India’s cybersecurity agency warns people of credit card skimming via e-commerce sites

Agencies
July 18, 2020

New Delhi, Jul 18: India's national cybersecurity agency CERT-in, has warned people of credit card skimming spreading across the world through e-commerce platforms.

Attackers are typically targeting e-commerce sites because of their wide presence, popularity and the environment LAMP (Linux, Apache, MySQL, and PHP), the Computer Emergency Response Team (CERT-In) said in a notice on Thursday.

Recently, attackers targeted sites which were hosted on Microsoft's IIS server running with the ASP.NET web application framework, it said.

Some of the sites affected by the attack were found to be running ASP.NET version 4.0.30319, which is no longer officially supported by Microsoft and may contain multiple vulnerabilities, CERT-In said.

The notice also included a list of best practices for website developers including the use of the latest version of ASP.NET web framework, IIS web server and database server.

The advisory is based on research by Malwarebytes which found that this skimming campaign likely began sometime in April this year.

Credit card skimming has become a popular activity for cybercriminals over the past few years, and the increase in online shopping during the pandemic means additional business for them, too, Malwarebytes said in a blog post, adding that attackers do not need to limit themselves to the most popular e-commerce platforms.

Researchers from global cybersecurity and anti-virus brand Kaspersky had warned in December last year that more cybercriminal groups will target online payment processing systems in 2020. 

It said that over the past couple of years, so-called JS-skimming (the method of stealing of payment card data from online stores), has gained immense popularity among attackers. 

Kaspersky researchers in their report said they are currently aware of at least 10 different actors involved in these type of attacks.

Their number will continue to grow during the next year, the report said, adding that the most dangerous attacks will be on companies that provide services such as e-commerce as-a-service, which will lead to the compromise of thousands of companies.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 7,2020

Washington, Jan 7: Facebook will ban deepfake videos ahead of the US elections but the new policy will still allow heavily edited clips so long as they are parody or satire, the social media giant said Tuesday.

Deepfake videos are hyper-realistic doctored clips made using artificial intelligence or programs that have been designed to accurately fake real human movements.

In a blog published following a Washington Post report, Facebook said it would begin removing clips that were edited--beyond for clarity and quality--in ways that "aren't apparent to an average person" and could mislead people.

Clips would be removed if they were "the product of artificial intelligence or machine learning that merges, replaces or superimposes content onto a video, making it appear to be authentic," the statement from Facebook vice-president Monika Bickert said.

However, the statement added: "This policy does not extend to content that is parody or satire, or video that has been edited solely to omit or change the order of words."

US media noted the new guidelines would not cover videos such as the 2019 viral clip -- which was not a deepfake -- of House Speaker Nancy Pelosi that appeared to show her slurring her words.

Facebook also gave no indication on the number of people assigned to identify and take down the offending videos, but said videos failing to meet its usual guidelines would be removed, and those flagged clips would be reviewed by teams of third-party fact-checkers -- among them AFP.

The news agency has been paid by the social media giant to fact-check posts across 30 countries and 10 languages as part of a program starting in December 2016, and including more than 60 organisations.

Content labeled "false" is not always removed from newsfeeds but is downgraded so fewer people see it -- alongside a warning explaining why the post is misleading.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
January 3,2020

Giving each and every app access to personal information stored on Android smartphones such as your contacts, call history, SMS and photos may put you in trouble as bad actors can easily use these access to spy on you, send spam messages and make calls anywhere at your expense or even sign you up for a premium "service", researchers from cybersecurity firm Kaspersky have warned.

But one can restrict access to such information as Android lets you configure app permissions. 

Giving an app any of these permissions generally means that from now on it can obtain information of this type and upload it to the Cloud without asking your explicit consent for whatever it intends to do with your data.

Therefore, security researchers recommend one should think twice before granting permissions to apps, especially if they are not needed for the app to work. 

For example, most games have no need to access your contacts or camera, messengers do not really need to know your location, and some trendy filter for the camera can probably survive without your call history, Kaspersky said. 

While decision to give permission is yours, the fewer access you hand out, the more intact your data will be.

Here's what you should know to protect your data.

SMS: An app with permission to send and receive SMS, MMS, and WAP (Wireless Application Protocol) push messages, as well as view messages in the smartphone memory will be able to read all of your SMS correspondence, including messages with one-time codes for online banking and confirming transactions.

Using this permission, the app can also send spam messages in your name (and at your expense) to all your friends. Or sign you up for a premium "service." You can see and conrol which apps have these rights by going to the settings of your phone.

Calendar: With permission to view, delete, modify, and add events in the calendar, prying eyes can find out what you have done and what you are doing today and in the future. Spyware loves this permission.

Camera: Permission to access the camera is necessary for the app to take photos and record video. But apps with this permission can take a photo or record a video at any moment and without warning. Attackers armed with embarrassing images and other dirt on you can make life a misery, according to Kaspersky.

Contacts: With permission to read, change, and add contacts in your address book, and access the list of accounts registered in the smartphone, an app can send your entire address book to its server. Even legitimate services have been found to abuse this permission, never mind scammers and spammers, for whom it is a windfall.

This permission also grants access to the list of app accounts on the device, including Google, Facebook, and many other services.

Phone: Giving access to your phone means permission to view and modify call history, obtain your phone number, cellular network data, and the status of outgoing calls, add voicemail, access IP telephony services, view numbers being called with the ability to end the call or redirect it to another number and call any number.

This permission basically lets the app do anything it likes with voice communication. It can find out who you called and when or prevent you from making calls (to a particular number or in general) by constantly terminating calls. 

It can eavesdrop on your conversations or, of course, make calls anywhere at your expense, including to pay-through-the-nose numbers, Kaspersky warned.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
March 18,2020

Thiruvananthapuram, Mar 18: To raise awareness about protective measures against coronavirus, Kerala Police released a dance video on the State Police Media Centre's Facebook page promoting the washing of hands, here on Tuesday.

In the video, the police officers were seen dancing to the tunes of Kalakkatha from the Malayalam action-drama thriller Ayyappanum Koshiyum while demonstrating the right technique for washing hands.

The video gained over 27,000 likes and over 2,400 comments and more than 33,000 netizens shared the video.

The video has received a positive response with users congratulating Kerala Police for the initiative.

"Congrats Kerala police media for this kind of initiative," one user commented on Facebook. Another user thanked the police in the comments section saying, "Super super thanks to KL (Kerala) police."

The number of people who have tested positive for the coronavirus in Kerala is 25.

The total number of confirmed COVID-19 cases in India has reached 147, including 122 Indians and 25 foreign nationals, said the Ministry of Health and Family Welfare earlier today.

Globally, the virus has infected more than 184,000 people and killed more than 7500, as per the data available on the World Health Organisation website.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.