Tag Archive for: TwoThirds

Two-thirds of ethical hackers considering bug bounty hunting as a full-time career


Pictured: A computer keyboard is seen in this cropped image with Javascript in the background. (“Coding Javascript” by Christiaan Colen is marked with CC BY-SA 2.0.)

Research from Intigriti on Tuesday found that 96% of ethical hackers would like to dedicate more time to bug bounty hunting in the future, and 66% are considering it as a full-time career.

The report, based on responses from 1,700 part-time and full-time ethical hackers, found that they are attracted to the money, as 48% said good pay was their No. 1 attraction point. The ethical hackers also cited the desire to be their own boss and the ability to work their own hours as 45% listed both points as appealing.

“The work-from-home culture has made employees desire more independence and has further encouraged digital nomads to pursue a remote working career, said Inti De Ceukelaire, head of hackers at Intigriti. “Bug bounty platforms can not only facilitate this, but they also allow people to work wherever they want, whenever they want, and without having to rely on a boss to match their talents with customers or be part of a corporate hierarchy.” 

Davis McCarthy, principal security researcher at Valtix, said hacking has turned into a full-blown industry, adding that data has become the new commodity, whether on Wall Street or in the underground — cybercriminals monetize passwords, remote access to corporate networks, exploits and botnets.

“Bug bounty hunting is a great career path for cybersecurity professionals,” McCarthy said. “For people getting into bug bounty hunting, it’s good to make sure the target organization has a bug bounty program, and to check if there are any limitations on what’s acceptable to test. There’s a lot of technical debt in the cloud, and the enterprise shift to using the cloud means there are a lot of opportunities for bug bounty hunters to do some good: find exposed S3 buckets, instances with default passwords, and poorly configured databases. If I was getting into bug bounty hunting now, I’d jump headfirst into cloud security.”

Casey Ellis, founder and CTO at Bugcrowd, said bug bounty hunters are ultimately entrepreneurs in their own right. Ellis said every bug is a…

Source…

The Cybersecurity 202: Nearly two-thirds of cybersecurity experts think Biden’s response to Russian hack is sufficient


The Biden administration responded both forcefully and responsibly, and I assume the Russians know that while the [United States] is not escalatory, we are no longer going to ignore provocation, said cybersecurity entrepreneur Dave Aitel.

After entering office in January, Biden ordered a sweeping review of the SolarWinds attack and other Russian aggressions, including election interference. The full extent of the damage wrought by the attack is unknown and officials believe there are still many unnamed victims.

The SolarWinds Orion hacking campaign called for that kind of retaliation combining financial and political punishment,” said Jay Kaplan, co-founder and chief executive of Synack. The response shows that the Biden administration is not going to sit back and let Russia, China, North Korea or any of our other adversaries continue carrying out damaging cyberattacks that victimize thousands of companies and costs hundreds of millions to clean up.

Many experts suggested the sanctions were a step in the right direction after years of failing to hold Russia accountable.

A serious situation received a proportionate response, far beyond what administrations have done in large nation-state cyber espionage cases previously, said Scott Montgomery, chief technical officer at the Federal Resources Corporation.

Experts often criticized former president Donald Trump for undermining the findings of his own intelligence community about Russia’s election interference. In a December Network survey, a majority of our experts said Trump led the nation in the wrong direction on cybersecurity. 

The Biden administration‘s response was direct and well coordinated across the interagency, which was a significant departure from the last four years when dealing with Russia, said Chris Cummiskey, CEO of Cummiskey Strategic Solutions.

In contrast to President Trump, who actively avoided any effort to hold Russia accountable, the Biden administration‘s actions were a refreshing change and apparently the beginning of a larger plan of signaling, action and potential engagement with Moscow, said Chris Painter,

Source…

Government Generously Hands Back Two-Thirds Of The $626,000 It Stole From Two Men Driving Through Missouri

A case out of Missouri is highlighting yet again the stupidity and vindictiveness that defines civil asset forfeiture. In January 2017, law enforcement seized $ 626,000 from two men as they passed through the state on their way to California. According to the state highway patrol, the men presented contradictory stories about their origin, destination, and the plans for the money found during the traffic stop.

The complaint filed against the money made a lot of claims about the government’s suspicions this was money destined for drug purchases. Supposedly evidence was recovered from seized phones suggested the two men were involved in drug trafficking, utilizing a third person’s money. Despite all of this evidence, prosecutors never went after the men. They only went after the money.

Records searches of both state and federal courts did not identify any criminal charges against Li, Peng or Huang.

Even the speeding that predicated the stop (in which a drug dog “alerted” on the rental vehicle that contained no drugs) went unprosecuted.

This is where the stupid begins: alleged drug dealers allowed to continue their drug dealing by state and federal agencies more interested in the men’s cash.

But it gets stupider. This was offered up in the complaint against the seized money as evidence of the men’s criminal activities.

Authorities noted in the complaint he lived “9 houses” away from the site of a residence where drug transactions were occurring and a contact in his phone was recently the subject of a civil forfeiture action.

That’s some mighty fine evidence. If you happen to live in the same neighborhood as a known criminal, I guess you’re a criminal, too. That’s just how society works, ladies and gentlemen. Move to a better neighborhood if you don’t want to be lumped in with your worst neighbors.

The other part is stupid, too. According to this line of thought, if law enforcement has stolen cash and property from someone in your Contacts list, you must be a criminal. Only criminals would associate with people whose stuff has been taken by the government but have never been convicted of criminal activity.

Also apparently suspicious: traveling and not attempting to avoid mandated IRS reporting.

Peng had a number of bank transactions the complaint states were “highly unusual” including multiple deposits and wire transactions for about $ 100,000 each. Financial records also showed three trips between Chicago and California and one from Chicago to New York in a three-month period between November 2016 and January 2017.

You just can’t win. Keep deposits too low (under $ 10,000) and the federal government thinks you’re engaged in structuring. Keep them well above the mandatory reporting mark and you’re probably a drug dealer.

It appears the agencies involved in this seizure didn’t think they had enough real evidence to follow through on this forfeiture. More than two years after the $ 626,000 was seized, the government is returning it to its rightful owners. That’s where the vindictiveness comes in. The government hasn’t won a criminal or civil case against any of the people involved, but it’s still going to keep a third of the cash just because.

U.S. District Attorney for Western Missouri Tim Garrison, in a settlement agreement dated April 25, wrote the government will return almost $ 418,000 to claimant Lu Li, of Chicago, and will keep almost $ 209,000.

Even when the government loses, it still wins. One-third of $ 626,000 remains in the hands of a government that couldn’t prove anything it alleged, even in a civil case where the standard of proof is considerably lower.

In the end, we have three people short $ 200,000 and a government that can’t competently prosecute people or their money, even when the latter can’t defend itself in civil forfeiture litigation. [waves American flag with one blue stripe frantically while humming ‘The Ballad of the Green Berets” for some reason]

Permalink | Comments | Email This Story

Techdirt.