Monthly Archives: April 2020

Tape the webcam, enable firewall: 11 rules to ensure cyber security when you work from home – Economic Times

Posted: April 11, 2020 at 7:47 pm

By Kushal Das

Just as the lockdown started, IT departments across the country had a litany of things to worry about. From making sure that employees have laptops ready to be able to seamlessly begin working from home, to preparing infrastructure teams and working with network-provider companies, as the demand for bandwidth went up.

Another pertinent issue that creates a new set of challenges with remote working is security. As most companies were not prepared for this move to WFH, the employees were never given any proper training or guidance about the basic security measures to take to protect the company assets, client information, and their own digital security.

As a result, criminals have found this as an easy surface to attack. Targeted phishing campaigns, malware, and ransomware attacks are increasing.

Here's a look at some basic pointers to keep in mind while working from home.

1. Beware of phishing Always double check the e-mail sender's address and do not click on any link provided on the emails (or download files) from unknown people. Even if you know the name of the person, verify if it is the correct e-mail address. If you have to open pdfs/docs/Excel sheets from unknown senders, it is much better to upload them to a cloud service like Google Drive, and open via Web tools.

This will help in case there is a malware in those attachments. If there is any known Web address in the e-mail, instead of clicking them, type them in the browser and open the site. Remember, criminals can easily fool you by faking URLs.

If you receive any e-mail asking to share authentication information (passwords, tokens, infrastructure details, or customer details), report to your IT team immediately. Do the same for any last-minute change request (say, of bank accounts). Please contact the person over phone or thorough encrypted chats and verify the request before taking any action.

2. Secure video callsFor video chatting, it is always better to use Web clients inside of your browser. If you have to download and install any software, make sure that you are downloading from a legitimate website. Criminals often spoof websites and stack them with malware, which may spy into your work or may be ransomware.

It is also important to note that many of the well-known video-chatting services are also not end-to-end encrypted, which opens them up to the possibility of snooping. If a business does not have a budget for paid services, using services that are secure is important.

Also remember not to share meeting, or screenshots from your video calls on the social media. You may accidentally be leaking information (meeting ID or other confidential information). Remember to close all software that arent required during the meeting.

3. Do not share any password or authentication details The average Web-based chat is unlikely to be end-to-end encrypted, and if passwords or other authentication details are shared over it, there is a chance that attackers can access that information. Try to identify one verified encrypted chatting medium and share these information over that one medium only. It can be Signal, Wire, Keybase, or any other system based on your organisations need and capacity.

4. Do not install any unverified softwareDo not download and install pirated software or anything else from random sites off the Internet. Many of them are malware ridden. Remember, since you are working from home, it my be difficult to get help in case of a cyber attack.

5. Lock the computer when you are getting upEven if you are inside the house, make sure to lock the computer screen when you get up. This is because someone in the house, maybe children, may click on the system and that could mean trouble.

6. Update your system dailyAs and when companies find bugs in their software and OS, they are also fixing them by releasing regular updates. Make sure that every day, you find time to update your system. Just having the latest version will save you from many threats.

7. Remember to enable a firewall All operating systems come with default firewall systems and you should not disable them. They are essential to defending against many known attacks.

9. Tape up your webcam and mute the mic by default If you are not in a meeting, make sure that your webcam is either taped or blocked via double folded paper. The microphone should always be on mute. There will be times when private topics may be discussed, and having the microphone on mute will help prevent any leaks or unnecessary sharing of embarrassing information.

10. Remember to check your childrens network access If your children are using a device, make sure you keep an eye on the content they are watching. Ask them not to click on any unknown image or link.

11. Secure browsing If you want an extra layer of security and privacy, it is a good idea to install the Tor browser. It comes with many security features, which makes Web-based attacks difficult to execute on your computer.

- The author is public interest technologist at Freedom of the Press Foundation; a CPython core developer; and director, Python Software Foundation.

4 Apr, 2020

4 Apr, 2020

4 Apr, 2020

4 Apr, 2020

4 Apr, 2020

Follow this link:
Tape the webcam, enable firewall: 11 rules to ensure cyber security when you work from home - Economic Times

Posted in Tor Browser | Comments Off on Tape the webcam, enable firewall: 11 rules to ensure cyber security when you work from home – Economic Times

Tails 4.5 Is Out: Run The Live Operating System With Secure Boot – Fossbytes

Posted: at 7:47 pm

Do you care about your anonymity and you use a Linux distro as your daily driver? Well then, you must be aware of the security-focused Debian Linux-based Tails operating system. If not, check out the latest version of Tails 4.5 which you can run directly from your USB stick without installation.

The new version 4.5 comes with several security bug fixes and vulnerabilities. Most importantly, the upstream Debian security flaws such as BlueZ and GnuTLS which allow attackers to access the target host system.

Other security updates include support for secure boot. You can now run Tails on your computer with secure boot enabled. This means your Original Equipment Manufacturer (OEM) firmware only allows the booting of authorized software.

Lastly, software packages such as the Tor browser and Firefox have been updated to their newer versions. Read the official release notes here for complete details.

The latest version fixes numerous security vulnerabilities. Hence, you must upgrade your system to v4.5. Though automatic upgrades are available from Tails 4.2 or later to 4.5, you can follow the manual upgradeas well.

For fresh installation on a new USB stick, you can follow the instructions for your respective operating system Windows, macOS and Linux.

Following the tradition of new releases every month, Tails 4.6 is scheduled to be released on May 5. For more details, you can check out the next release roadmap here.

Read this article:
Tails 4.5 Is Out: Run The Live Operating System With Secure Boot - Fossbytes

Posted in Tor Browser | Comments Off on Tails 4.5 Is Out: Run The Live Operating System With Secure Boot – Fossbytes

This Week In Security: Zoom (Really This Time), Fingerprints, And Bloatware – Hackaday

Posted: at 7:47 pm

You were promised Zoom news last week, but due to a late night of writing, that story was delayed to this week. So whats the deal with Zoom? Google, SpaceX, and even the government of Taiwan and the US Senate have banned Zoom. You may remember our coverage of Zoom from nearly a year ago, when Apple forcibly removed the Zoom service from countless machines. The realities of COVID-19 have brought about an explosion of popularity for Zoom, but also a renewed critical eye on the platforms security.

Zoombombing, joining a Zoom meeting uninvited, made national headlines as a result of a few high profile incidents. The US DOJ even released a statement about it. Those incidents seem to have been a result of Zoom default settings: no meeting passwords, no waiting room, and meeting IDs that persist indefinitely. A troll could simply search google for Zoom links, and try connecting to them until finding an active meeting. Ars ran a great article on how to avoid getting zoombombed (thanks to Sheldon for pointing this out last week).

There is another wrinkle to the Zoom story. Zoom is technically an American company, but its Chinese roots put it in a precarious situation. Recently its been reported that encryption keying is routed through infrastructure in China, even though the calling parties are elsewhere. In some cases, call data itself goes through Chinese infrastructure, though that was labeled as a temporary bug. Zoom was also advertising its meetings as having end-to-end encryption. That claim was investigated, and discovered to be false. All meetings get decrypted at Zoom servers, and could theoretically be viewed by Zoom staff.

Why does it matter? Is this just anti-Chinese rhetoric? Well, no. When a service like Zoom is hosted on a server in a given country, that service is subject to that countrys laws. China has a rather dismal history of abusing communications infrastructure to spy on and persecute its own citizens. (I am aware that the US has a dismal history there as well. Im not excited about my conversations being in the clear on a US server, either.) While thats not necessarily a huge problem for a school doing distance learning, government leaders should probably avoid holding cabinet meetings over the service.

Its a Hollywood trope at this point. Our hero has to infiltrate the super secret organization, and to get in, he has to defeat a fingerprint scanner. No problem, the hero has lifted a fingerprint earlier in the movie, and with a bit of ingenuity, fools the fingerprint scanner. Thats just the movies, and real fingerprint readers are more secure, right? Well, the Talos group at Cisco put the myth to the test. They used a 25 micron UV 3d printer to make a series of molds, and then tried different materials to cast the fake prints. A fabric glue seemed to work the best, as it was able to fool capacitive sensors as well as visual.

A mold could be calculated and printed in an hour in 25-micron resolution. There is some additional time for the cast itself to set, and they conclude that the attack isnt something that can be performed quickly.

Phones seemed to fare the worst, with a success rate somewhere around 80%. Of particular interest is the devices that were difficult to compromise. Interestingly, Windows Hello, a part of Windows 10, was entirely resilient to their attacks. The Talos researchers suggest that the key here is the comparison algorithm used to compare the scanned fingerprints. Another winner was the pair of USB keys that use a fingerprint scanner to unlock the stored data. Those keys also shrugged off this attack. The Talos researchers made sure to point out that this doesnt mean that these devices are secure against this type of attack. Their work was intentionally low-budget, and its likely a more determined, well-funded attacker could overcome the rest of the devices.

But even if you just want to play around with this at home, with a little effort you can fool face and iris recognition yourself. And all this aside, you shouldnt have to use biometric information in place of passwords anyway.

Running Firefox or the Tor browser anywhere? Go update now, make sure you on 74.0.1 or better (or 68.6.1 if youre using Firefox ESR). There are a pair of use-after-free bugs that are being actively exploited. There arent many more details available at the moment, possibly because of related bugs that still need to be fixed. According to the researcher that found the bugs: There is still lots of work to do and more details to be published (including other browsers). Stay tuned.

On the Google side of the fence, the big news is that the new same-site cookies policy is being rolled back. The Chrome blog has a link to a great explainer of the potential problem with 3rd party cookies, and how the samesite policy changes can help.

A novel paper came across my digital desk this week (PDF) that introduces a new way to ask an old question: What secrets is this closed-source app hiding? Weve talked about backdoors, hard-coded passwords, and hidden administrator menus in the past. Most of the time, these are unintentional; bits of debugging code that were forgotten about and never removed. In the linked paper, a technique was developed to examine the input validation code of an app, looking for hidden hardcoded options.

For example, a 3rd party screen lock will take user input, and then make a system call to compare that input against the system password. If there is a string compare that happens before the expected system call, then there might be a secret backdoor password hard-coded into the app. In another example, a translation app had a secret menu, unlocked by entering a hardcoded key, where debugging tasks could be done, like disabling ads.

After scanning 150k Android apps, about 12k were discovered to have hardcoded backdoors, passwords, or debugging menus. In other words, just over 8% of the most popular Android apps have some suspicious behavior built-in.

Via Heise Online

Ahhh, theres not many things that satisfy quite like unboxing new hardware for the first time. You finally pulled the trigger on a new laptop, and now its ready to boot up for the first time. Many of us have a similar policy in these situations: Boot the laptop, uninstall the OEM bloatware. If that isnt your habit, then maybe[Bill Demirkapi]s research on HP bloatware will convince you.

Theres quite a bit here, but the most interesting attack chain, an RCE, takes advantage of some seemingly unrelated issues. The first is an open redirect on HPs site. This seem innocuous enough. https://ers.rssx.hp.com/ers/redirect?targetUrl=https://google.com” would automatically redirect you to Google. The second issue is an HP service that registers a custom URL protocol. That protocol downloads and runs or opens the downloaded file. Before starting the download, there is check run that this download is coming from an HP domain. The open redirect comes in handy here, as the redirect is followed after that domain check is performed. An official looking link can then trigger HPs update downloader, which then will automatically open a downloaded zip file. Yes, it requires two interactions to compromise, but is a clever chain nonetheless.

Yet another installment of our Coronavirus scamming story. This week well look at emails claiming to be from the US Small Business Administration (SBA).

I received this email Tuesday the 7th, and took a moment to realize it was a fake. The first giveaway is that the attachment is a .img, rather than a PDF or other image file. That disk image contains a SBA_Disaster_Application_Confirmation_Documents_COV_Relief_doc.exe executable. There are a few other tip-offs that this probably isnt a legitimate communication, like the spelling of centres and endeavour, using the British spellings. The last, and perhaps most obvious flaw, is that the date has already passed.

Hold on to your hats, because were about to speculate. You see, this email came in only a few hours after I filled out some online paperwork for an Economic Injury Disaster Loan, on the official SBA website. I very nearly fell for this, because the timing was so spot-on. It appears that the SBA is leaking information about grant applicants, and someone is using that leak to run a phishing campaign.

More here:
This Week In Security: Zoom (Really This Time), Fingerprints, And Bloatware - Hackaday

Posted in Tor Browser | Comments Off on This Week In Security: Zoom (Really This Time), Fingerprints, And Bloatware – Hackaday

"Tiger King" and America’s captive tiger problem – Salon

Posted: at 7:46 pm

Editor's note: Netflix's new docuseries "Tiger King" takes viewers into the strange world of big cat collectors. Featuring eccentric characters with names like Joe Exotic and Bhagavan "Doc" Antle, the series touches on polygamy, addiction and personality cults, while exploring a mysterious disappearance and a murder-for-hire.

To Allison Skidmore, a Ph.D. candidate at the University of California, Santa Cruz who studies wildlife trafficking, the documentary didn't bring enough attention to the scourge of captive big cats.

A former park ranger, Skidmore first started studying the issue in the U.S. after the infamous death of Cecil the Lion in Zimbabwe in 2015. She was shocked to learn about how little oversight there was stateside. We asked her about the legality, incentives and ease of buying and selling tigers.

1. How many captive tigers are in the U.S.?

Unfortunately, there's no straightforward answer. The vast majority of captive tigers are crossbred hybrids, so they aren't identified as members of one of the six tiger subspeciesthe Bengal tiger, Amur tiger, South China tiger, Sumatran tiger, Indochinese tiger and Malayan tiger. Instead, they're classified as "generic."

Advertisement:

Less than 5% or fewer than 350of tigers in captivity are managed through the Association of Zoos and Aquariums, a nonprofit organization that serves as an accrediting body in the U.S. They ensure accredited facilities meet higher standards of animal care than required by law.

All the rest are privately owned tigers, meaning they don't belong to one of the Association of Zoos and Aquariums' 236 sponsored institutions. These are considered generic and fall outside of federal oversight.

There's no legal requirement to register these generic tigers, nor a comprehensive national database to track and monitor them. The best educated guess puts the number of tigers at around 10,000 in the U.S. Estimates put the global captive tiger population as high as 25,000.

In comparison, there are fewer than 4,000 tigers in the wild down from 100,000 a century ago.

2. How do tigers change hands?

The Endangered Species Act and the Convention on International Trade in Endangered Species of Wild Flora and Fauna prevent the importation of tigers from the wild. So all tigers in the U.S. are born in captivity, with the rare exception of an orphaned wild cub that may end up in a zoo.

Only purebred tigers that are one of the six definitive subspecies are accounted for; these are the tigers you see in places like the Smithsonian National Zoo and generally belong to the Species Survival Plan, a captive breeding program designed to regulate the exchange of specific endangered species between member zoos in order to maintain genetic diversity.

All other tigers are found in zoos, sanctuaries, carnivals, wildlife parks, exhibits and private homes that aren't sanctioned by the Association of Zoos and Aquariums. They can change hands in any number of ways, from online marketplaces to exotic animal auctions. They can be bought for as little as US$800 to $2,000 for a cub and $200 to $500 for an adult, which is less expensive than many purebred dog puppies.

3. Can I legally buy a tiger?

The U.S. is plagued with complicated and vague laws concerning tiger ownership.

However, there are no federal statutes or regulations that expressly forbid private ownership of tigers. State and local jurisdictions have been given this authority, and some do pass bans or require permits. Thirty-two states have bans or partial bans, and 14 states allow ownership with a simple license or permit. Four states Alabama, Wisconsin, North Carolina and Nevada have no form of oversight or regulation at all.

An overarching, cohesive framework of regulations is missing, and even in states that ban private ownership, there are loopholes. For example, in all but three states, owners can apply for what's called a "federal exhibitor license," which is remarkably cheap and easy to obtain and circumvents any stricter state or local laws in place.

You now need a permit to transport tigers across state lines, but there's still no permit required for intra-state travel.

4. What's in it for the owners?

Some see it as a business venture, while others claim they care about conservation. I consider the latter reason insincere.

Many facilities promote themselves as wildlife refuges or sanctuaries. These places frame their breeding and exhibition practices as stewardship, as if they're contributing to an endangered animal's survival. The reality is that no captive tiger has ever been released into the wild, so it's not like these facilities can augment wild populations. A true sanctuary or refuge should have a strict no breeding or handling policy, and should have education programs dedicated to promoting conservation.

Bottle-feeding at a 'pseudo-sanctuary' in Southern California. Allison Skidmore, Author provided

Ultimately, tigers are big money makers, especially tiger cubs. The Animal Welfare Act allows cub petting from eight to 12 weeks of age. People pay $100 to $700 to pet, bottle-feed, swim with or take a photo with a cub.

None of these profits go toward the conservation of wild tigers, and this small window of opportunity for direct public contact means that exhibitors must continually breed tigers to maintain a constant supply of cubs.

The value of cubs declines significantly after 12 weeks. Where do all these surplus tigers go? Unfortunately, due to a lack of regulatory oversight, it's hard to know.

Since many states don't account for their live tigers, there's also no oversight regarding the reporting and disposal of dead tigers. Wildlife criminologists fear that these tigers can easily end up in the black market where their parts can cumulatively be worth up to $70,000. There's evidence of U.S. captive tigers tied to the domestic black market trade: In 2003, an owner of a tiger "rescue" facility was found to have 90 dead tigers in freezers on his property. And in 2001, an undercover investigation led by the U.S. Fish and Wildlife Service ended up leading to the prosecutions of 16 people for buying, selling and slaughtering 19 tigers.

5. What role does social media play?

Posing with tigers on social media platforms like Instagram and on dating apps has become a huge problem. Not only can it create a health and safety risk for both the human and tiger, but it also fosters a false narrative.

If you see thousands of photos of people with captive tigers, it masks the true problem of endangered tigers in the wild. Some might wonder whether tigers are really so endangered if they're so easy to pose with.

The reality of the wild tiger's plight has become masked behind the pomp and pageantry of social media. This marginalizes meaningful ideas about conservation and the true status of tigers as one of the most endangered big cats.

Allison Skidmore, PhD Candidate in Environmental Studies, University of California, Santa Cruz

This article is republished from The Conversation under a Creative Commons license.

See original here:

"Tiger King" and America's captive tiger problem - Salon

Posted in Polygamy | Comments Off on "Tiger King" and America’s captive tiger problem – Salon

Cryptocurrency Review: Bitcoin, Ether and ‘Digital Gold’ – CoinDesk

Posted: at 7:45 pm

Will bitcoin (BTC) move beyond "digital gold"? Is ether (ETH) viable as money? In 24 charts, CoinDesk Research shows what happened to crypto assets in Q1 2020 and examines what may emerge in the future. Download our Q1 analysis here, and join us on April 15 for a webinar discussing our findings and other relevant cryptocurrency research.

The CoinDesk Quarterly Review provides research-based insights on how the narrative has changed for blue-chips such as bitcoin and ether. We look at which assets outperformed on returns, and how the participants in crypto markets are shifting in the wake of Q1s defining event, the March 12 plunge.

Bitcoins digital gold narrative grew up in a bull market in everything. Bitcoin as gold 2.0, a hedge against inflation and a safe haven in an eventual crash, was a meme investors readily understood.

Now, weve seen an economic crisis cause dislocation in crypto markets and push bitcoins price downward in tandem with stocks. Gold and Treasury bonds appeared to have failed to live up to safe haven expectations. If golds narrative is being debated, do we still know what digital gold means? At the very least, the events of the past month have put to rest the notion that bitcoin today can be a haven.

How March 12 shook crypto markets, and how it didn't

The crash shook participants in crypto markets. Open interest in bitcoin futures and perpetual swaps fell off a cliff in March. These markets are used by traders large and small to speculate on bitcoins price, and as a temporary hedge against positions in the spot market. Futures volume spiked and settled at a higher baseline, as it did in spot markets. The increased activity is taking place in a shrunken market. About $1.6 billion of traders positions were liquidated over two days in March. The sharks are eating each other in a smaller pool, as it were.

At the very least, the events of the past month have put to rest the notion that bitcoin today can be a haven.

Bitcoin's long-term holdings, however, remained unmoved. Hodlwaves use Bitcoin timestamps known as UTXOs to measure how long each bitcoin has been held. Tracking time between transactions is a useful measure of long-term buy-and-hold activity. That activity is consistent with bitcoins use case as digital gold, a putative store-of-value. Note that long-term holdings (180 days or more) did not change perceptibly during the March 12 crash. Balances held between 90 days and 180 days shifted abruptly. Were bitcoin sellers concentrated among three- to six-month holders? Or were exchange balances, which shifted on these dates, concentrated in that band?

Alternative user narratives: Return of payments?

Some of bitcoin's long-term holders are surely hoping in time it will prove itself as a haven or store of value. But events such as the March crash open the door to new narratives. The flagship crypto assets next meme will set the adoption curve for verifiably scarce digital assets. Will payments re-emerge as an avenue to adoption?

Since launch, the number of computers running the Lightning Network has increased on average 53 percent every quarter. Lightning is a layer two payments system built on top of the Bitcoin network. The value held within Lightning payment channels has also increased.

New importance for bitcoin and ethereum technical road maps

It's possible a new user adoption narrative will be something quite different from what long-term investors in bitcoin have contemplated to date. Will Bitcoin developers add capabilities like Schnorr signatures, with their privacy and programmability that lead to its adoption as digital financial infrastructure?

The technical road map emerges from Q1 2020 with increased importance for ethereum, as well. Ether evangelists have spread the meme ETH is money" in the belief that it has potential as the base currency of a decentralized, digital banking system, dubbed decentralized finance" or "DeFi." The failure of flagship DeFi systems during the March 12 crash have raised questions about that narrative. Now more than ever it seems to be dependent on a relatively uncertain road map for ETH 2.0, an improvement designed to allow more transaction throughput.

On March 12, total ETH locked in DeFi applications increased as expected, then crashed amid a crisis in DeFis programmatic governance. If ETH is money," wed expect to see the amount locked in DeFi and the ETH price grow in tandem, long-term. For the near term, a recovery to previous levels would indicate a restoration of confidence in DeFi systems.

The CoinDesk Quarterly Review lays out a Q1 analysis of what happened to crypto assets in the quarter. It begins to examine what will emerge now that the digital gold story has been shaken. Download it here, and join us April 15 for a webinar discussing our findings.

The leader in blockchain news, CoinDesk is a media outlet that strives for the highest journalistic standards and abides by a strict set of editorial policies. CoinDesk is an independent operating subsidiary of Digital Currency Group, which invests in cryptocurrencies and blockchain startups.

Read the original post:
Cryptocurrency Review: Bitcoin, Ether and 'Digital Gold' - CoinDesk

Posted in Cryptocurrency | Comments Off on Cryptocurrency Review: Bitcoin, Ether and ‘Digital Gold’ – CoinDesk

Cryptocurrency Market Update: Bitcoin and gold toying with a massive selloff, is $1,000 in the picture? – FXStreet

Posted: at 7:45 pm

Bitcoin price managed to stay above $7,200 support in the wake of rejection from levels under $7,500. The most traded cryptocurrency has stepped above $7,300 but is currently struggling with the resistance at $7,400. Across the cryptocurrency market, bears appear to be taking over control. All the top three cryptoassets are slightly in the red. Ethereum is trading marginally below the opening value at $173.31 while Ripple is down 0.88% to trade at $0.20.

A cryptocurrency trader and analyst on Twitter Henrik Zeberg is not afraid to openly speak of Bitcoins possible dive to $1,000. Zeberg is choosing to remain bearish in spite of Bitcoin price recovery from levels around $3,864 (reached in March) to highs close to $7,500 (earlier this week). Using the chart below, the trader points out that Bitcoin is vulnerable at $7,200.

Alongside the gold, the worlds most precious metal, Bitcoin is likely to fall into another selloff. Zeberg says that Bitcoin and gold are so misunderstood at this point! We have strong illiquid phase in front of us.

According to the daily chart, Bitcoin upside is limited by the 50-day SMA. Movement above $7,400 (tipping point) could push the price above $7,500. This is likely to shift the focus back to $8,000.

However, in relation to Zebergs bearish prediction, a bearish pennant patent puts Bitcoin in grave danger of breaking down to retest the support at $6,000 or even $5,000.

Meanwhile, short term analysis shows Bitcoin is likely to embrace consolidation as long as the RSI keeps on with the leveling motion between 50 and 60.

Link:
Cryptocurrency Market Update: Bitcoin and gold toying with a massive selloff, is $1,000 in the picture? - FXStreet

Posted in Cryptocurrency | Comments Off on Cryptocurrency Market Update: Bitcoin and gold toying with a massive selloff, is $1,000 in the picture? – FXStreet

What You Need to Know about Cryptocurrency… – Coinspeaker

Posted: at 7:44 pm

Most of the weaknesses of crypto security are attributable to the human factor, particularly a failure to adequately secure personal crypto wallets.

For years, crypto proponents have touted the security of cryptography and blockchain-based digital currencies. These are supposedly extremely difficult to hack. Thats why its puzzling why theres never a shortage of news that involves hacking or theft of Bitcoin and other cryptocurrencies.

In mid-2019 Taiwan-based Binance, the worlds largest cryptocurrency exchange based on transaction volume, admitted that they became the victim of a large scale data breach, which resulted in the loss of over US$40 million worth of cryptocurrency. Binance said that over 7,000 BTC was stolen from the companys hot wallet. Also, in early 2019, the Ethereum Classic blockchain was reportedly compromised.

Cryptocurrency hacking and theft may only be a small part in the cyber threat index, but they are a significant risk worth getting acquainted with. Strategies range from the simple to the sophisticated and large-scale, all of which emphasize the need for cybersecurity mindfulness.

Blockchain unhackability may no longer be a bragging right for cryptocurrency advocates. In January 2019, Coinbases security team observed irregular activities in the Ethereum Classic network, as the alternative currencys history of transactions appeared to be under attack.

A hacker managed to take control of the Ethereum Classic networks computing resources. This enabled the rewriting of the transaction history, which led to double spending of crypto coins. The hack allowed the hacker to steal coins equivalent to $1.1 million.

This attack is dubbed as the 51%, wherein a hacker succeeds in controlling more than half of the computing capacity of a cryptocurrency network (half+1%). Armed with more computing resources than everyone else in the network combined, the hacker gains the ability to tamper with the blockchain.

Once the consensus mechanism is compromised, its difficult to guarantee the integrity of the system. If its any consolation, though, 51% attacks have only worked on smaller cryptocurrencies so far. There were reports of such attacks on Vertcoin, Monacoin, Verge, and Bitcoin Gold, but none on Bitcoin, Bitcoin Cash, Ripple, and other top digital currencies.

This blockchain-defeating hack requires humongous computing power, which has to be at least 51% of the entire cryptocurrency network, hence the name. Multiple superfast computers working together or millions of devices infected by cryptojacking malware would be needed. This tremendous computing power requirement is the reason why 51% attacks have mostly focused on less popular cryptocurrency, since their underlying network of computing resources is correspondingly small.

The attack does not directly snatch coins from wallets. What happens is that the attacker generates an alternative and isolated version of the blockchain. The attacker builds blocks that are not broadcasted (which in normal situations ought to be broadcasted) to other miners. This results in a forkone that is followed by the regular miners and another by the attackers miners.

Eventually, the attacker will take advantage of the isolated alternative blockchain to reverse transactions or enable double spending. This is done by broadcasting the isolated blockchain to the network and, with the superior computing resources, outpace other miners in completing blocks. Since most blockchain-based cryptocurrencies are designed to defer to the rule of the majority, the regular miners are forced to acknowledge the faster, longer, and heavier alternative blockchain version (created by the attackers miners) as correct and switch to it as the new canonical transaction history.

The setting of a new transaction history does not mean that new crypto coins are created out of nothing. Rather, the hack makes it possible to re-use coins that were already spent or transferred to other wallets. In the process, previously confirmed transactions can be reversed or ongoing transactions may be voided to give way to a new transaction history. The latter can mean the loss of coins held by an original owner to recognize a new holder based on the new transaction history.

Hackers messing with blockchains sounds highly alarming. However, 51% and other similar attacks are extremely challenging to undertake, especially when used on the leading digital currencies such as Bitcoin and Ripple. The 51% attack against the Verge blockchain back in April 2018 only succeeded because of a flaw in the Verge blockchain protocol, which made it possible to quickly generate a longer version of the blockchain.

Thats why cybercriminals still turn to the usual attack methods to steal bitcoin and other crypto assets. These attacks usually involve social engineering and malware.

One early example of a social engineering attack on Bitcoin happened in 2013 when 4,100 coins were stolen from the now-defunct digital wallet Input.io. The attacker succeeded in deceiving the sites owner to provide the details needed for a password recovery request via email. The attack has since put Input.io out of commission.

When it comes to the use of malicious software, there are several possible variants. The most popular of which involves a clipboard hijacker or a malware that copies the information stored in the clipboard when someone copies something. Hackers take advantage of the natural instinct of most cryptocurrency owners to do the copy-paste combo when inputting their private keys to set up their online crypto wallets.

Attackers may also employ screenshot takers and keyloggers to steal login credentials and access online wallets. There are also those that use compromised crypto-trading add-ons written in JavaScript. Moreover, attackers may also use slack bots, which send fake notifications about nonexistent wallet issues in an attempt to convince the target to enter their private keys.

These crude attacks may not be as advanced direct assaults on blockchains, but they work because of the human factor in security weakness. Many still fail to use strong passwords, two-factor authentication, and other security measures. Others continue frequenting unsafe websites, exposing themselves to various kinds of malware.

Cryptocurrency security is far from perfect. However, security issues are not enough to discourage the use and further development of this new class of digital assets. Most of the weaknesses of crypto security are attributable to the human factor, particularly a failure to adequately secure personal crypto wallets. Yes, Bitcoin and other cryptos are hackable, but this is not reason enough to ditch the idea of decentralized currency.

Having obtained a diploma in Intercultural Communication, Julia continued her studies taking a Masters degree in Economics and Management. Becoming captured by innovative technologies, Julia turned passionate about exploring emerging techs believing in their ability to transform all spheres of our life.

You have successfully joined our subscriber list.

Read more here:
What You Need to Know about Cryptocurrency... - Coinspeaker

Posted in Cryptocurrency | Comments Off on What You Need to Know about Cryptocurrency… – Coinspeaker

Cryptocurrency Market Update: Bitcoin Cash rallies ahead of halving, Bitcoin stable above $7,200, ETH and XRP in the green – FXStreet

Posted: at 7:44 pm

The cryptocurrency market is being treated to a couple of halving events this week. Bitcoin Cash and its rival sibling Bitcoin SV will both undergo a mining reward halving. Halving is an event that reduces the reward miners get per block of coins mined. Bitcoin Cash halving is its first since it hard forked from Bitcoin in 2017. It is scheduled to take place on Wednesday and will have mining rewards slashed in half from 12.5 BCH to 6.25 BCH. On the other hand, Bitcoin SV halving will take place a proximately a day after that of BCH.

BCH/USD has surged 8% on the day as investors take their positions ahead of the mining. It is exchanging hands at $274 after advancing from $252 (opening value). An intraday high has been reached at $280. However, buyers eye $300 while riding on the speculation surrounding the halving event.

Bitcoin price has made a considerable movement above $7,000 this week. The price stepped above $7,400 on Tuesday but lost steam short of $7,500. At the time of writing, BTC is trading at $7,330 following an intraday growth of 1.77%. Immediate support has been established above $7,200, further cementing the buyers position on the market as they look forward to testing the level at $8,000.

Ethereum has also been in a bullish phase this week. The price action took a positive turn on breaking above $140. The rally above $160 9 (former resistance) allowed the improved sentiments towards Ether to improve. This catapulted Ethereum to test $180 resistance. For now, the price trading at $171 after adding 3.91% to its value on the day.

Ripple price is trading 3.77% higher on the day. The price movement has been bullish from the opening value at $0.1928 to $0.2001 (market value). The step above $0.20 is key to the next rally eyeing $0.30. Therefore, it is essential that bulls find support above this level and shift their focus to $0.30.

Read more from the original source:
Cryptocurrency Market Update: Bitcoin Cash rallies ahead of halving, Bitcoin stable above $7,200, ETH and XRP in the green - FXStreet

Posted in Cryptocurrency | Comments Off on Cryptocurrency Market Update: Bitcoin Cash rallies ahead of halving, Bitcoin stable above $7,200, ETH and XRP in the green – FXStreet

Cryptocurrency is a Curse on the Indian Reserve Bank – Programming Insider

Posted: at 7:44 pm

Introduction

India is known as a country that embraces all the new technologies and for the first time, India failed to embrace the new technology of bitcoins. Specially bitcoins are very helpful when you think to trade online from anywhere on earth. As the other best parts like easily transferable and could be sent anywhere on earth, this coin is extra money for you.Internet Users are Increasing

A large number of people are gradually moving into the digital world or the world of the internet very quickly. As of now, it can be said that there are about 480 million internet users in India which are growing rapidly and soon it is expected to rise as high as 660 million internet users. This number of users have been given to be increasing by 2023, magically dragging more people to the digital world. This is really good news for bitcoin trading applications because the greater number of people will use the internet will be able to use bitcoins for a better purpose. As per experts and the bitcoiners, India is a much stronger fertile ground for the use of bitcoins.

Digital Population for the Younger Generation

A concept-driven technology is a cryptocurrency or a bitcoin concept. This concept of cryptocurrencies is most appealing to the young population of India. India has the largest number of people below 35 years of age which covers like 65% of the people while 55% of the citizens are below 25 years. The average age of an Indian is somewhat around 29-30. On average, if we calculate more than 870 million it below 30 years old. It makes one thing clear that most of the Indians should use crypto to have some great time earning money.

The IT Sector is Enough

India has the required intellect to grow the best base for an intellectual industry strongly on the earth. Luckily India has an abundance of access to the crypto concept, but it is a different story that they do not want to use it. India has the miserably high number of Computer Engineers and plenty of people who are fresh graduates they join the software industry PR the IT sectors every year. Not only that the graduates are interested, in fact, but some of the best and well-known companies are also in India such as Wipro, TCS, and HCL, Infosys, etc. Some of the Indian cities like Pune, Hyderabad, and Bangalore are house to the best IT sectors and Software shades in India which are known globally. This also proves that the crypto world can work in India very easily without brining much difficulty on the way to deal with it.

India always had and still has everything that is required to have a great crypto trade in the market but somehow, it has failed to accept the concept gladly and it still considers it to be a crime. There are many reasons that have led to the ban on usage of the cryptocurrency but the major setback has been brought by the RBI.

RBI is a Curse on Cryptocurrencies in India

The finance regulatory body of India is the RBI who is solely responsible for the banning of the use of cryptocurrency in India. As soon as the RBI banned cryptocurrency in India, the roots of Cryptocurrency began to freeze brick by brick in India.

Conclusion

The Coronavirus that affected the entire world has also added some disappointment for the ones who deal with cryptocurrencies. The crypto-community is India has been left open mouth for the kind of a disappointment that they are facing from the government as well as the pandemic.

Read more from the original source:
Cryptocurrency is a Curse on the Indian Reserve Bank - Programming Insider

Posted in Cryptocurrency | Comments Off on Cryptocurrency is a Curse on the Indian Reserve Bank – Programming Insider

SC Verdict On Lifting Cryptocurrency Ban In India May Be Misinterpreted, And We May See The Ban Reinstated – Analytics India Magazine

Posted: at 7:44 pm

According to experts, the Supreme Courts recent verdict on setting aside RBIs circular on banking ban should not be interpreted as the legalisation of cryptocurrency trade in India.

On April 5, 2018, Reserve Bank of India had issued a few advisory guidelines concerning cryptocurrency activities in India under a circular titled Statement on Developmental and Regulatory Policies.

Paragraph 13 of the circular asked entities governed by RBI not to deal with or give services to any person or business organizations dealing with or transacting in virtual currencies. Additionally, it also asked these entities to end such ties if any. As per RBI, the circular was issued in the public interest.

This circular was challenged by the chief petitioner Internet And Mobile Association Of India in the court of law. On March 4, 2020, the Supreme Court of India delivered a historical judgment.

As per popular interpretation of the verdict, it signalled the legitimacy of virtual currencies in India; that is, the Supreme court had lifted the ban on virtual currencies, and thus, trading in virtual currencies was now legal. The petitioners had been entitled to supersede, and the challenged circular issued on April 6, 2018, was subject to be taken down, as per the Supreme Court.

Though the Supreme Court of India upheld the plea for striking down the applicability of the circular, the order pronounced by the bench consisting of Justice Rohinton Fali Nariman, Aniruddha Bose and V. Ramasubramanian, may need careful evaluation for better understanding of the judgement.

The arguments in support of petitioners were on Article 19(1) (g). The denial of banking access to a profession not prohibited under the Indian law was deemed a violation of Article 19(1) (g) of the Constitution of India (which provides the right to practice any legal profession).

The petitioners also argued that the power contained in the circular lied outside the powers of the RBI, but the Apex Court negated that argument. The Supreme Court held that anything that may act a threat to or have an impact on the financial system of India should be regulated or prohibited by RBI, despite the said activity not constituting part of the credit system or payment system of the country.

In its judgement, the court observed, It is no doubt true that the Reserve Bank Of India has pervasive powers not only in view of the statutory design but also in view of the special status and role that it possesses in the economy of India. These powers can be applied both in the form of preventive as well as curative measures.

The court was convinced about wide powers of RBI and issuance of the circulars as preventive measures for the betterment of Indian financial scenario, but as the circular could not pass the test of proportionality, the circulars were smacked down. So, it should not be seen as the Supreme Court has lifted the ban on cryptocurrency in India, or that cryptocurrency trading is official in India as many of us are construing this decision, said Advocate Dr Mahendra Limaye, who heads cyber law firm- Mahendra Limaye Associates.

The Supreme court stated RBI did not show any empirical data highlighting the damage caused by cryptocurrency exchanges on the entities regulated by RBI, which is a significant reason that petitioners were able to win. Given that official ban on cryptocurrency still not exist India, RBIs ban on banking support for crypto firms remained unjustified on the grounds of proportionality.

The availability of power is distinct from the manner and extent to which it can be exercised by RBI. To test the proportionality of banking ban, it required RBI to present at least some semblance of any damage endured by its regulated entities. But there is none, the Supreme Court stated.

So, the overturn of the circular does not mean cryptocurrencies are legal in India or that crypto exchanges will be permanently allowed to function, according to experts.

Given RBI will further challenge the verdict to prove the alleged risk that cryptocurrencies pose to the banking system, the banking ban could be reinstated later. Plus, we know that an Inter-Ministerial Committee proposed in February 2019 a blanket ban on cryptocurrencies.

Known asBanning of Cryptocurrency and Regulation of Official Digital Currency Act,the draft bill is yet to be presented in front of the legislature. If passed, it could make buying, selling, mining, and even holding of cryptocurrency a punishable offence. So, have we interpreted the recent verdict by the Supreme Court wrongly?

Dr Limaye says, In my views, the mainstream interpretation of the verdict is wrong. The petitioners received the benefit of doubt and lassitude from governments part also played an imperative role in tiling the balance in favour of petitioners. The Apex Court has accepted the powers of RBI to issue circulars in Public Interest. There was no blanket order banning Virtual Currency and diametrically opposite views by the Central government regarding virtual currencies, and it let down the populous move of RBI banning VC exchanges from banking exposures.

What is essential to note, is that all petitions are filed against the Reserve Bank Of India, and not the Finance Ministry draft ban bill. The verdict remains only short-term relief as the verdict against the RBI does not impact activities on the policy level, also wrote Tanvi Ratna, a technology consultant and CEO of Policy 4.0 in herblog.

The verdict had been welcomed and celebrated by professionals in the crypto industrymultiple exchanges like Unocoin, Wazirx and CoinDCX started INR deposit services soon after.

The announcement also was followed by multiple investment announcements in cryptocurrency-related startups. This included Binance, Aeternity and HashCash investing in the countrys blockchain and cryptocurrency economy in 2020.

The cryptocurrency ecosystem in India saw a revival of fiat liquidity and resurgence of fiat-based trading at exchanges and as well as investments in startups. But, is this festive mood going to be a short-lived affair if Banning of Cryptocurrency and Regulation of Official Digital Currency Act is passed?

The verdict of the Supreme Court solely addresses the Reserve Bank of India circular. The Supreme Court is very unlikely to issue any action against the Finance Ministry, and impact their view on the subject, according to Tanvi Ratna.

Experts believe the Supreme Court seemingly gave a verdict in favour of the cryptocurrency industry as there is no such law yet in India which bans cutting banking support for exchanges. This means the judgment would not hold once there is such anti-crypto regulation is in place.

In the entire judgement, the Supreme Court never uttered a single word about legitimacy or genuineness of virtual currencies or about exchanges trading such virtual currencies. But SC only decided that the activities of petitioner exchanges, trading in virtual currency were not declared unlawful. Hence, their bank accounts could not be debit frozen by the banks citing the challenged RBI Circular, said Dr Mahendra Limaye.

Also Read: How Lifting Crypto Ban In India Will Accelerate Jobs And Blockchain Startups

comments

Excerpt from:
SC Verdict On Lifting Cryptocurrency Ban In India May Be Misinterpreted, And We May See The Ban Reinstated - Analytics India Magazine

Posted in Cryptocurrency | Comments Off on SC Verdict On Lifting Cryptocurrency Ban In India May Be Misinterpreted, And We May See The Ban Reinstated – Analytics India Magazine