Dropbox has announced its plans to purchase several key assets from Boxcryptor so that it is able to provide end-to-end encryption for its business users. In addition, the partial merger between the two companies will enable Dropbox to better meet its client’s needs, including an enhanced level of security for cloud storage.

Boxcryptor, a provider of cloud backup services, utilizes zero-knowledge encryption to protect its customers’ data.

Dropbox’s acquisition of Boxcryptor assets
In November, Dropbox reported that customer demand for encrypted file storage had grown significantly. As a result, the company is looking to integrate built-in encryption features into its services.

Boxcryptor’s features will be directly integrated for business customers who subscribe to Dropbox’s paid plans. This feature will encrypt data locally on devices before syncing with Dropbox folders.

It is unclear how much Dropbox has paid for Boxcryptor’s assets and what these assets may be since the acquisition details were not made public.

Boxcryptor’s Clients
Cloud storage services like SharePoint, OneDrive, and Google Drive are some of the cloud storage services Boxcryptor protects.

Boxcryptor and Dropbox were selective with the language they used in the announcement. Boxcryptor stated that its “new mission” was to integrate its technology into Dropbox.

Dropbox said it was purchasing “several key assets,” hinting that this wasn’t a full-blown acquisition. Boxcryptor will continue to support its existing customers as long as their contracts remain valid.

According to LastPass CEO Karim Toubba, the password manager has been hacked once again.

A data breach occurred in the development environment only a few months ago, prompting LastPass to announce they had experienced a security breach on August 25, 2022. LastPass disclosed to its customers that a developer account was compromised. At the time, only portions of LastPass’ source code and some proprietary technical information appeared to have been compromised due to the breach.

A combined investigation with Mandiant was initiated immediately. After completing their analysis on September 15, they concluded that the threat actor had engaged in limited activity for four days. Moreover, there is no evidence of threat actor activity beyond the established timeline. Neither was there evidence suggesting any access to customer data or encrypted password vaults occurred during the incident.

Although it seemed that the cyberattack had ended, Toubba said that his company discovered strange behavior in a cloud storage service used by both LastPass and its affiliate, GoTo.

Toubba confirmed that unauthorized parties were accessing customer information using data obtained during the August 2022 cyberattack. However, LastPass’ Zero Knowledge architecture ensures that customer passwords are completely secure.

At this point, it is not clear what information was obtained by the cybercriminal. However, the company assured users that they were diligently working to gather more information about the breach and to identify what data has been compromised.

Hackers have targeted LastPass on multiple occasions, but the cybercriminals are gaining ground this time. While it seems that the cybercriminals couldn’t gain access to customers’ passwords, they could still access customers’ information, which could significantly affect more than 25 Million users.

The new security-focused data lake solution from Amazon Web Services (AWS), unveiled at re:Invent 2022, aims to give consumers more value from their security data.

The Amazon Security Lake service aims to consolidate an organization’s security data from various on-premises and cloud-based sources into a single location to pinpoint security threats precisely.

With the help of Amazon Security Lake, based on Amazon S3, security teams will find it simple to automatically gather, aggregate, and analyze security data at petabyte size.

In his keynote address, AWS CEO Adam Selipsky stated that security data is spread across various applications, firewalls, and identity providers.

By combining a variety of AWS’s existing data analytics and management services, the new platform may significantly enhance AWS’s security capabilities.

The platform integrates with CloudTrail, Lambda, and GuardDuty to allow customers to import their data. The data can be analyzed further with tools such as Amazon Athena or SageMaker.

Security Lake is fully compliant with the Open Cybersecurity Schema Framework (OCSF), meaning it can combine data from the world’s top technology companies and connect with up to 50 partner analytics systems.

Jon Ramsey, vice president of Security Services at AWS, emphasized the importance of customers being able to detect security risks to quickly and effectively protect data and networks. However, their data is often scattered and stored in various formats, making it difficult to analyze.

With Amazon Security Lake, customers can create a security data lake. Then, in just a few clicks, gather data from various sources and normalize it to OCSF standards, enabling customers to quickly take action with their preferred security tool.

Amazon Security Lake is in the preview phase in the AWS Regions of North Virginia, Ohio, Oregon, Sydney, Tokyo, Frankfurt, and Dublin. More AWS regions will be added soon.

While artificial intelligence (AI) is seen as a new phenomenon in mainstream society, it is not a new concept. As AI technologies increase, AI is becoming increasingly important for companies looking to stay competitive.

What is AI

Artificial intelligence is a broad term for any computer software that engages in human-like activities. This includes learning, planning, and problem-solving.

Machine Learning

Many different types of artificial intelligence (AI) are used in business today. One of the main types is machine learning, which is primarily used to process large amounts of data quickly. These types of AIs are algorithms that appear to learn as they are given more data.

Machine learning algorithms can analyze data that would otherwise be too complex for humans. Additionally, the algorithms can rapidly analyze data as it is entered and identify patterns and anomalies as they appear.

Businesses can use machine learning to determine when equipment is working at a reduced capacity and inform decision-makers when preventative maintenance is required. Nevertheless, machine learning is still a relatively broad category.

Deep Learning

Deep learning evolved as a result of the development of artificial neural networks. In deep learning, neural networks can perform nonlinear reasoning, a more advanced form of machine learning. Therefore, a deep learning model is essential for detecting fraud and conducting a more comprehensive analysis.

The deep learning approach allows simultaneous analysis of a wide array of factors. Deep learning models continue to improve their performance as more data is received. For example, self-driving vehicles must simultaneously identify, analyze, and respond to numerous factors. As a result, deep learning models become more detailed and scalable as more data is received.

AI and business

Artificial intelligence is not considered a replacement for human intelligence and ingenuity. However, it can process and analyze data much faster than humans. As a result, AI can assist with anticipating possible outcomes and decision-making by providing alternative courses of action.

AI is commonly used in cybersecurity, customer relationship management, content generation, and personal assistants.

It is unlikely that human jobs will disappear as artificial intelligence becomes more integrated into the workforce. Instead, it is predicted that the need for specific skills will shift as technology advances, leading to a growing demand for more refined technical skills.

Overall, AI is playing an increasingly important role in businesses today. As the technology continues to develop, it will be interesting to see how else AI will transform various industries.

The FBI warns about scammers pretending to be refund payment gateways from financial institutions to steal sensitive information from unsuspecting victims.

The federal law enforcement agency stated that scammers deceive victims into granting them access to their computers via email or phone calls by posing as representatives of technical or computer repair companies.

According to the FBI, scammers typically start by specifying the service to be renewed and include a fee, usually between $300 and $500 USD, causing a sense of urgency for the victims to supply information for a refund.

“In this case, the scammers pretend to help the victim secure a refund by gaining remote access to the victim’s computer.”

Although tech support scams are nothing new, the FBI said that recently, con artists started employing scripts created to mimic the appearance and feel of refund payment gateways in command prompt windows.

It has been discovered that some of the scripts imitate Chase Bank, JPMorgan Chase’s division for consumer and commercial banking. In addition, other batch files used in this tech support campaign have also been uncovered. These batch files allow dynamic customization by changing the output’s bank name using Windows environment variables.

However, these scripts aim to gather the targets’ personal and financial data (such as full name, bank name, ZIP code, and refund amount) to facilitate unlawful wire transfers of money from the victims’ bank accounts.

According to the FBI, “the malware will often launch a command prompt styled to seem like a service interface.”

The script also has many pauses that encourage user interaction as they “wait” for a refund or other action to happen, as well as commands to send data to a text file.

Individuals who have been victims of this tech support fraud should report it as soon as possible by submitting a report to the Internet Crime Complaint Center.

The FBI also cautioned potential victims against granting remote access to their computers to unauthorized parties and against sending wire transfers in response to the advice they received from internet or telephone contacts.

Earlier this year, Twitter confirmed that an API vulnerability had caused a massive data leak containing non-public information for over 5.4 million Twitter users.

Twitter denied claims that hackers had leaked the private information priorly. However, Pompompurin, the owner of the hacking forum Breached, stated they were responsible for exploiting the API bug and platforming the data after another hacker shared the vulnerability with them.

The stolen data includes public information like Twitter IDs, account names, logins, locations, and verified status. In addition, private information like phone numbers and email addresses have also been exposed. Fraudulent activities such as phishing could be carried out using this information.

In addition to the breach of the 5.4 million active accounts, private information for roughly 1.4 million suspended Twitter profiles were also shared using the same API bug. While the extent of the data breach is not fully known, security expert Chad Loder stated that information for “tens of millions” of Twitter users might have been collected using the same API bug.

To keep yourself safe, disregard emails claiming to be from Twitter that state your account is suspended. In addition, be skeptical of emails about issues logging in or the account is about to lose its verified status. These emails are probably attempting to phish for your private information to use in fraudulent activities.

Threat actors may now launch their own sophisticated assaults thanks to the emergence of Phishing as a Service (PhaaS) platforms like “Caffeine.” Through an open registration procedure, anyone who wishes to launch their phishing campaign can sign up on these platforms.

Security experts at Mandiant discovered the first sighting of these threats while investigating a large-scale phishing campaign. The purpose of this campaign was to steal Microsoft 365 credentials.

The company noticed that the threat now known as Caffeine was a problematic PhaaS platform with a low entry barrier and a feature-rich nature.

Although phishing assaults are made possible by an underground economy, Caffeine was the first to stand apart from other phishing-as-a-service platforms.

This generation of PhaaS platforms quickly gained popularity because they offer built-in features for cybercriminals rather than paying service providers who do the work.

The Caffeine-like platforms lower the entry barrier for cybercriminals compared to other PhaaS platforms by allowing anyone with an email address to register for its services. Other platforms require an endorsement or referral from existing subscribers or to work directly through underground forums to access their services.

When Caffeine was first discovered, the investigation revealed that the platform has an entirely subscription-based license structure, with several service tiers and the ability to sign up for a Core Caffeine account.

The administrators of Caffeine announced many significant changes to the platform, including the addition of new features and support. But, aside from that, “attackers have a variety of alternatives at their disposal for phishing email designs, including webmail phishing lures targeting subscribers of major Russian and Chinese services.”

Threat actors are always looking to improve their methods regarding phishing attacks, especially in response to improvements in automated detection techniques by email and security protection platforms.

When Caffeine was discovered, Mandiant researchers advised companies to implement necessary security methods to protect themselves from this type of attack.

The Caffeine phishing platform makes it easy for inexperienced cybercriminals to launch sophisticated attacks. Companies should implement necessary security measures to protect themselves from this type of threat.

Data allegedly stolen from Cincinnati State Technical and Community College has been leaked after Vice Society attacked the campus.

Many of the stolen documents were posted on the hackers’ websites. These documents date from several years ago until November 24, 2022, suggesting that threat actors still have access to the compromised systems, but this has not been confirmed. The leaked files contain personally identifiable information and can be accessed freely.

Impact on College Resources

Earlier this month, Cincinnati State College notified its 10,000 students and 1,000 employees that they had suffered a cybersecurity attack. Campus officials warned that restoring online services and regular operations would take time.

Earlier this week, the university announced that some internet access, classroom computers, and on-campus email had been restored after the cyberattack. However, many online applications, registration portals, voicemail, network printing, VPN access, and other resources remain unavailable.

For the time being, the college has posted FAQs to guide employees, current students, and new students on how to interact with the college administration. However, the disruption caused by the cyberattack remains significant for the college, as workarounds are not available for all services.

Vice Society

There is a long history of Vice Society targeting educational institutions, ranging from K-12 schools to universities. Vice Society’s disproportionate targeting of schools and universities prompted the FBI to issue a warning in September.

Among Vice Society’s more recent victims was Los Angeles Unified (LAUSD), the second-largest school district in the country. However, Vice Society has also been associated with other attacks worldwide.

In a massive malicious SEO campaign, cybercriminals are promoting low-quality Q&A sites by redirecting visitors to fake discussion forums. As a result, almost 15,000 sites have been compromised.

In September 2022, researchers at Sucuri discovered the attacks. Each compromised site was found to contain approximately 20,000 files that were utilized in the search engine campaign.

Researchers believe that the goal of threat actors is to generate enough indexed pages in order for them to increase their authority in the search engines. This will enable them to rank higher as a result.

Primarily, the malware targets WordPress sites. The hackers modified the WordPress PHP files to inject redirects to fake Q&A discussion forms.

The infected files contain malicious code that checks if website visitors are logged into WordPress. If not, the visitors are redirected to a Google search click URL that redirects them to the spam Q&A site.

The use of Google search click URLs is likely to increase performance metrics on URLs in the Google index. Thus, the sites appear popular, and web traffic is seen as more legitimate, possibly bypassing some security software.

Users who are logged in are excluded so that the threat actor doesn’t raise suspicion by redirecting a site administrator.

While Sucuri couldn’t identify the exact way the attackers breached the website that was used for redirects, it is likely that they exploited a vulnerable plugin or brute-forced the WordPress administrator password to access the website.

Sucuri recommends that users secure their admin panel with two-factor authentication or other access restrictions to prevent becoming a victim. Furthermore, users should ensure that all software on their website is up-to-date and patched to the latest versions.