Tag Archive for: Web’

Meet the hackers who earn millions for saving the web. How bug bounties are changing everything about security

/in


These hackers are finding security bugs–and getting paid for it. That’s changing the dynamics of cybersecurity.

The first time Katie Paxton-Fear found a bug, she thought it was just luck. 

One of her friends had signed her up for an event in London, where hackers aim to find the vulnerabilities in a particular piece of software.

Without any experience of cybersecurity beyond being a programmer and developer, she found one bug, then another. “To be fair, I thought it was a fluke,” she says. But since then she’s found 30 more security bugs.

“It’s kind of like playing Sherlock Holmes,” says Paxton-Fear.

“You feel like a detective, going in rooting around and saying, ‘That looks interesting’, and having a stream of clues,” she says. “And, when you get all the pieces neatly together, and it works and there’s a bug there–it’s the most thrilling experience ever.”

But unlike a hacker looking for vulnerabilities to cause damage or steal data, Paxton-Fear is a bug bounty hunter. The bugs she finds are reported to the companies that write the code.

SEE: Security Awareness and Training policy (TechRepublic Premium)

That allows these organisations to fix the problems before malicious hackers find the same weaknesses. And the bug hunters get paid for each one they find.

As such she’s part of a growing industry that allows security researchers to hack into organisations’ software–with their permission–and then report the weaknesses they discover in return for a financial reward.

It’s a different way of approaching computer security, but one that is proving increasingly popular. One key feature is these security researchers will approach a target from the same perspective as a potential attacker. 

In that sense, bug bounty hunters are both the detective Holmes and also at least in part his nemesis, Moriarty, although Paxton-Fear says she sees herself more as Sherlock because by finding…

Source…

Security company Gunnebo hacked with stolen data published on the dark web

/in


Multinational Swedish security company Gunnebo AB has been hacked with the data stolen finding its way onto the dark web, the shady part of the internet reachable with special software.

Founded in 1889, though with roots in an earlier company founded in 1764, Gunnebo is a leading provider particularly in Europe of banking security solutions, including cash management, entrance control and safe storage. Although the name of the company may not be well-known, Gunnebo owns Chubbsafes, a familiar brand of safes that had its origins in the U.K. in the 19th century.

The hack of the company possibly dates back to March 2020, Krebs on Security said today, but the data stolen has now only appeared on the dark web. Gunnebo said in August that it has thwarted a ransomware attack, but it’s not clear if that attack was related to the theft and subsequent publication of data stolen from the company.

Data stolen and then published is said to include tens of thousands of sensitive documents, including schematics of client bank vaults and surveillance systems. The published data is highly sensitive and valuable to international criminals, particularly bank robbers. Other information stolen and published included security arrangements for the Swedish parliament and confidential plans for the Swedish Tax Agency’s new office according to The Local Sweden.

Officially, Gunnebo is describing the theft of data as an “IT incident” that is “extremely regrettable.” While a bank security company being hacked is embarrassing, the tone taken by the firm is arguably unique in that it attacks the media for their reporting of the incident.

How the hack took place is a case of bad security 101. “This breach was the result of an easily-guessed password (password01) and lack in company network security, which ultimately allowed the hackers to enter the system and steal documents,” Ben Goodman, senior vice president for global business and corporate development at digital identity company ForgeRock Inc., told SiliconANGLE. “This type of breach happens all too often. Employing a weak password as the only authentication method gives attackers the easy access they need to hack into a system…

Source…

Becoming Anonymous: The Complete Guide To Maximum Security Online

/in

Gartner: ‘Insider threat is alive and well on the dark Web’

/in

National Harbor, Md. — Corporate employees who help carry out cyberattacks are increasingly being sought and are seeking criminals to hire them, a Gartner analyst told a group at the consulting firm’s Security and Risk Management Summit.

A group of 60 CIOs and CISOs she worked with say this recruitment is more active and becoming a larger concern because of their use of the Dark Web to sell their services, says Gartner analyst Avivah Litan.

+More on Network World: National Intelligence office wants to perfect the art of security deception+

To read this article in full or to leave a comment, please click here

Network World Tim Greene