By Owais Sultan
A phishing scam is not only about stealing your login credentials, but it can also install malware, including ransomware, which is why it is essential to learn how to tackle this growing threat.
This is a post from HackRead.com Read the original post: Phishing Scams: How To Recognize A Scam Email, VOIP call, or Text

The number of phishing scams reported in the first quarter of 2022 **set a new record** of over one million total attacks, according to a report by the Anti-Phishing Working Group.

And the scams have been growing fast in recent years. The number of attempts reported in the first quarter of 2022 is more than triple the average numbers just two years before, in early 2020.

With so many attacks underway—and growing by the day—what’s the best way to recognize these scams and prevent them? We’ll look at how to recognize and protect yourself from the most common types of phishing fraud. Meanwhile, you can also learn **how to detect phishing images in an email**.

**Most prevalent types of phishing scams**

Phishing today refers to a type of scam that steals people’s personal information by posing as a trusted third party. For example, a scammer might pretend to be a government worker to get you to share your Social Security number or pretend to be from your bank to get you to share account details.

With so many communication channels today, there are more phishing methods than ever before. And scammers have adapted to each type of channel by leveraging trust signals inherent to each one.

This can make it hard for the untrained eye to spot a phishing scam and even difficult to recognize **if you’ve been hacked** after falling for an attack. The first sign that tips off most victims is an unexpected charge, damaged credit score, or depleted bank account.

Here are the six most common types of phishing scams and how to protect yourself.

**1\. Email scams**

Anyone can fall for an email scam; **this U.S. judge did**. By far the most common type of phishing attack is via email. You’re probably familiar with the spam emails we all get on a day-to-day basis, but the most sophisticated phishing attacks look very different.

These emails often look identical to official messages and notifications, including the company’s logo and exactly the same content as a real message. For example, one of today’s most common scams is a message notification from LinkedIn that’s almost impossible to tell apart from the real thing.

**How to protect yourself:**

*   Never click on links in emails. Instead, visit the official site.
*   Beware of email addresses that aren’t from the business domain, especially if the address is from a free provider like Gmail.
*   Disable automatic image loading, as this can let scammers know you’ve seen the message.

**2\. Voice phishing (vishing)**

Another common method fraudsters use to trick victims is over the phone. These calls usually claim to have a one-of-a-kind offer or urgent, life-threatening warning.

Most scammers use a VoIP phone system that lets them change the phone number, meaning the call appears as though it’s from a local number even if it’s not.

**How to protect yourself:**

*   Never answer calls from numbers you don’t recognize, even if it has a local area code.
*   Don’t return calls from numbers. you don’t recognize (one type of scam collects expensive per-dial and per-minute fees, hoping you’ll call back).
*   Remember that most U.S. government agencies, including the IRS, Medicare, and the Social Security Administration, almost never call by phone and do not have the power to arrest you.

**3\. Phishing websites**

One of the most common destinations for phishing scams is a fraudulent site that looks like the official website. The cloned site will often be identical to the real page, using the company’s logos, color scheme, and fonts.

After establishing trust with the design, the site will ask you to share personal information, anything from your email and password to your Social Security number or bank account details. For example, this **attack impersonating American Express** used an email message and web page almost impossible to tell apart from the real brand.

Phishing email and the phishing page (Screenshots via Armorblox)

**How to protect yourself:**

*   If you get a message with a link—even if it looks trustworthy—go to the official site instead.
*   Check the URL of a website to make sure it’s correct. (You’ll notice the American Express phishing page above comes from a site other than AmericanExpress.com.)
*   Don’t automatically trust an HTTPS connection. The “green padlock” icon is an important trust signal, but it doesn’t mean a site is safe. Hackers can use them on phishing sites, too.

**4\. SMS text message scams (smishing)**

Text messages don’t have much space for the scammer’s message, but that hasn’t stopped criminals from trying new tactics to trick innocent victims. The goal of most **SMS scams** is to get you to click on a link or make a call, so immediately be suspicious of any message with a link or number (though of course, some legitimate messages have these as well).

One of the most common ruses right now with text scams is, ironically enough, helping to protect you from scams. You’ll often see a message “confirming” an expensive purchase or withdrawal, directing you to a number or link to cancel or investigate. There is nothing to cancel or investigate, but the scammer will pretend to resolve the situation by collecting your personal data for a future attack.

**How to protect yourself:**

*   Don’t trust texts from numbers you don’t recognize. Instead, visit the official site.
*   Beware of texts that use vague terms like “your bank” or “package service.” Scammers use these (instead of actual company names) so the message can apply to anyone.
*   Don’t reply to scam messages, even unsubscribe. This only confirms you have an active number and will result in more attacks.

Social media has become one of the more recent additions to the phishing repertoire. Scammers reach out either using a fake lookalike account or a compromised account.

One common ruse is a friend reaching out for help, usually with an authentication code. But it’s not a friend—it’s a scammer who’s taken over their account and is trying to take over yours. Another ruse is a message from someone posing as the **official company support account**, asking you to provide information to verify you’re the authentic owner or to keep your page active.

Fake Support chatbot (Image: Trustwave)

**How to protect yourself:**

*   Beware of anyone who reaches out and asks for personal information or verification codes, even if they appear to be coming from a friend.
*   Don’t respond to messages from “official” accounts. If you’ve received an alert from the social networking site, it’ll usually appear in your account settings.
*   Don’t ever share your social media password with a third-party website.

**6\. Man-in-the-middle attack**

This type of phishing scam requires the attacker to be nearby but can be one of the most dangerous because it’s almost impossible to detect. It works when you and the attacker are on the same Wi-Fi network, **like at a coffee shop** or airport. The attacker intercepts everything you send and receive and can redirect your browser to safe sites to look-alike sites without you knowing.

Once the attacker has set up a man-in-the-middle attack, they can see almost all the information you share, including usernames, passwords, credit card details, and more.

**How to protect yourself:**

*   Never use public Wi-Fi networks. A better option is to connect to a hotspot from your cell phone, which has a secure and private connection.
*   If you have to use public Wi-Fi, turn on a VPN. This can protect you against most types of man-in-the-middle attacks and safeguard your personal details.

**How to prevent phishing**

Every type of phishing requires a slightly different method to spot, and scammers are constantly developing new methods that leverage our weaknesses. But there are a few common warning signs you can look for across different types of phishing attacks.

*   **Unfamiliar senders.** Emails, texts, or calls from people you don’t recognize are automatically suspect.
*   **Poor spelling or grammar.** Major corporations pay careful attention to small details like this. Scammers, on the other hand, don’t usually worry about a few typos and often use poor English.
*   **Urgency and threats.** Scammers demand immediate action or scare you using intimidation tactics, like arrest or deportation, so you don’t recognize warning signs of a scam.
*   **Unusual payment methods.** Phishing scams often take the opportunity to charge a “fee” for a service but will only accept forms of payment like gift cards, money orders, or cryptocurrency. Legitimate businesses use other methods.

**What to do if you’re a victim of phishing**

You’ve learned how to protect yourself from phishing scams, but what if you’ve already fallen victim? If you know you’ve shared information with a scammer, **here’s what you should do**, based on what information you’ve shared.

*   **Credit or debit card details.** Call the issuing company and have the card canceled immediately. Ask to reverse or dispute any fraudulent charges.
*   **Login details or passwords.** Log into the compromised account, change the password, look for an option to close all active sessions, and add two-factor authentication if possible. Do the same for any other accounts using the same password.
*   **Medical insurance information.** Call your insurance company and any impacted companies, explain the fraud, and dispute any fraudulent charges.
*   **Social Security number.** Set up a credit freeze at each of the three credit bureaus (Experian, Equifax, and TransUnion). This prevents anyone from requesting credit in your name.
*   **Name, email, date of birth, or other information.** Keep a close eye on your accounts for signs of identity theft.

No matter what kind of information you’ve shared, it’s always a good idea to report the fraud to the Federal Trade Commission at **IdentityTheft.gov**. Filing the report helps protect others, gives you documentation of the attack, and will provide you with recovery steps specific to your situation

**Conclusion**

Phishing attacks are on the rise, and scammers are developing even more intricate scams all the time. But if you know the most common warning signs and stay vigilant, you can protect yourself and take quick action in case you’ve been compromised.

1.  **WhatsApp OTP Scam Allows Crooks to Hijack Your Account**
2.  **Scammers Made Deepfake AI Hologram of Binance Executive**
3.  **16,000 Scam Domains Aimed at FIFA World Cup Fans in Qatar**
4.  **Phishing Scam: Hackers Steal $11M from Canadian University**
5.  **Scammers Use AI-Generated Images to Represent Fake Law Firm**

Phishing Scams: How To Recognize A Scam Email, VOIP call, or Text

By Habiba Rashid
Here is everything you need to know about the first two days at the Pwn2Own hacking contest.
This is a post from HackRead.com Read the original post: Pwn2Own Day 1 and 2: Samsung, HP, MikroTik & Netgear Pwned

Being held at Zero Day Initiative (ZDI)’s Toronto office, this year’s **Pwn2Own** kicked off smoothly on 6th December 2022 with contestants participating both in person and remotely. Before we dive into the proceedings on the event days, let’s talk about what Pwn2Own is and how it started. 

**What is Pwn2Own?**

Pwn2Own is a hacking contest where security researchers are invited to hack into devices that IT hardware and software manufacturers believe are secure.

At Pwn2Own Toronto 2022, contestants would have targets such as mobile phones, wireless routers, home automation hubs, printers, smart speakers, and NAS devices for hacking into.

For their efforts resulting in a successful hack, the participants are rewarded with prize money. 

Starting in April 2007 during the CanSecWest conference in Vancouver, Pwn2Own has come a long way to become the highly reputable competition that it is. It began when security researcher Dragos Ruiu wanted to put Apple’s impenetrable security system to the test and ever since, the competition has followed a similar mission statement.

Not only has it allowed organizations to normalize bug reporting but has also changed how the industry looks at security. 

This fall’s Pwn2Own event introduced a new category called “SOHO Smashup” (Small Office/Home Office) to incorporate a real-world setting where a threat actor would exploit a home office.

A contestant would be required to pick a router and begin exploiting the WAN interface and then they would pivot to the LAN, where a second device is hacked such as a NAS appliance, a smart speaker, or a printer. 

**DAY 1 PROCEEDINGS**

The **first day** of the competition welcomed participants who won a total of $400,000 for exploits targeting phones, printers, routers, and NAS devices. 

The Devcore team which is a recurring contestant in the competition won the highest single reward of $100,000 in the SOHO Smashup category for hacking a MikroTik router and a Canon printer connected to it. 

Coming in second with a reward of $50,000 was the team Neodyme which successfully hacked a Netgear router and an HP printer.

Meanwhile, the Star Labs team also earned $50,000 for hacking a Samsung Galaxy S22 smartphone. The same device was also hacked by a participant named Chim who earned $25,000. 

Researchers at industrial and IoT cybersecurity firm Claroty earned $40,000 for hacking a Synology DiskStation NAS device.

There were also multiple $20,000 rewards for hacking Canon, HP, Lexmark printers, TP-Link, and Synology routers. Two teams earned $10,000 each for Synology NAS and HP printer hacks.

Excluding the SOHO Smashup entry, Netgear router exploits earned smaller rewards. The Netgear exploits by some contestants including Tenable were neutralized just days before the competition due to a last-minute hotfix released by the vendor.

With 26 contestants signing up for 66 exploits, ZDI decided that the full cash prize would be awarded to the first winner of each target, with subsequent exploits getting 50% of the prize money. 

**DAY 2 PROCEEDINGS**

On the second day of the competition, participants earned a total of more than $280,000 for their exploits. A large sum of the total amount was earned by targeting the smart speaker, specific vulnerabilities in the Sonos One smart speakers. 

$60,000 went to a team from Qrious Secure for hacking a Sonos One speaker while $22,500 went to the Star Labs team for an exploit that involved targeting one new and one previously known flaw. 

The Bugscale team earned $37,500 for a SOHO Smashup exploit targeting a Synology router and an HP printer where again, new and previously known bugs were used. 

Another significant reward was earned by researcher Luca Moro, who was awarded $40,000 for a WD My Cloud Pro hack in the NAS category. Interrupt Labs earned $25,000 for hacking a Samsung Galaxy S22 phone.

The list of devices hacked on the **second day of Pwn2Own**, for which participants earned between $1,250 and $10,000, includes HP, Lexmark, Canon printers, Netgear, Synology, and TP-Link routers.

ZDI announced that a total of $681,000 was paid out in the first two days for 43 new and unique vulnerabilities. As the event progresses successfully, we look forward to it serving as a beacon to improve the relationship between vendors and independent researchers. 

1.  **Firefox, Edge, Safari, Tesla & VMware pwned at Pwn2Own**
2.  **Pwn2Own 2022 – Windows 11, MS Teams and Firefox Pwned**
3.  **Mobile Pwn2Own: Hackers pwn iPhone, Huawei, Galaxy & Pixel**
4.  **MS Exchange server, Teams, Zoom, Chrome pwned at Pwn2Own**
5.  **Pwn2Own: Xiaomi, Amazon Echo, Sony & Samsung** **Smart** **TVs pwned**

Pwn2Own Day 1 and 2: Samsung, HP, MikroTik & Netgear Pwned

By Owais Sultan
Telco fraud, telecom fraud, telecommunications fraud – regardless of the name used, it refers to one thing that…
This is a post from HackRead.com Read the original post: The Onyx Fms: Monitor And Prevent Telecom Fraud In Real-time

Telco fraud, telecom fraud, **telecommunications fraud** – regardless of the name used, it refers to one thing that has mobile network operators racking their brains for an answer – the abuse of telecommunication companies for financial gain.

Over the years, telco fraud has evolved to the point where it costs communication service providers millions of dollars each year! Unfortunately, this loss has also affected mobile users. They have fallen victim to scams to extort money, bank information, and other financial or personal assets from them.

**The elderly**, unemployed, and other vulnerable groups have especially suffered under this new wave of phone scams. And it is up to mobile network operators to nip this fraud in the bud before it results in a global crisis.

But how can mobile network operators take this bull by its horns? 

**Keeping Abreast of the Latest Scams**

Thanks to technological advances, **scams have increased**. A simple phone call could be the gateway to having someone’s bank account swept clean in mere seconds. Some of the scams that have nagged mobile operators and their users include:

*   **Wangiri fraud**
*   **SMS phishing**
*   **Deposit fraud**
*   **PBX hacking**
*   **Traffic pumping**
*   **Account takeover**
*   **Subscription fraud**
*   **Telecom arbitrage fraud**
*   **The interconnect bypass fraud**
*   **The international revenue sharing fund**.

Knowing what’s affecting other networks can help you prepare for similar incidents. But how can you stop what’s coming?

**Investing in Proactive Technology**

Besides educating themselves and the public regarding the danger of phone scams, they must also arm themselves with technology equipped to monitor and prevent fraud in real-time. And what better way to do that than by investing in the **Onyx FMS**?

This hybrid fraud management system comes with several features, including:

1.  **Detection of new fraud schemes:** Often, mobile operators focus on preventing known fraud attacks. Examples include the IRSF, Interconnect bypass fraud, and traffic pumping. Unfortunately, this is not enough. Criminals are constantly devising new ways to scam their victims; a system that can detect and stop this fraud is the only way to keep up. The ONYX FMS reduces the fraud attack window, ensuring that the mobile operator and its users face minimal to no losses.
2.  **Detection of anomalies:** The ONYX FMS features a machine-learning-based solution with an anomaly detection component. Thanks to the study of previous fraud attacks like subscription fraud, account takeover, and SMS phishing rings, this statistical data plays a significant role in detecting new scams. Moreover, the system does not stop at past and current attacks but also predicts future fraud patterns. As a result, it can prevent previously unknown attacks with new fraud patterns.
3.  **Sharing of Databases**: Scammers often use a ploy in one network before trying it in another once they have been discovered. As a result of the reduced connectivity between the networks, the criminals often have their way with several networks before the scam dies down. The ONYX FMS solves this by providing a shared knowledge database that all operators can access. You can view some of the patterns present in scams in other networks and proactively prepare for them. It also gives you enough time to warn your users of impending scams before they even occur.
4.  **Investment Reusability:** Besides relying on the ONYX FMS for fraud detection and prevention, you can also use it for other network-related tasks. It features an open architecture that allows you to use its platform for predictive network maintenance, 5G network security, and a range of other new applications. You can thus rely on one system to protect your network and its users.

Whether you’re dealing with known frauds like the **Wangiri fraud** (PDF) or are grappling with a new scam, you can always rely on the ONYX FMS to weed out the scammers. Doing so can save you a lot of time and enable you to maximize your profits by cutting back on losses. Moreover, having a secure network makes you more marketable to users who may have fallen victim to scammers over the years.

1.  **Don’t Sell Your Laptop Without Following These Steps**
2.  **Phishing Scams: How To Recognize A Scam Email, VOIP call, or Text**
3.  **Guardio Review: Can This Browser Extension Protect From Cybercrime?**

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

The Onyx Fms: Monitor And Prevent Telecom Fraud In Real-time

By Deeba Ahmed
It is time to welcome a brand-new token consortium and on-chain governance framework, Grand Central hard fork, to…
This is a post from HackRead.com Read the original post: DeFiChain’s Grand Central Hard Fork Is Now LIVE

It is time to welcome a brand-new token consortium and on-chain governance framework, Grand Central hard fork, to **DeFiChain**, the world’s leading decentralized, proof-of-stake blockchain on the Bitcoin network.

The new development aims to extend the decentralized financial application (**DeFi**) access to a wide user base. The blockchain has officially activated the Grand Central hard fork on its network.

The activation occurred on 8 December 2022, at 01 am EST on Thursday, on Block Height 2,479,000. This is a monumental update for **DeFiChain** this year as it addresses a much-awaited product debt and ensures accelerated growth for the DeFiChain community in 2023.

The exchange will be rolling out the following key features:

*   On-chain governance
*   Token consortium framework
*   Pool commission & reward fixes
*   Masternode parameter updates support (for owner, operator, reward address)

According to DeFiChain’s co-founder U-Zyn Chua, Grand Central activation is a major step in the governance infrastructure of the exchange because it implements on-chain governance. It will make the voting procedures more transparent, strong, and convenient for its governance structure. That’s a welcome step for the **entire ecosystem**.

Regarding on-chain governance, community members can submit 3 kinds of proposals, which Masternode owners will vote on. The three proposals are listed here:

*   Block reward reallocation proposal
*   Vote of confidence (aka DeFiChain Improvement Proposal; DFIP)
*   Community development fund request proposal (aka Community Fund Proposal; CFP)

At the moment, the proposal creation and voting process are conducted off-chain. On-chain governance will enable a proposal that needs community voting will be directly conducted on DeFiChain.

This will improve its governance structure and make the voting process fully transparent. Results will be available in real-time on a dashboard that can be accessed on defiscan.live to ensure easy tracking.

Masternode owners can generate a script to vote for each proposal through the dashboard to reduce the effort involved in voting. The changes would allow a superior level of participation in proposal voting.

DeFiChain Consortium will encourage a proper structure for dAssets backing so that all digital assets can be backed. Consortium members like Cake DeFi will have a dedicated key to mint and burn tokenized digital assets.

Each member will have to back any digital assets they minted, whether they minted for themselves or on behalf of their platform’s users.

Moreover, they will have to pledge two days’ worth of collateral in DUSD or DFI, which will be locked up in a smart contract apart from backing the **tokenized digital assets**. This collateral will determine the number of digital assets each member can mint daily.

DeFiChain’s Grand Central Hard Fork Is Now LIVE

By Deeba Ahmed
Bybit users will access the ApeX decentralized protocol directly from their Bybit account.
This is a post from HackRead.com Read the original post: Leading Crypto Exchange Bybit Announces ApeX Pro Integration

Bybit, the third most visited crypto exchange in the world has announced its integration of ApeX Pro into its platform. This service will be available soon, and Bybit users will access the ApeX decentralized protocol directly from their Bybit account.

This new development will encourage the addition of ApeX to Bybit’s portfolio and offer vast opportunities to traders to benefit from the decentralized exchange (DEX) and centralized exchange (CEX) both on a single platform.

**How Does it Work?**

Users have to simply transfer funds from their **Bybit** exchange account to ApeX Pro. Funds will be transferred quickly, and there won’t be any platform charges added. So, users can start trading without compromising privacy or transparency.

Bybit’s co-founder and CEO, Ben Zhou, stated that this integration is a “great moment for the industry,” as it helps restore the trust in the crypto ecosystem and serves as a gateway for users to access the entire range of opportunities offered by Web.

**What is ApeX Pro?**

It is a permissionless, non-custodial DEX that uses StarkEx, StarkWare’s scalability engine, to offer high-performance perpetual contracts. This integration will ensure CEXs become securer, more efficient, and useful for traders, along with encouraging privacy, transparency, and self-custody, which are the hallmarks of DEXs, hence, closing the gap for users to use the order book model more conveniently in their trades.

ApeX Pro offers many advanced features. Such as it operates and even looks like Bybit, and with the integration of the order book model, it will not increase the learning curve. Furthermore, ApeX Pro uses zero-knowledge proofs, in which the balance changes are recorded on the blockchain. This allows the user’s wallet identity to remain private.

Leading Crypto Exchange Bybit Announces ApeX Pro Integration

By Deeba Ahmed
The exposed server, which belonged to the global online retailer VEVOR, was exposed twice between April and July 2022.
This is a post from HackRead.com Read the original post: Online Retailer Giant Exposed User Data and Over 1B Records

The cyber security researchers at Website Planet published a report on discovering an **unprotected database** containing a trove of data. The exposed server, which belonged to a global online retailer, was identified twice between April to July 2022.

**Research Findings**

According to Website Planet and security researcher Jeremiah Fowler, the first time the server was found was in April 2022. What’s worse, even after several responsible disclosure attempts, they didn’t receive any response from the company, and the unprotected database remained open to public access for several days post-discovery.

In July 2022, they discovered the same database hosted on a different IP address. Again, they didn’t receive any response from the owner, but the **exposed AWS server** was secured quickly.

However, a probe revealed the database was exposed due to a misconfiguration caused by the server’s owner or the company responsible for managing IT infrastructure, not Amazon Web Services’ fault.

During the first exposure in April, the database contained 706,206,770 documents (406.79GB size), and the second time in July, it contained 1,166,293,742 documents (601.84GB).

**Who Owns the Database?**

According to Fowler, the database had several references to Vevor, an online retailer based in California. However, Crunchbase claims that although the company is registered in the US, its website suggests it is based in **China**, boasting more than ten million customers across 200 countries/regions.

The brand deals in tools and equipment and offers DIYers and professionals advanced tools and equipment at low rates.

**Contents of the Database**

The content of the database was marked as Production. It contained PII and other sensitive data related to the company’s online operations. For instance, the data contained customer details, including first and last names, transaction IDs, partial credit card numbers, refund info, etc.

The checkout and payment records were also part of the database. This included names, currency, home addresses, email IDs, etc. It is worth noting that the data was stored both in hashed and plain text formats.

The email addresses were part of around seven folders named email-API. There were, in total, 8.1 million records (approx. 31.64GB). A limited sample of 10,000 records was evaluated, and 2,559 email IDs were declared unique.

Emails in the email-API folder (Image: Website Planet)

Conversely, 12.9 million records were contained in folders titled Members. Researchers found that all records didn’t have customer names in plain text. There were records with various Localized Domains, including .com, .ca, .de, .it, .uk, .es, .fr, and .au.

Also, part of the database were error messages in Chinese and internal images and documents hosted on amazonaws.com.cn. Furthermore, there were internal Vevor account admin names and plaintext passwords, active password reset links, credit card numbers (partial), and references to tax and passport numbers.

“IP addresses, Ports, Pathways, middleware, and storage info that cybercriminals could exploit to access systems or services. Overall, the exposure provided a complete look at Vevor’s operating structure, logging, monitoring and error records, and more. Configuration information that could be used to penetrate deeper in the network,” Website Planet’s **blog post** revealed.

At the time of writing, the server was either secured or taken down. Nevertheless, the good news is that it is not available for public access.

**Dangers of a misconfigured server**

Databases are a crucial part of modern technology, used to store and manage important data. However, if these databases are not properly configured, they can become a massive security flaw that can leave your personal or business information vulnerable to attack.

A misconfigured database can open the door for hackers and other malicious outsiders to access confidential information without authorization. The risks associated with an improperly configured or misconfigured database are numerous and should be taken seriously.

By leaving key ports open on your server or failing to update software regularly, hackers could gain unauthorized access to sensitive information such as usernames, passwords, credit card numbers, social security numbers, and more.

Additionally, they could manipulate stored data or even delete valuable records entirely – making it vital that proper measures are taken to ensure a secure system environment.

1.  **Misconfigured baby monitors expose video stream online**
2.  **Anonymous hacked 90% of Russian misconfigured databases**
3.  **US and China Exposed Most Servers Among 308k Found in 2021**
4.  **Misconfigured Servers Exposed 579 GB of Users’ Website Activity**
5.  **Exposed Server Revealed US Military’s Social Media Spying Campaign**

Online Retailer Giant Exposed User Data and Over 1B Records

By Owais Sultan
Before selling or trading in your laptop, it is important to prepare the device for its new owner as this will help ensure all of your personal data remains safe.
This is a post from HackRead.com Read the original post: Don’t Sell Your Laptop Without Following These Steps

In an age when every day, a new version of a laptop with better features, sleek design, and improved performance hits the market, it is no wonder that you also wish to buy a new laptop to achieve excellence in performance and enjoy new features.

You have money, you can buy a new laptop, great! But what about your previous laptop? If you are thinking of selling it, then…stop.

If you think selling a laptop is all about saving your data, finding a seller, and selling it, then you need to think again. It goes beyond this! It is not all about getting a fair price, but also saving your personal information and private data from reaching a stranger – that might cost you a lot if that stranger is fraudulent or malicious.

Before selling or trading in your laptop, it is important to prepare the device for its new owner. This can be done by taking several simple precautions that will help ensure all of your personal data remains safe.

**1 Save Your Important Data**

It goes without saying that your first step should be keeping a **backup of your essential data**, including personal and work-related files and folders, containing documents, presentations, emails, plans, strategies, or anything else that you have prepared with so much hard work.

If you don’t want to see your data slipping from your fingers, then this should be your number one step.

You can save your data on a data drive or upload it to a reliable **cloud service**. Or send them to your own email address (well, this is my favorite way of saving my data!). Do whatever suits you, but saving data is a must before selling your laptop.

However, this can only work if you have a few GB of data. In case you have terabytes of data then owning a workstation from companies like **Western Digital (WD)** is a good way to go.

**2 Delete Passwords Permanently**

Nobody wants the passwords of important accounts to get leaked. Full stop! But have you ever thought about how to save your passwords before giving your laptop? What — did you just say you can do it by signing off from all your accounts and deleting history and cookies? Ah, I wish it was really that easy, but it is not. 

Where technology has brought so much **ease into our lives**, there it has also become a trouble in many ways — like this one. Unfortunately, some software can extract passwords even if you log out from your accounts.

That is where you should act smartly if you don’t want someone to sneak into your Facebook and start sending weird messages through your accounts to your friends. It could trigger so many controversies – eh. So, cut iron with iron.

You can also use apps such as password generators. One such example is the **IPVanish** password generator which lets users delete passwords permanently from their browsers. If you wish to do that manually, follow these easy steps:

**For Chrome browser:** First, open Chrome and click on the three-dot menu icon located in the top right corner. Then select “Settings” and click on “Passwords” under Autofill. Here you will find a list of all the websites that have saved credentials, along with their usernames and passwords.

Select an entry to see the details, then click on the three-dot menu icon next to it and select “Remove.” You’ll be asked to confirm by clicking “remove” again; once confirmed all login information for that website will be deleted from your computer. (_Read more on_ **Google**.)

**For Firefox:** First, launch the Firefox browser on your device. Then, click the ‘Menu’ icon (three lines in the upper right corner) and select ‘Options’ or ‘Preferences’. In this menu, you will see a section for ‘Logins & Passwords. You can then scroll through all of your saved logins and passwords until you find the one that needs to be deleted.

**For Safari Browser:** To begin, open up the Safari browser on your computer and click the ‘Safari’ menu at the top left corner. In that menu option, select ‘Preferences’ and then navigate to the ‘Passwords’ tab. (Read more on **Mozilla**.)

Here you will see a list of all of your stored passwords that have been saved by Safari. To delete one or more of these passwords, simply check off each box next to each entry that you wish to remove and hit delete in the bottom right corner. (Read more on **Apple**.)

**3 Format the Drive**

Have you saved your important data? Great! Now, what about data that is still on your laptop? Obviously, you can’t leave it like this for others to see your private information and confidential data. No, just deleting data files and clearing Recycle Bin or Shift + Delete might not work. It can still keep the issue of data leakage and privacy breaches there. 

In this condition, most people go for drive formatting that cleans up your laptop and makes it data free. However, this method works if your files are overwritten and you are using a solid-state drive (SSD) with TRIM enabled.

With HDD or TRIM disabled, you would have to overwrite the hard drive if you don’t want cheap software to recover your data – yes, even after formatting. It is very easy to recover a permanently deleted file through even cheap software. So, be safe than sorry!

**4 Prepare Your Laptop for Selling**

Once you are done saving your information, next, it is time to prepare your laptop for sale at a good price. The price of your gadget also depends on its model, functionalities, current market price, and a lot more. However, improving the outer condition, and speed, upgrading Windows, and enhancing the memory storage can enhance the price of your laptop. 

So, work on the following things to get good bucks:

*   First, install the latest Windows to make your buyer happy. You can vow anyone with the latest functionalities already installed on the laptop, so that person wouldn’t have to go through all the trouble. It is a good chance to impress a buyer.

*   Second, work on the speed of the laptop. Half of the work is already done when you delete files and data. So, reset the laptop to speed it up.

*   Clean up your laptop, please. Don’t take your laptop to a buyer with all the lint or dust trapped between keys and scratches on the screen. You can remove lint or dust with a brush and change the screen cover. This simple work can make a lot of difference.

*   Lastly, visit a laptop expert and ask for a thorough inspection so that you can rectify if there are any internal faulty parts.

1.  **World’s most dangerous laptop has been sold for $1.3 million**
2.  **BusKill USB cable switches off your laptop in the event of theft**
3.  **German army’s sensitive data found on laptop bought from eBay**
4.  **World’s most dangerous laptop ‘Persistence of Chaos’ up for auction**

Don’t Sell Your Laptop Without Following These Steps

By Habiba Rashid
From December 7th, 2022, their Mastodon instance, Vivaldi Social, will be integrated into the sidebar of the desktop browser, creating an inbuilt Mastodon client for users.
This is a post from HackRead.com Read the original post: Vivaldi Integrates Mastodon Into its Web Browser

Riding the **Mastodon hype**, Vivaldi recently became the first browser to not only have its own Mastodon instance, Vivaldi Social but to also integrate Mastodon into its newest browser version, Vivaldi 5.6. available on Windows, macOS, and Linux.

In the recent update where the company announced its newest functionality, it also explained how **Mastodon** matched its values to give its users an algorithm-free experience with no surveillance capitalism or data profiling. 

According to the company’s **press release**, From December 7th, 2022, their Mastodon instance, Vivaldi Social, will be integrated into the sidebar of the desktop browser, creating an inbuilt Mastodon client for users. However, users will have the option to add any Mastodon server of their choice to the sidebar.

The new feature does not demand implementation and can be ignored if it is not up your alley. Moreover, the app does not run in the background which means that system resources or valuable bandwidth will not be used unless you open the panel.

Vivaldi Social has expanded to around 11,000 people ever since it went live in mid-November.  Vivaldi’s founder **Jon Stephenson von Tetzchner** explained that they “support the idea of a decentralized federated social media network like Mastodon.” 

Along with the creation of its own Mastodon instance, comes the responsibility of dealing with content moderation but the company remains confident that it has the expertise necessary to tackle the thorny issue. 

1.  **Trust Wallet Launches Browser Extension Wallet for Desktop**
2.  **8 Online Best Dark Web Search Engines for Tor Browser (2022)**
3.  **Improving privacy: Alternative browsers and chrome extensions**
4.  **Meet Plexus, An AI-based Browser Security Solution from LayerX**
5.  **Guardio: Can This Browser Extension Protect You From Cybercrime?**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Vivaldi Integrates Mastodon Into its Web Browser

By Habiba Rashid
The bank confirmed that it had "experienced an unprecedented cyber attack from abroad."
This is a post from HackRead.com Read the original post: IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack

Russia’s second-largest bank experienced the largest cyber attack (**DDoS attack**) in its history. The government-controlled St Petersburg-based VTB financial institution announced on Tuesday that it was experiencing an “unprecedented cyber attack from abroad.”

The bank warned customers of temporary difficulties in accessing its mobile app and website due to the ongoing DDoS attack (distributed denial of service attack) but assured them that their data remained safe. VTB stores its customer data in the internal perimeter of its infrastructure which the attackers did not breach.

According to the bank’s internal analysis and as **reported** by local Russian media, this DDoS attack was pre-planned and orchestrated to cause hindrance in the bank’s functionalities and to inconvenience its customers. Despite the bank’s online portals being inaccessible, all other core banking services are operating as usual.  

VTB stated that they identified most of the malicious DDoS requests from “foreign segments of the internet,” but some network-flooding traffic also originated from Russian IP addresses which the bank noted was “of particular concern.” 

Either foreign actors used local proxies for some of the attacks or they managed to recruit local dissidents in their **DDoS campaign**. The bank stated that it will hand over all the information regarding the Russian IP addresses to law enforcement for criminal investigation. 

What makes this DDoS attack particularly interesting in light of the recent political events is that VTB is 61% state-owned, implying that the attackers made an indirect blow at the Russian government. 

On Dec 6, 2022, in a **tweet**, the pro-Ukraine hacktivist group, going by the name ‘IT Army of Ukraine,’ claimed responsibility for the DDoS attacks against VTB, announcing the campaign on Telegram and Twitter.

According to the IT Army of Ukraine, over 900 Russian entities, including stores selling military equipment and drones, the Central Bank of Russia, the National Center for the Development of Artificial Intelligence, and Alfa Bank, have been targeted by the group since they started being more active in November. 

It is worth noting that the IT Army of Ukraine along with the hacktivist group Anonymous also took responsibility for **September 2022’s social engineering attack** in which the Russian Yandex taxi app was hacked to cause a massive traffic jam in Moscow.

On the other hand, Microsoft **warns** Europe to be on alert for cyber attacks from Russia because this attack follows a series of cyber campaigns launched against Russian organizations. 

Last week, **reports of data-wiping trojan** deployed against Russian mayors’ and courts’ computers surfaced. The media reported that the wiper poses as ransomware and demands half a million rubles and deletes files regardless of whether the organization pays the amount or not. 

With the latest round of wiper and DDoS attacks, GM of Microsoft’s Digital Threat Analysis Centre Clint Watts warns Europe that Russia is likely to expand its “hybrid-war” efforts beyond Ukraine. He further stated that the Kremlin might use such state-sponsored attacks to disrupt foreign supply chains. 

European nations and the US should also brace for more Kremlin-backed influence operations – preying on citizens’ concerns about rising energy prices and inflation, and pushing pro-Russian narratives, Watts wrote. 

1.  **Anonymous Hacktivists Leak 1TB of Top Russian Law Firm Data**
2.  **Ukraine Busts Pro-Russia Hackers Who Stole 30M EU Citizens’ data**
3.  **OldGremlin Gang Known for Targeting Russia Launches Linux Malware**
4.  **Russian Ministry Website Hacked to Display “Glory To Ukraine” Message**
5.  **Ukraine Thwart Russian Industroyer 2 Malware Attack on Energy Provider**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack

By Habiba Rashid
Spanish Police confirmed that the SIM Swapping gang also used dark web forums to illegally obtain ID and credit card numbers through cryptocurrency purchases.
This is a post from HackRead.com Read the original post: Police Dismantle SIM Swapping Gang in Spain

The Spanish National Police successfully arrested a **SIM swapping** gang known as the “Black Panthers”, making 55 arrests in Barcelona. 

Their operation included committing bank scams through SIM swapping attacks and other methods such as social engineering techniques, and voice phishing (aka **vishing**, **phishing**, and **call forwarding**.

The group managed to accumulate a total amount of €250,000 by draining the bank accounts of a hundred victims by gaining access to their personal details after tricking the phone companies. 

The police stated that vishing was the technique majorly used to obtain **duplicate SIM cards**. “They did it directly to well-known telephone and telecommunications companies in our country, posing as customers – whose data they already had after having carried out phishing attacks on the employees of the telephone operators themselves,” said the police

By cleverly posing as technical support workers, the gang members gained straightforward access to databases containing the user credentials of phone company employees. This enabled them to acquire customers’ personal details and make duplicate SIM cards.

In its **press release**, Spanish Police added that the cybercriminals also used dark web forums to illegally obtain ID and credit card numbers through cryptocurrency purchases.

The items purchased using the cloned cards were usually luxury products that were collected at the delivery points by displaying the physical IG cards stolen or bought on black markets to make it difficult for the purchase to be traced back to them. During the bust, 45 SIM cards, 11 mobile phones, and four laptops were seized. 

The group consisted of a network of four differentiated but interconnected cells that used different methods to carry out scams. The group had an interesting collaborative dynamic that allowed them to work without a central leader, instead relying on highly specialized individuals to succeed in their separate criminal endeavors. 

1.  **Europol nabs SIM hacking network from across Europe**
2.  **10 SIM-swapping hackers nabbed for targeting US celebrities**
3.  **Turkish PoliceArrests Sim Swapping Crypto Stealing Hackers**
4.  **Sim swapping hackers charged with stealing $2.5m in crypto**
5.  **Europol nabs 106 criminals for SIM swapping, money laundering**

“Those investigated took control of mobile phone numbers of victims by making a duplicate of their SIM cards,” said police. “To do this, they used phishing, vishing, and call-forwarding techniques. Once they impersonated the identity of the users, they took control of victims’ electronic banking and made fraudulent transfers to a network of mules spread throughout the Levantine coast.”

By doing so, the criminals drained their victims’ accounts with approximately €2,500 stolen from each one.

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Source

HackRead