Category Archives: News

image_pdfimage_print
Articles, Digital Security

What is Juice Jacking and How to Avoid It?

Posted on by FMTAD
what is juice jacking and how to avoid it
06
May

Juice Jacking by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.  

How to protect yourself from Juice Jacking”

Do you often use public USB chargers to recharge your smartphone or tablet? If so, you may be exposing your device to a cyberattack called Juice Jacking. In this article, we will explain what Juice Jacking is and how to protect yourself from it.

Why Encrypt SMS? NFC card protecting encrypted SMS communications from espionage and corruption on Android NFC phone.

2024 Digital Security

Why Encrypt SMS? FBI and CISA Recommendations
December 16, 2024
French Minister at G7 holding a hacked smartphone, with a Bahraini minister warning him about a cyberattack.

2024 Digital Security

French Minister Phone Hack: Jean-Noël Barrot’s G7 Breach
December 6, 2024
Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024

Juice Jacking: How to Avoid This Cyberattack

Do you often use public USB chargers to recharge your smartphone or tablet? If so, you may be exposing your device to a cyberattack called Juice Jacking. This is a type of attack that can steal your data or infect your device when you use a public USB charger. In this article, we will explain what Juice Jacking is and how to protect yourself from it.

What is Juice Jacking?

Juice Jacking is an attack that hackers can perform. They put malware on the public charger’s USB port. When you plug your device into the charger, the malware can access your data or infect your device.

Juice Jacking can take two forms:

  • Data theft: the malware can copy your contacts, photos, messages, passwords or any other sensitive information stored on your device.
  • Malware installation: the malware can install a program that will do malicious things to your device.

The Lack of Awareness and Protection of Juice Jacking Among Users Worldwide

One of the reasons why juice jacking is a serious threat is that many people are unaware of it or do not take precautions when using public USB ports. According to a 2019 study by the University of Illinois at Urbana-Champaign, 64% of Americans use public USB ports to charge their devices, and 15% of them do not know what juice jacking is. The study also found that only 8% of the participants used a USB data blocker or a power-only cable to protect their devices from potential attacks. A similar situation exists in other countries, such as the United Kingdom and Australia. A 2020 study by Comparitech surveyed more than 2,000 people in the UK and found that 45% of them used public USB ports to charge their devices, and 50% of them had never heard of juice jacking. A 2019 study by Finder analyzed the behavior of more than 1,000 people in Australia and found that 41% of them used public USB ports at least once a month, and 21% of them did not know what juice jacking was. These studies show that there is a need for more education and awareness on the risks and prevention of juice jacking.

How to prevent Juice Jacking?

To prevent Juice Jacking, don’t use public USB chargers. Instead, you can use your own charger or a portable battery. However, if you have no choice but to use a public charger, you can take some precautions:

  • Use a USB data blocker. This is a device that blocks the data transfer between the charger and your device. It only allows the power to pass through.
  • Turn off your device before plugging it into the charger. This may reduce the risk of data theft or infection.
  • Use a VPN app on your device. This can encrypt your data and make it harder for hackers to access it.

How to protect yourself from Juice Jacking with EviCore NFC HSM and EviCypher Technology

Juice Jacking is a cyberattack that steals or modifies your data through malicious USB chargers. You need a secure and portable encryption solution to protect yourself from this threat. EviCore NFC HSM and EviCypher technology can help you.

EviCore NFC HSM is a contactless hardware security module (HSM). It stores your sensitive data and protects it with configurable multi-factor authentication. You can access your data with your smartphone via NFC (Near Field Communication).

EviCypher is a hardware encryption device that works with EviCore NFC HSM. It encrypts and decrypts your documents, emails and messages with your smartphone. You can use it with any messaging service and enjoy an advanced electronic signature system.

With EviCore NFC HSM and EviCypher, you can avoid hackers who use malicious USB chargers. Your data are safe and secure offline, without any server or database. To learn more about this innovative technology, visit the website EviCore NFC HSM by Freemindtronic.

EviCore NFC HSM and EviCypher are products and services from Freemindtronic. Freemindtronic is a company specialized in NFC security solutions. It offers the best encryption products on the market.

A more technical explanation by ethical hackers

The Juice Jacking is a cyberattack that exploits the vulnerability of the USB ports that are used for both charging and data transfer. Ethical hackers, who are security professionals who use their skills for good, have demonstrated how this attack works and how to prevent it.

One of the first demonstrations of Juice Jacking was made by researchers from the University of Michigan in 2011 at the DEF CON hacker convention. They set up an informative kiosk on Juice Jacking to raise awareness among visitors about the danger of plugging their devices into public charging stations. When a visitor plugged in their phone, the screen turned red and displayed a warning message: “You should not trust public kiosks with your smart phoneYou should not trust public kiosks with your smart phoneYou should not trust public kiosks with your smart phone”.

The researchers also showed how malicious actors could use the kiosk to steal data, track devices, or compromise them. They also provided information on how to compromise charging kiosks.

Another demonstration was made by security researchersecurity researcher Kyle Osborn in 2012. He published an attack framework called P2P-ADB that uses a USB On-The-Go cable to connect an attacker’s phone to a victim’s device. The framework includes examples and proofs of concept that would allow hackers to unlock locked phones, steal data from a phone, including authentication keys that would allow the attacker to access the owner’s Google account.

In 2013, security researchers from Georgia Tech published a proof of concept of a malicious tool called Mactans that uses the USB charging port of an Apple mobile device. They used low-cost hardware components to build a small malicious wall charger that can inject malware into an iPhone running

In 2014, security researchers Karsten Nohl and Jakob Lell from srlabs published their research on the BadUSB attack at the Black Hat USA conference . They showed how hackers can reprogram USB devices such as flash drives or cables to act as keyboards or network cards and send commands or data to a connected device.

These demonstrations show how Juice Jacking can be performed by skilled hackers who have access to the USB ports or cables in public places. They also show how users can protect themselves by using their own chargers or batteries, using data blockers, turning off their devices, or using VPN apps.

Some examples and testimonials

Juice Jacking is a serious threat for users of public USB chargers. It can compromise your data and your device’s security. Here are some examples and testimonials that illustrate the risks of Juice Jacking:

  • In 2011, at the DEF CON hacker convention, an informative kiosk on Juice Jacking was set up to raise awareness among visitors about the danger of plugging their devices into public charging stations . When a visitor plugged in their phone, the screen turned red and displayed a warning message: “You should not trust public kiosks with your smart phone” .
  • In 2013, security researchers from Georgia Tech presented a proof of concept of a malicious wall charger that could inject malware into an iPhone running the latest version of iOS while it was being charged. The malware bypasses all the built-in security measures in iOS and hides itself in the same way that Apple hides background processes in iOS .
  • In 2019, the Los Angeles County District Attorney warned travelers about Juice Jacking in airports. He advised travelers to use electrical outlets rather than USB ports to charge their devices.
  • In 2020, a French journalist testified that she was a victim of Juice Jacking during a trip to India. She said that her phone was infected by malware after plugging it into a USB port in a hotel. The malware sent her messages asking her to pay a ransom to get her data back.

To illustrate the phenomenon of Juice Jacking further, you can also check out these videos:

  • A video explanation from ZDNet that presents Juice Jacking and its consequences.
  • A video demonstration from ETX Studio that shows how to protect yourself from Juice Jacking with a USB data blocker.
  • A video information from Slate that explains why you should not be afraid of Juice Jacking and how it is unlikely to happen.

Some scientific and statistical sources

Juice Jacking is a topic that interests security researchers and public authorities. Here are some scientific and statistical sources that address Juice Jacking:

  • An academic paper published in 2011 by researchers from the University of Michigan that analyzes the risks associated with using public USB ports and proposes solutions to reduce them.
  • A technical report published in 2014 by researchers from Johns Hopkins University that describes a method to detect and prevent Juice Jacking on Android devices.
  • A study conducted in 2017 by Kaspersky Lab that reveals that 25% of French users have already used a public USB charger and that 12% of them have already suffered a loss or theft of data as a result of such use.

Conclusion

Juice Jacking is a cyberattack that targets users of public USB chargers. It can compromise your data and your device’s security. To avoid it, you should use your own charger or battery whenever possible. If you have to use a public charger, you should use a USB data blocker, turn off your device, or use a VPN app.

We hope this article helped you understand what Juice Jacking is and how to protect yourself from it.

2023, Articles, Cyberculture, Digital Security, Technical News

Strong Passwords in the Quantum Computing Era

Posted on by FMTAD
Strong Passwords in the Quantum Computing
05
May

Strong Passwords by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.  

How to Protect Your Passwords from Quantum Computers Introduction

Do you know that quantum computers could break your passwords in seconds? This could expose your personal and financial data to hackers. To prevent this, you need to create strong passwords that can resist quantum attacks. In this article, you will learn how to do it easily and effectively.

Why Encrypt SMS? NFC card protecting encrypted SMS communications from espionage and corruption on Android NFC phone.

2024 Digital Security

Why Encrypt SMS? FBI and CISA Recommendations
December 16, 2024
French Minister at G7 holding a hacked smartphone, with a Bahraini minister warning him about a cyberattack.

2024 Digital Security

French Minister Phone Hack: Jean-Noël Barrot’s G7 Breach
December 6, 2024
Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024

How to create strong passwords in the era of quantum computing?

Quantum computing is a technology that promises to revolutionize the field of computation by exploiting the properties of subatomic particles. It offers unprecedented possibilities for scientific research, artificial intelligence or cryptography. But it also represents a risk for the security of data and online communications. Indeed, quantum computers could be able to crack the secret codes that protect our passwords, our bank accounts or our private messages.

What is quantum computing? What is encryption? What is a brute force attack?How to protect ourselves from this threat? The answer is simple: create strong passwords and resist quantum attacks. But what is a strong password? And how to choose it? Here are some tips to help you strengthen your digital security in the era of quantum computing.

What is quantum computing and how does it work in video?

What is a strong password?

A strong password is a password that is hard to guess or crack by a hacker. It must be composed of at least 12 characters, mix uppercase and lowercase letters, numbers and symbols, and not contain dictionary words, proper names or personal data. For example, “P@ssw0rd123” is not a strong password, because it is too short, too simple and too common. On the other hand, “Qx7!tZ9#rGm4” is a strong password, because it is long, complex and random.

Why is a strong password important?

A strong password is important because it reduces the risk that your account will be hacked by a brute force attack. A brute force attack consists of testing all possible combinations of characters until finding the right password. The longer and more complex the password, the more possible combinations there are, and the more time and resources it takes to crack it.

For example, a password of 8 characters composed only of lowercase letters has about 200 billion (26^8) possible combinations. A classical computer can crack it in a few minutes. But a password of 20 characters composed of letters, numbers and symbols has about 10^39 (95^20) possible combinations. A classical computer would need 766 trillion years to crack it.

But what about quantum computers?

Quantum computers are able to perform calculations much faster and more powerful than classical computers thanks to their ability to manipulate qubits instead of bits. A qubit can take two states simultaneously (0 and 1), which allows it to explore multiple solutions at the same time. Thus, a quantum computer could theoretically crack a password by testing all possible combinations in parallel.

However, there are technical and practical limits to this ability. First, you need to have a quantum computer powerful and stable enough to perform this type of operation. However, current quantum computers are still very rudimentary and only have a limited number of qubits. Second, you need to know the type of encryption used to protect the password. However, there are encryption algorithms that are resistant to quantum attacks, such as symmetric encryption or elliptic curve encryption. Third, you need to have access to the system that stores the password. However, there are security measures that prevent unauthorized access, such as two-factor authentication or account locking after several unsuccessful attempts.

Thus, even if quantum computers represent a potential threat for the security of passwords, they are not yet able to crack them easily. Nevertheless, it is prudent to prepare for the advent of this technology by creating strong passwords and changing them regularly.

How to choose a strong password?

To choose a strong password, there are several methods. Here are some examples:

  • The Diceware method: it consists of randomly choosing several words from a predefined list and separating them by spaces or symbols. For example, “piano cat star 7 &”. This method allows you to create passwords that are easy to remember and hard to crack.
  • The XKCD method: it consists of choosing four random words and assembling them without space. For example, “correcthorsebatterystaple”. This method is inspired by a comic from the XKCD site that shows that this type of password is safer than a complex but short password.

The random generator method: it consists of using an online tool that creates a random password composed of letters, numbers and symbols. For example, “Qx7!tZ9#rGm4”. This is the method implemented in the evicore nfc and evicore hsm technology from Freemindtronic, which features a random password generator with Shannon entropy control. This technology also automatically calculates the number of bits of the generated password based on the type of printable ASCII 95 characters used. This method allows you to create very secure passwords but difficult or impossible to remember, which requires the use of a hardware or virtual password manager. Whatever the method chosen, it is important to follow some rules:

  • Do not use the same password for multiple accounts or services.
  • Do not write the password on a paper or store it on an insecure device.
  • Do not share the password with other people or communicate it by email or phone.
  • Do not use obvious clues or security questions to recover the password in case of forgetfulness.
  • Use a password manager to store and manage your passwords securely.

Tools for creating and protecting strong passwords

If you want to create and protect strong passwords in the age of quantum computing, you can use some of these online tools to help you:

  • Online password generator: A tool that creates a random and strong password composed of letters, numbers and symbols. For example, Mot de passe.xyz is a free and secure online password generator that lets you choose the length and types of characters for your password.
  • Password strength calculator: A tool that calculates the entropy (the number of bits) of a password based on its length and the number of possible characters. For example, Password Entropy Calculator is a free online tool that shows you how strong your password is and how long it would take to crack it.
  • Data breach checker: A tool that checks if your email or phone number has been exposed in a data breach. For example, Have I Been Pwned? is a free online service that lets you check if your personal information has been compromised by hackers.

Using these tools can help you create and protect strong passwords that are resistant to quantum attacks. However, you should also remember to use different passwords for different accounts, change them regularly, and use a password manager to store them safely.

In conclusion

Passwords are essential to protect our privacy and our data online. Faced with the potential threat of quantum computers, it is important to create strong passwords and resist quantum attacks. To do this, we need to choose passwords that are long and complex, change them regularly and manage them with caution. Thus, we will be able to enjoy the benefits of quantum computing without fearing for our digital security.

Articles, Phishing

Protect Your Data from AMOS Malware

Posted on by FMTAD
AMOS malware protection with Keepser NFC Cold Xallet
04
May


AMOS Malware Protection by Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Related topic : CryptBot malware

Protect Your Mac from AMOS Malware

Are you worried about the threat of AMOS malware on your Mac? Keep your data safe with Keepser Cold Wallet. Learn how this technology can protect your sensitive information from this dangerous malware.

White background image illustrating the ePrivacy Regulation with a secure lock symbol, digital icons for encryption and consent, and the European Union flag subtly integrated.

2024 Cyberculture Legal information

ePrivacy Regulation: Transforming Messaging Privacy in 2025
November 26, 2024
Laptop and smartphone displaying 2FA MFA security features with OATH initiative, key management solutions for 2024.

2024 Articles Technical News

Best 2FA MFA Solutions for 2024: Focus on TOTP & HOTP
October 8, 2024
Flags of France and the European Union on a white background representing ANSSI cryptography authorization

2024 Articles Cyberculture Legal information

ANSSI Cryptography Authorization: Complete Declaration Guide
October 7, 2024
laptop displaying Microsoft Uninstallable Recall feature, highlighting TPM-secured data and uninstall option, with a user's hand interacting, on a white background.

2024 Articles Technical News

New Microsoft Uninstallable Recall: Enhanced Security at Its Core
October 3, 2024
Ultra-realistic image illustrating Andorra's shared EAN code with Spain, featuring a barcode starting with 84 and a map connecting Andorra and Spain.

2024 Articles Cyberculture

EAN Code Andorra: Why It Shares Spain’s 84 Code
September 9, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Balance scale showing the balance between privacy and law enforcement in EU regulation of end-to-end encrypted messaging.

2024 Articles Cyberculture legal Legal information News

End-to-End Messaging Encryption Regulation – A European Issue
June 10, 2024
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking
March 25, 2024

AMOS Malware Protection with Keepser Cold Wallet

The Threat of AMOS Malware on macOS

AMOS malware is a growing threat to macOS users. Hackers are marketing a new malware for the macOS operating system. Named Atomic Macos Stealer or AMOS, this malicious software is designed to steal user data for $1,000 per month. It extracts passwords from the keychain, steals files on disks, cookies, as well as cards and identification information stored in the browser and tries to extract data from 50 different cryptocurrency wallets. Buyers also benefit from a complete web dashboard to brute force MetaMask.

How AMOS Malware Works

AMOS is capable of accessing iCloud keychain passwords, system information, files from the desktop and documents folder, as well as the Mac password. It is able to infiltrate applications such as Chrome and Firefox and extract autofill information, passwords, cookies, wallets and credit card information. Cryptocurrency wallets such as Electrum, Binance and Atomic are specific targets.

The malware is being propagated using an unsigned disk image file called Setup.dmg. Once executed, the file prompts the victim to enter their system password on a bogus prompt. This allows the malware to escalate privileges and carry out its malicious activities. This technique is similar to that used by other macOS malware, such as MacStealer.

How to Protect Against AMOS Malware

The increase in the deployment of macOS stealer malware by non-state actors highlights the need for users to be cautious when downloading and installing software. The cybersecurity industry recommends that users only download and install software from trustworthy sources, enable two-factor authentication, review app permissions, and refrain from opening suspicious links received via email or SMS messages.

The Solution: Keepser Cold Wallet with EviVault Technology

However, there is a solution to protect your sensitive data against AMOS malware. For only €387, you can purchase two NFC Cold Wallet Keepser from Keepser Group with EviVault technology from Freemindtronic SL. These wallets allow you to store offline and physically externalized from macOS and/or PC computers the private keys and/or seed phrases of cryptocurrency wallets as well as identifier and password pairs. Thus, it will simply be impossible to extract sensitive data from a computer that is not physically present in these computers, even for this AMOS malware.

By using EviVault NFC Cold Wallet technologies from Freemindtronic embedded in Keepser products, you can protect your sensitive data against malware attacks such as AMOS or Cryptbot. These wallets also work on macOS, providing additional protection to Mac users.

The Benefits of EviVault Technology

Thanks to EviVault technology developed by Freemindtronic, the Keepser Cold Wallet is a unique ultra-secure cold storage solution for cryptocurrency wallets, offering anonymous, offline and contactless use via NFC technology, as well as compatibility with NFC Android phones and computer systems via a browser extension.

It’s like they say: “Why pay €1,000 per month to steal sensitive data when you can pay €387 one shot for AMOS malware protection without subscription to protect against it (and other malware like Cryptbot)!” 😉

It is important to take seriously the threats posed by malware such as AMOS and to take the necessary measures to protect your sensitive data. By using advanced technologies such as EviVault NFC Cold Wallet from Freemindtronic embedded in Keepser products, you can ensure that your data is secure.

Articles, EviVault Technology, Phishing

Cryptbot malware steals data cryptocurrencies

Posted on by FMTAD
CryptBot: the malware that targets your data and crypto on Chrome
01
May
CryptBot malware By Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Article updated on May 3, 2023
Related topic : Amos malware
 

CryptBot: A Threat to Chrome Users

Cryptbot is a malware that targets Chrome users who store or trade cryptocurrencies. It can steal your data and virtual wallets. Google says it infected 670,000 people in 2022. This article tells you how Cryptbot works, how to detect and remove it, and how to prevent future attacks.

Digital world map showing cyberattack paths with Midnight Blizzard, Microsoft, HPE logos, email symbols, and password spray illustrations.

2024 DataShielder Digital Security PassCypher Phishing

Midnight Blizzard Cyberattack Against Microsoft and HPE: What are the consequences?
March 10, 2024
google account security flaw how to protect yourself from hackers digital artwork that conveys the concept of a security breach in online services due to persistent cookies attacks

2024 Articles Digital Security News Phishing

Google OAuth2 security flaw: How to Protect Yourself from Hackers
January 8, 2024
Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers

Articles Crypto Currency Cryptocurrency Digital Security EviPass Technology NFC HSM technology Phishing

Ledger Security Breaches from 2017 to 2023: How to Protect Yourself from Hackers
December 16, 2023
BITB attacks Browser-In-The-Browser remove delete destroy by IRDR Ifram Redirect Detection Removal since EviCypher freeware web extension open-source from Freemindtronic in Andorra

2023 Digital Security Phishing

BITB Attacks: How to Avoid Phishing by iFrame
May 10, 2023
Snake malware: The Russian that steals sensitive information for 20 years

Articles Digital Security Phishing

Snake Malware: The Russian Spy Tool
May 10, 2023
ViperSoftX How to avoid the malware that steals your passwords

Articles Cryptocurrency Digital Security Phishing

ViperSoftX How to avoid the malware that steals your passwords
May 7, 2023
AMOS malware protection with Keepser NFC Cold Xallet

Articles Phishing

Protect Your Data from AMOS Malware
May 4, 2023
CryptBot: the malware that targets your data and crypto on Chrome

Articles EviVault Technology Phishing

Cryptbot malware steals data cryptocurrencies
May 1, 2023

Understanding Cryptbot Malware: A Comprehensive Guide to the Threats and Risks

Cryptbot malware is a serious concern for Chrome users, as it surreptitiously steals their confidential information and digital currencies by hiding in malicious extensions that are installed in the browser without their knowledge. Once installed, it can compromise sensitive information such as passwords, banking logins, private keys of cryptocurrencies and browsing history. Moreover, Cryptbot malware can add malicious code in the web pages to misappropriate cryptocurrencies from the users’ wallets or exchanges. Hence, the security threat posed by this malware is severe and requires immediate attention.

Cryptbot Malware: How it Steals Sensitive Data, Including Cryptocurrency Wallets, from Chrome Users

This type of Trojan malware was first detected in December 2019 and is known for disguising itself as authentic software such as Google Chrome or Google Earth Pro and can be downloaded from counterfeit websites. Upon download and installation, the computer gets infected with Cryptbot along with another Trojan, Vidar, both of which are created to identify and steal sensitive data of Chrome users like:

  • Username and password that are saved in Chrome browser
  • Browser cookies that may contain session or preference information
  • Cryptocurrency wallet data, like Ethereum or Bitcoin
  • Credit card information saved in the browser
  • Desktop or window screenshots

The data that is collected can often be sold to other hackers who may use it for extortion campaigns or data breaches. Moreover, this malware is capable of taking screenshots of active windows or desktop, exposing even more confidential information. Therefore, Cryptbot malware endangers your privacy and security while putting online accounts, identity, money and personal safety at risk. It may also lead to further malware infections or phishing attempts. Hence, safeguarding against Cryptbot malware is essential, and it should be removed if detected.

CryptBot Malware: How It Spreads Through Fraudulent Websites and Phishing Campaigns, and Its Command and Control Server

CryptBot mainly spreads through fraudulent websites that offer modified or pirated versions of legitimate software such as Google Chrome or Google Earth Pro. These websites encourage users to download and run malicious files, which then install CryptBot on their computer.

This malware can also be distributed through phishing campaigns, which involve sending misleading emails to users, impersonating trusted entities such as Google or Microsoft. These emails often contain links or attachments infected.

Once installed on the victim’s computer, CryptBot connects to a command and control (C&C) server, which gives it instructions on the data to collect and send. CryptBot can automatically update itself to avoid detection and stay hidden on the victim’s computer.

Removing CryptBot Malware from Chrome

If you suspect that your Chrome browser is infected with CryptBot malware, you should take immediate action to remove it. Here are some steps you can follow to detect and remove CryptBot:

  • Suspicious Extension Check: Open Chrome and click on the three dots icon on the top right corner. Go to More Tools > Extensions and look for any suspicious extensions that you do not recognize or do not remember installing. Remove them by clicking on the Remove button.
  • Anti-Malware Software Use: Download and install a reputable anti-malware software such as Malwarebytes or Norton. Run a full system scan to detect and remove CryptBot malware from your computer.
  • Chrome Settings Reset: Go to Chrome Settings > Advanced > Reset and clean up > Restore settings to their original defaults. This will reset your browser settings to their default state and remove any unwanted changes made by CryptBot.
  • Password Change: If CryptBot has stolen your passwords, you should change them immediately for all affected accounts.

Detecting CryptBot Malware on Your Computer

It is not always easy to detect the presence of CryptBot on your computer, as it is a discreet and silent malware. However, there are some signs that can alert you:

  • Your computer becomes slower or more unstable
  • Your Chrome browser displays unwanted ads or redirects you to suspicious websites
  • You receive security alerts or password reset requests from your online accounts
  • You notice unusual or unauthorized transactions on your bank accounts or cryptocurrency wallets

If you notice any of these symptoms, it is possible that you are infected by CryptBot. In this case, it is recommended to scan your computer with a reliable and up-to-date antivirus, such as Bitdefender or Malwarebytes. If the scan detects the presence of CryptBot or other threats, follow the instructions to remove them.

Tips for Avoiding CryptBot Malware on Chrome

Best Practices for Computer Security

To avoid being infected by CryptBot malware on Chrome, it is recommended to follow these tips. For this, you need to adopt some good practices of computer security:

  • Only download software from official and verified sources
  • Update your applications and operating system regularly
  • Do not open attachments or links in emails you receive, especially if they come from unknown or unsolicited senders
  • Use a firewall and security software, such as an antivirus or anti-malware. Update them regularly and run full scans of your system
  • Follow email best practices, such as not responding to messages that ask for personal or financial information, or that offer deals that are too good to be true
  • Deploy email security gateways, which filter incoming messages and block those that contain spam, phishing or malware
  • Avoid links and ads that appear on websites you visit, especially if they promise gifts, discounts or free downloads
  • Implement access control, which limits access to sensitive resources and data of your company to authorized people only
  • To enhance the security of your online accounts, enable two-factor or multi-factor authentication which adds an extra layer of protection by requiring a second factor of verification such as a code sent by SMS or a fingerprint..
  • Use the principle of least privilege, which limits the rights and permissions of users to what is strictly necessary to accomplish their tasks
  • Use strong and unique passwords: Use strong and unique passwords for each account, and avoid using the same password for multiple accounts.

Enhancing Protection Against CryptBot Malware on Chrome with EviVault’s End-to-End NFC Cold Wallet Technology

Adopting the best practices for computer security, such as downloading software only from official sources, updating applications, avoiding suspicious links and emails, and using a firewall and anti-malware, can help you avoid CryptBot malware and protect your sensitive data and cryptocurrency. In addition to these tips, you can further enhance your protection by using Freemindtronic’s EviVault technology, which provides end-to-end NFC Cold Wallet protection for your crypto assets. This patented solution adds an extra layer of security against threats like CryptBot malware on Chrome.

Google’s Legal Action Against CryptBot Malware and Its Importance in Protecting Chrome Users

Google has successfully obtained a court order to remove current and future domains linked to the distribution of CryptBot, a malware that poses a threat to Chrome users. Google believes that legal action against such security threats, which abuse legitimate software like Chrome, can be effective. The company used a similar strategy against the alleged operators of the Russian botnet Glupteba in 2021, which resulted in a 78% reduction in Glupteba infections.

However, this court order does not mean that the danger of CryptBot is completely eliminated. The malware is constantly evolving and can still infect systems if users are not careful. It is strongly recommended to follow the advice here, including updating applications and operating systems, downloading software from reliable sources, and regularly checking for the presence of CryptBot.

Click here for download US Court Decision in Google LLC vs CryptBot Case

If you want to review the court decision issued by Judge Valerie Figueredo of the Southern District Court of New York in response to Google LLC’s (“Google”) lawsuit against CryptBot infrastructure and distribution networks, which aimed to reduce the number of victims whose sensitive information, such as usernames, passwords, and cryptocurrencies, the malicious software steals, click on the following link to download the document.

Through this legal action, Google sought to reduce the number of victims who fall prey to CryptBot’s theft of sensitive information. This court decision is a crucial step in the fight against sophisticated and difficult-to-detect malware attacks such as CryptBot.

In the next section, we will delve deeper into CryptBot and its inner workings

Malware Targeting Chrome Users: Understanding the Inner Workings of CryptBot

CryptBot is a type of malware that targets Chrome users by stealing their personal data, including cryptocurrency. But how does this malware infiltrate Chrome and avoid detection by antivirus software, and how does it communicate with its command server? Below is a brief technical explanation of CryptBot for those interested in the details:

  • CryptBot is primarily spread through phishing campaigns that offer a fake Chrome update or other legitimate software that contains a hidden virus. Once installed, the virus creates four files in the %TEMP% folder and activates a disguised BAT file that injects CryptBot into Chrome’s legitimate process. This allows the malware to access and encrypt the user’s data using the AES algorithm before sending it to its command server via an HTTP POST request.
  • In addition to stealing data, CryptBot can receive instructions from the command server via a JSON and AES-based communication protocol. These instructions can include downloading additional malware, updating the configuration settings, or deleting itself as needed.
  • Although CryptBot is a dangerous form of malware, understanding how it works can help users protect themselves from future attacks.

In conclusion, the threat CryptBot poses to the security of your data and cryptocurrencies on Chrome is real, but there are steps you can take to protect yourself. By following the advice we have shared and using Freemindtronic’s EviVault technology embedded in cold wallets such as Keepser, you can strengthen the security of your computer and protect your cryptographic assets from hackers. Don’t forget to share this article with your friends and sign up for our newsletter to receive the latest news on computer security and cryptocurrencies.

2023, Articles, Cyberculture, Eco-friendly, Electronics, GreenTech, Technologies

The first wood transistor for green electronics

Posted on by FMTAD
29
Apr


Wood transistor by Jacques gascuel This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.  

The first wood transistor for green electronics

Wood is a natural and renewable material that can be used for many purposes, from construction to furniture. But did you know that wood can also be used to make electronic devices? In this article, we will introduce you to the first wood transistor ever created, and explain how it works and why it is a promising innovation for green electronics.

White background image illustrating the ePrivacy Regulation with a secure lock symbol, digital icons for encryption and consent, and the European Union flag subtly integrated.

2024 Cyberculture Legal information

ePrivacy Regulation: Transforming Messaging Privacy in 2025
November 26, 2024
Mobile Cyber Threats for Government Agencies – smartphone with cyber threat notifications on white background.

2024 Cyberculture

Mobile Cyber Threats: Protecting Government Communications
November 14, 2024
Realistic depiction of electronic warfare in military intelligence with modern equipment and personnel analyzing communication signals on white background

2024 Cyberculture

Electronic Warfare in Military Intelligence
November 3, 2024
A modern smartphone displaying a notification to 'Restart Your Phone Weekly', emphasizing cybersecurity on a clean white background with a security shield icon.

2024 Cyberculture

Restart Your Phone Weekly for Mobile Security and Performance
October 25, 2024
Quantum Computing Encryption Threats - Visual Representation of Data Security with Quantum Computers and Encryption Keys.

2024 Cyberculture

Quantum Computing Encryption Threats: Why RSA and AES-256 Remain Secure
October 16, 2024
Flags of France and the European Union on a white background representing ANSSI cryptography authorization

2024 Articles Cyberculture Legal information

ANSSI Cryptography Authorization: Complete Declaration Guide
October 7, 2024
Digital Authentication Security showing a laptop and smartphone with biometric login, two-factor authentication, and security keys on a bright white background.

2024 Cyberculture

Digital Authentication Security: Protecting Data in the Modern World
September 19, 2024
Ultra-realistic image illustrating Andorra's shared EAN code with Spain, featuring a barcode starting with 84 and a map connecting Andorra and Spain.

2024 Articles Cyberculture

EAN Code Andorra: Why It Shares Spain’s 84 Code
September 9, 2024

What is a wood transistor?

A transistor is a device that can amplify or switch electrical signals. Transistors are the building blocks of modern electronics, such as computers, smartphones, and sensors. They are usually made of silicon, a semiconductor material that can conduct electricity under certain conditions.

However, a wood transistor is a type of transistor that uses wood as the base material instead of silicon. Wood is also a semiconductor, but with different properties than silicon. To make wood transistors, researchers coat thin slices of wood with carbon nanotubes. These are tiny tubes of carbon atoms that have excellent electrical and mechanical properties.

The carbon nanotubes act as electrodes, which are the parts of the transistor that connect to the external circuit. The wood acts as the channel, which is the part of the transistor that controls the flow of current between the electrodes.

How does a wood transistor work?

A wood transistor works by applying a voltage to one of the electrodes, called the gate. This voltage creates an electric field that affects the conductivity of the wood channel. By changing the gate voltage, the current flowing between the other two electrodes, called the source and the drain, can be modulated.

The wood transistor can operate in two modes: depletion mode and enhancement mode. In depletion mode, the wood channel is normally conductive, and the gate voltage can reduce or stop the current flow. In enhancement mode, the wood channel is normally non-conductive, and the gate voltage can increase or start the current flow.

The researchers who developed the wood transistor made an interesting discovery. They found that it can switch between depletion mode and enhancement mode by changing the polarity of the gate voltage. This means that the wood transistor can perform both n-type and p-type functions, which are essential for creating complex electronic circuits.

Why is a wood transistor important?

A wood transistor is important because it offers several advantages over conventional silicon transistors. Some of these advantages are:

  • Wood is abundant, cheap, biodegradable, and renewable, which makes it an environmentally friendly alternative to silicon. Silicon is scarce, expensive, non-biodegradable, and requires high-energy processing.
  • Wood transistors have a low operating voltage, which means they consume less power and generate less heat than silicon transistors. This can improve the energy efficiency and performance of electronic devices.
  • Wood transistors have a high sensitivity to humidity and temperature changes, which makes them suitable for applications such as environmental sensors and smart textiles.
  • Moreover, wood transistors have a flexible and transparent structure, which makes them compatible with flexible and wearable electronics.

What are the challenges and opportunities for wood transistors?

Researchers are still developing wood transistors, and they face some challenges and opportunities for further improvement. Some of these are:

  • The stability and reliability of wood transistors need to be enhanced by optimizing the fabrication process and protecting them from moisture and oxidation.
  • The scalability and integration of wood transistors need to be improved by developing methods to produce large-area and high-density arrays of wood transistors on various substrates.
  • The functionality and diversity of wood transistors need to be expanded by exploring different types of wood materials and carbon nanotube coatings with different properties.
  • The applications and markets for wood transistors need to be explored by collaborating with industry partners and end-users who can benefit from this novel technology.

Conclusion

Wood transistors are a breakthrough innovation that can revolutionize green electronics. They combine the natural advantages of wood with the exceptional properties of carbon nanotubes to create low-power, high-performance, flexible, transparent, and biodegradable electronic devices.

Source

Li, T., Zhu, H., Wang, X. et al. Wood-based fully biodegradable and flexible electronic devices. Nat Electron 4, 33–40 (2021). https://doi.org/10.1038/s41928-020-00518-9

[1] A transistor made of wood: Electrical current modulation in wood electrochemical transistor – https://www.pnas.org/content/118/17/e2026873118

Articles, Digital Security, Phishing

Kevin Mitnick’s Password Hacking with Hashtopolis

Posted on by FMTAD
Kevin Mitnick and his Hashtopolis: The Ultimate Password Cracking Tool
27
Apr


password hacking with Hashtopolis by Jacques gascuel
This article will be updated with any new information on the topic, and readers are encouraged to leave comments or contact the author with any suggestions or additions.
Related topic : ******

How Kevin Mitnick hacked passwords with Hashtopolis

Learn about password hacking using Hashtopolis, a powerful tool that can crack any hash in minutes using multiple machines equipped with GPUs. Famous hacker Kevin Mitnick used it to demonstrate the tool’s capabilities. Discover the advantages and disadvantages of using such a tool, as well as ethical and legal implications of password hacking. Get tips on how to protect your online accounts with strong passwords. Keep reading to find out more!

White background image illustrating the ePrivacy Regulation with a secure lock symbol, digital icons for encryption and consent, and the European Union flag subtly integrated.

2024 Cyberculture Legal information

ePrivacy Regulation: Transforming Messaging Privacy in 2025
November 26, 2024
Laptop and smartphone displaying 2FA MFA security features with OATH initiative, key management solutions for 2024.

2024 Articles Technical News

Best 2FA MFA Solutions for 2024: Focus on TOTP & HOTP
October 8, 2024
Flags of France and the European Union on a white background representing ANSSI cryptography authorization

2024 Articles Cyberculture Legal information

ANSSI Cryptography Authorization: Complete Declaration Guide
October 7, 2024
laptop displaying Microsoft Uninstallable Recall feature, highlighting TPM-secured data and uninstall option, with a user's hand interacting, on a white background.

2024 Articles Technical News

New Microsoft Uninstallable Recall: Enhanced Security at Its Core
October 3, 2024
Ultra-realistic image illustrating Andorra's shared EAN code with Spain, featuring a barcode starting with 84 and a map connecting Andorra and Spain.

2024 Articles Cyberculture

EAN Code Andorra: Why It Shares Spain’s 84 Code
September 9, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Balance scale showing the balance between privacy and law enforcement in EU regulation of end-to-end encrypted messaging.

2024 Articles Cyberculture legal Legal information News

End-to-End Messaging Encryption Regulation – A European Issue
June 10, 2024
Cardokey NFC vCard Business: Edit, Read, and Import Contacts Seamlessly on iPhone.

2024 Articles Cardokey EviSwap NFC NDEF Technology GreenTech Technical News

NFC vCard Cardokey: Revolutionizing Digital Networking
March 25, 2024

Password hacking tool: how it works and how to protect yourself

Password hacking is a practice that consists of finding the secret code that protects access to an account or a file. There are specialized tools to perform this operation, such as the one used by Mitnick Security Consulting. In this article, we will present the features of this tool, its advantages and disadvantages, as well as the ways to protect yourself from password hacking.

Introduction

Password hacking is a practice that consists of finding the secret code that protects access to an account or a file. It can be done for various purposes, such as testing the security of a system, recovering a forgotten password, or stealing personal or professional data.

There are specialized tools to perform password hacking, such as the one used by Mitnick Security Consulting. This company is led by Kevin Mitnick, a famous hacker who was arrested in 1995 for hacking dozens of computer systems, including those of the Pentagon, NASA and FBI. Today he has become a security expert and consultant who helps companies protect themselves from cyberattacks.

The main purpose of this article is to present the features, advantages and disadvantages of the password hacking tool used by Mitnick Security Consulting, as well as the ways to protect yourself from password hacking. We will first explain how the tool uses a large number of GPUs to speed up the hacking process. Then we will discuss the benefits and drawbacks of using such a tool in terms of energy consumption and privacy concerns. Next we will address the ethical and legal implications of password hacking. After that we will summarize some user reactions to password hacking. Finally we will provide some tips on how to protect your online accounts with strong passwords.

Features of the password hacking tool

The password hacking tool used by Mitnick Security Consulting uses a large number of GPUs to speed up the hacking process. According to the information shared by Mitnick, the tool uses 24 GPU 4090s and 6 GPU 2080s, all clustered and running with Hashtopolis. This allows the tool to hack passwords at an impressive speed, reaching 6.2 trillion per second for NTLM (New Technology LAN Manager).

Hashtopolis is an open source software that allows to distribute the password hacking work across multiple machines equipped with GPUs. It uses a web interface to manage the agents, tasks and passwords found. It supports several types of hashes, such as NTLM, MD5, SHA1, SHA256, SHA512, WPA/WPA2 and even BitLocker.

A hash is a mathematical function that transforms a password into a random string of characters. For example, the password “password” hashed with MD5 would be “5f4dcc3b5aa765d61d8327deb882cf99”. Hashing is used to store passwords securely without revealing them in plain text.

To crack a password, one has to find the original password that corresponds to a given hash. This can be done by using different methods, such as bruteforce, dictionary or mask.

Bruteforce is a method that tries all possible combinations of characters until finding the right one. For example, if the password is four digits long, it would try 0000, 0001, 0002… until 9999.

Dictionary is a method that tries words from a predefined list or a common language dictionary. For example, if the password is a word in English, it would try apple, banana, carrot… until finding the right one.

Mask is a method that tries combinations based on a known pattern or structure. For example, if the password is composed of two words separated by an underscore (_), it would try word_word, name_name… until finding the right one.

Advantages and disadvantages of the password hacking tool

The use of such a tool has advantages and disadvantages. On one hand, it allows the company to quickly test the security of the passwords used by its clients and detect vulnerabilities. This can help prevent unauthorized access and data breaches. It can also help users improve their password habits and choose stronger passwords.

On the other hand, it consumes a considerable amount of energy and generates heat. This can have a negative impact on the environment and increase the carbon footprint of the company. It can also raise privacy concerns, as the tool can be used for malicious purposes, such as hacking online accounts or sensitive data. This can result in identity theft, industrial espionage or sabotage.

It is important to note that even with such a powerful tool, there are limits to what can be achieved in terms of password hacking. Long and complex passwords, stored using secure hashing algorithms such as bcrypt or PBKDF2, can be very difficult to hack even with powerful tools. These algorithms use a large number of iterations to significantly slow down the hashing process, making brute force hacking much more difficult.

In addition to the number of iterations, these algorithms have other features that make them more resistant to GPU or specialized hardware attacks. Bcrypt uses an encryption function based on Blowfish, which is designed to be costly in memory and random access. This makes it difficult to parallelize bcrypt on multiple GPUs. PBKDF2 uses an internal hash function, such as SHA-256 or SHA-512, which can be optimized for GPUs, but which also requires a lot of calculations. This makes the cost of the attack proportional to the number of iterations. According to a 2015 study, it would take about 4 days to crack an 8-character alphanumeric password with bcrypt and 10 iterations, compared to about 5 hours with PBKDF2 and 10,000 iterations.

Ethical and legal implications of password hacking

The use of such a powerful password hacking tool raises ethical and legal questions. On one hand, it can serve to strengthen the security of computer systems by demonstrating their vulnerability and encouraging users to choose stronger passwords. This can be seen as a form of ethical hacking or penetration testing, which aims to improve the security of a system by finding and reporting its weaknesses.

On the other hand, it can be used for malicious purposes, such as hacking online accounts or sensitive data. This can be seen as a form of illegal hacking or cybercrime, which aims to harm or exploit a system by exploiting its weaknesses.

Therefore, some ethical and legal rules must be respected when using a password hacking tool. For example:

  • The tool should only be used with the consent and authorization of the owner or administrator of the system.
  • The tool should only be used for legitimate purposes, such as testing the security of passwords or recovering a forgotten password.
  • The tool should not be used to access or disclose confidential or personal information without permission.
  • The tool should not be used to cause damage or disruption to the system or its users.

To give you an idea of how long it would take to crack a password using high-performance GPUs, a machine equipped with eight RTX 4090 GPUs, the most powerful on the market today and very popular among gamers and creators, could go through all possible combinations of an 8-character password in just 48 minutes using brute force methods. For comparison, it would take about 3 hours and 20 minutes with eight RTX 3090 Ti GPUs.

User reactions to password hacking

Kevin Mitnick’s post sparked many positive comments from computer security experts, who praised the power and speed of his password hacking tool. Some even asked for technical details on how Hashtopolis works and what types of hashes it can crack.

For example, one comment said: “This is amazing! I would love to see how Hashtopolis works and what kind of hashes it can crack. Can you share some screenshots or videos of the tool in action?”

Another comment said: “Wow, this is impressive! I wonder how long it would take to crack a password with bcrypt or PBKDF2 using this tool. Do you have any benchmarks or comparisons?”

However, some negative comments from Internet users also expressed concerns about the environmental impact and privacy issues of password hacking.

For example, one comment said: “This is terrible! Do you realize how much electricity and heat this tool consumes? You are contributing to global warming and climate change with your irresponsible hacking. You should plant some trees or use renewable energy to offset your carbon footprint.”

Another comment said: “This is scary! How can we trust you with our passwords and data? You could hack into our accounts or steal our information without our consent. You are violating our privacy and security with your unethical hacking. You should respect the law and the rights of others.”

In conclusion

The new password hacking tool used by Mitnick Security Consulting is impressive in terms of power and speed. It can crack passwords at an astonishing rate, reaching 6.2 trillion per second for NTML. It uses Hashtopolis, an open source software that allows to distribute the password hacking work across multiple machines equipped with GPUs. It supports several types of hashes and methods to crack them.

However, the use of such a tool also raises concerns about energy and privacy. It consumes a considerable amount of electricity and generates heat, which can have a negative impact on the environment. It can also be used for malicious purposes, such as hacking online accounts or sensitive data, which can result in identity theft, industrial espionage or sabotage.

As Internet users, it is important to be aware of the risks associated with weak passwords and use secure methods to protect our online accounts. Some tips to do so are:

  • Use long and complex passwords that contain letters, numbers and symbols.
  • Use a password manager to store and generate secure passwords.
  • Use a random password generator or a secret phrase that is easy to remember but hard to guess.
  • Use multi-factor authentication that requires a code sent by SMS or email to access an account.

Password hacking is a practice that can have positive or negative consequences depending on how it is used. It is therefore necessary to be vigilant and adopt good practices to protect ourselves from hackers like Kevin Mitnick.

I hope this article has helped you understand how password hacking works and how to protect yourself from it. If you want to learn more about password hacking, you can check out these sources:

  • Cracking Passwords at 7.25 TRILLION Hashes per second?
  • How Secure Is My Password?
  • How To Create A Strong Password

Sources :

(1) hash – What is the specific reason to prefer bcrypt or PBKDF2 over …. https://security.stackexchange.com/questions/133239/what-is-the-specific-reason-to-prefer-bcrypt-or-pbkdf2-over-sha256-crypt-in-pass.

(2) Password Storage – OWASP Cheat Sheet Series. https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html.

(3) Do any security experts recommend bcrypt for password storage?. https://security.stackexchange.com/questions/4781/do-any-security-experts-recommend-bcrypt-for-password-storage.

(4) Password Hashing: PBKDF2 (using sha512 x 1000) vs Bcrypt. https://stackoverflow.com/questions/4433216/password-hashing-pbkdf2-using-sha512-x-1000-vs-bcrypt.

2023, News, Skills Enhancement

ChatGPT Cybersecurity System Safety: AI-Powered Defense for Secure Systems

Posted on by FMTAD
Shield representing ChatGPT Cybersecurity System Safety, connected to a network of digital nodes.
21
Apr

Optimize ChatGPT for Cybersecurity and System Safety

Optimize prompts for ChatGPT as part of our “Skills Enhancement” series. This guide will show you how to harness the full potential of ChatGPT-4 for cybersecurity and system safety. Learn how to create impactful prompts that enhance your AI’s ability to detect threats, secure systems, and provide critical insights into security practices.

Preamble

to learn chatgpt

To learn

create with chatgpt

Create

have fun with chatgpt

Have fun

Get informed

Discuss

Test

collaborate with ChatGPT

Collaborate

explorer with ChatGPT

Explorer

improve with ChatGPT

Improve

Personalize

Prompt ChatGPT Openai white freemindtronic Andorra

Other

ChatGPT Cybersecurity System Safety

ChatGPT is an AI chatbot launched by OpenAI in November 2022, specifically designed for cybersecurity tasks. Trained with Reinforcement Learning from Human Feedback (RLHF) and utilizing GPT-3.5 and GPT-4 language models, ChatGPT can perform a range of tasks including pentesting, fuzzing, shellcode generation, custom email creation, and buffer overflow exploitation. Additionally, it assists blue teams in detecting, analyzing, and preventing cyberattacks with greater efficiency.

Learn Cybersecurity with ChatGPT for System Safety

If you want to use ChatGPT as a learning tool about cybersecurity and system safety, you can ask it to explain concepts, teach you skills, or help you solve problems. Here are some examples of prompts you can use to learn with ChatGPT:

  • Explain [cybersecurity or safety concept] to me as if I were 5 years old.
  • Teach me how to [apply a cybersecurity or safety measure or technique] step by step.
  • Help me solve this problem: [cybersecurity or safety scenario or case study].
  • What are the best resources for learning [cybersecurity or safety field or topic]?
  • What are the advantages and disadvantages of [cybersecurity or safety choice or solution]?
  • What is the difference between [term A] and [term B] when it comes to cybersecurity or safety?
  • How can I improve in [cybersecurity or safety field or topic]?
  • What are the pitfalls to avoid when [doing something related to cybersecurity or safety]?
  • What is the story of [cybersecurity or safety event or persona]?
  • What are the most interesting facts about [cybersecurity or safety field or topic]?

Create Secure Systems with ChatGPT Cybersecurity Prompts

If you want to use ChatGPT as a cybersecurity and systems safety authoring tool, you can ask it to generate content, design items, or give ideas. Here are some examples of prompts you can use to create with ChatGPT:

  • Write a blog post on [cybersecurity or safety topic] using AIDA (Attention, Interest, Desire, Action) format.
  • Create a catchy slogan for (product or service related to cybersecurity or safety).
  • Give me 10 name ideas for new cybersecurity or safety software.
  • Draw me an architecture diagram for a secure system.
  • Write a safety or security policy for [organization or project].
  • Compose a cybersecurity or safety incident alert or report.
  • Invent a cybersecurity or safety test or audit scenario for [system or application].
  • Create an action or remediation plan for [cybersecurity or safety issue or vulnerability].
  • Write source code for [cybersecurity or safety feature or measure] using the [programming language].
  • Generate a secure key or password.
  • Create a quiz or game on [cybersecurity or safety domain or topic].

Stay Informed on System Safety with ChatGPT Cybersecurity Insights

If you want to use ChatGPT as an information tool on cybersecurity and system safety, you can ask it to provide you with data, facts, or opinions on various topics. Here are some examples of prompts you can use to inform yourself with ChatGPT:

  • What is the current cyber threat situation in the world?
  • What are the latest news on [cybersecurity or safety topic]?
  • What is the best way to [protect, detect, respond] to [type of attack or incident]?
  • What are the best products or services for [cybersecurity or safety needs]?
  • What is the historical and future evolution of [cybersecurity or safety-related field or topic]?
  • What are the benefits and risks of [cybersecurity or safety technology or trend]?
  • What is your opinion on [controversial topic related to cybersecurity or safety]?
  • What are the best books or movies on [genre or theme related to cybersecurity or safety]?
  • What are upcoming events in [domain or sector related to cybersecurity or safety]?
  • Who are the most influential people in [field or sector related to cybersecurity or safety]?

Have Fun with ChatGPT: Cybersecurity and System Safety Games

If you want to use ChatGPT as an entertainment tool, you can ask it to make jokes, play games, or simulate characters. Here are some examples of prompts you can use to have fun with ChatGPT:

  • Tell me a joke on [topic].
  • Let’s play a game: I’m thinking of something and you have to guess what it is by asking me closed-ended questions (yes or no).
  • Talk to me like you were [famous person].
  • Make me an imitation of [celebrity].
  • Invent a riddle on [subject].
  • What’s the funniest movie you’ve ever seen?
  • What’s the craziest thing you’ve ever done?
  • What is your wildest dream?
  • What is your favorite superpower and why?
  • What’s the best piece of advice you’ve ever received?
  • What is the most embarrassing thing that has happened to you?

Discuss System Safety and Cybersecurity with ChatGPT

If you want to use ChatGPT as a tool for discussing cybersecurity and system safety, you can ask it to talk about themselves, their interests, or their emotions. Here are some examples of prompts you can use to chat with ChatGPT:

  • Tell me about yourself: who are you, what do you do, what do you like about cybersecurity or safety?
  • What are your hobbies or passions in cybersecurity or safety?
  • How do you feel today in terms of cybersecurity or safety?
  • What makes you happy or sad about cybersecurity or safety?
  • What are your cybersecurity or safety dreams or goals?
  • What scares or stresses you about cybersecurity or safety?
  • What makes you curious or fascinated about cybersecurity or safety?
  • What makes you laugh or cry when it comes to cybersecurity or safety?
  • What are your values or principles regarding cybersecurity or safety?
  • What are your strengths or weaknesses in cybersecurity or safety?

Test Your Cybersecurity Knowledge with ChatGPT System Safety Quizzes

If you want to use ChatGPT as a cybersecurity and system safety testing tool, you can ask it to check your knowledge, skills, or personality. Here are some examples of prompts you can use to test with ChatGPT:

  • Give me a quiz on [cybersecurity or safety topic].
  • Assess my level of [cybersecurity or safety competency] by asking myself questions.
  • Analyze my personality in terms of cybersecurity or safety by asking me questions.
  • Correct my text on [topic related to cybersecurity or safety] by looking for errors or weaknesses.
  • Give me feedback on my [cybersecurity or safety-related project or work].
  • Give me tips on how to improve in [area or topic related to cybersecurity or safety].
  • Give me a challenge in [field or topic related to cybersecurity or safety].
  • Compare my results with those of other users in terms of cybersecurity or safety.
  • Give me a grade on [cybersecurity or safety criterion].
  • Give me a reward or sanction based on my cybersecurity or safety performance.

Collaborate on Cybersecurity Projects Using ChatGPT for System Safety

If you want to use ChatGPT as a collaboration tool on cybersecurity and system safety, you can ask it to work with you on a project, task, or idea. Here are some examples of prompts you can use to collaborate with ChatGPT:

  • Help me [do something related to cybersecurity or safety] by giving me instructions or resources.
  • Work with me on [cybersecurity or safety project] by giving me ideas or suggestions.
  • Participate in [cybersecurity or safety task] by giving me your opinion or feedback.
  • Create with me [something related to cybersecurity or safety] by giving me examples or models.
  • Join me in [cybersecurity or safety activity] by giving me encouragement or motivation.
  • Learn with me [something related to cybersecurity or safety] by giving me lessons or exercises.
  • Play [cybersecurity or safety game] with me by giving me strategies or tips.
  • Share with me [something related to cybersecurity or safety] by giving me information or facts.
  • Discuss [cybersecurity or safety topic] with me using arguments or opinions.
  • Trust me in [cybersecurity or safety situation] by giving me support or help.

Explore New Cybersecurity Horizons with ChatGPT for System Safety

If you want to use ChatGPT as an exploration tool on cybersecurity and system safety, you can ask it to introduce you to new topics, places, or people. Here are some examples of prompts you can use to explore with ChatGPT:

  • Let me know [cybersecurity or safety topic] by giving me an introduction or summary.
  • Show me around [place related to cybersecurity or safety] by giving me a description or map.
  • Let me meet [someone related to cybersecurity or safety] by giving me a biography or interview.
  • Take me on a journey back to [cybersecurity or safety era] by giving me historical or cultural context.
  • Let me dive into [cybersecurity or safety universe] by giving me a storyline or plot.
  • Make me dream of [cybersecurity or safety fantasy] by giving me a vision or a feeling.
  • Make me think about [cybersecurity or safety issue] by giving me a perspective or hypothesis.
  • Make me imagine [cybersecurity or safety situation] by giving me an example or simulation.
  • Make me experiment with [something related to cybersecurity or safety] by giving me a challenge or opportunity.

Improve Your System Safety Strategies with ChatGPT Cybersecurity Tools

If you want to use ChatGPT as a cybersecurity and system safety improvement tool, you can ask it to help you patch, develop, or optimize your writing, project, or strategy. Here are some examples of prompts you can use to improve with ChatGPT:

  • Correct my text on [topic related to cybersecurity or safety] by looking for errors or weaknesses. Make sentences clearer. [Paste your text].
  • Develop a cybersecurity or safety strategy for my [organization or project] using the [framework name] framework. Guide me through the steps of developing an effective strategy.
  • Create catchy headlines for a blog post on [cybersecurity or safety topic]. Titles should be engaging, impactful, and memorable. [Create a number of titles].
  • Plan my day more efficiently by creating a list of priority tasks based on the following tasks: [List your cybersecurity or safety tasks].
  • Optimize my security or safety configuration for my [system or application] using the [approach name] approach. Guide me through the optimization process.
  • Summarize the most important lessons from the book [Book title related to cybersecurity or safety] in a comprehensive but digestible summary.
  • Help me break writer’s block by writing me a plan for a detailed blog post on [cybersecurity or safety topic].
  • Help me design a conversion funnel for my (cybersecurity or safety-related product or service) using the [framework name] framework. Guide me through the key elements of an effective funnel.
  • Help me set better goals for [personal or professional goal related to cybersecurity or safety] using the SMART framework. Create specific, measurable, achievable, realistic, and time-bound goals.
  • Help me develop a communication strategy for my [project or work related to cybersecurity or safety] using the RACE (Research, Action, Communication, Evaluation) template. Guide me through the steps of creating a strategy that inspires interest and trust.
  • Help me innovate and improve my (cybersecurity or safety-related product or service) using the Jobs to Be Done framework. Identify potential areas for improvement based on customer needs and wants.
  • Help me review and update my security or safety policy for [organization or project] using current best practices and standards. Guide me through the key points of an effective and compliant policy.

Personalize Your ChatGPT Experience

If you want to use ChatGPT as a customized cybersecurity and system safety tool, you can ask it to change its behavior, tone, or style according to your preferences. Here are some examples of prompts you can use to customize ChatGPT:

  • From now on, talk to me in [language].
  • From now on, use a [formal or informal] tone in your answers.
  • From now on, adapt your writing style to [target genre or audience].
  • From now on, be more [concise or detailed] in your answers.
  • From now on, always give me at least [number] of options or examples in your answers.
  • From now on, always cite your sources or references in your answers.
  • From now on, always use verified data or facts in your answers.
  • From now on, avoid sensitive or controversial topics in your answers.
  • From now on, respect my opinions or beliefs in your answers.
  • From now on, treat me as [relationship or status] in your answers.

Enhance Your AI Interactions with ChatGPT-4 Prompts

In our fast-paced digital landscape, optimizing the way you interact with AI is essential. Whether you’re a cybersecurity professional or exploring the potential of AI for personal or professional growth, effective prompts for ChatGPT-4 can significantly enhance your AI interactions. Discover how well-crafted prompts can help you get the most out of ChatGPT-4’s capabilities across various tasks, including cybersecurity.

Explore AI-Driven Cybersecurity Strategies

Leverage the power of ChatGPT-4 to develop sophisticated cybersecurity strategies tailored to your unique needs. By crafting precise prompts, you can guide the AI to provide valuable insights into the latest cyber threats, mitigation techniques, and best practices for data protection.

Some effective prompts include:

  • “What are the top five emerging cybersecurity threats for 2024, and how can I mitigate them?”
  • “Develop a step-by-step plan to safeguard my company’s data against ransomware.”
  • “Analyze the latest trends in cybersecurity and suggest how I can implement them in my organization.”

Optimize System Safety with AI

System safety is crucial in maintaining a secure digital environment. ChatGPT-4 can assist in enhancing your network’s resilience by providing actionable advice through well-crafted prompts. Whether you need to protect sensitive data or ensure compliance with industry standards, ChatGPT-4 is a valuable tool.

Consider these prompts to enhance system safety:

  • “Design a comprehensive system safety plan for a medium-sized enterprise.”
  • “What steps can I take to improve my system’s safety against cyber threats?”
  • “What are the essential components of an effective incident response plan for a cyber breach?”

Discover More on Effective AI Prompts

For further insights into optimizing your ChatGPT-4 interactions, especially in the realm of cybersecurity, explore our comprehensive guide on effective prompts for ChatGPT. This resource offers detailed strategies and expert advice on maximizing the potential of AI in various applications.

Incorporating these techniques into your cybersecurity practices will not only fortify your defenses but also streamline your approach to managing digital risks. Make ChatGPT-4 an integral part of your cybersecurity toolkit and stay ahead of the curve in this ever-evolving field.

Explore More: Best Prompts for ChatGPT

This wraps up our guide on the top prompts for engaging with ChatGPT on cybersecurity and system safety. We hope you found this resource valuable and that you’ll experiment with these prompts to enhance your interactions with ChatGPT. We’d love to hear your feedback or suggestions—feel free to share them in the comments section below. If you found this article useful, don’t hesitate to share it with friends or colleagues who might benefit from it. Dive into your ChatGPT conversations and take your cybersecurity practices to the next level!

2023, Events

THcon 2023: A Cybersecurity Conference and CTF in Toulouse

Posted on by FMTAD
THCON 2023 DataShielder by Freemindtronic silver sponsor THCON CTF FCT ENSEEIHT Toulouse Hacking Convention
19
Apr
Eurosatory 2024 Technology Clusters promotional image showcasing Freemindtronic's Hall 5B - booth A-199 DataShielder NFC HSM PGP innovation with DNA-based encryption and authentication.

2024 Eurosatory Events Exhibitions Press release

Eurosatory 2024 Technology Clusters: Innovation 2024 DataShielder Defence
May 14, 2024
THCON 2023 DataShielder by Freemindtronic silver sponsor THCON CTF FCT ENSEEIHT Toulouse Hacking Convention

2023 Events

THcon 2023: A Cybersecurity Conference and CTF in Toulouse
April 19, 2023
datashielder serverless cryptography solution team Sesame Expertises Region Hauts de France FIC 2023 Freemindtronic Andorra

2023 Events FIC 2023

Serverless Cryptography Solution – FIC 2023
March 23, 2023
CONFEX 4.0 Cybersecurity Transalley Freemindtronic from Andorra participates in the first edition theme industrial cybersecurity iiot cyber pc Kubb Bleujour

2022 Confex Events

CONFEX 4.0 Cybersecurity Transalley
November 23, 2022
List of exhibitors Eurosatory 2022 by Freemindtronic in Hall 5b stand C178 new stealth NFC card EviCypher

Eurosatory Events Exhibitions

Exhibitors list Eurosatory 2022 and Freemindtronic Story
June 29, 2022
evistealth FOMEC FFOMECBLOT Camouflage Furtif Anonymat

2022 CyberStealth Eurosatory Press release

EviStealth Technology at Eurosatory 2022
June 9, 2022
Cyber Computer Laptop EviCypher technology embedded contactless NFC hardware from Freemindtronic andorra Eurosatory 2022 exhibition picture web edition

2022 Cyber Computer Eurosatory Press release

Cyber Computer at Eurosatory 2022
June 9, 2022
Contactless double strongbox with enslaving access evicypher nfc rugged secure usb storage technology

2022 Contactless Dual Strongbox Eurosatory Press release

The Contactless Dual Strongbox for sensitive data at Eurosatory 2022
June 9, 2022
Team THcon 2023 Freemindtronic Andorra Silver Sponsor
hardware CTF THcon 2023 Freemindtronic Andorra Silver Sponsor
Fortnite THcon 2023 Freemindtronic Andorra Silver Sponsor
Cryptax CTF THcon 2023 Freemindtronic Andorra Silver Sponsor
Team THcon 2023 Freemindtronic Andorra Silver Sponsor
THcon 2023: Highlights of the Cybersecurity Event

Do you want to know more about THcon 2023, a cybersecurity conference and CTF that took place in Toulouse, France? In this article, you will learn about the highlights of the event, the speakers, the partners and the prizes. You will also find out how to register for the next edition in 2024. Read on to discover why THcon is a must-attend event for cybersecurity enthusiasts!

Are you a cybersecurity enthusiast who missed THcon 2023 and its CTF? Or are you curious about what happened at this amazing event that took place in Toulouse, France from April 20 to 22, 2023? If so, you are in the right place. In this article, I will give you a recap of the highlights of THcon 2023 and its CTF. I will also show you why you should attend the next edition in 2024.

What is THcon and its CTF?

THcon is a cybersecurity event organized by the Toulouse Informatique Sécurité et Associatif (TISA) association. It aims to bring together hackers, researchers, students, professionals and enthusiasts from all over the world to share their passion and knowledge on cybersecurity.

The event features two days of talks, a social event and a CTF (Capture The Flag) in person. The talks cover various and current topics, such as hardware hacking, firmware analysis, secret extraction in CI/CD systems, attacks against online games, Android security model or the challenges of connected vehicle security. The speakers are recognized experts in their fields, such as Travis Goodspeed, Axelle Apvrille or Damien Cauquil.

The social event is an opportunity for the participants to network and have fun in a friendly and festive atmosphere. It is also the occasion to award the prizes for the challenge that takes place during the talks.

The CTF is a hacking competition that consists of solving cybersecurity challenges. For example, exploiting a vulnerability in an electronic device, extracting hidden data in a memory image, finding weaknesses in an encryption protocol and much more. The CTF takes place at ENSEEIHT on the third day of the event and is open to all levels. The winning teams win prizes such as hacking equipment, t-shirts and other surprises.

Highlights of THcon 2023 and its CTF THcon 2023 and its CTF were full of memorable moments that made this edition a success. Here are some of them:

  • The opening keynote by Travis Goodspeed. He shared his experience and insights on hacking hardware devices, such as radios, microcontrollers or smart cards.
  • The talk by Axelle Apvrille. She showed how to analyze firmware images using static and dynamic techniques. For instance, reverse engineering, emulation or fuzzing.
  • The talk by Damien Cauquil. He demonstrated how to attack online games using various tools and methods. For example, packet sniffing, proxying or cheating.
  • The social event on Thursday evening. Participants enjoyed music, drinks and food while chatting with each other and with the speakers.
  • The award ceremony for the challenge that took place during the talks. The challenge was to find hidden flags in different web pages related to THcon. The first three teams who found all the flags won prizes such as books or vouchers.
  • The CTF on Saturday at ENSEEIHT. More than 600 participants from 12 countries faced various and stimulating challenges in the field of cybersecurity.
  • Congratulation to the Synacktiv team, ENSEEIHT team and GCC–ENSIBS team for the podium and also to every team that participated ! 👏 You can learn more about GCC-ENSIBS on their LinkedIn page: https://www.linkedin.com/company/gcc-ensibs

Partners and sponsors of THcon 2023 THcon is supported by several partners and sponsors who contribute to make this event possible. Among them are:

  • Freemindtronic: an Andorran company specialized in cybersecurity and safety of computer systems. Freemindtronic actively participates in the hardware CTF of THcon. You can discover the backstage of the hardware CTF of THcon 2022 in this video made by Jacques Gascuel, the CEO of Freemindtronic: https://www.youtube.com/watch?v=P-Es2RJUQBo
  • Synacktiv: a French company that provides offensive security services and solutions. Synacktiv also organizes trainings on various topics related to cybersecurity.

ENSEEIHT: a French engineering school that offers courses on computer science, electronics, telecommunications and applied mathematics. ENSEEIHT hosts the CTF of THcon on its premises.

Among the prizes offered by Freemindtronic, silver sponsor of THcon since 2022, there are four NFC HSM DataShielder Lite collector devices, a unique version made for THcon CTF 2023. These devices are password and bank card managers that work without a battery and offer secure, decentralized and individualized management of sensitive data.

Why should you attend THcon 2024?

THcon is a must-attend event in Occitania for learning, having fun and meeting other cybersecurity enthusiasts. You can find all the information on the official website of the event: https://thcon.party/. You can also consult the list of challenges of the CTF on the site https://ctf.thcon.party/challenges.

If you want to experience this unique and enriching event, don’t hesitate to register for the next edition of THcon in 2024! You will find all the necessary information on the website https://thcon.party. Don’t miss this opportunity to discover the latest trends in cybersecurity, face exciting challenges and meet people who share your interests!

THCon Conference 2023

THURSDAY 20TH 2023

9h15 – 9h30 OPENING SPEECH
Mohamed Kâaniche (Director at LAAS-CNRS),
Marc Sztulman (Conseiller Régional d’Occitanie)

9h30 – 10h15 [K] MASK ROMS AND MASKS OF ABSTRACTION
Travis GoodSpeed
More info →

10h15 – 10h55 [LP] AUTOMATING THE EXTRACTION OF SECRETS STORED INSIDE CI/CD SYSTEMS
Théo Louis-Tisserand and Hugo Vincent
Synacktiv (Toulouse & Paris, France)
More info →

11h15 – 11h35 [SP] HASH CRACKING : AUTOMATION DRIVEN BY LAZINESS, 10 YEARS AFTER
David Soria
Astar (Toulouse, France)
More info →

11h35 – 12h15 [LP] WEAPONIZING ESP32 RF STACKS
Romain Cayre and Damien Cauquil
Institut Eurecom (Sophia-Antipolis, France),
Quarkslab (Paris, France)
More info →

14h00 – 14h45 [K] HAMMERSCOPE: OBSERVING DRAM POWER CONSUMPTION USING ROWHAMMER
Yaakov Cohen and Arie Haenel
Intel
More info →

14h45 – 15h25 [LP] REFLECTIONS ON TRUSTING DOCKER: INVISIBLE MALWARE IN CONTINUOUS INTEGRATION SYSTEMS
Florent Moriconi, Axel Neergaard, Lucas Georget, Samuel Aubertin and Aurélien Francillon
Institut Eurecom (Sophia-Antipolis, France)
More info →

15h25 – 15h45 [SP] DYNAMIC BINARY FIRMWARE ANALYSIS WITH AVATAR²
Paul Olivier
Institut Eurecom (Sophia-Antipolis, France) / LAAS-CNRS (Toulouse, France)
More info →

FRIDAY 21TH 2023

9h30 – 10h15 [K] HACKING FOR IDEAS
Axelle Apvrille
Fortinet
More info →

10h15 – 10h55 [LP] AN EXPLAINABLE-BY-DESIGN ENSEMBLE LEARNING SYSTEM TO DETECT UNKNOWN NETWORK ATTACKS
Céline Minh, Kevin Vermeulen, Cédric Lefebvre, Philippe Owezarski and William Ritchie
Custocy (Toulouse, France),
LAAS-CNRS, Universite de Toulouse, CNRS, INSA (Toulouse, France)
More info →

10h55 – 11h15 [SP] AN EXPLORATION OF FUTURE CHALLENGES FOR CROWD SOURCED VULNERABILITY DETECTION
Olivier de Casanove and Florence Sèdes
IRIT, Universite Toulouse III – Paul Sabatier (Toulouse, France)
More info →

11h35 – 12h15 [LP] THE ANDROID SECURITY MODEL
Jean-Baptiste Cayrou
Synacktiv (Toulouse, France)
More info →

12h15 – 12h35 [SP] SOFTWARE DEFINED VEHICULE SECURITY – CHALLENGES, RISKS AND REWARDS
Redouane Soum
Renault
More info →

14h00 – 14h40 [LP] A STUDY ON WINDOWS AUTHENTICATION & PROX-EZ
Geoffrey Bertoli and Pierre Milioni
Synacktiv (Paris, France)
More info →

14h40 – 15h20 [LP] WHY THERE IS MORE TO TODAY’S ATTACKS AGAINST ONLINE GAMES THAN MEETS THE EYE
Ilies Benhabbour, Marc Dacier, David Bromberg, Sven Dietrich, Rodrigo Rodrigues and Paulo Estes-Verissimo
King Abdullah University of Science and Technology (KAUST), (Thuwal, Kingdom of Saudi Arabia),
Univ Rennes, CNRS, IRISA, INRIA Rennes (France),
City University of New York (New York, NY, USA),
Instituto Superior Tecnico and INESC-ID (Lisboa, Portugal)
More info →

15h50 – 16h30 [LP] FIGHTING AGAINST DLL SEARCH ORDER HIJACKING, ONE SLAHP AT A TIME
Antonin Verdier, Romain Laborde and Abdelmalek Benzekri
IRIT, Universite Toulouse III – Paul Sabatier (Toulouse, France)
More info →

16h30 – 16h50 CONCLUSION

2024, Articles, Compagny spying, Digital Security, Industrial spying, Military spying, News, Spying, Zero trust

KingsPawn A Spyware Targeting Civil Society

Posted on by FMTAD
KingsPawn A Spyware
16
Apr

 

KingsPawn from QuaDream Spyware Threat

KingsPawn, a spyware developed and sold by QuaDream based on digital offensive technology to governments. Its spyware, named Reign, uses zero-click exploits to infiltrate the mobile devices of civil society victims. In this article you will learn how QuaDream works, who its Cyber victims and customers have been, and how to protect yourself from this type of dangerous spyware

Why Encrypt SMS? NFC card protecting encrypted SMS communications from espionage and corruption on Android NFC phone.

2024 Digital Security

Why Encrypt SMS? FBI and CISA Recommendations
December 16, 2024
French Minister at G7 holding a hacked smartphone, with a Bahraini minister warning him about a cyberattack.

2024 Digital Security

French Minister Phone Hack: Jean-Noël Barrot’s G7 Breach
December 6, 2024
Government office under cyber threat from Salt Typhoon cyber attack, with digital lines and data streams symbolizing espionage targeting mobile and computer networks.

2024 Digital Security

Salt Typhoon: Protecting Government Communications from Cyber Threats
November 14, 2024
Cyberattack exploits backdoors in telecom systems showing a breach of sensitive data through legal surveillance vulnerabilities.

2024 Digital Security

Cyberattack Exploits Backdoors: What You Need to Know
October 15, 2024
Google Sheets interface showing malware activity, with the keyphrase 'Google Sheets Malware Voldemort' subtly integrated into the image, representing cyber espionage.

2024 Digital Security

Google Sheets Malware: The Voldemort Threat
September 3, 2024
Operation Dual Face - Russian Espionage Hacking Tools in a high-tech cybersecurity control room showing Russian involvement

2024 Articles Digital Security News

Russian Espionage Hacking Tools Revealed
August 31, 2024
Side-channel attacks visualized through an HDMI cable emitting invisible electromagnetic waves intercepted by an AI system.

2024 Digital Security Spying Technical News

Side-Channel Attacks via HDMI and AI: An Emerging Threat
August 20, 2024
Depiction of OpenVPN security vulnerabilities showing a globe with digital connections, the OpenVPN logo with cracks, and red warning symbols indicating a global breach.

2024 Digital Security

OpenVPN Security Vulnerabilities Pose Global Security Risks
August 12, 2024

To learn more about the potential dangers of KingsPawn spyware, read “QuaDream: Spyware That Targets Civil Society.” Stay informed by browsing our constantly updated topics

How to Secure Your Data from QuaDream’s KingsPawn Spyware,” written by Jacques Gascuel, the innovator behind advanced sensitive data security and safety systems, provides priceless knowledge on the topic of data encryption and decryption. Are you prepared to enhance your comprehension of data protection?

QuaDream: KingsPawn spyware vendor shutting down in may 2023

QuaDream was a company that sold digital offensive technologies to governments. Its main product, Reign, was a spyware that used zero-click exploits to hack mobile devices. A few months after Pegasus, a similar spyware by NSO Group, Microsoft and Citizen Lab found QuaDream’s Reign / KingsPawn spyware and its victims worldwide.

However, in May 2023, QuaDream stopped its activitiesMay 2023, QuaDream stopped its activities, due to the Israeli government’s restrictions on its spyware export. QuaDream had developed other espionage technologies, such as ENDOFDAYS, that it sold to foreign governments, like Morocco, Saudi Arabia, Mexico, Ghana, Indonesia and Singapor.

QuaDream tried to sell its assets to other players, but the Israeli government blocked them It is unknown if the spyware KingsPawn is still active and used, or who controls it. Therefore, it is advised to be vigilant and protect your data with reliable security solutions.

How QuaDream’s Exploits KingsPawn her Spyware Work

According to Microsoft, QuaDream has an arsenal of exploits and malware that it calls KingsPawn. It includes a suspected exploit for iOS 14, named ENDOFDAYS, that seems to use invisible iCloud calendar invitations sent by the spyware operator to the victims. This exploit was deployed as a zero-day against iOS 14.4 and 14.4.2 versions, and maybe others.

The KingsPawn spyware is designed to exfiltrate data from the infected devices, such as contacts, messages, photos, videos, audio recordings, location data, browser information and app data. The malware communicates with command and control (C2) servers via encrypted protocols and uses evasion techniques to avoid detection.

How the KingsPawn spyware infects phones

The main infection vector of KingsPawn is the ENDOFDAYS exploit, which does not require any user interaction to execute. The spyware operator sends an invisible iCloud calendar invitation to the target’s phone number or email address. The invitation contains a malicious link that triggers the exploit when the phone processes the notification. The exploit then downloads and installs the KingsPawn malware on the device, without the user’s knowledge or consent.

The spyware operator can also use other methods to deliver the malicious link, such as phishing emails, SMS, social media messages, or fake websites. However, these methods require the user to click on the link, which reduces the chances of success.

KingsPawn Datasheet

The following table summarizes the main features and characteristics of the KingsPawn malware:

Feature Description
Name KingsPawn
Developer QuaDream
Platform iOS
Version 1.0
Size 2.5 MB
Permissions Full access to device data and functions
Capabilities Data exfiltration, audio recording, camera capture, location tracking, file search, keychain access, iCloud password generation, self-deletion
Communication Encrypted TCP and UDP protocols
C2 servers Multiple domains and IP addresses, some located in Israel, Bulgaria, Czech Republic, Hungary, Ghana, Mexico, Romania, Singapore, UAE, and Uzbekistan
Victims At least five civil society actors, including journalists, political opponents, and an NGO worker, in North America, Central Asia, Southeast Asia, Europe, and the Middle East
Customers Several governments, some with poor human rights records, such as Singapore, Saudi Arabia, Mexico, Ghana, Indonesia, and Morocco

How to Detect KingsPawn

KingsPawn is a stealthy and sophisticated malware that can evade most antivirus and security software. However, there are some signs and symptoms that can indicate a possible infection, such as:

  • Unusual battery drain or overheating of the device
  • Increased data usage or network activity
  • Unexpected pop-ups or notifications
  • Changes in device settings or behavior
  • Presence of unknown apps or files

If you notice any of these signs, you should scan your device with a reliable antivirus or security app, such as Malwarebytes or Norton. These apps can detect and remove KingsPawn and other malicious software from your device.

How to Protect Against KingsPawn

If you suspect that your device is infected by KingsPawn, you should take the following steps to remove it and protect your data:

  • Disconnect your device from the internet and any other networks
  • Backup your important data to a secure external storage
  • Perform a factory reset of your device to erase all data and settings
  • Restore your device from a clean backup or set it up as a new device
  • Update your device to the latest version of iOS and install security patches
  • Change your passwords and enable two-factor authentication for your online accounts
  • Avoid clicking on suspicious links or opening attachments from unknown sources
  • Use a reputable antivirus or security app to scan your device regularly

These steps will help you to get rid of KingsPawn and prevent it from infecting your device again. However, you should also be aware of the risks of using unsecured email services, such as iCloud web mail, which can be compromised by hackers or spyware. To protect your emails and other sensitive data, you should use a technology that encrypts your data with a hardware security module (HSM), such as EviCypher NFC HSM or DataShielder HSM PGP.

Who Are the Victims and Customers of QuaDream?

Citizen Lab, a research lab at the University of Toronto, identified at least five civil society victims of the spyware and exploits of QuaDream in North America, Central Asia, Southeast Asia, Europe and the Middle East. The victims include journalists, political opponents and a worker of a non-governmental organization (NGO). Citizen Lab did not reveal the names of the victims for security reasons, but one of them agreed to share his testimony anonymously:

I was shocked when I learned that my phone was infected by QuaDream. I had no idea tat they were targeting me. I work for a human rights NGO and I have been involved in several campaigns to denounce the abuses of authoritarian regimes. I fear that they have accessed my personal and professional data, and that they have compromised my contacts and sources.

Citizen Lab also detected QuaDream servers operated from Bulgaria, Czech Republic, Hungary, Ghana, Israel, Mexico, Romania, Singapore, United Arab Emirates (UAE) and Uzbekistan. These countries could be potential or current customers of QuaDream, which sells its Reign platform to governments for law enforcement purposes. Media reports indicate that QuaDream sold its products to Singapore, Saudi Arabia, Mexico and Ghana, and offered its services to Indonesia and Morocco.

What Is the Link Between QuaDream and InReach?

QuaDream had a partnership with a Cypriot company called InReach, with which it is currently in legal dispute. The two companies accused each other of fraud, theft of intellectual property and breach of contract. Several key people associated with both companies have previous links with another surveillance provider, Verint, as well as with Israeli intelligence agencies.

Microsoft and Citizen Lab shared information about QuaDream with their customers, industry partners and the public, to improve the collective knowledge of how PSOAs (private sector offensive actors) operate and how they facilitate the targeting and exploitation of civil society. Microsoft calls for stricter regulation of PSOAs and increased protection of human rights in cyberspace.

Conclusion

QuaDream is a new spyware vendor that poses a serious threat to civil society. Its spyware, named Reign, uses zero-click exploits to infiltrate the mobile devices of civil society victims. QuaDream has sold its products to several governments, some of which have a poor record of human rights. QuaDream is also involved in a legal dispute with another company, InReach, over the ownership of the spyware technology. The international community should be aware of the dangers of QuaDream and other PSOAs, and take action to prevent their abuse.

DataShielder, Technical News

Electronic Signature HSM OpenPGP

Posted on by FMTAD
Electronic Signature from DataShielder
26
Mar

Electronic signatures are increasingly being used to authenticate and protect documents online. But did you know that there are different levels of security for electronic signatures? According to the eIDAS regulation, there are three types of electronic signatures: simple, advanced and qualified. Each type offers a different degree of reliability and safety. In this article, we will look at simple electronic signatures and explain how HSM OpenPGP can make them more secure.

Electronic Signature from HSM OpenPGP

Simple Electronic Signatures

A simple electronic signature is the most basic form of electronic signature. It has no specific criteria defined by the eIDAS regulation. It is based solely on the express or implied consent of the author of the document. For example, a simple click on an “I agree” button or entering a name in a form field can be considered a simple electronic signature.

Simple electronic signatures are used for documents that do not require increased security, such as newsletters, surveys or contact forms. They have limited legal value, as they do not guarantee the identity of the signer or the integrity of the document.

Simple electronic signatures present several risks for data security. First of all, they are easy to forge or usurp. It is enough to know the name or email address of the signer to be able to sign in his place. Then, they are vulnerable to computer attacks. A hacker can intercept, modify or delete the signed document without the signer or the recipient noticing. Finally, they are difficult to verify. There is no simple and reliable way to prove the authenticity and validity of a simple electronic signature.

Il is a tool that allows you to sign your electronic documents in compliance with the eIDAS regulation. HSM OpenPGP offers you several advantages to enhance the security of your simple electronic signatures:

HSM OpenPGP uses an asymmetric cryptography system to protect your data. Each signer has a pair of keys: a public key and a private key. The public key is used to verify the signature, while the private key is used to sign the document. The private key is stored in a secure digital vault and is only accessible to the signer. HSM OpenPGP generates a timestamp for each signed document. The timestamp is an indelible proof of the date and time of the signature. It ensures the integrity of the document and prevents tampering or repudiation. HSM OpenPGP allows you to choose the level of security of your electronic signature according to your needs. You can opt for a simple, advanced or qualified electronic signature. Each level offers additional guarantees on the identity of the signer and the validity of the document. It is therefore a tool that allows you to sign your electronic documents with confidence and compliance. If you want to learn more about HSM OpenPGP and its features, feel free to visit our website or contact us.

Advanced Electronic Signatures

Electronic signatures are increasingly used to authenticate and protect online documents. But not all electronic signatures are equal. According to the eIDAS regulation, there are three types of electronic signatures: simple, advanced and qualified. Each type offers a different level of reliability and security. In this article, we will focus on advanced electronic signatures and explain how HSM OpenPGP can make them safer.

An advanced electronic signature is a form of electronic signature that offers a higher level of security than a simple electronic signature. It is based on a digital certificate issued by a trusted third party, called a qualified trust service provider (QTSP). This certificate allows to authenticate the identity of the signer and to ensure the integrity of the signed document. To be considered as an advanced electronic signature, the signature must meet several criteria defined by the eIDAS regulation. It must be:

  • Uniquely linked to the signer;
  • Capable of identifying the signer;
  • Created using signature creation data that the signer can use under his exclusive control;
  • Linked to the signed data in such a way that any subsequent modification of the data is detectable.

Advanced electronic signatures are used for documents that require increased security, such as contracts, invoices or tax declarations. They have a stronger legal value than simple electronic signatures, because they can prove the origin and integrity of the document.

It is an encryption key management application that provides unparalleled security and privacy to users. It is compatible with all messaging services and offers end-to-end encrypted instant messaging via segmented key authentication SMS. It also has a file encryption and data signing system with signature self-verification.

  • eIDAS compliance: By using HSM OpenPGP for advanced electronic signatures, you can be sure that your signatures meet the requirements of the eIDAS (Electronic IDentification, Authentication and Trust Services) regulation, which was established in July 2016 to define the criteria for an electronic signature process within the European Union.
  • Timestamp of signed documents: HSM OpenPGP generated a timestamp for each signed document. The timestamp is indelible proof of the date and time of the signature. It ensures the integrity of the document and prevents falsification or repudiation.
  • Choice of security level: HSM OpenPGP also allows you to choose the level of security of your electronic signature according to your needs.
  • Advanced features for data security and privacy: In addition to meeting eIDAS requirements for advanced electronic signatures, HSM OpenPGP also offers other data security and privacy benefits. For example, it allows you to generate, store, and use all types of symmetric and asymmetric keys offline for Open PGP encryption algorithms. The user can freely choose the algorithm he wants to use from AES 128 192 256 or RSA 2048 3072 4096 Open PGP. They can also import or export existing keys for storage, management, sharing, or use with HSM OpenPGP.

By using HSM OpenPGP for advanced electronic signatures, you not only benefit from a high level of reliability and security in accordance with the eIDAS regulation, but also additional protection for your data thanks to the advanced features offered by HSM OpenPGP.

Compliance with eIDAS Regulation

It is an innovative application for managing encryption keys and signing files. Although HSM OpenPGP offers an interesting approach to electronic signatures, it is important to note that its approach differs from the requirements for a qualified electronic signature under the eIDAS regulation.

The eIDAS Regulation (No 910/2014) was adopted on 23 July 2014 by the European Parliament and the European Union Council. It aims to strengthen trust in electronic transactions within the internal market by establishing a common foundation for secure electronic interactions between citizens, businesses and public authorities. According to this regulation, a qualified electronic signature must be created using a secure signature creation device (DSC) that ensures that the signature creation data is under the exclusive control of the signatory. It must also be based on a qualified electronic signature certificate that attests to the identity of the signatory and is issued by a qualified trust service provider (PSC) meeting applicable technical and regulatory requirements. Finally, it must allow the signatory to be identified and any subsequent changes to the signed data to be detected.

To learn more about the eIDAS Regulation, you can visit the EUR-Lex website at the following address:

https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32014R0910

HSM OpenPGP does not generate a qualified electronic signature within the meaning of the eIDAS Regulation because its approach does not rely on the use of a secure signature creation device (DSC) or a qualified certificate for electronic signatures issued by a qualified trust service provider (PSC).

However, It’s offers an innovative approach in the field of file signing and data encryption. HSM OpenPGP allows the signatory to generate, store and share their own public key and signature hash without relying on an external trusted third party. HSM OpenPGP uses technology patented by Freemindtronic on segmented key authentication to provide users with an unparalleled level of security and privacy. HSM OpenPGP also allows you to choose the level of security for your electronic signature based on your needs.

In short, although HSM OpenPGP does not generate a qualified electronic signature within the meaning of the eIDAS Regulation, it offers an innovative approach to simple and advanced electronic signatures with a high level of security and privacy.

According to the eIDAS Regulation, an advanced electronic signature must meet the following criteria:

  • It is uniquely linked to the signatory.
  • It allows the signatory to be identified.
  • It is created using data that the signatory can use under their exclusive control.
  • It is linked to the data to which it relates in such a way that any subsequent changes to the data can be detected.

It is appears to meet these criteria by allowing the signatory to generate their own private key using an application on their phone. The private key is encrypted and stored in the keychain (Apple) or key store (Android) and is only accessible to the signatory. The signatory creates their signature in .asc format from their private key after authenticating by entering at least one key or two or three. The signatory then sends the signature and their public key to the recipient so that they can verify that the file has not been corrupted.

By using HSM OpenPGP for advanced electronic signatures, you not only benefit from a high level of reliability and security in accordance with the eIDAS Regulation, but also additional protection for your data thanks to HSM OpenPGP’s advanced features. For example, it has a file encryption system and data signing with self-verification of signatures. The user can freely choose which algorithm they want to use among AES 128 192 256 or RSA 2048 3072 4096 Open PGP. They can also import or export existing keys for storage, management, sharing or use with HSM OpenPGP.

In conclusion, although HSM OpenPGP does not generate a qualified electronic signature within the meaning of the eIDAS Regulation, it offers an innovative approach to simple and advanced electronic signatures with a high level of security and privacy. It is appears to meet the criteria for an advanced electronic signature by allowing the signatory to generate their own private key using an application on their phone and providing users with an unparalleled level of security and privacy thanks to its patented technology. By using HSM OpenPGPfor advanced electronic signatures, you not only benefit from a high level of reliability and security in accordance with the eIDAS Regulation, but also additional protection for your data thanks to HSM OpenPGP’s advanced features. For example, it has a file encryption system and data signing with self-verification of signatures. The user can freely choose which algorithm they want to use among AES 128 192 256 or RSA 2048 3072 4096 Open PGP. They can also import or export existing keys for storage, management, sharing or use with HSM OpenPGP.

This site uses cookies to offer you a better browsing experience. By browsing this website, you agree to our use of cookies.
More info Accept