Jay Bavisi, President and Co-founder of the EC Council says, “We need Ethical Hackers more today than ever before”.
The rise of IT Security and ethical hackers is due to technology advances and the growing number of threats in the computer world. In the wake of September 11, terrorist attack, when ethical hacking as a concept was put forward by EC Council, it received mixed responses. “Ethical Hacking” is an oxymoron and both, people and media were not ready to accept this term. EC Council explained it as a bodyguard to the computer systems. An ethical hacker is someone who follows ethical principles to protect information and systems from the unethical hackers. Recently, many organizations have faced cyber-attacks leading to the growing need of having professional ethical hackers who can safeguard their networks.
Organizations under constant Cyber-Attack
Banks are major targets therefore they always remain under cyber-threats. “Defending against cyber-attacks account for a significant portion of the $25 billion banks worldwide spend annually on security technology” (Source). Besides banks, other organizations small, medium or large are constantly under cyber-attacks. ‘Adobe Systems last year, faced a data hack of 2.9 million customers’ (Source). Security thus has become a mainstream requirement in today’s world.
To stop a hacker, one needs to think like one and this is what ethical hacking is all about. Ethical hackers also perform security tasks like hackers; however it is to protect the computers and networks of an organization. They have the permission to hack organization’s network in order to perform tests that keep it safe from illegal hacking. Ethical hackers help in improving the security of systems in organizations.
Transition to Cloud Increases Demand of Ethical Hackers
The information world is moving towards Cloud where Virtualization and IT outsourcing are major trends. This transition has increased the level of threats and therefore the demand of ethical hackers. Since the advent of cloud computing, security has been a major concern. In order to avail the benefits of cloud and virtualization without harming the security, companies need to go for ethical hackers. The major challenge that today’s businesses face is the fast growing cyber world and the complexities of security requirements. The hacking tactics are evolving every day and only an expert professional can overcome this challenge. Ethical hackers are thus in high demand in today’s business world.
Why Hire Ethical Hackers?
- To build a computer system that prevents hackers’ access and safeguard system and information from malicious attack
- To manage adequate preventive measures in order to avoid security breaches
- To safeguard user or customer information available in business transactions and visits
- To test networks at regular intervals
- To create security awareness at all levels in a business
Hiring an Ethical Hacker
Companies like IBM employ teams of Ethical Hackers to keep their systems secure.
Costs of security testing vary based on businesses. Businesses with large user data base might need to pay hefty costs while others might pay lesser for information security. Tasks like checking of firewalls, servers, IP addresses do cost high but this investment is justified compared to the loss caused by cyber-attacks. To safeguard the systems, companies can either hire an ethical hacking firm or agency or hire ethical hackers. This decision is made based on various factors. Few businesses cannot afford to allow other agent to hack in systems from outside for security and therefore hire in-house ethical hackers. While others go for ethical hacking firms to protect their systems and network. In both the circumstances, ethical hackers need to sign a legal agreement with various terms and conditions with the host client.
Today, hiring ethical hackers is not a matter of choice but a necessity for businesses. EC Council governs the Certified Ethical Hacker program to qualify professional hackers. For all obvious reasons, CEH are in high demand in businesses across industries worldwide.
STOLEN APPLE IDS USED IN STRING OF DIGITAL PAYMENT THEFTS IN CHINA, SAYS REPORT
Popular Chinese e-transaction giants Alipay and Tencent Holdings are warning users that hackers used hijacked Apple IDs to steal cash from customers’ accounts, according to a Bloomberg report Wednesday. It’s unclear how much the hackers stole.
Alipay said in a blog post that it’s working with Apple to figure out how the hackers got in. The company warned that customers may be vulnerable to theft if they’ve linked their Apple IDs to Alipay accounts, WeChat Pay or credit cards. Alipay suggested users lower their transaction limits to prevent large amounts of money from being stolen.
When reached for comment, Apple didn’t directly address the stolen Apple IDs.
“We encourage customers to create a strong password and turn on two-factor authentication to protect their accounts,” an Apple spokesperson said in an emailed statement.
Tencent, which developed the popular chat app WeChat, reportedly said it’s also contacted Apple. It advised users to safeguard their Apple ID. WeChat has more than a billion users worldwide and can be used to pay for basically everything in China.
Alipay operates under Ant Financial, which is controlled by Jack Ma, the billionaire co-founder of e-commerce giant Alibaba.
Alipay and Tencent Holdings didn’t immediately respond to requests for comment.
RUSSIA GRU CLAIMS: UK POINTS FINGER AT KREMLIN’S MILITARY INTELLIGENCE
The UK government has accused Russia’s military intelligence service of being behind four high-profile cyber-attacks.
The National Cyber Security Centre says targets included firms in Russia and Ukraine; the US Democratic Party; and a small TV network in the UK.
A Russian foreign ministry spokeswoman described the accusation as a “rich fantasy of our colleagues from Britain”.
World Anti-Doping Agency computers are also said to have been attacked.
Files later emerged showing how British cyclists Sir Bradley Wiggins and Chris Froome had used banned substances for legitimate medical reasons.
At the time, some of the attacks were linked to Russia – but this is the first time the UK has singled out the GRU, the Russian military intelligence service.
British police think the men who carried out the Salisbury poisoning in March worked for the same group.
Speaking on behalf of the Russian foreign ministry, Maria Zakharova said the UK’s accusations were “mixed in one perfume bottle”, adding: “Maybe a Nina Ricci bottle: GRU, WADA, Kremlin hackers – it’s a diabolical perfume.”
But Defence Minister Gavin Williamson condemned Russia as a “pariah state”, and said Moscow’s “reckless and indiscriminate” attacks had left it isolated in the international community.
The NCSC said it has assessed “with high confidence” that the GRU was “almost certainly responsible” for the cyber-attacks.
Foreign Secretary Jeremy Hunt said the GRU had waged a campaign of “indiscriminate and reckless” cyber strikes that served “no legitimate national security interest”.
Cyber security consultant Andrew Tsonchev said individuals can get “caught up” in the attacks.
He said: “The more obvious and urgent effect that people need to be aware of is that the services they use – the essential services – are at risk and are actively being targeted for sabotage.”
What is the GRU accused of?
The NCSC says hackers from the GRU, operating under a dozen different names – including Fancy Bear – targeted:
- The systems database of the Montreal-based World Anti-Doping Agency (Wada), using phishing to gain passwords. Athletes’ data was later published
- The Democratic National Committee in 2016, when emails and chats were obtained and subsequently published online. The US authorities have already linked this to Russia
- Ukraine’s Kyiv metro and Odessa airport, Russia’s central bank, and two privately-owned Russian media outlets – Fontanka.ru and news agency Interfax – in October 2017. They used ransomware to encrypt the contents of a computer and demand payment
- An unnamed small UK-based TV station between July and August 2015, when multiple email accounts were accessed and content stolen
Former UK diplomat Lord Ricketts said it was likely the Russians targeted Wada “to distract from the very serious allegations about Russian athletes”, and targeted the Ukraine as they were trying to “destabilise” the region.
But he added other attacks seemed random and might have been part of a “pilot project” to “see what they can do at a point where they wanted to use” cyber warfare.
What has the UK government said?
“The GRU’s actions are reckless and indiscriminate: they try to undermine and interfere in elections in other countries; they are even prepared to damage Russian companies and Russian citizens,” said Foreign Secretary Jeremy Hunt.
“This pattern of behaviour demonstrates their desire to operate without regard to international law or established norms and to do so with a feeling of impunity and without consequences.
“Our message is clear: together with our allies, we will expose and respond to the GRU’s attempts to undermine international stability.”
Lord Ricketts believes rather than the UK participating in an offensive cyber counterattack, the government should continue targeting “dodgy Russian money” with economic sanctions.
By Gordon Corera, BBC security correspondent
Today’s statement is part of a drive by Britain to keep the pressure on the Russian state and specifically on Russia’s military intelligence outfit – the GRU.
Some of these cyber-attacks had been previously attributed by private sector researchers to Russia. Britain had also attributed other cyber-attacks to Russia.
But for the first time British intelligence has singled out the GRU – and not just the Russian state – as specifically responsible for a series of events which hit a wide range of targets.
The statement also collates the range of names that have been publicly linked to the GRU by different security researchers.
Some are well known, like Fancy Bear, and others less well known. The British statement puts them all together in one place and confirms that in the view of British intelligence they all belong to the GRU.
Do other countries carry out cyber attacks?
Russia is not the only state to have been accused of cyber-attacks.
- The UK blamed the Wannacry ransomware incident on North Korean actors in December 2017, as did the US, Australia, Canada, New Zealand, Denmark and Japan
- In March this year, Britain blamed a campaign targeting universities around the world, including in the UK, on the Mabna Institute based in Iran
- China-based groups linked to the state were accused of hacking UK think tanks last year by a US cyber-security company which investigated
- In April, the UK said it had conducted a “major offensive cyber-campaign” against the Islamic State group.
What is the GRU?
The GRU, also known as the Main Intelligence Directorate, is the intelligence arm of the Russian military.
It is different to the former KGB (now known as the SVR and FSB) as it conducts undercover military operations and collects intelligence operations around the globe.
In recent years the GRU has been accused of undercover involvement in the conflict in Ukraine, which saw the Russian annexation of Crimea in 2014.
It is believed that the two men accused of poisoning Russian ex-spy Sergei Skripal and his daughter Yulia, named as Alexander Petrov and Ruslan Boshirov, were GRU agents.
GOOGLE TESTED THIS SECURITY APP WITH ACTIVISTS IN VENEZUELA. NOW YOU CAN USE IT TOO
When Jigsaw tested this privacy app with a few dozen political activists in Venezuela, the company wanted to keep the trial small.
Within weeks, thousands of people around the world were using Intra, a security app used to stop government regimes from censoring the internet and manipulating traffic.
On Wednesday, Jigsaw, a tech incubator owned by Google’s parent company, Alphabet, announced it’s releasing this app to the world.
The app takes on DNS (Domain Name System) manipulation, one of the most common techniques used for political manipulation and spreading malware. Intra creates an encrypted connection between your phone and, which makes it much harder for governments and hackers to intercept that traffic.
“DNS manipulation represents one of the most common forms of censorship in the world,” said Justin Henck, a product manager at Jigsaw. “That’s true for people at risk as well as those who are just trying to live out their lives and understand what’s going on.”
Think of DNS servers like a phone book — something that matches up a domain name that you type in with the website’s IP address, where it’s actually hosted.
When connections aren’t secure, attackers can intercept DNS traffic, directing people to pages infected with malware instead, or completely block out online resources. Venezuela’s government has been known block access to social media applications and news websites through DNS manipulation, according to a study from the Open Observatory of Network Interference.
The practice is widespread, as researchers have found governments in more than 60 countries, including Iran, China and Turkey, using DNS manipulation to censor parts of the internet.
Intra was released on the Play Store on Wednesday morning for free, and Jigsaw had been testing its security features among a small group of activists in Venezuela since the beginning of the summer, Henck said.
They wanted to keep its public beta limited, but the app spread through word of mouth in Venezuela, to the point where activists from around the world started using it.
“People found it useful as a tool they could use to get the access that they needed,” Henck said.
Intra automatically points your device to Google’s public DNS server, but you’re able to point it to change it to other servers like Cloudflare’s 126.96.36.199 through the settings. There’s not much you need to do with it for your encrypted connection — the app really has only one button that you tap to turn on.
This encrypted connection to DNS servers comes by default on the upcoming version of Android Pie, but Jigsaw’s developers realized that millions of people that don’t have the latest updates wouldn’t have that same protection. It’s important to consider when about 80 percent of Android’s users aren’t on the latest version of the mobile operating system.
“There were millions of users that we realized we weren’t going to help just by adding features to Android 9,” said Ben Schwartz, the lead engineer on Intra.
The app should be compatible with 99 percent of Android phones, he said. When Jigsaw’s engineers tested it with Venezuelan activists, the majority of people were using devices from 2011 and 2012, he added.
“It’s been really valuable to be able to reach all those users,” he said.
Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.
Blockchain Decoded: CNET looks at the tech powering bitcoin — and soon, too, a myriad services that will change your life.