating powerful vibrations through ear speakers to eavesdrop on user conversations wasn’t possible. But during their research, the team realized that modern smartphones have high-quality stereo speakers and highly sensitive sensors that can detect finer vibrations.

Hence, they finally determined the ideal environment for successful eavesdropping using various devices and techniques. They used multiple pre-recorded audio files, a 3rd party application for capturing sensor data as they simulated calls, and a machine learning algorithm for results interpretation.

**Research Findings**

The team found that gender detection was 98.6%, and speaker detection was up to 92.6% accurate. Moreover, they found speech detection up to 56.42% accurate. This proved the existence of differentiating between speech features in the accelerometer data that attackers can exploit for spying. EarSpy focused on gender recognition using data collected at 20 Hz, which indicates a lower sampling rate can allow attackers to determine the user’s gender.

Overview of ear speaker eavesdropping

**How to Prevent Eavesdropping?**

Researchers recommended limiting permissions to counter eavesdropping via sensor data so that 3rd party applications cannot record sensor data without the user’s permission. It is worth noting that Android 13 doesn’t allow sensor data collection at 200 Hz without the user’s permission to prevent accidental data leaks.

Furthermore, experts suggested that mobile device manufacturers must be cautious about designing more powerful speakers and instead focus on maintaining a similar sound pressure during audio conversations as was maintained by old-generation phones ear speakers.

Lastly, positioning motion sensors as far from the ear speaker as possible could minimize the phone speaker’s vibrations and diminish spying chances.

1.  **5 Tips for Protecting Your Phone from Malware**
2.  **10 Android Educational Apps That Collect Most User Data**
3.  **SSID Stripping flaw lets hackers mimic real wireless access points**
4.  **Hackers could access photos, videos without unlocking your phone**

EarSpy Attack Can Use Motion Sensors Data to Pry on Android Devices

By Habiba Rashid
The threat actor claims that Twitter data was "scraped via a vulnerability."
This is a post from HackRead.com Read the original post: 400 Million Twitter Users’ Scraped Info Goes on Sale!

The sample data seen by Hackread.com shows that the sold information also includes records on top celebrities and political figures, such as Democratic Rep. Alexandria Ocasio-Cortez and Bollywood’s Salman Khan.

On December 23, 2022, a threat actor going by the handle “Ryushi” claimed to sell more than 400 million Twitter users’ personal details on BreachedForums, a cybercrime and hacking forum that surfaced as an alternative to the **now-seized Raidforums**.

As seen by Hackread.com, the sample data attached to the post contains private email addresses, usernames, follower counts, creation dates, and, in certain cases, the user’s phone numbers.

The sample data also contains a variety of well-known user accounts including New York Democratic Rep. Alexandria Ocasio Cortez, Ethereum cryptocurrency founder Buterin, Indian actor Salman Khan and cybersecurity reporter Brian Krebs. 

> Hey @elonmusk, since you don't seem to have much a media/comms team anymore, can you address the apparently legitimate claim that someone scraped & is now selling data on hundreds of millions of Twitter accounts? Maybe it didn't happen on your watch, but you owe Twitter a reply.
> 
> — briankrebs (@briankrebs) December 27, 2022

It is worth mentioning that the latest data leak came just one month after a hacker leaked the contact and personal details of over **5.3 million Twitter users** online. Both the earlier and latest incidents are now being **investigated** by Irish authorities.

The threat actor stated in the post that the data had been “scraped via a vulnerability” but did not specify any further details.

Further, they openly advised the **CEO of the social media giant, Elon Musk**, that he should buy this data directly from the hacker instead of “paying $276 million USD in GDPR breach fines like Facebook did” but does not specify a price at which the data is being sold.

Sample data seen and analyzed by Hackread.com (Image credit: Waqas – Hackread.com)

Offering to conduct the “deal” through a middleman, the threat actor states, “After that, I will remove this thread and will not sell this info again. And data won’t be sold to anyone else, which will stop a lot of celebrities and politicians from Phishing, Crypto scams, Sim swapping, Doxxing, and other things that will make your users lose trust in you as a company and thus stunt the current growth and hype.”

Researchers who have seen the sample data believe that this alleged data leak is the result of an API flaw which allowed the threat actor to search any email addresses or phone numbers and return a **Twitter** profile.

This attack followed only months after Twitter entered into a **consent order** with the US Federal Trade Commission binding it to maintain a privacy and information security program for the next two decades.

The agreement ended a federal investigation into Twitter’s use of phone numbers and email addresses for advertising purposes when they were collected to be used for multi-factor authentication. Twitter also paid a $150 million civil penalty.

Therefore, if this data breach is verified, the impact on Twitter would be drastic both financially and socially. At the time of writing, the data was still up for grabs.

1.  **Hackers leak scraped data of 87,000 GETTR users**
2.  **Nearly 500 million WhatsApp User Records Sold Online**
3.  **Leaky Server Exposing Scraped Data of 150,000 Mastodon Users**
4.  **Leaked: 235m Instagram, TikTok, YouTube users’ scraped records**
5.  **Meta Fined €265 million in Facebook Data Scraping Case in the EU**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

400 Million Twitter Users’ Scraped Info Goes on Sale!

By Deeba Ahmed
It turns out that hackers stole much more than just the source code from LastPass.
This is a post from HackRead.com Read the original post: LastPass: Hackers Stole User Data and Encrypted Password Vaults

According to LastPass, hackers managed to access end-user names, company names, billing addresses, telephone numbers, email IDs, and IP addresses in the August 2022 data breach.

In August 2022, **Hackread.com reported** on a data breach involving the popular password management service LastPass in which the company claimed only its source code was stolen by hackers. The latest reports reveal that the breach’s scope was way more extensive than the company claimed earlier.

Do not confuse the new details with the data breaches that LastPass revealed in September of 2022, or the one **in earlier December** of this year.

On Thursday, LastPass released updated information about the breach, revealing that attackers managed to steal the personal data of a large number of its customers, including encrypted password vaults. Furthermore, the attackers used previously leaked data to access the vaults.

Hackers reportedly accessed the private data and metadata of its customers. The information obtained by attackers included end-user names, company names, billing addresses, telephone numbers, email IDs, and IP addresses the customers used for accessing **LastPass**‘s services.

Further, the attackers also copied the backup of customer vault data, including website URLs and other encrypted data fields, like website usernames, form-filled data, secure notes, and passwords. But unencrypted credit card data wasn’t breached.

These fields were secured with **256-bit AES encryption**. Hence it could only be decrypted through a unique encryption key obtained from the master password of each user. For this, the attackers used LastPass’s Zero Knowledge architecture, Karim Toubba, the company’s CEO, wrote.

He didn’t reveal how recent the backup was but noted that the attacker used brute force to obtain the master password and decrypt the vault data.

“If you reuse your master password and that password was ever compromised, a threat actor may use dumps of compromised credentials that are already available on the internet to attempt to access your account,” the CEO added.

The attackers also stole proprietary technical data and source code from LastPass’s development environment. All of this they achieved using the compromised accounts of an employee.

According to LastPass’s **blog post**, the attacker obtained keys and credentials to steal data from a backup stored in a Cloud-based storage service, which operated independently and wasn’t a part of its production environment. The encrypted vault data was also stored in the same service’s “proprietary binary format.”

The incident is currently under investigation. The company has notified a small portion (3%) of its business clients to take preventive measures on their account configurations.

1.  **LastPass hacked; security compromised for good**
2.  **LastPass Flaw Allowed Hackers to Steal Credentials**
3.  **Critical vulnerabilities found in popular Password Managers**
4.  **PasswordState password manager’s update dropped malware**

LastPass: Hackers Stole User Data and Encrypted Password Vaults

By Waqas
In BetMGM's case, hackers are selling data of 1.57 million customers, while data of 68,000 DraftKings customers is also up for grabs.
This is a post from HackRead.com Read the original post: Online Casinos DraftKings and BetMGM Hacked; Data of Millions at Risk

Threat actors are now targeting online betting platforms and casinos since two mainstream casino sites have been targeted and hacked within a brief period.

**BetMGM Hacked**

MGM Resorts owns BetMGM. **In May 2022**, MGM Resorts had 142 million customer records leaked on Telegram from the **2020 breach**; BetMGM is the latest to suffer a data breach.

BetMGM is an online sports betting platform that suffered a data breach recently, resulting in the leaning of data of 1.57 million of its customers. As seen by Hackread.com, the attacker placed the stolen database up for sale the same day on BreachedForums, a cybercrime and hacking forum that surfaced as an alternative to the **now-seized Raidforums**.

In their post, the attacker claimed the database contained records dating from November belonging to every customer who had placed a casino wager. The message was posted on December 21st, 2022. The hacker also shared data samples. However, it wasn’t clarified how much they demanded to sell the database.

“We breached BetMGM’s casino database current as of Nov 2022. The database is inclusive of every BetMGM casino customer (over 1.5M) as of November 2022 from MI, NJ, ON, PV, and WV. Any customer that has placed a casino wager is included in this database,” the hacker said.

On the other hand, BetMGM confirmed the attack by posting a statement on its website on the same date, i.e. December 21st, 2022. The statement revealed the hackers gained unauthorized access to its system and stole patron records.

The company revealed that it detected a data breach on November 22 and suspects that the intrusion occurred in May 2022.

**What Data Was Stolen?**

According to BetMGM, the stolen data includes names, postal addresses, email IDs, phone numbers, dates of birth, account identifiers, hashed Social Security Numbers, and transactions-related information of its customers.

The data “varied by patron,” the company **stated**, adding that so far, there’s no evidence that passwords and account funds were accessed. The company still urges its customers to change passwords and has promised to offer impacted customers free identity restoration and credit monitoring services for up to two years.

**DraftKings Hacking**

Another online sports betting platform, DraftKings, has become the target of hacking lately and has lost the private data of 68,000 customers. The company became a victim of a **credential stuffing attack** where the attackers used previously leaked credentials to access DraftKings’ user accounts and steal personal data.

The hackers also withdrew funds from victims’ accounts. It is worth noting that the company’s cofounder Paul Liberman has **confirmed** the attackers stole $300,000 from victims’ accounts. The incident occurred in November.

DraftKings stated that it would restore the stolen funds and sent notification letters to affected customers on Friday, informing them about the leaking of their data.

“Based on our investigation to date, we believe that attackers may have previously gained access to your username or email address and password from a non-DraftKings source and then used those credentials to access your DraftKings account,” the letter read.

**What Data was Exposed?**

According to DraftKings, the personal information compromised in this breach can include customer names, phone numbers, addresses, email IDs, account balances, profile photos, previous transaction information, last password change date, and the last four digits of their payment cards.

However, there wasn’t any evidence that hackers stole Social Security Numbers, financial account numbers, and driver’s license numbers. DraftKings urged customers to change their account credentials and reset passwords immediately.

“We have restored amounts that have been withdrawn from certain accounts in connection with credential stuffing attacks, as determined and identified by DraftKings,” the company stated.

1.  **Casino Becomes Victim of Data Hack, courtesy Fish Tank**
2.  **Ransomware Group ‘FIN10’ Hacked Casinos, Mining Firms**
3.  **Computer System of Canadian Casino Hacked; Data Stolen**
4.  **Hackers attack Casino’s fish tank thermometer to obtain data**
5.  **Gambler Hacks Casino Surveillance System To Win $33.2 Million**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Online Casinos DraftKings and BetMGM Hacked; Data of Millions at Risk

By Owais Sultan
In this article, we'll explore the key features and benefits of Android-based digital signage and how you can take advantage of them.
This is a post from HackRead.com Read the original post: Android-Based Digital Signage: Key Features and Benefits

Today, digital signage is an incredibly powerful tool for businesses. It can help increase your clientele base and sales. The great news is that it’s now easier than ever to access digital signage through Android-based systems.

With Android-based digital signage, you can leverage the convenience, flexibility and affordability of Android technology to take your **digital signage** to the next level.

In this article, we’ll explore the key features and benefits of Android-based digital signage and how you can take advantage of them. Read on to find out more about this exciting and innovative technology!

Android-based digital signage is a great choice for businesses of all sizes. It has a wide range of features and benefits to offer, including:

*   The ability to track viewer engagement and measure results
*   The ability to play videos, photos and other multimedia content
*   The ability to connect to the internet and receive real-time updates
*   A customizable interface that can be tailored to meet your specific needs

**What is Android-based digital signage?**

Android-based digital signage is a digital display system that uses the Android operating system. It can be used for various purposes, such as displaying information, advertising and promoting products or services.

Android-based digital signage has several key features that set it apart from other types of digital signage. These features include running multiple apps simultaneously, using a wide range of sensors and cameras, and connecting to the internet and other devices.

**Key benefits of android-based digital signs**

There are several key benefits of using Android-based **tv for digital signage** that you need to know.

First, these systems are extremely versatile and can be used for various purposes. You can use them to display information, promote your brand or engage with customers. They’re also very easy to use and can be customized to your specific needs.

**Android-based devices** are also extremely reliable and can be depended on for accurate performance in any environment. They’re also secure, and you can rest assured that your data will always be protected.

Finally, Android-based digital signage is cost-effective and easily scaled to meet your needs. This makes it the ultimate choice for businesses of all sizes.

**Flexible and user-friendly content management**

Android-based digital signage is very flexible and user-friendly. In most cases, you don’t need any technical expertise to manage the content on your screens. You need to be able to use a computer and navigate around a basic interface.

You can quickly and easily change your content as needed using professional digital signage software compatible with **Android OS**. It literally takes just a couple of minutes if you need to update your prices, switch up your marketing messages, or add new content. Plus, you can easily access your signage from anywhere worldwide as long as you have an internet connection.

**Affordability and scalability for small businesses**

One of the main benefits of Android-based digital signage is its affordability and scalability for small businesses. **Android is an open-source platform**, meaning there is no licensing fee associated with using it. It makes it a more cost-effective option for small businesses that want to implement digital signage on a budget.

Android-based digital signage is also highly scalable, enabling it to be easily expanded as your business grows. If you start with a few displays and want to add more later, you can do so without replacing your existing infrastructure. It makes it a very flexible solution that can grow with your business.

**Enhancing customers’ shopping experiences**

You can use Android-based digital signage to enhance customers’ shopping experiences in several ways. For example, you can use it to:

*   **Showcase products:** Use digital signage to showcase products interactively and engagingly. You can use it to provide product information and show images and videos.
*   **Create a sense of urgency:** Use digital signage to create a sense of urgency and encourage customers to buy products before they run out of stock. You can use it to display countdown timers and messages such as “while stocks last.”
*   **Provide directions:** Use digital signage to provide directions and help customers find their way around your store. You can use it to display maps and directions and store information such as opening hours and contact details.

Android-based digital signage is becoming a more popular option because of its versatility and affordability. It’s a great way to get your message out there and can be tailored to meet your specific needs. If you’re looking for an effective and affordable way to advertise your business, Android-based digital signage is worth considering.

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Android-Based Digital Signage: Key Features and Benefits

By Owais Sultan
Cybersecurity awareness is no longer a “nice to have”; in fact, it has become a fundamental part of…
This is a post from HackRead.com Read the original post: Cybersecurity Awareness Training in Companies: Why You Can’t Do Without It

Cybersecurity awareness is no longer a “nice to have”; in fact, it has become a fundamental part of your corporate training process across all levels and aspects of your business.

Would you leave your business unlocked and open to all comers? Of course not – but if you don’t have **solid cybersecurity** in place, that’s effectively what you’re doing! As the business world becomes a digital space, security has also become a digital matter.

One cybercriminal can wreak havoc if unchecked, and our potential flashpoints for vulnerabilities are growing daily. Nor is this something you can achieve alone – a great IT security team is one thing, but if one of your other workers leaves the metaphorical door unlocked, you’ll still be in trouble. 

With top-down training boosted with the power of video, however, security can become a simple matter. 

**A Growing Risk**

The average cost-per-company of a data breach is over $4 million. Cybercrime currently costs companies globally $8.4 _trillion_ a year- and that is **expected to soar** to $23 trillion (or more) by 2027. Fortunately, there’s a lot you can do to mitigate your risk and keep your company out of those stats. 

Humans are and will remain, the weakest link in any business’s digital security. Just as a thoughtless individual can leave a door unlocked and bypass your multi-million dollar security system in a heartbeat, one wrong move from an employee and even the best cybersecurity comes tumbling down.

It’s critical that all people in your organization are aware of cybersecurity risks, know the best practices for data and network security, and understand the consequences of laziness leading to cybersecurity failures. 

**Cybersecurity Awareness Training**

It’s a simple idea – using a technical approach to proactively educate employees, ensuring awareness of data privacy, identity, and digital assets permeates every level of your organization. This will immensely **reduce your risk of cybersecurity breaches**. In turn, that means fewer financial losses from this type of crime, making it a solid return on investment.

And being cybersecurity-aware will have knock-on positives in your reputation with consumers, making you seem more trustworthy and desirable. Prevention of security issues means no loss of brand reputation, too. 

**The Learning Gap**

Of course, your training is only as good as its retention rate. **Cybersecurity training for employees** can’t be some dull, dusty lecture or 500-page word document that’s unengaging, boring, and packed with jargon, or you may as well not waste your time. It’s critical that staff feel both empowered with their new skills, and that it comes over as simple to understand and easy to implement.

We all know that video is one of the most powerful storytelling formats out there. From the power of video shorts and reels for marketing to the way a great TV program can unite us, it’s a format that delivers punchy messages in an engaging way. 

Unlike text, where aspects like reading level can play a role, everyone can engage with video. Plus you have the benefit of being able to condense a lot of information into short, pithy, and easy-to-retain factoids. You can power that up further with the **power of AI**, making videos simple to create, engaging, and easy to update and adapt without a huge financial outlay.

Using a simple text-to-speech format, you can create compelling, entertaining, _and_ educational content that will help keep every member of your organization aware of cybersecurity risks and qualified to prevent them from occurring.

**Cybersecurity awareness** is no longer a ‘nice to have’. It’s an absolutely essential part of your corporate training process, across all levels and aspects of your business. With the power of simple-to-use AI video on your side, creating engaging learning programs to keep staff informed and ahead of cyber criminals is a simple matter, so don’t delay in addressing this critical aspect of business security today.

1.  **5 Reasons You Should Learn About Cyber Security**
2.  **Cyber Security firm exposes 5 billion+ login credentials**
3.  **Solving the Cyber Security Problem: Mission Impossible**
4.  **If a Cyber Security Report Falls in a Forest, Is Anyone Listening?**
5.  **5 Proven Cyber Security Certifications That Will Boost Your Salary**

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Cybersecurity Awareness Training in Companies: Why You Can’t Do Without It

By Habiba Rashid
Hackread.com can confirm that the InfraGard database is also circulating on several Russian cybercrime forums and Telegram groups.
This is a post from HackRead.com Read the original post: Sale or No Sale; Hacker Leaks FBI’s InfraGard database Online

After claiming not to sell data stolen from the FBI’s critical-infrastructure portal, InfraGard, the hacker has released the data publicly for download.

On December 14th, 2022, **HackRead.com reported** about a hacker who was selling a database belonging to InfraGard, an FBI-launched security program to develop physical and cyber threat information-sharing collaborations with the private sector.

The database leak came right after pro-Russian hackers from the KillNet group claimed to have **infiltrated the FBI’s database**, allegedly stealing the personal information of more than 10,000 US federal agents.

The InfraGard hacker, who goes by the handle “USDoD,” was selling the database for $50,000. It contained the contact details and personal information of more than 87,000 members registered with InfraGard.

However, **on December 16th, 2022**, the same hacker edited their post, announcing that they would no longer be selling the database, citing the harm it would cause to the victims.

“I would like to let you know that this data will no longer be posted for sale and won’t be used in the future. I realised that selling it would cause more harm to everyone than it would benefit me financially.”

Now, without even selling it to any individual, the hacker has made the database available to the public. It appears that they did not feel any guilt for their actions as was previously stated.

Hackread.com can confirm that the InfraGard database is also circulating on several Russian cybercrime forums and Telegram groups. The database in question contained the personal details of the InfraGard members including the following:

1.  Full names
2.  Email addresses
3.  Employment details
4.  Industry of employment
5.  Social media USERIDs and more.

3 posts from the InfraGard hacker (Image credit: Hackread.com)

**Brief History of InfraGard**

InfraGard was established in 1996 as a joint initiative of the **FBI**’s National Infrastructure Protection Center (NIPC) and the Information Systems Security Association (ISSA). InfraGard provides access to secure email systems, secure data storage platforms, web-based vulnerability assessment tools, password management solutions, and other security services.

Additionally, InfraGard offers educational seminars on topics such as cybersecurity best practices and emerging threats. These seminars are open to members of all sectors and help them stay informed about current security trends.

InfraGard also provides resources for identifying potential cybercrime victims or suspicious activities before they become major issues.

**Potential Threats to InfraGard Members**

The incident is concerning not only because it puts the security of these companies at risk but also because many of its members are federal agencies as well as state and local law enforcement agencies that handle sensitive materials on a regular basis.

With the leaked information in the wrong hands, cyber criminals could take advantage of this vulnerability and use it to gain access to confidential government records or even personal information belonging to members of the public.

1.  **US Govt’s secret terrorist watchlist exposed online**
2.  **Top US Federal Agencies Hacked by Russian Hackers**
3.  **Hacker accessed FBI server to send fake email threats**
4.  **48 DDoS-hiring Services Busted by FBI in Major Sweep**
5.  **Chinese hackers accessed NSA hacking tools before leak**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Sale or No Sale; Hacker Leaks FBI’s InfraGard database Online

By Habiba Rashid
It is still unclear who was behind the suspected ransomware attack on The Guardian.
This is a post from HackRead.com Read the original post: Media Giant Guardian Hit By Suspected Ransomware Attack

Although the online publishing at the Guardian remained unaffected, some of the company’s internal technology infrastructure was affected.

One of the most-read newspapers in the world, the Guardian, was hit by what is suspected to be a ransomware attack on Tuesday night. The London, England-based news organisation said that they believed it to be a **ransomware attack**, “but are continuing to consider all possibilities.”

Ransomware attacks are conducted by threat actors who hack into an organisation’s computer systems, encrypt the important files and then **demand a ransom** to restore the services or unlock the files. If the demand is not met, the data is leaked online in most cases.

Although the online publishing by the organisation has remained unaffected with stories continuing to be written and published on the Guardian website and app, some of the company’s internal technology infrastructure was affected. 

They also told the staff to work from home, following the routine used during the pandemic.  The Guardian Media Group chief executive, Anna Bateson, and the editor-in-chief, Katharine Viner, **told** the staff:

“We will continue to keep our staff and anyone else affected informed. We will update everyone again at the end of the day. With a few key exceptions, we would like everyone to work from home for the remainder of the week unless we notify you otherwise.”

“Thank you to everyone working hard throughout this incident to keep us publishing, looking after our readers, supporters and advertisers, and keeping our core systems available for colleagues.”

Journalists, media outlets and new organisations have become a much more frequent target for cyber attacks as compared to the past as they play a vital role in forming a public outlook and a national view. Media houses command a significant soft power to retain and spread their influence by advocating their agenda, gathering public opinion and shaping it. 

Therefore, it has become more important than ever before for journalists and news organisations to employ the **best cyber security practices** and protect themselves from breach campaigns. 

1.  **Ransomware Gang Leaks Medibank Data on Dark Web**
2.  **Royal Ransomware Uses Google Ads and Cracked Software**
3.  **University College London hit by a major ransomware attack**
4.  **CryWiper Masquerading as Ransomware to Target Russian Courts**
5.  **Pro-Russian Killnet group hits UK organizations with DDoS attacks**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Source

HackRead