The first 24 hours after a cyber attack

The first 24 hours after a cyber attack

by | Feb 20, 2017 | Tech

The first 24 hours after a cyber attack

A simple guide on how to respond to a cyber attack:

Data Breaching

by Praise Maukazuva

A data breach is when your personal data has been viewed, stolen or used without any authorization.

Computer Security Incident Response Team (CSIRT)

Dealing with cyber attacks is strenuous. There is no guarantee that your security measures will keep your system or data safe.

Ways to respond to these attacks in an effective and comprehensive manner are actively being developed at the highest level in government bodies and International communities. However it is difficult to identify the type of attack you are facing until an investigation has been carried out.

First of all, you need a Computer Security Incident Response Team (CSIRT) to manage the whole process. They should all be assigned to a task each, for example one member will deal with how to notify affected users or IT specialists in case there is a technical fault.

Notifications

Secondly, notifications are sent to affected users. For example, in a company, employees, investors, and customers should be notified. Most importantly the law enforcement and legal authorities should also be notified. The notification should include key details to show the source of the problem, how it is currently being fixed and assurance that it will not be a problem in the future. E-bay was criticized for not notifying its victims in time after its system was hacked in 2014.

As mentioned earlier, the type of attack is essential to determine the type of response. The network will be slower than normal due to reduced internet speed. This can be a sign of a hacking attempt or that the computer has been infected by a form of malware, or a network worm could be replicating itself. There could also be frequent antivirus software alerts reporting an infection in the computer.

After detecting the type of attack the next step would be to assess whether it is massive or not. Cyber attacks can either be a basic or sophisticated. So how do we distinguish between the two.

BASIC ATTACKS

BASIC ATTACKS involve small-time criminals such as individual hacktivists that target other private individuals and non-strategic Government departments for financial gain and publicity. They have limited skills and resources that are publicly known.

SOPHISTICATED ATTACKS

SOPHISTICATED ATTACKS are seriously organized crimes that are usually sponsored by the State and advanced tools are used. Their targets are the Government or Major Corporate Organizations for warfare, terrorism, major financial rewards and also to unveil National secrets.

In a sophisticated attack the whole system may be shut down and you will know that you have been attacked. For example a certain department in an Organization has its system shutdown by an attacker and for them to restore their system they need to pay money.

Prevention

Next step is to prevent the attack from spreading into other systems as well. You can keep all affected systems or devices offline,isolated or suspended to stop incoming traffic from the attacker. Passwords should be changed and strengthened.

Do not delete any files, as they might be useful during the investigation.

Continuously document the whole process. So far, the type of attack, the areas it has affected, how it occurred and how it was detected should have been documented. This will be for future references.

Forensic

The most important step would be to contact a forensic team or cyber security experts to further investigate the incident. The investigation will include:

  • Identifying the attacker or the cause of the attack
  • Detecting previously unknown security vulnerabilities
  • Identifying areas that need improvement or better security.
  • Assist in repairing the damage and re-building a stronger system protection with sophisticated security measures.

The forensic team uses a variety of tools during the investigation process. A simple example is TRIPWIRES, a software that detects critical file changes and intrusions on the network.

In short, a cyber attack response involves:

  • Form an incident response team
  • Notify victims and law enforcement
  • Detect the type of attack
  • Assess the scale of the attack
  • Prevent further damage
  • Document the steps taken and why they were taken
  • Contact security specialists for forensic investigation
  • Recover system with prevention measures

An effective method of response to a cyber attack is necessary as it minimises loss and data destruction. It shows vulnerabilities that were compromised and methods to avoid or reduce future risks!

3 methods Cyber Criminal uses to hack your password

3 methods Cyber Criminal uses to hack your password

by | Feb 7, 2017 | Tech

3 Methods Cyber Criminal Uses To Hack Your Password

Praise Maukazuva, 7 Feb 2017

Most people use a convenient password that they can recall in the future.

According to the Cyber Streetwise campaign that was carried out by the U.K Government in 2016, it is said that 35% of the people struggle to remember their passwords.

Unauthorized access is a major problem for people who use computers, tablets, mobile phones and other computer devices, and passwords act as the main defense in protecting your data. Here are some of the methods used by cyber criminals to acquire your passwords, for fraudulent reasons.

1. Password cracking

This includes guessing the most common passwords used by people.

The “Most Common Passwords of 2016 List” researched by Keeper Security revealed that 17% of the people used “12345” as their password to secure their accounts. More weak passwords include “Password” which comes as the second worst password. “QWERTY,” on the other hand is also widely used. Besides it being rather short and letters only, which makes it easy to break down. However, the movie “StarWars” based passwords have been widely used lately.

An example of a strong password that can be difficult to crack is “My$3cur1ty#” for “My security number.” as it includes all the required characters.

So how do these cyber criminals crack passwords? Two most common ways are “Brute Force Attack” and “Dictionary Attacks”.

In Brute Force attack, every possible password is tried and tested until it finds the right password. This method is only suitable for short words, because the longer the word the more time it takes to test the password. Brute force attack uses a lot of software tools, such as Cain and Abel, John the Ripper and Air cracking depending on the operating system.

Dictionary attack uses a list of common single words from the dictionary. This method is suitable for long words, and it is more advanced as you can add symbols and numbers in front or at the end of the word. But the words have to be real dictionary words that are spelt properly which can be a limiting factor. Software tools such as brutus and crowbar are used.

Image: Dribbble, Kristin Fall Bonett

2. Malware

Spyware is an example of malware, a malicious code that can access your computer through downloading pirated files or simply clicking pop up ads that are infected. This malware monitors a user’s activities such as sites visited and programs that were run thereby tracking log in passwords and usernames.

Shockingly 80% of personal computers is infected with some kind of spyware, without their knowledge, as it works in the background silently making changes and recording activities.

Image: www.taringa.net

3. social engineering

This is a manipulative way of getting personal information from individuals, this information is then used for fraudulent ways. Types of social engineering include, phishing and scareware.

  • In phishing, you receive an email that will enable you to click a link that redirects you to a fake website asking your for your passwords and credit card details. An email may come as :

“You won $1 million! Click here for your reward!”

With all the excitement you are quick to click on the link that will require you to enter your password.

  • Scareware on the other hand, involves the attacker tricking you into believing that you have malware in your computer. They will act as if they are helping you get rid of it but in turn, they are making you download the actual malware.

The more developed we are in terms of technology, the more methods of acquiring passwords maliciously there are, advancing with time also.

However, There are many ways of keeping your data safe with a password that is difficult or impossible to acquire.

Tips on choosing a good password

People struggles to create a good password because they think that the strongest passwords are not easy to remember. This is not true. Below are some of the ways of creating a strong password.

1.

Use of Long phrases with numbers, symbols, letters, lower cases and upper cases. The longer it is, the harder it is to break down.

2.

You need to have a different and unique password for every service. Avoid using the same password for your E-mail services and also banking services.

3.

Use of Biometrics. Nowadays mobile smart phones, tablets or laptops allow you to gain access to them using your fingerprints or through voice recognition. You don’t need to remember your password.

4.

Use of Password Managers. Examples of these include LastPass, DashLane, 1Password and Norton. It can be in the form of a mobile application, that stores all your passwords, for every service. You just need to remember your master password that will unlock your other passwords. They usually come with a browser extension where you can log in to your accounts automatically.

5.

The two-step Verification. During the signing in process, a code is sent to your mobile phone, and you are supposed to enter that code in order to gain access for example to your e-mails. However without the code, there is no access.

6.

This consists of simple steps, that are easily ignored such as, not sharing the password, not to write it down, and also to change it regularly.

Implementing a few of these facts is better than not implementing any of them. However the goal here is to make sure that our Personal files and data are kept safe by a very strong password.

Can you get hacked?

Can you get hacked?

by | Feb 3, 2017 | Tech

Imagine the amount of personal information, the purchases you make and all your day to day processes that are stored in your computer. Are they all secure?

Cyber Security is one of the most urgent issues of the day. Cyber attacks have evolved over the years in parallel to the advancement of the tech industry and will continue as the network expands. It is advisable to take the right prevention techniques as they say prevention is better than cure.

Let’s take a look at some of the most common cyber attacks around.

1. MALWARE

Malwares are basically software with a malicious intent to either steal your data or to destroy your operating system. It operates on computers, smartphones, tablets and even servers. It houses a variety of cyber threats:

  • Worms – Just like a virus, it replicates itself and spreads, but only across the network.
  • Trojan horses – they are harmless until they are activated and their intentions are to steal data or files. Trojan horses generally don’t spread like worms.
  • Viruses – This type of malware reproduces itself and spreads from file to file, slowing down the system, disrupting operations and also deleting files.
  • Spyware – Spyware monitors all your activities, sites visited, programs run to track login and password information.

Malwares are transmitted via email attachment, instant messaging or a website that is either infected or malicious. Some websites will automatically download the malware without users’ knowledge.

It tricks you into clicking, for example, an email attachment or a software download, resulting in it being installed in your computer. Once installed, it spreads and starts executing malicious commands.

How to avoid

 

  • This type of cyber attack can be avoided by simply installing an antivirus or antimalware software, once installed it has to be updated and run regularly. You can schedule automatic scans on your computer too for consistency.
  • Avoid opening emails or messages from unknown recipients and also websites with illegal or pirated content. Files should always be scanned before they are downloaded.
  • Use strong passwords, include upper cases, lower cases, numbers and symbols as they are difficult to crack. Avoid using common English words.
  • Lastly, backup all your files, using an external hard disk or cloud services regularly.

2. RANSOMWARE

This is a new type of malware. It limits users from accessing their systems or files by locking their screens or the files until a ransom in the form of money is paid in order to restore your computer.

The data can be converted into a code that can not be read or understood, and in order to make your data understandable, an online payment must be made. This malware can be delivered to your computer through email attachments or pirated downloads.

It tricks you into clicking, for example, an email attachment or a software download, resulting in it being installed in your computer. Once installed, it spreads and starts executing malicious commands.

How to avoid

  • Install an antivirus software that supports internet security features. This will scan your emails and downloads.
  • Your data always backup your files. You can use external hard drives, USB flash drives or Cloud storage such as Dropbox.
  • Use strong passwords, include upper cases, lower cases, numbers and symbols as they are difficult to crack. Avoid using common English words.
  • Do not open attachments that look suspicious or messages sent by unfamiliar people and avoid clicking on just any hyperlinks especially on social media.

3. PHISHING

Phishing is when personal data such as passwords, usernames, or credit card information are stolen. How does it work?

A user receives an email from someone pretending to be a trustworthy bank or credit card company for example, that will redirect the user to a fake website that is identical to the original website.

The website will then prompt the user to enter personal email address, password or credit card information.

How to avoid

Phishing, however, can be avoided. Received emails must be checked carefully. Phishing emails usually have a “dear customer” without stating the name of the receiver. Such emails need you to verify with the organization stated in the email. During the verification, one should not use any email address or phone number from the email received.

Entering confidential information should be avoided at all costs, and this information should never be sent through emails. Online banking credentials should be changed regularly to avoid targeted attacks.

4. DENIAL OF SERVICE (DDoS)

This cyber threat disrupts the service of a network and brings servers to a halt. Attackers use multiple computers to send large volumes of data packets and traffic to the network.

This will slow down the network performance and the user will not be able to access any websites, resulting in low productivity especially for businesses. There will also be a dramatic increase in spam emails.

How to avoid

DDoS attacks can be prevented by installing a firewall. Firewalls can be hardware or software based, and they control the amount of incoming and outgoing traffic.

Firewalls can detect irregular traffic patterns and fend them off.

Email filters, on the other hand, will reduce spam emails.

“Understand what data you hold, how you are using it, and make sure that you are practicing good data hygiene”

David Mount, Director, Micro Focus, London – April 2016

 

Building the Malaysia-Singapore HSR

Building the Malaysia-Singapore HSR

by | Jan 25, 2017 | Branded Content, Tech, travel

Building the Malaysia-Singapore HSR

In July of 2016, Malaysia and Singapore signed an agreement to build a high speed rail system that would extend 350 kilometers from Kuala Lumpur’s Bandar Malaysia to Singapore’s Jurong East.

The project, estimated to cost between RM 50 – 60 billion and slated to begin its construction in 2018, will be completed by the end of 2026, connecting 8 cities across Malaysia and Singapore.

The initiative is part of the Malaysian government’s Economic Transformation Program (ETP) that aims to further develop the local economy through investment and infrastructural development.

Do we need the HSR?

It is estimated that trips between Malaysia and Singapore will more than double by 2060. This presents a problem because the causeway between Singapore and Johor in Malaysia is already overly congested and in need of a re-assessment.

The railway is expected to cut the travel time between Kuala Lumpur and Singapore to 90 minutes instead of the current 4-5 hours by road or 3 hours by air.

The high speed railway is also expected to cause a boom along the towns and cities along the line due to the ease of transportation of labor, goods and tourism.

The Japanese Shinkansen Network

The Japanese company that has expressed the bid for the construction of the Malaysian high speed railway is Shinkansen. A company with a long and impressive history with high speed railway development.

Not only does Shinkansen hold the record for the fastest high speed railway in the world, it also boasts impeccable safety accomplishments. The Japanese high speed railway has not had a single fatal accident in more than 50 years, despite having passenger numbers that have surpassed 10 billion.

The Japanese regularly smashes its own speed records, establishing and breaking its own top-speeds in 1997, 1999, 2003, 2015 and recently when the Japanese Maglev reached speeds of 603 km/h in 2016.

The train that broke the recent 2016 record, the floating Maglev, earned its name because, unlike traditional trains, the Maglev doesn’t use metal train tracks. Instead, it floats 10cm above the rails through the use of magnetism. The magnetic levitation means that the train has no contact with the ground whatsoever, allowing for friction-less movement.

Shinkansen’s advanced technology has not only been used inside Japan, but has also been adopted by other countries like China’s CRH2 Railway, which is designed after Shinkansen’s E2-1000 series. Or Taiwan’s high speed rail which operates the 700T series which was built by Japanese engineers. India also decided to adopt the Japanese high speed railway system. In addition, the Japanese system, Shinkansen, is expanding to Thailand and the US.

If the Japanese Maglev technology was applied to the Malaysian high speed railway, it would take about 50 minutes to reach Singapore from Kuala Lumpur.

HSR’s impact on local economic growth

High speed railways do have an indisputable reputation of growing local businesses by allowing ease of transportation of goods, tourism, services and labour.

A research paper co-authored on the effects of the HSR on Japanese businesses by economists from Dartmouth College, the University of Oslo, and Japan’s Research Institute of Economy, Trade, and Industry took into consideration the linkages formed between different businesses and their suppliers by the construction of high speed railway systems found that the construction of advanced transportation such as the high speed rail allowed smaller businesses to compete with its bigger counterparts.

This is because smaller firms may not have the capability to transport goods from their respective suppliers across long distances, which may cause a lapse in quality.

So far, Japan, Germany, Spain, France and China have all expressed tender intent to the Malaysian government, but Malaysia has yet to make a decision on who will be the main contractor of the HSR.

Shinkansen

Japan's high speed rail expert with over 51 years of experience
Follow us on Facebook

Do you support the HSR project? Share your view.

Breathe better with cleaner air

Breathe better with cleaner air

by | Jan 6, 2017 | Branded Content, Lifestyle, Tech

Breathe better with cleaner air

The transboundary haze plaguing Malaysia annually has raised the public’s awareness on the importance of good air quality. Consequently, there are now a plethora of air purifiers in the market. As such, shopping for one can be a daunting task.

We surveyed the market to give you a brief review of what is available in Malaysia. Below, we compare the attributes of air purifiers from five popular brands – Coway, Cuckoo, Dyson, Panasonic and Sharp.

A good air purifier is effective in both removing airborne particles and improving indoor air quality. The objective of the air purifiers is to minimize the hazardous health effect of polluted indoor air in a user friendly manner by continuously reducing the concentration of particles in the air to a minimum, especially the smallest particles (nano particles, below 0,1micron) as these are considered causing the most severe health problems.

Coway has four air purifiers available in Malaysia. The Dolomities has a 4-step filtration, the Indicator and Tuba have 5, and the Lombok II has 6. All of them feature Coway’s Anti-Flu HEPA™ Filter that eliminates cigarette smoke, micro dust, bacteria, viruses and germs. Indicator and Lombok II have a resistive barrier discharge (RBD) plasma and filtration system that generates charged ions that capture airborne particles and sterilise moulds and germs like Aspergillus, Nigermand and E.Coli and decompose harmful gases like formaldehyde. All but Dolomities have a deodorisation filter.

Source: Coway

Cuckoo only has one air purifier in the market, simply named B Model, which is certified with the Clean Air Mark by the Korean Air Cleaning Association. It features an 8-level filtration, which consists of 5 filters – “Pre-Filter, Allergen Plus, Harmful Gas Relax, Deodorixing, 4-in-1 HEPA” – and a plasma ionizer. Cuckoo boasts of filters that are 1.5x larger than those of regular air purifiers (300×465).

Dyson, meanwhile, boasts of filters capable of capturing pollutants as small as 0.1 microns. Moreover, Dyson’s 360° Glass HEPA filter is engineered to draw air from all around, allowing free positioning of the machine. A layer of activated carbon granules captures odours and potentially harmful toxins like paint fumes.

Dyson’s patented Air Multiplier™ technology draw air through the filter and accelerate it through the machine, creating a long-range stream of smooth air. It’s the same technology used in Dyson’s bladeless fans.

The Dyson Pure Cool™ and Pure Cool™ Link are also low maintenance. Some purifiers rely on you changing, washing and drying your filters every month or so. Waiting for the filters to dry can result in up to six hours without a purifier. It takes fewer than 60 seconds to replace Dyson’s filter, and only after using it for 12 hours every day for a year.

Dyson’s 360° Glass HEPA filter is engineered to draw air from all angles

Panasonic, meanwhile, feature long-lasting filters (other than the pre-filters). The filters of the F-VK655A last 5 years while those of F-VXK70A lasts 10 years.

The key technology in Panasonic air purifiers is nanoe™ – it claims that this technology inhibits 99.9% of viruses and bacteria, reduces 90% of odour after 30 minutes, and even restores moisture back to your skin! A nanoe™ is a fine (5-20nm) and weak acidic water particle with a reactive substance and an electric charge. nanoe™ possesses the characteristics of removing hydrogen from viruses, bacteria, odours and allergens. It has a lifespan 6x of normal ions. The nanoe™ dimension is one-billionth parts of vapour, which enables it to easily penetrate textile fibres and eliminate bacteria and odour.

Sharp has a similar technology, which it calls Plasmacluster Ion technology, that powerfully and quickly removes airborne particles.

Mechanism for removing bacteria from the air using Plasmacluster (for illustration purpose only)

Source: Sharp

Filtration aside, there are other unique characteristics that may sway you to consider them.

Sharp, for example, has two air purifier models that can also double as a mosquito catcher! Some of the Panasonic and Sharp models are also humidifiers. Cuckoo has voice guide enabled — you can choose between English, Malay and Mandarin.

Dyson air purifiers double as fans and arguably the most aesthetically-pleasant air purifiers in the market. Not that because they are fans, they tend to be louder than others when on higher fan speeds. Nonetheless, they are quieter than regular blade fans. Moreover, while other air purifiers rely on big AC motors and large filters to purify the air, taking up valuable space in your home, Dyson purifier fans use a small efficient DC motor. Its compact footprint makes it smaller than conventional purifiers.

Dyson purifiers can be set to automatically monitor, react and purify the air — multiple sensors  detect changes in conditions, before automatically adjusting airflow to maintain your target air quality. Live air quality metrics are then sent straight to your Dyson Link app (for Pure Cool™ Link machines). You can also control your purifier remotely via the app.

Brand Model Power Consumption Airflow Rate Noise Level (dB) Pollution Indicator Weight (kg)

Indicator

 5.6 – 38.0W 1.9 – 5.1 m³/min 21.1 – 48.0 Colour Indicator 7.9

Lombok II

 13 – 72W 1.6 – 7.1 m³/min 20.0 – 70.5 Colour Indicator 12.0

Tuba

 106W Max 4.2 – 16.8 m³/min 31.2 – 52.5 Colour Indicator 25.0

B Model

 16.4 – 33W n/a n/a -Colour indicator

-Contamination figure

-Voice Guide

 11.4

Pure Cool™

 56W 33.4 litres/s 63dBA
(Max Setting)		 Colour indicator. Detailed reported shown via Dyson Link App. 3.03 (desk)

—

3.2 (tower)

Pure Cool™ Link

 56W 418 litres/s 63dBA
(Max Setting)		 Colour indicator. Detailed reported shown via Dyson Link App. 3.03 (desk)

—

3.2 (tower)

F-VK655A

 12 – 54W 1-5.5m³/min 10 – 58 Colour indicator 11.9

F-VXK70A

 n/a 1.1-6.7m³/min 18 – 54 Colour indicator 10.2

 

Brand & Model Power Consumption
—
Airflow Rate		 Noise Level
—
Pollution Indicator		 Weight (kg)

Indicator

 5.6 – 38.0W

—

1.9 – 5.1 m³/min

 21.1 – 48.0

—

Colour Indicator

 7.9

Lombok II		 13 – 72W

—

1.6 – 7.1 m³/ min

 20.0 – 70.5

—

Colour Indicator

 12.0

Tuba		 106W Max

—

4.2 – 16.8 m³/ min

 31.2 – 52.5

—

Colour Indicator

 25.0

B Model

 16.4 – 33W

—

n/a

 n/a

—

Colour indicator, contamination figure, voice Guide

 11.4

Pure Cool™

 56W

—

33.4 litres/s

 63dBA
(Max Setting)—Colour indicator. Detailed report shown via Dyson Link App.		 3.03 (Desk)

—
3.2 (Tower)

V6 Entry

 56W

—

418 litres/s

 63dBA
(Max Setting)—Colour indicator. Detailed report shown via Dyson Link App.		 3.03 (Desk)

—

3.2 (Tower)

F-VK665A

 12 – 54W

—

1 – 5.5 m³/min

 10 – 58

—

Colour Indicator

 11.9

F-VXK70A

 n/a

—

1.1 – 6.7 m³/min

 18 – 54

—

Colour Indicator

  

10.2

Decent air purifiers are not cheap. Coway and Cuckoo air purifiers can also be rented if you prefer not to buy them outright.

Coways range from RM2,500 to RM4,500 or RM85-150/month to rent. The Cuckoo B Model is RM2,988 or RM120/month to rent. Dyson’s Pure Cool™ Link tower costs RM3,399 while the desk model costs RM2,599. Panasonic models range from RM599 for the entry level F-PXJ30A with 20m2 coverage, to RM2,999 for the F-VK655A. Sharp air purifiers range from RM549 to RM2,619, with the two mosquito catcher models costing RM769 and RM1,049.

Dyson's Trade in Campaign

If Dyson tickles your fancy, you may want to take advantage of its trade-in campaign running from 10 Dec 2016 to 29 Jan 2017. Enjoy 15% off all Dyson technology (vacuum cleaners, bladeless fans and purifier fans). When you trade-in any vacuum cleaner, desk/floor standing fans or air purifiers. Terms and conditions apply.

Trade-in now