#ransomware

Hacking group referred to as 'The Dark Overload' took their Netflix addiction to a new level and released 10 of the 13 newest episodes of hit series 'Orange is the New Black' after the company failed to pay the desired ransom. Talk about Netflix and not chill. The series was set to be released June 9th of this year, but after Larson Studio (an additional dialogue recorded studio) and  Netflix denied the demand for a supposed 50 BTC ($70,422), the group took to social media. TDO posted links to a Pastebin page, GitHub profile, and the Pirate Bay torrent site sharing. Of the three, Pirate Bay are the only posts that remained up, allowing plenty of users the ability to download and share the content. The group has revealed it managed to steal "hundreds of GBs of unreleased and non-public media" from the servers of Larson Studios, but none of these companies have confirmed any breach or demand for ransom.Netflix acknowledged this leak, which it said was caused by a breach at a 'production vendor' also used by other TV studios. Subsequently, their share price has risen in light of the breach, perhaps because this leak was related to content rather than customer data. It seems the added publicity was not what hackers intended, but has thus far been the result. It’s not clear whether the way streaming services process digital content is that different or less secure from established broadcasters but the minute a show exists in a form that can be copied makes it more vulnerable to theft. "The Netflix incident is an example of the growing threat to organizations from extortion scams," says Moty Cristal the CEO of NEST Negotiation Strategies, a firm that specializes in helping organizations negotiate with online extortionists. The Dark Overload has been responsible for cyber attacks in the past carried out against Gorilla Glue and Little Red Door, an Indiana Cancer Services agency, as well as the sale of 655,000 healthcare records on the Dark Web.

Who is next on the list? FOX, IFC, NAT GEO, and ABC. Oh, what fun we're all going to have. We're not playing games anymore. -Tweet from The Dark Overlord in regards to the leak

Take an in-depth look at ransomware to discover some of the inner workings and why it's so effective.

#privacy 

It's a conversation we won't stop having until technology stops trying to be Big Brother. You've probably been asked by various apps for permission to access your smartphone’s microphone. If so, you need to reconsider. This access allows apps to utilize Ultrasonic Cross-Device Tracking.Tracking itself implies that you're being watched, but this new technology used by some marketers and advertising companies is currently being used to track individuals across multiple devices and have access to more information than ever before for ad targeting. This information, as you probably know, helps advertisers to create a personalized profile and monitor your interests by figuring out which devices belong to you, then allowing them to target you with interest-based advertisements. Ultrasonic Cross-Device Tracking works by allowing apps to continuously listen for inaudible, high-frequency ultrasonic sounds from your surroundings. These sounds emitted from retail stores you visit, a commercial on TV or an advertisement on a web page, are a unique 'ultrasonic audio beacon'  that know where you go, what you like and dislike, all without your knowledge. We'll call it the creepiest helicopter mom around.Since an app requires no mobile data nor Wi-Fi connection, but only microphone access to listen to beacons, tracking works even when you have disconnected your phone from the Internet. According to The Hacker News, "A team of researchers last year demonstrated that how ultrasonic sounds emitted by ads on a web page accessed through Tor can be used to deanonymize Tor users by making nearby phones or computers send identification information, such as location and IP, back to advertisers." The best course of action for protecting yourself is to use good judgment when deciding which apps should be given microphone access and revoke the permissions of those who do not need it.

234 Android applications that ask permission to access your smartphone’s microphone do so to incorporate a particular type ultrasonic beacon to track consumers. -security researchers presenting at the IEEE European Symposium on Security and Privacy

Keep your personal information safe. Read 'How to Protect Online Privacy' for tips and best practices.

#phishing

If you're an avid Twitter user, then you probably saw at least a few of the many warnings put out on Wednesday regarding a Google Doc phishing scam. This scam came in the form of a very believable OAuth email, which says that the person [sender] "has shared a document on Google Docs with you."When you click on the link, you will be redirected to a page which says, "Google Docs would like to read, send and delete emails, as well access to your contacts," asking your permission to "allow" access. This gives hackers the permission to manage your Gmail account with access to all your emails and contacts, without requiring your Gmail password. A real Google Docs invitation does not require access to Gmail. For those who were not aware that the link was malicious inadvertently sent the same Google Docs phishing email to everyone on their contact list. Scams such as this are especially dangerous because hackers could potentially get control over those online accounts from Gmail, including Apple, Facebook, and Twitter.Luckily, Google said it has already disabled offending accounts involved in a widespread spree of phishing emails. Possibly the most interesting aspect of this attack is who has declared responsibility. "A self-described graduate student, Eugene Pupov, claims he was behind the blast of emails, and that they were part of a test for a school project, not a phishing attack. But according to the university, he claims to be enrolled at, he’s not a student there," Naked Security reports. He alleges he sent the emails to test a program created for a graduate final. It appears, however, that the email targeted many journalists, organizations, and media outlets that use Google for email.

We have taken action to protect users against an email impersonating Google Docs, and have disabled offending accounts. We’ve removed the fake pages, pushed updates through Safe Browsing, and our abuse team is working to prevent this kind of spoofing from happening again. We encourage users to report phishing emails in Gmail. -a Google spokesperson

For an attacker's point of view on phishing attacks, read 'The 5 Phases of a Phishing Attack' to better understand their mindset.

#factbyte

Facebook has pledged to hire 3,000 people around the world over the next year to review content in the wake of criticism after users had livestreamed incidents of rape and murder. 

#certspotlight

Social engineering is a physical form of hacking that can be extremely effective. It can be something as simple as a link on an email from a seemingly legitimate source. Organizations strive to make end users aware of the most common types of social engineering attacks so that they can try to avoid them. The Social Engineering Micro Certification is designed with the end-user in mind and serves as the ideal starting point for anyone looking to enter the cyber security field and ultimately raise their threat awareness. The content addresses topics regarding social engineering, including common attack vectors, how to perform them and the consequences that follow.It will explore a broad range of Social Engineering attacks such as Shoulder Surfing, tailgating and then explains what happens during those attacks and how they can be prevented.Use code SOCIALIZER to earn the End User Social Engineering Micro Certification FREE. This code expires 05/05/17 at midnight EST. Olivia Lynch (@Cybrary_Olivia) is the Marketing Manager at Cybrary. Like many of you, she is just getting her toes wet in the field of cyber security. A firm believer that the pen is mightier than the sword, Olivia considers corny puns and an honest voice essential to any worthwhile blog.