The Giant Email Hack That Wasn't

And most of the data in question was “bogus.”

On Thursday, a Reuters report described how hackerswere peddling some 272.3 million usernames and passwords for unsuspecting users’ email accounts, raising concerns of yet another major data breach at a time when cybersecurity sensitivity is at an all-time high.

Ensuing stories suggested the information had been pilfered from popular consumer services including Gmail, Yahoo Mail, and Russia’s Mail.ru. By Friday, though, the services themselves (as well as independent analysts) concluded that the situation was not quite what it seemed.

The data stash was not the product of a large-scale hack of some of the world’s biggest email platforms, they argued. Instead, it seems to have been drawn from a variety of less secure third-party sites over a long period of time and subsequently aggregated.

What’s more, most of the stolen credentials were invalid.

Get Data Sheet, Fortune’s technology newsletter.

Yahoo  YHOO 0.79%  has issued a statement denying that it was hacked, as did Mail.ru, Russia’s biggest email provider. Google  GOOG 1.38%  told Ars Technica that 98% of the Google user data in the database was “bogus.” Mail.ru’s analysis found that 22.56% of Mail.ru email addresses in the database did not exist, another 64.27% were matched to incorrect passwords, and the remaining 12.42% had already been identified as compromised. Only 0.018% of the email-password combinations, the company said, were correct and current.

The original report, from a firm called Hold Security, actually made clear that the database was a “collection of multiple breaches over time,” which explains why most of the data was outdated and most passwords incorrect. These sorts of collections of many smaller hacks are widespread on the so-called dark web, where low-level hackers offer to sell the usually not-very-useful data for small sums. The compiler of this particular database was asking for $1, which Hold said was a red flag about the quality of the data.

Though Hold Security was clear from the outset about what it had found, critics, including at Ars Technica, say the company should have done more to cool down the media response. Troy Hunt, who runs a large database of compromised login data, has questioned whether Hold Security CEO Alex Holden should have done more to verify the data before going to the press.

The knee-jerk reaction to the incident may have been too severe, but there remains a real lesson to draw from the situation. Some of the accurate email-password combinations found in the data cache probably came from users who re-used their email passwords on other sites.

So, in case you needed to be reminded, don’t do that.

Microsoft Will Integrate Ubuntu Linux In Windows 10

Microsoft Will Integrate Ubuntu Linux In Windows 10

Somethhing amazing was happened on the first day of Microsoft’s Build Developer Conference 2016, where Microsoft announced that “MICROSOFT WILL INTEGRATE UBUNTU LINUX IN WINDOWS 10”.

Microsoft Will Integrate Ubuntu Linux In Windows 10

Recently the BQ company has put on sale, the first tablet with UbuntuTouch OS in the world, and previously also opted for smartphones. But in the ‘Desktop World’, considering desktops and laptops, Ubuntu takes many more years of filming and has been raised for years as one of the GNU / most interesting Linux as an alternative to desktop users of Windows. Now, Microsoft is very close to the integration of Ubuntu within its own computer operating system, Microsoft Windows 10.

Microsoft’s Kevin Gallo on stage at of Build Developer Conference 2016 said that “The Bash shell is coming to Windows. Yes, the real Bash is coming to Windows, This is not a VM. This is not cross-compiled tools. This is native,” he also added that “We’ve partnered with Canonical to offer this great experience, which you’ll be able to download right from the Windows Store.”

According to the agreement with Canonical, it will allow Windows 10 users soon to run Ubuntu and Windows 10 simultaneously on their computers, not as a virtualized operating system. However, as a part of the native libraries of Windows 10, which is not expected to be available for the users who has the Unity interface, since a change would be more focused on developers.

The interesting thing is the integration is the ability to use tools such as BASH Shell and Terminal desktop operating system Ubuntu, beyond user functions by passing own system interface. Thus, while keeping intact the own interface in Microsoft Windows 10, without possibility of loading the elements of Ubuntu, would mean the complete integration of Linux within Windows 10 and in addition to the hand of one of the most recognized distributions.

According to this movement, on the other hand, Microsoft would have a strong support for the development of their tools of cloud computing, and will have support of a truly broad community to work in software solutions on its operating system. And what is not clear at this point, whether Ubuntu would remain available also independently, as before it was, or this integration would end installable distributions of Ubuntu.

Six Things to Watch for in 2016

Well, if you thought you had it rough in 2014 because of big, bad Poodles and an irritating case of Heartbleed, things only got worse this year. Rather than intrusions permeating our IT systems and stealing our data, attacks got a bit more personal in 2015. Not only were privacy and civil liberties put at risk by legislators pushing overbearing rules based on an underwhelming knowledge of computers, but hackers and security research were squarely in the crosshairs of government and law enforcement. It was a rough year.

What’s ahead? Who knows? Who saw Wassenaar coming? Or Going Dark? Or backdoors in enterprise networking gear? Nonetheless, 2016 can be better with some prep work against a best guess of what we might be in for as the new year turns.

Activism is Job 1

Security researchers and advocates have certainly grown up in the last two years. Emerging from the shadows of SOCs and IT labs, researchers spurred on by the assault on crypto, privacy and overall integrity of legitimate hacking, have evolved into a tidy and effective group of activists. Hopefully this trend continues, because with legislators and law enforcement convinced that things like CISA and Wassenaar and exceptional access are good ideas, there needs to be more voices from the security wilderness. Many of you have stood up and shouted about the lunacy of some of these ideas, and in the case of Wassenaar for example, a spate of rational, well thought-out comments put a temporary halt to the U.S. implementation of the rules. This was a victory that can be emulated on many fronts in 2016.

Securing Things

Brush off securing the Internet of Things as a fad, tomorrow’s problem, perhaps. But that’s foolhardy. Against the kicking and screaming of those who know better, we continue to embed tiny, networked computers in just about everything without clearly mapping out security and privacy implications. Just like mobile and client-server architectures before it, IoT has been rushed to market and security is flailing its arms desperately trying to catch up. Thankfully, we had our first inflection point in 2015 demonstrating the need to slow down—literally. Charlie Miller and Chris Valasek’s car-hacking research put a real face on the problem of IoT security. Their ability to remotely manipulate a moving automobile’s controls forced a recall of 1.4 million vehicles, and in the bigger picture, caused an entire industry to stand up and take notice.

The Kids Are Not Alright

Predicting at the start of 2015 that there would be a major health care data breach was a cakewalk. Five weeks into the year and we had Anthem, and shortly thereafter CareFirst Blue Cross. Health care data is the new hacker black, and attackers are taking advantage of organizations still behind in securing patient data and electronic health care systems. For next year, shudder to think it, but cybercrime is going to continue to target personal data in a big way and they’re going to go younger. We’ve already seen VTech and Hello Kitty breaches impacting the personal data of tens of thousands of children, giving hackers a long shelf life of identities to be exploited for fraud. Expect more of it in 2016.

Money On The Move

Now that mobile payment services like Apple Pay and Google Wallet have turned your smartphone into an extension of your wallets and bank accounts, expect hackers to turn out en masse against these systems. The juicy target for hackers may not be on the transaction side of mobile payments, but in the personal payment card data that lives on your device. An attacker with access to that data is a short hop away from being able to spoof your identity and payment data, and this is a shortcoming that needs to addressed next year.

Bury The Ghosts of APTs

Advanced persistent threats, a.k.a sophisticated nation-state sponsored targeted attacks, a.k.a China/Russia/the NSA, aren’t necessarily going away, but they are going to look different. Researchers at Kaspersky Lab say APT gangs are making strategic and tactical changes to their activities—likely since so many have been outed in the past 24 months. Expect to see more attacks with roots in memory-resident or fileless malware, Kaspersky says. APTs will be harder to detect because there will be fewer cookie crumbs for investigators to follow. The security company also said that APT gangs have likely invested enough in building custom malware and rootkits and commodity attacks will be repurposed more often.

Samy Time

Is there a more creative hacker than Samy Kamkar? He’s been around for a long time, but it’s likely he’d be hard-pressed to remember a year when he had as much fun tackling new problems. Very few hackers can say their resume includes the use of a child’s messaging toy to open garage doors on a whim, or game vehicles’ OnStar systems to gain persistent access to vehicles. Thrown in his take on the ProxyGambit attack, and Rolljam, another device that steal vehicular lock codes, and Kamkar had a busy year. Predicting what’s next is a crapshoot, but nothing in the

IoT universe seems out of reach.

12 Simple Steps To Become A Hacker

Hacking is an engaging field but it is surely not easy. To become a hacker one has to have an attitude and curiosity of learning and adapting new skills. You must have a deep knowledge of computer systems, programming languages, operating systems and the journey of learning goes on and on. Some people think that a hacker is always a criminal and do illegal activities but they are wrong. Actually many big companies hire hackers to protect their systems and information and are highly paid. We have prepared a list of 12 most important steps necessary to become a hacker, have adeeper look

1. Learn UNIX/LINUX

UNIX/LINUX is an open source operating system which provides better security tocomputer systems. It was first developed by AT&T in Bell labs and contributed a lot in the world of security. You should install LINUX freely available open source versions on your desktops as without learning UNIX/LINUX, it is not possible to become a hacker.

2. Code in C language 

C programming is the base of learning UNIX/LINUX as this operating system is coded in C programming which makes it the most powerful language as compared to other programming languages. C language was developed by Dennis Ritchie in late 1970’s. To become a hacker you should master C language.

3. Learn to code in more than one Programming Language

It is important for a person in the hacking field to learn more than one programming. There are many programming languages to learn such as Python, JAVA, C++. Free eBooks, tutorials are easily available online.

4. Learn Networking Concepts

Another important and essential step to become a hacker is to be good at networking concepts and understanding how the networks are created. You need to know the differences between different types of networks and must have a clear understanding of TCP/IP and UDP to exploit vulnerabilities (loop holes) in system.

Understanding what LAN, WAN, VPN, Firewall is also important.

You must have a clear understanding and use of network tools such as Wireshark, NMAP for packet analyzing, network scanning etc.

5. Learn More Than One Operating Systems 

It is essential for a hacker to learn more than one operating system. There are many other Operating systems apart from Windows, UNIX/LINUX etc. Every system has aloop hole, hacker needs it to exploit it.

6. Learn Cryptography

To become a successful hacker you need to master the art of cryptography. Encryption and Decryption are important skills in hacking. Encryption is widely done in several aspects of information system security in authentication, confidentiality and integrity of data. Information on a network is in encrypted form such as passwords. While hacking a system, these encrypted codes needs to be broken, which is called decryption.

7. Learn more and more about hacking

Go through various tutorials, eBooks written by experts in the field of hacking. In the field of hacking, learning is never ending because security changes every day with new updates in systems.

8. Experiment A Lot

After learning some concepts, sit and practice them. Setup your own lab for experimental purpose. You need a good computer system to start with as some tools may require powerful processor, RAM etc. Keep on Testing and learning until you breach a system.

9. Write Vulnerability (Loop hole program)

Vulnerability is the weakness, loop hole or open door through which you enter the system. Look for vulnerabilities by scanning the system, network etc. Try to write your own and exploit the system.

10. Contribute To Open Source Security Projects

An open source computer security project helps you a lot in polishing and testing your hacking skills. It’s not a piece of cake to get it done. Some organizations such as MOZILLA, APACHE offer open source projects. Contribute and be a part of them even if your contribution is small, it will add a big value to your field.

11. Continue never ending Learning 

Learning is the key to success in the world of hacking. Continuous learning and practicing will make you the best hacker. Keep yourself updated about security changes and learn about new ways to exploit systems

12. Join Discussions and meet hackers 

Most important for a hacker is to make a community or join forums, discussions with other hackers worldwide, so that they can exchange and share their knowledge and work as a team. Join Facebook groups related to hacking where you can get more from experts.

Best Android Hacking Tools 2016

Best Android Hacking Tools 2016

I’m going to post some latest best hacking tools 2016 for android and must have tools for every hacker.

As we all know hacking and pen testing is only can be done on computers. But now the world is changing now your mobile is smallhacking toolkit 2016 using these apps. Must try all these hacking tools 2016.

Also Read: Best Hacking Tools for PC

Best Android Hacking Tools 2016

Here are latest and best android hacking tools,

#1 The Android Network Hacking Toolkit

In the last Defcon conference a new tool has been released by a security researcher and the tool is called “The Android network toolkit”. The has been developed for penetration tester and ethical hackers to test any network and vulnerabilities by using their mobile phones. This toolkit contain different apps that will help any hacker to find vulnerabilities and possibly exploit it. The company behind the app is an Israeli security firm called Zimperium.

#2 Nmap for Android

Nmap (network mapper) is one the best among different network scanner (port finder) tool, Nmap mainly developed for Unix OS but now it is available on Windows and Android as well. Nmap for android is a Nmap apps for your phone! Once your scan finishes you can e-mail the results. This application is not a official apps but it looks good.

#3 FaceNiff 2.4 final- Session Hijacker for Android

Your Facebook account is at risk, just like a Firesheep (for firefox hacking) there is a FaceNiff for hijacking the session of famous social networking websites includes facebook and twitter. FaceNiff is developed by Bartosz Ponurkiewicz who created Firesheep before but faceniff is for android OS.

#4 AnDOSid- DOS Tool for Android

DOS or denial of service attack is very dangerous attack because it takes down the server
(computer).AnDOSid allows security professionals to simulate a DOS attack (A http post flood attack to be exact) and of course a dDOS on a web server, from mobile phones.AnDOSid is designed for security professionals only!

#5 SSHDroid- Android Secure Shell

Secure shell or SSH is the best protocol that provides an extra layer of security while you are connecting with your remote machine.SSHDroid is a SSH server implementation for Android.
This application will let you to connect to your device from a PC and execute commands (like “terminal” and “adb shell”).

Also Read: Android Hacking Apps

Note :- This post is only for security or information purpose, But now the world is changing now your mobile is small hacking toolkit using these apps. Must try all these best hacking apps or hacking tools.

How Lack Of Human Resource Is Threatening The Cybersecurity Realm

Maintaining a Cybersecurity department is the need of the hour for the companies. Human Resource has a major impact on the Cybersecurity and it can be perceived from the situation that there has been a decline in the number of recruitments due the lack of skillset and talent, despite the numerous high-salary job opportunities.

We are humans and using us to accomplish a goal is called Human Resource (HR). The topic concerning to maximize the potential of Human Resource has been prevalent and to my utmost concern, the human race has to input heavy efforts in order to pace up with industry’s increasing talent demands.

Cybersecurity – one of the major fields where the human resource is losing its credibility – is for protecting computer hardware, software, and information stored from potential attacks like DDoS, phishing, tampering, and many more. But in recent years, humans appointed in the Cybersecurity field have shown an acute lack of determination, when it comes to acceptance of new skills as well as consistency in a rapidly changing atmosphere, that requires an individual to remain up-to-the-minute with latest practices and technological trends in the Cybersecurity space.

In a keynote presented by Mathew Rosenquist, a Cybersecurity Strategist at Intel Security, he focussed on how Human Resource is playing a pivotal role in shaping new age Cybersecurity workforce. Despite enormous efforts made by various Cybersecurity organisations and the “digital security field outpaced IT positions by double and twelve times the rate of the overall job market”, it is easy to decipher the situation that a qualified workforce is like a day dream for the security industry, with an estimate of 2 million unfilled positions by the end of 2017.

While speaking at the ICT Educators Conference this month, Rosenquist emphasized on how the current education system can upgrade its course structure by introducing a formal degree program for CyberScience related syllabi. He also discussed that the sole focus on training an individual to acquire proper knowledge and unvarying skill set will help the individual to be an efficient and reliable Human Resource.

Another side of the coin is the diversity of workforce required in the Cybersecurity workspace. There is a rising demand of people with varying interests and capability to think “out of the box” in tricky environments. Rosenquist discussed Intel’s continuous efforts to diversify its workforce, be it on ethnic, gendered, or based on skill level. Intel has plans to invest $300 million for that purpose.

It is a great example of how a corporation can make a difference in the hiring, progression, and retention of a diverse workforce, contribute to building a sustainable flow of talent, and directly support other organizations doing the same.John Pescatore, Director of emerging security trends at SANS Institute

The keynote (presented at ICT Educators Conference) briefs the effectiveness of diverse workforce when it comes to solving problems, finding an error and showing creativity. An individual can take advantage of the competitive hiring process, exposure to executive levels, and significant salary bumps with an average inflation of $12000 than any other computer field.

Intel’s Diversity In Technology Initiative

Intel flagged off its Diversity and Inclusion initiative in January 2015 with a goal to represent a completely diverse workforce by the end of the year 2020. The company will utilize its resources to increase the percentage of women and underrepresented minorities.

According to the Diversity in Technology mid-term report published on May 12, 2015, in the first half of the year 2015 Intel managed to outperform its predefined goal of 40% – 1275 diverse employees out of a total of 2944 hiring in the United States which account for 43.3% – by the mid-year. Exploring the diversity of the workforce yields 35.2% (1035) women, 4.7% (139) African American, 7.5% (222) Hispanic, and 0.3% (9) Native American.

Intel is determined to work on the following key programs:

Achieve full workforce representation through focused hiring and retention programs.

In December 2014, Intel’s US workforce comprised of 23.5% (11386) women employees which increased to 24.1% (12916) by the end of July 2015. A similar increase was observed for African Americans, Hispanics, and Native Americans.

Intel maintains a Diversity Dashboard which is used to keep an eye on the number of new hires and fires to track the progress of women and underrepresented minorities. The Dashboard is regularly synchronized across all Intel divisions and regularly shared with the CEO, VPs, and the executive team.

In the case of leadership roles, by July 2015, the workforce representation was 17.1% (68) for women and 6.0% (24) for underrepresented minorities.

To balance hiring, we have increased focus on advancing our inclusive culture by utilizing fair processes and practices, such as rigorous reviews of annual appraisal parity and pay audits, as well as by increasing investments in our manager and leader capabilities to ensure that the unique skills and experiences of our entire workforce are fully leveraged.

— the report says.

Grow the pipeline of technical talent for the industry at large:

Intel will invest an amount of $5 million over the next four and a half years as per an MOU signed with Oakland Unified School District. The funds will be utilized to improve the number of Computer Science and Engineering graduates by boosting the number of students from 100 to 600. Intel will put forward its efforts to bring volunteer participation of its employees to accomplish this goal in addition to offering employment options to technical graduates from the Oakland district.

Improve diversity in our supply chain and vendors:

With plans to focus on Indirect Service Segment, Intel eyes an approximate investment of $600 million in order to satisfy its intentions to improve supplier diversity. Further aid will be accomplished by performing a collaborative operation with Capital Partners, thereby, increasing technology sector representation in terms of diversity and inclusion.

Invest in diverse entrepreneurs of emerging technologies:

A $125 million Intel Capital Diversity Fund is aimed at rising technology startups which come under the eligibility criteria of a woman or an underrepresented minority as the CEO or founder, or having, at least, three women in leadership roles. The fund announced on June 9, 2015, has been utilized to power Brit + Co, Care Cloud, Mark One, Venafi.

Intel Captial was founded in 1991, and since then, it has been a cash card to around 1400 companies spanning over 57 nations with the total investment amounting to $11.4 billion.

We are proud to take a leading role toward broader participation in technology entrepreneurship and employment. With this new fund, Intel Capital is committed to investing in the best talent from a myriad of backgrounds to cultivate innovations that serve the needs of a diverse public.

— said Intel Capital MD Lisa Lambert, who is leading the Intel Capital Diversity Fund.

Support women in gaming:

Gaming is not considered as a woman’s deal and they don’t contribute much to the male dominated International Game Developers Association (IGDA). Intel made an attempt to make justice with their Diversity in Technology initiative by sponsoring Gamescom, E3, and Nordic Games conferences in addition to creating the game-design seminar for girls titled as Intel Two5Six Scholar Program.

There are some female warriors in the gaming realm such as Katherine Gunn aka Mystik is an American professional gamer who has bagged credits in the Guinness Book of World Records 2016 Gamer’s Edition. She won the second season of WCG Ultimate Gamer in 2010 and is famous for DOA4 and HALO: Reach.

The Crisis Situation

If we time travel four or five years back, the technology companies were not that much concerned about the security aspects, the Cybersecurity division was often included under the IT department. But the pace of time has forced them to think about a separate security division, which is the need-of-the-hour.

“This has resulted in increased salaries and a shortage of qualified [staff for] small to medium enterprises in the marketplace,” – says Douglas Saylors, Director at Information Services Group (ISG) based in Stamford, Connecticut.

One out of the hundreds of concerns faced by Cybersecurity firms is finding talented employees. However, the fact can’t be denied that the complicated and tedious recruitment process poses as an imminent cause to increased number of unfilled positions. Hence, an intelligible perspective should be displayed upfront for a potential recruit.

Talking about the training and skill set aspect, does it really matter?

Intel’s $300 million investment to transform the academia is a clear long-shot but if we have to make a decision on a short-term notice, the lack of skilled workforce and above that, untrained employees may act as a cause to the unreliable future of cybersecurity space dealing with digital attacks every now and then.

The reason so many enterprises need more security people is because they are doing basic things wrong in IT — not keeping up with patches and misconfiguring things.John Pescatore, Director of emerging security trends at SANS Institute

Companies based in the United States often try to lure brains residing in India and other parts of the world, with their H1B VISA schemes and hard cash salary packages. But that’s not a fool-proof solution for the future of this vast field, which is finding it hard to fill the security professional chairs.

These companies should understand the value of proper training, and understand that IT professionals often lack a broader perspective of the Cybersecurity space.This will allow the transformation of the current networking staff into security specialists after proper training. An internal evaluation that would acknowledge the companies whether their security experts can deal with up-to-the-minute cyber-threats is a must.

Write your views in the comments section below.

Also Read: Snowden Leak Proves That NSA And GCHQ Spied On Israeli Drones Using Open Source Tools