New Cryptocurrency-Mining Android Malware is Spreading Rapidly

Due to the recent surge in cryptocurrency prices, threat actors are increasingly targeting every platform, including IoT, Android, and Windows, with malware that leverages the CPU power of victims' devices to mine cryptocurrency.

Just last month, Kaspersky researchers spotted fake antivirus and porn Android apps infected with malware that mines Monero cryptocurrency, launches DDoS attacks, and performs several other malicious tasks, causing the phone's battery to bulge out of its cover.

Now, security researchers at Chinese IT security firm Qihoo 360 Netlab discovered a new piece of wormable Android malware, dubbed ADB.Miner, that scans wide-range of IP addresses to find vulnerable devices and infect them to mine digital cryptocurrency.

According to the researchers, ADB.Miner is the first Android worm to reuse the scanning code programmed in Mirai—the infamous IoT botnet malware that knocked major Internet companies offline last year by launching massive DDoS attacks against Dyndns.

ADB.Miner scans for Android devices—including smartphones, smart TVs, and TV set-top boxes—with publicly accessible ADB debug interface running over port 5555 and then infects them with a malware that mines Monero cryptocurrency for its operators.

Android Debug Bridge (ADB) is a command-line tool that helps developers debug Android code on the emulator and grants access to some of the operating system’s most sensitive features.

It should be noted that almost all Android devices by default come with the ADB port disabled, so botnet would target only those devices that have manually been configured to enable port 5555.

Besides mining Monero cryptocurrency, ADB.Miner installed on an infected device also attempts to propagate itself by scanning for more targets on the Internet.

Researchers did not reveal exactly how or by exploiting which ADB flaw hackers are installing malware onto Android devices.

However, the researchers believed hackers are not exploiting any vulnerability that targets any specific device vendor since they found devices from a wide range of manufacturers impacted.

According to the researchers, the infection started on January 21, and the number of attacks has increased recently. As of Sunday, the researchers detected 7,400 unique IP addresses using the Monero mining code—that's more than 5,000 impacted devices in just 24 hours.

Based on the scanning IP addresses, the highest number of infection has been noticed in China (40%) and South Korea (31%), the researchers estimated.

In order to fight against such malware Android users are advised not to install unnecessary and untrusted applications from the app store, even from Google Play Store, and keep your devices behind a firewall or a VPN.

3 Biggest Cybersecurity Threats Facing Small Businesses Right Now

Technology has quickly engulfed the world around us. Everything we do, both at a business and personal level, seems to involve technology in one way or another. However, as that happens, small businesses continue to be a top target for hackers, with the number of organizations hit by cybercrime rising each year. According to The Ponemon Institute’s 2017 State of Cybersecurity in Small & Medium-Sized Businesses report, 61 percent of businesses experienced a cyber attack in 2017, signifying a 6 percent increase from the previous year’s 55 percent. Data breaches were up to 54 percent from 50 percent in 2016. This year promises faster internet, more connectivity, and unfortunately, more cybersecurity threats. Threat Horizon 2018, from the Threat Horizon series by the non-profit association Information Security Forum (ISF), shows that with the growing connectivity, there will be an increase in the information security threat landscape.

1. Internet of Things (IoT) leaks

As real-time data collection becomes increasingly important, the IoT is growing too. From monitoring traffic and collecting real-time patient information to optimizing the uptime of industrial equipment, organizations are massively acquiring IoT devices. However, these devices aren’t always secure. This creates a potential backdoor into the organization, warns the ISF.

IoT works so great because it’s comprised of dozens of devices that hide in plain sight. Be it alarm systems, GPS, web cameras, HVAC or medical devices, such as pacemakers, it’d be hard to guess which of these devices are even connected to the internet in the first place. But since IoT devices lack built-in security, they are often easy targets by hackers.

 Attackers usually use automated programs to locate IoT devices. Once located, attackers attempt to connect to the device using the default admin credentials. And since most users don’t change them, this is usually a success for the attacker. Once in, the hackers can easily install malware, basically taking the system under their control.

Daniel Soderberg, CEO of EyeOnPass, advises changing all passwords immediately when you acquire a new device. “I wouldn’t operate any device with the default password,” he warns. “Default passwords are usually printed and freely available, exposing the user to all manner of cyber dangers.”

2. Opaque algorithms                                                                                              

The Threat Horizon 2018 report also warns of the increasing using of algorithms. As organizations continue to fully trust algorithms with the operation and decisions concerning critical systems, the report says, they lose the visibility into the functioning and interaction of their systems.

The lack of proper and transparent interactions between algorithms poses a security risk in case unintended interactions between algorithms create incidents -- like the U.S. Treasury Bonds “flash crash” of October 2014 that saw bond yields drastically drop briefly before the algorithms corrected themselves.

“We know they’re going to do some quirky stuff from time-to-time,” says Steve Durbin, managing director of the ISF. “You need to understand some of the exposure you have to algorithmic systems. We’re building more and more of our systems on top of algorithms -- industrial control, critical infrastructure. There’s an increasing risk in this space we need to be addressing.”

To be able to manage these risks, organizations need to have a human monitoring the execution of operations and decisions often left to algorithms. The report advises organizations to know the risks that come with algorithm-controlled systems and know when to involve a human. Also, they must update their code maintenance policies and identify alternatives to treating algorithm-related incidents, especially when insurance isn’t an option.

3. Security researchers are being silenced

Security researchers are often the whistleblowers. They impart knowledge about digital vulnerabilities, making sure systems are secure and users’ data remains in the intended hands. When they are silenced, either by the government or private companies, it’s often a loss for all users.

With software replacing hardware in most major sectors, users and businesses depend on researchers to unearth vulnerabilities and make them public as part of ongoing efforts to improve security. However, lately, manufacturers have been responding to such actions by taking legal action instead of working with the research to fix those vulnerabilities. The ISF predicts that this trend will only grow; exposing customers to vulnerabilities that manufacturers have decided to hide rather than fix.

To protect themselves, the ISF advises technology buyers, which include small businesses, to insist on transparency during the procurement process. It advises manufacturers to take it more positively when vulnerabilities are found within their systems by rewarding the researchers rather than attempting to punish them.

Considering that a researcher might find a vulnerability in a tool in 2018 and not report it, it’s imperative for the small business owner to take a step further in protecting themselves, even if it means working with other business in order to come up with an affordable solution.

Transparency is key

When it comes to security, transparency has a great role to play. But this part has long been left for the security professionals. If all users reflected some degree of transparency, security in the cyberspace would be easier to achieve. If the non-technical managers and leaders understood the impact of good and poor protection, they would use the cyber assets they have more responsibly. Employees would be more careful about the devices they introduce to the network.

As the business owner, it’s your job to carefully manage the inventory of the connected IoT devices. “Some things have internet capabilities that you didn’t ask for and will never use,” says Leon Adato of SolarWinds adding that any devices that don’t need to be connected to the internet should be disconnected.

Relieve Your Work Stress With These Toys for Adults

In this article, we’re going to look at eight stress-relieving tech toys for adults. If you buy a couple of them, you will hopefully find your stress melting away.

1. Marpac Dohm-DS All-Natural White Noise Sound Machine

Do you live or work in a noisy environment? If so, you might find the constant around-the-clock commotion is making you stressed.

Of course, you could move house or apply for a new job, but for a less drastic solution, you should try using a white noise machine. White noise has been scientifically proven to mask unwanted sounds, as long as it’s played at a consistent volume.

The Marpac Dohm-DS model has a dual-speed motor and an asymmetrical fan. It provides the sound of moving air. You can also adjust its tone and volume.

2. Muse: The Brain-Sensing Headband

Another proven stress-buster is meditation. It can help cure anxiety, manage anger, focus you on your goals, relax your body, and even improve your all-around health.

Unfortunately, meditation isn’t an easy hobby to get in to. If you don’t have any previous experience with it, you might need an expert to get you on the right track.

That’s where the Muse headband can help. It reads your brain waves to establish whether your mind is active or calm, then plays appropriate sounds through its earpiece. The device can also log all your sessions via the accompanying app.

3. Stress Thermometer

The process of measuring brain waves and other stress-based signals your body emits is called biofeedback. The technology undoubtedly works, but it’s also expensive. An individual biofeedback gadget can often cost more than $250.

For a much cheaper solution, you can try using a stress thermometer. You won’t see stress thermometers on many lists of cool toys for adults, but hear us out.

The idea is simple. When your hands are cold, you’re more stressed. When they are warm, you’re less stressed. The thermometers measure the temperature of your finger every two seconds, thus teaching you how to control your thoughts to reduce your stress levels.

4. Buddha Board

A Buddha board allows you to “paint” with water. A few moments after you make your creation on the canvas, it disappears. Given that painting is a sure-fire way to clear the mind and relieve stress, these gadgets are guaranteed winners.

Using the board is easy. Fill up the device with water, then dip the supplied bamboo brush into the liquid and start painting. The use of water gives the images you create an oriental feel.

The board we’ve selected has some of the best reviews on Amazon. The canvas is 12×9.5 inches in size.

5. Sunbeam King-Size Heating Pad

Stress doesn’t only come in a mental form. Your muscles and tendons can also become stressed, either because you’ve overworked them or because your stressed mind is subconsciously making them feel lethargic.

The Sunbeam heating pad is a possible solution. It can help you get rid of muscle cramps and knots.

The 12×24-inch pad has three heat settings and a slideable temperature adjuster. Furthermore, the pad’s cover is machine-washable.

However, the heating pad’s best feature is perhaps the sponge insert. It allows you to apply moist heat to your body. Moist heat is proven to relieve soreness faster than dry heat.

6. PureSpa USB Personal Aroma Diffuser

Essential oils have become more popular in the last few years. The correct blend of oils can help alleviate allergies, improve concentration, aid sleep, relieve stress, and a whole lot more.

Typically, the oils are placed in a large diffuser and evaporated into the air. However, large diffusers are unwieldy — you wouldn’t want to haul it to your office and back every day.

The PureSpa USB Personal Aroma Diffuser uses the same principle as a large diffuser. The difference is that it plugs into your computer’s USB port for power. This model includes three refill pads.

7. Mini Desktop Arcade Machine

Unlike some other approaches we’ve discussed on this list, gaming might not be a scientifically-proven stress beater. If anything, playing the latest AAA title will increase your stress levels.

But what about a more casual desktop arcade game? At the very least, it will help you take your mind off what’s troubling you for a few minutes.

The $18.99 model on thehut.com comes with 240 classic 16-bit games. You will find all the usual arcade genres, including sports, puzzles, and fantasy. The screen is 2.5 inches, and it boasts an eight-way joystick. It’s a cool toy for adults that will be great for any fan of old-school video games.

8. SADES Prime Fidget Spinner

We couldn’t publish an article about techy stress-relieving toys without mention fidget spinners. The popularity of the must-have trinket of 2017 is showing no signs of slowing down in 2018.

Predictably, tech nerds have gotten their hands on the innocuous bits of plastic and given them a makeover. For example, the SADES Prime Fidget Spinner now comes equipped with a Bluetooth speaker.

It means you can listen to your favorite soothing songs while simultaneously giving your hands something to do. The spinner even lights up. Fidget toys for adults are here, and they’re here to stay.

2017 Smashed World's Records for Most Data Breaches, Exposed Information

Five mega-breaches last year accounted for more than 72% of all data records exposed in 2017.

It was a record-breaking year for the numbers of publicly reported data breaches and exposed records in 2017 worldwide: a total of 5,207 breaches and 7.89 billion information records compromised.

While hacking remained the No. 1 method used in data breaches last year (55.8%), for the first time it wasn't the top cause of exposed data records: 68.7% of exposed records came at the hands of unintentional Web-borne exposure due to accidental leaking online and misconfigured services and portals.

Some 5.4 billion records were exposed this way, even though that was via just 5% of all reported breaches. Data breaches due to hacks accounted for 2.3 billion records.

"These were misconfigured services, faulty backups, that sort of administrative error that leads to those data sets then being open and exposed to the Internet," explains Inga Goddijn, executive vice president of Risk Based Security, which compiled the breach data from public disclosures for its annual report. "The popularity of search engines like Shodan make it an incredibly open doorway for discovering that information. ... Both security researchers and malicious actors alike understand the power of those tools."

There was a painful wave of publicly disclosed leaks via misconfigured Amazon Web Services (AWS) Simple Storage Service (S3) bucket accounts in 2017. RedLock CSI (Cloud Security Intelligence) found that 53% of businesses using cloud storage services like AWS S3 had inadvertently exposed one or more of their cloud services to the Internet. Among the big-name companies found with exposed AWS S3 storage buckets were Accenture, Booz Allen Hamilton, and Verizon.

Goddijn says most of the exposed record incidents in 2017 were data-handling errors that could have been prevented. Risk Based Security, which compiles and aggregates publicly disclosed data breach events, published its findings today in its annual Data Breach QuickView report on breach trends for 2017.

Both the number of total breaches and total records exposed each jumped by 24% over 2016.

Big Data Eight of 2017's reported data breaches made the Top 20 list of all-time largest breaches, according to the report. And the five biggest breaches of the year exposed 72.2% of the records, or 5.7 billion records total.

Goddijn points to a few mega-breaches driving that data, including those at Equifax and Sabre Systems. While travel systems provider Sabre has not reported the full extent of its breach, affected third parties continue to issue notifications affecting their customers, she says. "We are still getting information on organizations that had employee or customer data exposed as part of that Sabre breach," including hotels and travel organizations, she says.

"They [Sabre] never came out and said how big it was, but it has been one of the larger ones" based on the fallout, she says. It's unclear if Sabre even knows the full extent of the breach, she says.

Most reported breaches (39.4%) occurred in the business sector, followed by medical (8.1%), government (7.2%), and education (5.3%). And 40% of breaches came from organizations that were not identifiable based on the public disclosure data.

Businesses suffered the most exposed records, with 82.9%, government (3.7%), medical (less than 1%), education (less than 1%), and some 12.4% in sectors not identifiable via public disclosure information.

The US led the world with the most reported breaches, with 2,330, followed by the UK (184), Canada (116), India (78), and Australia (62). That wide gap between the US and Europe could change once the European Union's General Data Protection Regulation (GDPR) goes into effect in May, which includes rules for mandatory breach notification. "I'll be curious to see how GDPR impacts the data," she says, noting that the US has had some of the most stringent reporting requirements thus far.

Critical Flaw in Grammarly Spell Checker Could Let Attackers Steal Your Data

A critical vulnerability discovered in the Chrome and Firefox browser extension of the grammar-checking software Grammarly inadvertently left all 22 million users' accounts, including their personal documents and records, vulnerable to remote hackers.

According to Google Project Zero researcher Tavis Ormandy, who discovered the vulnerability on February 2, the Chrome and Firefox extension of Grammarly exposed authentication tokens to all websites that could be grabbed by remote attackers with just 4 lines of JavaScript code.

In other words, any website a Grammarly user visits could steal his/her authentication tokens, which is enough to login into the user's account and access every "documents, history, logs, and all other data" without permission.

"I'm calling this a high severity bug, because it seems like a pretty severe violation of user expectations," Ormandy said in a vulnerability report. "Users would not expect that visiting a website gives it permission to access documents or data they've typed into other websites."

Ormandy has also provided a proof-of-concept (PoC) exploit, which explains how one can easily trigger this serious bug to steal Grammarly user's access token with just four lines of code.

This high-severity flaw was discovered on Friday and fixed early Monday morning by the Grammarly team, which, according to the researcher, is "a really impressive response time" for addressing such bugs.

Security updates are now available for both Chrome and Firefox browser extensions, which should get automatically updated without requiring any action by Grammarly users.

A Grammarly spokesperson also told in an email that the company has no evidence of users being compromised by this vulnerability.

"Grammarly resolved a security bug reported by Google's Project Zero security researcher, Tavis Ormandy, within hours of its discovery. At this time, Grammarly has no evidence that any user information was compromised by this issue," the spokesperson said.

"We're continuing to monitor actively for any unusual activity. The security issue potentially affected text saved in the Grammarly Editor. This bug did not affect the Grammarly Keyboard, the Grammarly Microsoft Office add-in, or any text typed on websites while using the Grammarly browser extension. The bug is fixed, and there is no action required by Grammarly users."