#netneutrality

We've quoted Eminem before, and we'll quote him again. 'The FCC won't let me be.' And this time we mean it. Now, after recent changes to privacy rules, FCC chairman Ajit Pai has announced the first move in efforts to kill off Net Neutrality.Before we get too ahead of ourselves, let's revisit the definition of Net Neutrality. It's the principle that ISPs should give consumers access to all content and applications on an equal basis, treating all Internet traffic equally. That means ISPs must treat Facebook in the same way as a local shop website, and the richest man in the world has the same rights to access the Internet as the poorest. Pai claims that removal of net neutrality rules is meant to restore 'internet freedom,' but let's consider some questions. 'What if you have to pay ISPs extra for loading your website faster?' 'What if you can't access your favorite website, which has been blocked by your ISP?' Essentially, the removal of these rules could raise the prices for accessing services like Netflix, and make it harder for small businesses who rely on the Internet, to thrive. Not to mention, the digital divide will only continue to grow.Doesn't sound like much of a win for anyone, including Cybrary. "In a 400-page document released Wednesday, the FCC detailed its new plan which, if passed, would allow ISPs to give or sell access to 'fast lanes' and block web traffic to others." Many who criticize this plan, argue that it inhibits consumer choice by impeding traffic in order to favor their own services or established competitors. Or, they could impose new fees altogether. The FCC will vote on the proposed rule change and rollback of the FCC's 2015 regulations on May 18. Everyone is encouraged to take action by educating themselves fully on the issue and making their opinion known to Congress.

Without net neutrality, the incumbents who provide access to the Internet would be able to pick winners or losers in the market -a letter sent to Pai by a group of 800 startups

For a fuller view of the privacy and net neutrality issues at hand, read this previous UNM4SK3D: FCC, WhatsApp, and GiftGhost. 

#bugbounty

Looks like the military is exchanging fatigues for white hats. The Air Force is following in the footsteps of 'Hack the Army' by becoming the latest division of the U.S. Armed Forces to announce a public-facing bug bounty program. This program invites vetted white hat security experts to hack key public-facing Air Force websites. Hack the Air Force will be an invite-only program managed by HackerOne and select applicants from the U.S. and outside the U.S. for the first time from countries such as the United Kingdom, Canada, Australia and New Zealand. Candidates must pass a rigorous background test after registration, which begins May 15th, and have a clean criminal record in order to participate in the program. According to critics, this process excludes many talented hackers and bug hunters, however, these criteria is common across all of the Pentagon's bug bounty programs.Hackers who participate in this program will receive cash rewards, although no specific amounts have been released yet. In the past, DoD bug bounty programs have been incredibly successful and serve as a method for strengthening the protection of critical assets. Hack the Pentagon, which was the first of its' kind, received 138 valid submissions and cost the U.S. government $150,000, half of which went to participants. During the Hack the Army program, 416 vulnerability reports were filed, 118 of which were classified as unique and actionable. Participants were awarded roughly $100,000.

We have malicious hackers trying to get into our systems every day. It will be nice to have friendly hackers taking a shot and, most importantly, showing us how to improve our cyber security and defense posture. -Peter Kim, CISO with the Air Force

Get the Bug Bounty Field Manual from HackerOne for a guide on how to plan, launch, and operate a successful bug bounty program.

#botnet

I-ut-OT. Around 300,000 IoT devices have been captured by a vigilante hacker in an IoT botnet known as Hajime, in order to supposedly secure them. The malware emerged around the same time the infamous Mirai botnet started making the rounds. According to a new report published by Kaspersky Lab on Tuesday, the number of devices infected by Hajime will only continue to rise with each day that passes by. The Hajime (which means 'beginning' in Japanese) botnet works like Mirai by spreading itself via unsecured IoT devices that have open Telnet ports and uses default passwords. The difference with Hajime is once it infects an IoT device, "Hajime secures the devices by blocking access to four ports (23, 7547, 5555, and 5358) known to be the most widely used vectors for infecting IoT devices. It also uses a decentralized peer-to-peer network (instead of command-and-control server) to issue updates to infected devices, making it more difficult for ISPs and Internet providers to take down the botnet."Perhaps most intriguing is the mystery behind the hacker. At this time, researchers do not know the purpose of the botnet or who is behind it. Instead, it displays a cryptographically signed message every 10 minutes on infected device terminals, saying "just a white hat, securing some systems." The biggest concern is that this botnet could be repurposed for malicious purposes either by the vigilante hacker or by another bad intentioned hacker. What’s certain, however, is that Hajime’s author continues to update the code, as changes were seen in the attack module with the TR-069 exploit only being implemented recently.

While the botnet is getting bigger and bigger, partly due to new exploitation modules, its purpose remains unknown. We haven’t seen it being used in any type of attack or malicious activity -Kapersky Lab Researchers

Take a deeper look at the Mirai bot by reading 'Windows Botnet Helps Mirari Bots Cross-Over to Linux Hosts.'

#factbyte

Call center fraud is rising at an astronomical rate, increasing 113% in 2016, according to the 2017 Call Center Fraud Report by Pindrop Labs. 

#certspotlight

The OSI model makes network designs more extensible as new protocols and other network services are generally easier to add to a layered architecture than to a monolithic one. The Open Systems Interconnection model (OSI model) is a conceptual model that characterizes and standardizes the communication functions of a telecommunication or computing system without regard to their underlying internal structure and technology. The OSI model doesn't perform any functions in the networking process. Upper layers of the OSI model represent software that implements network services like encryption and connection management. Lower layers of the OSI model implement more primitive, hardware-oriented functions like routing, addressing, and flow control.This code expires 4/30/17 at midnight EST. Olivia Lynch (@Cybrary_Olivia) is the Marketing Manager at Cybrary. Like many of you, she is just getting her toes wet in the field of cyber security. A firm believer that the pen is mightier than the sword, Olivia considers corny puns and an honest voice essential to any worthwhile blog.