Facebook's Bug Bounty Brilliance: Indian Engineers Making Waves
Arunkumar K.
CTO @ Sennovate | Pioneering AI Cybersecurity Solutions | Former CISO in Web3 & Crypto | Experienced with Bolstering defences for State & National Governments
Welcome to "Hacker Hacks," the podcast where we dive into the world of cybersecurity, unraveling the latest trends, threats, and triumphs in the digital realm. Each episode, we bring you cutting-edge insights, expert analyses, and behind-the-scenes stories from the frontline of cyber defense. Whether you're a seasoned security professional or just curious about the cyber world, join us as we explore the intricate dance of hackers and the heroes who stop them.
Cybersecurity researchers at CYFIRMA discovered Silver RAT, a C# Remote Access Trojan that bypasses antivirus software to hack Windows and Android systems. It enables covert operations like launching hidden applications and keyloggers. Popular among hackers on Telegram and forums, its cracked version surfaced in October 2023. Silver RAT allows customization of payloads and remote control of victim's computers. Researchers tracked its developers' online activities and financial transactions, and recommend measures like security training and regular updates for protection.
The Iconic, an online retailer, has promised full refunds to customers affected by hackers using stolen login details for fraudulent orders. This rise in "credential stuffing" attacks, where hackers use breached credentials to access accounts, has led to significant financial losses for customers. The Iconic, not breached itself, urges customers to change passwords and enhances security with third-party partners. This incident adds to the increasing cybersecurity issues in Australia, with significant financial losses reported nationwide.
The Qualys 2023 Threat Landscape Year in Review report highlights the Clop ransomware gang as the most prolific ransomware operator of the year. Since its emergence in 2019, Clop has steadily grown, exploiting a range of vulnerabilities in platforms like GoAnywhere MFT, PaperCut, MOVEit, and SysAid, impacting millions. They've utilized zero-day exploits like CVE-2023-27350 and CVE-2023-34362, with their MOVEit hack affecting over 85 million individuals. In 2023, 26,447 vulnerabilities were disclosed, increasing the threat landscape. However, only a small percentage pose high risks, with less than 1% being actively exploited by threat actors like Clop. The report emphasizes the importance of proactive patch management and threat intelligence in response to the growing efficiency of attackers and the rapid exploitation of vulnerabilities.
The Facebook Bug Bounty Award, a prestigious recognition in ethical hacking and cybersecurity, has highlighted the significant contributions of Indian engineers. The program, which began in 2011, encourages security researchers to identify and responsibly disclose vulnerabilities in Facebook's products. Among over 170,000 submissions from 150 countries, only 8,500 reports were awarded, with India consistently ranking among the top contributors. Rakesh Datta, an Engineering Leader at Microsoft, stood out in 2013 by exposing a critical flaw within the bug bounty program itself. His groundbreaking work involved creating millions of test accounts under a single user, which could potentially crash Facebook's servers due to memory exhaustion. This exploit was significant because it bypassed Facebook's limit of 10 test accounts per user, posing a risk of a memory leak and a denial-of-service attack. Rakesh's discovery was promptly addressed by Facebook's security team and earned him a spot in Facebook's Hall Of Fame 2013, making him one of the few Indians to achieve such recognition.
领英推荐
U.S. Congressman Ruben Gallego demanded answers from the SSA and FTC regarding the Xfinity data breach affecting 35 million Americans, including 65,000 Arizonans. The breach exposed usernames, passwords, contact details, birthdates, and partial Social Security numbers. Gallego's inquiry focuses on the breach's awareness, Xfinity's compliance with privacy laws, government steps for cybersecurity, actions taken with Xfinity, the number of affected Social Security beneficiaries, and whether the FTC needs more authority for consumer protection.
McAfee has introduced Project Mockingbird, an AI-driven tool for detecting deepfake audio, at the 2024 Consumer Electronics Show (CES) in Las Vegas. This innovative technology addresses growing concerns about deepfakes, with 84% of Americans worried about their impact and over 33% having experienced a deepfake scam. Project Mockingbird showcases a 90% accuracy rate in identifying manipulated audio content. It employs contextual, behavioral, and categorical models to distinguish between genuine and AI-generated audio, aiming to safeguard consumers from scams, cyberbullying, and public image manipulation.The tool is named after the mockingbird, known for mimicking other birds' songs, reflecting its ability to detect voice mimicry in deepfakes. Steve Grobman, McAfee’s CTO, emphasizes that Project Mockingbird enhances digital understanding and assessment of content authenticity, crucial in the AI-driven world. This advancement is especially pertinent given the rise in voice cloning and "cheapfakes," which manipulate authentic media, and the reported increase in camera injection attacks exploiting facial recognition security.
Security firm CloudSEK discovered a sophisticated malware exploiting third-party cookies to access Google accounts without passwords. Revealed in October 2023, the malware bypasses two-factor authentication and targets Google’s authentication cookies. Google responded with enhanced defenses and advised users to activate Enhanced Safe Browsing in Chrome. The exploit, reported in CloudSEK's ‘Compromising Google accounts’ report, can maintain access to Google services even after password resets, emphasizing the need for vigilant cybersecurity practices against evolving threats.
The Biden administration is set to release a rule making it harder for companies to classify workers as independent contractors instead of employees. This change, affecting various industries, especially app-based services, follows the proposed rule in 2022, causing significant share drops for companies like Uber and Lyft. The rule will consider factors like profit opportunities and degree of employer control, replacing a Trump-era regulation. It aims to address worker misclassification and ensure more benefits and protections for workers deemed economically dependent on a company.
Three major universities in Oregon - Portland State University, University of Oregon, and Oregon State University - have joined forces to establish the Oregon Cybersecurity Center of Excellence. This initiative aims to enhance the state's defense against cyberattacks and will serve as an advisory body to the governor and state legislature. The center will be headquartered at Portland State University and was created under House Bill 2049, signed into law in July 2023.
Thank you for tuning into "Hacker Hacks." We hope today's episode provided you with valuable insights into the constantly evolving world of cybersecurity. Don't forget to subscribe to stay updated on the latest cyber trends and threats. Until next time, stay vigilant and keep your data safe. Remember, in the digital world, knowledge is your greatest shield.