We provide technology stacks that support the national Credential Registry and provide services to educational organizations, businesses, adn government to improve information managment

Credential Engine

**TORRANCE, United States / California, June 10th, 2024, CyberNewsWire/--**AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, announced that it has started selling its paid threat detection data from its CTI search engine ‘Criminal IP” on the Snowflake Marketplace. Criminal IP is committed to offering advanced cybersecurity solutions through Snowflake, the leading cloud-based data warehousing platform. Criminal IP’s Intelligence for Fraud Detection and Privacy Protection is meticulously crafted to address the growing concerns surrounding fraudulent activities and privacy breaches. By aggregating data on known malicious and masked IP addresses, including those with historical abuse records such as IDS, malware, phishing, ransomware, and blocked IPs, this dataset equips organizations with actionable insights to identify and mitigate fraudulent activities in real time. Additionally, the product boasts advanced capabilities to detect servers infected by botnet and C2 software, as well as IP addresses leveraging masking services like VPNs, proxies, and hosting. This product is tailored to support fraud detection (FDS) and malicious IP plans, enabling organizations to bolster their security posture and streamline incident response protocols. Criminal IP's Intelligence for Threat Detection & Incident Response is designed to empower organizations to combat cyber threats effectively. This comprehensive cyber threat intelligence dataset provides invaluable insights into malicious IP addresses, leveraging data sourced from Criminal IP's Cyber Threat Intelligence Database (CTIDB). These new datasets on the Snowflake Marketplace offer granular, real-time threat intelligence, enabling organizations to safeguard digital assets, mitigate risks, and respond swiftly to security incidents. Snowflake's global customers can access a complimentary trial of up to 1,000 data items, with subscription options for daily updates. About AI Spera AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, significantly expanded its reach by launching its flagship solution, Criminal IP, in 2023. Since then, the company has formed technical and business collaborations with over 40 renowned global security firms, including VirusTotal, Cisco, Tenable, Sumo Logic, and Quad9. Besides the CTI search engine, the company offers Criminal IP ASM, a SaaS-based Attack Surface Management Solution on AWS and Azure Marketplace, and Criminal IP FDS, an AI-based Anomaly Detection Solution used for credential stuffing prevention and fraud detection. Available in five languages (English, French, Arabic, Korean, and Japanese), the search engine provides a powerful service for users worldwide. Contact Michael Sena AI SPERA support@aispera.com This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. **TORRANCE, United States / California, June 10th, 2024, CyberNewsWire/--**AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, announced that it has started selling its paid threat detection data from its CTI search engine ‘Criminal IP” on the Snowflake Marketplace. Criminal IP is committed to offering advanced cybersecurity solutions through Snowflake, the leading cloud-based data warehousing platform. Criminal IP’s Intelligence for Fraud Detection and Privacy Protection is meticulously crafted to address the growing concerns surrounding fraudulent activities and privacy breaches. By aggregating data on known malicious and masked IP addresses, including those with historical abuse records such as IDS, malware, phishing, ransomware, and blocked IPs, this dataset equips organizations with actionable insights to identify and mitigate fraudulent activities in real time. Criminal IP’s Intelligence for Fraud Detection and Privacy Protection Criminal IP’s Intelligence for Fraud Detection and Privacy Protection Additionally, the product boasts advanced capabilities to detect servers infected by botnet and C2 software, as well as IP addresses leveraging masking services like VPNs, proxies, and hosting. This product is tailored to support fraud detection (FDS) and malicious IP plans, enabling organizations to bolster their security posture and streamline incident response protocols. Criminal IP's Intelligence for Threat Detection & Incident Response is designed to empower organizations to combat cyber threats effectively. This comprehensive cyber threat intelligence dataset provides invaluable insights into malicious IP addresses, leveraging data sourced from Criminal IP's Cyber Threat Intelligence Database (CTIDB). Criminal IP's Intelligence for Threat Detection & Incident Response Criminal IP's Intelligence for Threat Detection & Incident Response These new datasets on the Snowflake Marketplace offer granular, real-time threat intelligence, enabling organizations to safeguard digital assets, mitigate risks, and respond swiftly to security incidents. Snowflake's global customers can access a complimentary trial of up to 1,000 data items, with subscription options for daily updates. About AI Spera AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, significantly expanded its reach by launching its flagship solution, Criminal IP, in 2023. Since then, the company has formed technical and business collaborations with over 40 renowned global security firms, including VirusTotal, Cisco, Tenable, Sumo Logic, and Quad9. technical and business collaborations technical and business collaborations Besides the CTI search engine, the company offers Criminal IP ASM, a SaaS-based Attack Surface Management Solution on AWS and Azure Marketplace, and Criminal IP FDS, an AI-based Anomaly Detection Solution used for credential stuffing prevention and fraud detection. Available in five languages (English, French, Arabic, Korean, and Japanese), the search engine provides a powerful service for users worldwide. search engine search engine Contact Michael Sena AI SPERA support@aispera.com This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here . here here

Criminal IP Unveils Innovative Fraud Detection Data Products On Snowflake Marketplace

**TORRANCE, United States / California, May 22nd, 2024/CyberNewsWire/--**AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, announced today that its proprietary search engine, Criminal IP, is now available on the AWS Marketplace. This integration ensures efficient software procurement and deployment, aligning seamlessly with customers' existing cloud architectures. After meeting specific technical and security standards set by AWS, the SaaS-based Criminal IP search engine ensures reliability and seamless integration with AWS services. The AWS Marketplace, a significant platform primarily used in the US, provides Criminal IP with access to a vast global customer base, enhancing its visibility and credibility. This listing demonstrates the critical role of AWS Marketplace in the software's adoption and success. <Criminal IP, a comprehensive threat intelligence tool, is now available on the AWS Marketplace> Criminal IP excels in threat detection, empowering cybersecurity with unparalleled intelligence. Criminal IP is the industry's leading IP address intelligence tool, leveraging AI and machine learning to provide unparalleled visibility into the risks associated with internet-connected devices. It offers comprehensive solutions for fraud detection, attack surface management, and threat hunting. Additionally, Criminal IP offers seamless API integration, allowing effortless incorporation of threat intelligence data into existing services and security systems such as SOAR and SIEM. With a rich repository of cyber threat intelligence data, including risk classification, geographical insights, vulnerable asset graphs, and more, Criminal IP empowers organizations to stay ahead in the ever-evolving landscape of cybersecurity. Seamless Integration and Payment Flexibility Between AWS Marketplace and Criminal IP Criminal IP's presence on the AWS Marketplace brings several conveniences for users. The interconnected tokens of AWS and Criminal IP seamlessly exchange information, allowing users to leverage both platforms' strengths without encountering data silos or compatibility issues. Additionally, customers enjoy consistent plans and subscription options on Criminal IP, regardless of whether transactions are initiated through Criminal IP or the AWS Marketplace. This uniformity extends to credit usage monitoring for specific features and APIs, accessible directly from the dashboard, promoting transparency and ease of management. <Payments on AWS Marketplace seamlessly reflect on Criminal IP> “The most important aspect of entering the AWS Marketplace was to ensure easier compatibility between AWS Cloud and 'Criminal IP' threat intelligence. We paid a lot of attention to interoperability with AWS products and credit management systems,” stated Byungtak Kang, CEO of AI SPERA. “We will continue to pursue Marketplace registration to secure global customers and increase interoperability with various clouds in the future.” Explore the detailed features of the newly listed Criminal IP on the AWS Marketplace, as well as Criminal IP ASM, an Automated Attack Surface Management SaaS solution that monitors all internet-connected assets and vulnerabilities. About AI Spera AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, significantly expanded its reach with the launch of its flagship solution, Criminal IP, in 2023. Since then, the company has established technical and business collaborations with over 40 renowned global security firms, including VirusTotal, Cisco, Tenable, Sumo Logic, and Quad9. Available in five languages (English, French, Arabic, Korean, and Japanese), the search engine ensures a powerful service for users worldwide. In addition to the CTI search engine, the company also offers Criminal IP ASM, a SaaS-based Attack Surface Management Solution available on Azure Marketplace, and Criminal IP FDS, an AI-based Anomaly Detection Solution used for credential stuffing prevention and fraud detection. Contact Michael Sena AI SPERA support@aispera.com This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. **TORRANCE, United States / California, May 22nd, 2024/CyberNewsWire/--**AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, announced today that its proprietary search engine, Criminal IP, is now available on the AWS Marketplace. This integration ensures efficient software procurement and deployment, aligning seamlessly with customers' existing cloud architectures. After meeting specific technical and security standards set by AWS, the SaaS-based Criminal IP search engine ensures reliability and seamless integration with AWS services. The AWS Marketplace, a significant platform primarily used in the US, provides Criminal IP with access to a vast global customer base, enhancing its visibility and credibility. This listing demonstrates the critical role of AWS Marketplace in the software's adoption and success. <Criminal IP, a comprehensive threat intelligence tool, is now available on the AWS Marketplace> Criminal IP excels in threat detection, empowering cybersecurity with unparalleled intelligence. Criminal IP is the industry's leading IP address intelligence tool, leveraging AI and machine learning to provide unparalleled visibility into the risks associated with internet-connected devices. It offers comprehensive solutions for fraud detection, attack surface management, and threat hunting. Additionally, Criminal IP offers seamless API integration, allowing effortless incorporation of threat intelligence data into existing services and security systems such as SOAR and SIEM. With a rich repository of cyber threat intelligence data, including risk classification, geographical insights, vulnerable asset graphs, and more, Criminal IP empowers organizations to stay ahead in the ever-evolving landscape of cybersecurity. Seamless Integration and Payment Flexibility Between AWS Marketplace and Criminal IP Criminal IP's presence on the AWS Marketplace brings several conveniences for users. The interconnected tokens of AWS and Criminal IP seamlessly exchange information, allowing users to leverage both platforms' strengths without encountering data silos or compatibility issues. Additionally, customers enjoy consistent plans and subscription options on Criminal IP, regardless of whether transactions are initiated through Criminal IP or the AWS Marketplace. This uniformity extends to credit usage monitoring for specific features and APIs, accessible directly from the dashboard, promoting transparency and ease of management. subscription options subscription options <Payments on AWS Marketplace seamlessly reflect on Criminal IP> “The most important aspect of entering the AWS Marketplace was to ensure easier compatibility between AWS Cloud and 'Criminal IP' threat intelligence. We paid a lot of attention to interoperability with AWS products and credit management systems,” stated Byungtak Kang, CEO of AI SPERA. “We will continue to pursue Marketplace registration to secure global customers and increase interoperability with various clouds in the future.” Explore the detailed features of the newly listed Criminal IP on the AWS Marketplace, as well as Criminal IP ASM, an Automated Attack Surface Management SaaS solution that monitors all internet-connected assets and vulnerabilities. About AI Spera AI SPERA, a leader in Cyber Threat Intelligence (CTI) solutions, significantly expanded its reach with the launch of its flagship solution, Criminal IP, in 2023. Since then, the company has established technical and business collaborations with over 40 renowned global security firms, including VirusTotal, Cisco, Tenable, Sumo Logic, and Quad9. technical and business collaborations technical and business collaborations Available in five languages (English, French, Arabic, Korean, and Japanese), the search engine ensures a powerful service for users worldwide. In addition to the CTI search engine, the company also offers Criminal IP ASM, a SaaS-based Attack Surface Management Solution available on Azure Marketplace, and Criminal IP FDS, an AI-based Anomaly Detection Solution used for credential stuffing prevention and fraud detection. Contact Michael Sena AI SPERA support@aispera.com This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here. This story was distributed as a release by Cyberwire under HackerNoon’s Business Blogging Program. Learn more about the program here . here here

Criminal IP: Enhancing Security Solutions Through AWS Marketplace Integration

10 Steps to Write a Compelling About Me Page

As AI services and the data they consume and create become more important and prevalent in various applications and processes, so do the platforms and architectures they are built upon. As usual, there is no “one size fits all”, however, what is briefly presented here is an optimized approach to such data-driven AI application architectures. All of the source code mentioned and more can be found , and a free “Develop with Oracle AI and Database Services: Gen, Vision, Speech, Language, and OML” workshop (where all of the use cases are based on the U.N.’s 17 Sustainable Development Goals) giving many more examples can be found . here here Often, multiple network calls must be made in a given AI app, entailing calls to the AI services as well as calls to retrieve and persist the content (whether it be text, audio, images, video, etc.) that is the input or output. The persistent information is then often processed and analyzed further and additional calls, AI or otherwise, are made in reaction. The provides the ability to make calls out to other services, again AI and otherwise, whether they be within the Oracle Cloud or external. Oracle database When the calls are instead made from the database itself, it provides an optimized architecture with various benefits including: Reduced network calls, thus reducing latency. Reduced network calls, thus, increasing reliability. Transactional (ACID) operations on AI and other data (and even messaging when using TxEventQ) which avoid the need for idempotent/duplicate processing logic, etc., and the related wasted resources there. Processing optimization is due to the locality of data whether that data is stored directly in the database or an object store or other source. This is because the Oracle database provides a robust functional frontend to otherwise dumb object storage buckets, and the database provides many options to either sync or optimally operate on data in place in the object store and other data sources. Enhanced security due to a common authentication mechanism and reuse of a famously robust database and cloud security infrastructure. Reduced overall configuration as calls are made from a central location. The entry point to the database itself can be exposed as a Rest endpoint (using ORDS) with a single click, and of course, drivers in various languages can be used to access the database as well. Vector database advantages. This topic is a blog unto itself, and one I’ll release as a follow-on especially as Oracle has and is adding several powerful features in this area. Oracle Database Machine Learning. In addition to various AI services, the Oracle database itself has had a machine-learning engine for many years. OML streamlines the ML lifecycle, offering scalable SQL, R, Python, REST, AutoML, and no-code tools with over 30 in-database algorithms, enhancing data synchronization and security by processing data directly in the database. Oracle Autonomous Database. Select AI which enables querying data using natural language and generating SQL that is specific to your database. Oracle Autonomous Database. AI Vector Search, which includes a new vector data type, vector indexes, and vector search SQL operators, enables the Oracle Database to store the semantic content of documents, images, and other unstructured data as vectors, and use these to run fast similarity queries. These new capabilities also support RAG (Retrieval Augmented Generation) which provides higher accuracy and avoids having to expose private data by including it in the LLM training data. Again, there are many different AI application flows and requirements, but a basic comparison of the two approaches can be visualized in the following way.: The Code It is possible to run several different languages in the database, making it possible to conduct various application logic there. These include Java, JavaScript, and PL/SQL. PL/SQL examples are given here, and they can be executed from the page in the OCI console, from the SQLcl command line tool (which is pre-installed in the OCI Cloud Shell or can be downloaded), from SQLDeveloper, VS Code (where Oracle has a convenient plugin), etc. Database Actions -> SQL There are also a few ways to go about making the calls out to AI and other services. Standard Rest calls using the database’s UTL_HTTP package or fetch from JavaScript, etc., is one approach. If the AI services run within OCI (the Oracle Cloud), then OCI SDKs, which are written for all major languages, can also be used. I find the use of the DBMS_CLOUD.send_request package for all OCI services calls (rather than, for example, more specific OCI SDK calls such as DBMS_CLOUD_OCI_AIV_AI_SERVICE_VISION) to be the simplest and most dynamic approach. We start by creating a credential that can be referenced and reused for all of our cloud service calls and simply includes the information from your OCI account/config. BEGIN
dbms_cloud.create_credential (
 credential_name => 'OCI_KEY_CRED',
 user_ocid => 'ocid1.user.oc1..[youruserocid]',
 tenancy_ocid => 'ocid1.tenancy.oc1..[yourtenancyocid]',
 private_key => '[yourprivatekey - you can read this from file or put the contents of your pem without header, footer, and line wraps]'
 fingerprint => '[7f:yourfingerprint]'
);
END; Next, before we look at the main program/function, let’s just quickly look at the table we’ll save the AI results in. Notice, in this case, the table has columns for both the JSON from an AI call return and a text field that is created from key fields in the JSON for quick reference, searches, etc. Again, the table structures, use of SQL/relational vs JSON, etc., may all vary, and again, this is a great example of the Oracle multi-purpose database where you can use various data models and data types. For example, the JSON Duality feature in the Oracle database is worth checking out as it allows the same data to be accessed using SQL/relational as well as JSON and even MongoDB APIs. CREATE TABLE aivision_results
    (id RAW (16) NOT NULL,
     date_loaded TIMESTAMP WITH TIME ZONE,
     label varchar2(20),
     textfromai varchar2(32767),
     jsondata CLOB
     CONSTRAINT ensure_aivision_results_json CHECK (jsondata IS JSON));
/ And now, the simple function that typifies the heart of the architecture… Here, we see a call to DBMS_CLOUD.send_request with the credential we created and the URL of the (AI) service operation endpoint (the operation of the Oracle Vision AI service in this case). analyzeImage The JSON payload of the body consists of the feature(s) of the service that we would like to use and any other config as well as the arguments to the operation which, in this case, include the object storage location of an image (another option would be to provide the image byte array directly/inlined as part of the payload). The JSON result is then retrieved from the response, certain elements of it are parsed out into a text field for convenience, and the JSON, text, etc., are persisted as mentioned earlier. CREATE OR REPLACE FUNCTION VISIONAI_TEXTDETECTION (
    p_endpoint VARCHAR2,
    p_compartment_ocid VARCHAR2,
    p_namespaceName VARCHAR2,
    p_bucketName VARCHAR2,
    p_objectName VARCHAR2,
    p_featureType VARCHAR2,
    p_label VARCHAR2
) RETURN VARCHAR2 IS
    resp DBMS_CLOUD_TYPES.resp;
    json_response CLOB;
    v_textfromai VARCHAR2(32767);
BEGIN
    resp := DBMS_CLOUD.send_request(
        credential_name => 'OCI_KEY_CRED',
        uri => p_endpoint || '/20220125/actions/analyzeImage',
        method => 'POST',
        body => UTL_RAW.cast_to_raw(
            JSON_OBJECT(
                'features' VALUE JSON_ARRAY(
                    JSON_OBJECT('featureType' VALUE p_featureType)
                ),
                'image' VALUE JSON_OBJECT(
                    'source' VALUE 'OBJECT_STORAGE',
                    'namespaceName' VALUE p_namespaceName,
                    'bucketName' VALUE p_bucketName,
                    'objectName' VALUE p_objectName
                ),
                'compartmentId' VALUE p_compartment_ocid
            )
        )
    );
    json_response := DBMS_CLOUD.get_response_text(resp);
    SELECT LISTAGG(text, ', ') WITHIN GROUP (ORDER BY ROWNUM)
    INTO v_textfromai
    FROM JSON_TABLE(json_response, '$.imageText.words[*]'
        COLUMNS (
            text VARCHAR2(100) PATH '$.text'
        )
    );
    INSERT INTO aivision_results (id, date_loaded, label, textfromai, jsondata)
    VALUES (SYS_GUID(), SYSTIMESTAMP, p_label, v_textfromai, json_response);
    RETURN v_textfromai;
EXCEPTION
    WHEN OTHERS THEN
        RAISE;
END VISIONAI_TEXTDETECTION;
/ We can also expose the function as a Rest endpoint programmatically using the following: BEGIN
    ORDS.ENABLE_OBJECT(
        P_ENABLED      => TRUE,
        P_SCHEMA      => 'AIUSER',
        P_OBJECT      =>  'VISIONAI_OBJECTDETECTION',
        P_OBJECT_TYPE      => 'FUNCTION',
        P_OBJECT_ALIAS      => 'VISIONAI_OBJECTDETECTION',
        P_AUTO_REST_AUTH      => FALSE
    );
    COMMIT;
END;
/ Analysis and Text Searching of AI Results This architecture also makes analysis and text searching of all AI results convenient and efficient. From here, more processing and analytics can take place. Let’s take a look at three statements that will provide us with an easy-to-use text search of our AI results. First, we create an index for text searches on our table. aivision_results Then, we create a function that searches for a given string using the powerful functionality, or we could additionally/optionally use the package to search multiple tables and return the refcursor of results. contains DBMS_SEARCH Finally, we expose the function as a Rest endpoint. It's that simple. create index aivisionresultsindex on aivision_results(textfromai) indextype is ctxsys.context;
/ CREATE OR REPLACE FUNCTION VISIONAI_RESULTS_TEXT_SEARCH(p_sql IN VARCHAR2) RETURN SYS_REFCURSOR AS refcursor SYS_REFCURSOR;
BEGIN
    OPEN refcursor FOR
        select textfromai from AIVISION_RESULTS where contains ( textfromai, p_sql ) > 0;
    RETURN refcursor;
END VISIONAI_RESULTS_TEXT_SEARCH;
/ BEGIN
    ORDS.ENABLE_OBJECT(
        P_ENABLED      => TRUE,
        P_SCHEMA      => 'AIUSER',
        P_OBJECT      =>  'VISIONAI_RESULTS_TEXT_SEARCH',
        P_OBJECT_TYPE      => 'FUNCTION',
        P_OBJECT_ALIAS      => 'VISIONAI_RESULTS_TEXT_SEARCH',
        P_AUTO_REST_AUTH      => FALSE
    );
    COMMIT;
END;
/ In Conclusion… This was a quick blog showing an architectural pattern for developing data-driven AI Apps by making calls to AI services directly from the database. Thanks so much for reading, and please let me know of any questions or feedback you may have. Also published here

How to Develop Data-Driven AI Apps: A Guide to Making AI Services Directly From the Database

কীভাবে ডেটা-চালিত এআই অ্যাপস ডেভেলপ করবেন: ডাটাবেস থেকে সরাসরি এআই পরিষেবা তৈরি করার জন্য একটি নির্দেশিকা

So entwickeln Sie datengesteuerte KI-Apps: Ein Leitfaden zur Erstellung von KI-Diensten direkt aus der Datenbank

Cómo desarrollar aplicaciones de IA basadas en datos: una guía para crear servicios de IA directamente desde la base de datos

Comment développer des applications d'IA basées sur les données : un guide pour créer des services d'IA directement à partir de la base de données

डेटा-संचालित एआई ऐप्स कैसे विकसित करें: डेटाबेस से सीधे एआई सेवाएं बनाने के लिए एक गाइड

データ駆動型 AI アプリを開発する方法: データベースから AI サービスを直接作成するためのガイド

데이터 기반 AI 앱 개발 방법: 데이터베이스에서 직접 AI 서비스를 만드는 가이드

Como desenvolver aplicativos de IA baseados em dados: um guia para criar serviços de IA diretamente do banco de dados

Как разрабатывать приложения ИИ, управляемые данными: руководство по созданию услуг ИИ непосредственно из базы данных

Veriye Dayalı Yapay Zeka Uygulamaları Nasıl Geliştirilir: Yapay Zeka Hizmetlerini Doğrudan Veritabanından Yapma Kılavuzu

Cách phát triển ứng dụng AI dựa trên dữ liệu: Hướng dẫn tạo dịch vụ AI trực tiếp từ cơ sở dữ liệu

如何开发数据驱动的人工智能应用：直接从数据库制作人工智能服务的指南

351 Stories To Learn About Data Security

Phishing is a long-standing social engineering technique used by cybercriminals to trick people into giving up sensitive information (e.g., credit card details, login credentials, phone numbers, addresses, etc.) for financial gain. The victim is not even aware their information has been compromised, given that there’s no provided consent or approval. According to the , in Q4 of 2022, the number of phishing attacks worldwide set a record of over 4.7 million attacks. That translates to a growth rate of more than 150% per year since 2019, with the financial sector the most targeted. Anti-Phishing Working Group (APWG) reports Attackers use these electronic means to distribute persuasive text and images to earn the victim’s trust by convincing them about the legitimacy of the communication. This kind of scam comes in many forms, including telephone phishing, smishing (SMS phishing), phishing emails, and phishing websites. A common way to approach potential victims is by delivering legitimate-looking phishing links (URLs) via email that lead to malicious websites. Even messages sent on social networking sites and apps, like Facebook, WhatsApp, and Instagram may contain phishing links, along with a reason to click on them — all the while claiming it will redirect the user to the official page of something they recognize. In addition, it’s also common to find malicious links among benign ones as part of search engine results. It's important to note that malicious links can be very similar to the actual URL that the attackers are attempting to impersonate. A common example of those phishing URLs would be something like — the camouflaged version of the real . The very similar appearance between URLs brings another security gap that can be taken advantage of by attackers since users can mistype letters when they enter a URL address in their internet browser. These nearly identical URLs can be taken by a phishing website. In the wild, we can find examples of phishing URLs with a completely different appearance from the actual one, and they seem to be a shortened version of very long URLs, like the ones generated by Google URL shortener. www.faceb00k.com www.facebook.com can be hard to identify. Hoping to trick victims into giving up personal information, many sites look convincingly like the ones they’re imitating. In some cases, fake websites are poorly constructed by attackers, and it’s evident that the page looks distorted. Like a poorly rendered version of the original one or there are unexpected elements on the page (page footers, menus, or panels). There could also be some textual elements that include mismatched typography and/or language. Phishing websites Nevertheless, since most of the source code of any webpage is accessible through an internet browser, it’s fairly easy to create phishing webpages that look identical to the legitimate ones, which makes identifying a malicious page, via a visual assessment or “user intuition,” very challenging to do accurately. Phishing emails are typically less successful thanks to advances in classifying them as spam. However, some phishing emails and links still manage to slip into inboxes. Nevertheless, attackers are becoming more and more creative in the way they distribute malicious URLs. For instance, scammers can share them during phone calls, or by sending large numbers of SMS messages — tricks to hitting specific groups of people. This can range from posting malicious URLs in videos of popular YouTubers to deceptive apps for authentication, showing the user a QR code that contains a phishing site with a credential stealer installed. Below you can find two examples of recent phishing campaigns. Phishing continues to be a leading attack method because it allows cybercriminals to target people at scale. Usually, they distribute under the pretense of being representatives from major companies where the intended targets have accounts. Banks, governmental institutions, e-shops, e-mail service providers, and telecommunication companies are the most attractive businesses for phishing attacks — due to their high number of clients and the sensitive data involved. phishing scams What does a phishing site look like? Some of the modern phishing websites are reasonably easy to highlight in the wild due to the evident disparities to legitimate sites. Nowadays, cybercriminals use toolkits to create phishing pages in a short time, without the need for expert knowledge in website construction. Below you can find an example of such an attack, where visual differences reveal the fakeness of the site. In the previous Facebook login pages, we can see some changes that lead us to doubt the authenticity of the website, like a bigger logo, typographic differences, the absence of the footer text, the “Create new account” button in a slightly different green tone, and among others. Nevertheless, there are extremely deceptive phishing sites. In those cases, attackers put a lot of effort into making them look like the real thing. In the examples below, you can see how similar a phishing site looks compared to its authentic counterpart. In the login pages shown above, we can spot small details that differentiate the phishing site from the actual login page. The phishing version is a near duplicate of the original one, where the changes are very subtle and discrete intentionally to go unnoticed by the victim, i.e., the footer text has a different alignment, there are missing elements in it, or they are not displayed correctly. Phishing sites have greatly evolved over the years to become convincing counterfeits. Some even use HTTPS, giving users a false sense of security when they see the green padlock. The minor flaws in a phishing website might appear obvious when positioned alongside a legitimate page, but not so noticeable alone. But think about the last time you saw the login page for a service you frequently use. Chances are, you’ll struggle to recall all the details, which is exactly what phishing scammers are hoping for when they design their pages. How are phishing threats spreading? Historically, the most common way to spread phishing websites has been via phishing emails, but they’re also spread via paid advertisements that appear in search results. Other attack vectors include a technique called clickbait. Cybercriminals typically use clickbait on social media by promising something, such as a free phone, to encourage users to click on malicious links. What happens when a phisher makes a catch? Like nearly all modern cyberattacks, phishing is used for financial gain. When users give up login credentials to a phishing site, cybercriminals can abuse them in several different ways, depending on the type of site used to phish. Many phishing attacks imitate financial institutions, such as banks or companies like PayPal, and aim to yield significant financial rewards for cybercriminals. If a cybercriminal tricks a user into giving up their credentials to a shipping website, such as UPS or FedEx, they’re unlikely to profit from accessing the account. Instead, they may try to use the same credentials to access other accounts with more valuable information, such as an email account, knowing that people often use the same passwords across multiple services. Another way for cybercriminals to profit would be to sell the stolen credentials on the dark web, a deeper part of the internet where private networks do business anonymously without disclosing identity information. This is a “spray and pray” attack method. Many outdated WordPress sites on the web can be hacked and used for phishing campaigns at a very low cost. Generally, the price to deploy a phishing kit is approximately $25, making it very affordable and still profitable for the attackers. Another disadvantage of phishing – for the potential victim - is that the attacks have a short time to live (TTL), and the URLs frequently change inside one campaign making standard detection methods, like creating blocklists of suspicious URLs, ineffective against zero-day attacks. How to protect yourself Time often varies between a successful phishing attack – when the cybercriminal acquires the credentials, and when they use them. The quicker we’re able to mitigate the threat, the more potential victims we’re able to protect. Once a user’s credentials are stolen, there’s not much they can do other than change those credentials as soon as possible. In 2024, cybersecurity researchers found evidence that there are also new techniques to bypass various spam filters, even the best ones on Google. For example, attachments are sent as PDF files, which do not contain any text, to redirect users to other Google services, such as Google Docs. In addition, other non-standard phishing attachments are used, such as calendar invitations, where URLs linking to phishing sites are also included in the event description. Below, here’s a checklist to help prevent you from falling victim to one of the most successful forms of a cyberattack: First and foremost, install an antivirus solution on all of your devices, whether PC, mobile, or Mac. acts as a safety net, protecting users online. Antivirus software Do not click on links or download files from suspicious emails. Avoid replying to them, even if they allegedly came from . Instead, contact those entities through a separate channel and ensure that the message actually came from them. someone you trust Directly enter a website’s URL into your browser whenever possible, so you end up visiting the site you want to visit, rather than a phony version. Do not solely rely on the green HTTPS padlock. While this signifies that the connection is encrypted, the site could still be fake. Cybercriminals encrypt their phishing sites to further deceive users, so it’s important to double-check that the site you’re visiting is the real deal. Surf the web safely through an internet browser capable of catching phishing sites that are imperceptible to the naked eye. Like , which is powered with state-of-the-art security features distributed across multiple protection layers, assesses the URL legitimacy from its technical components running behind curtains to the visual content shown to the user. Leading to an efficient mitigation of these threats in massive campaigns. Norton Secure Browser : . Author Javier Aldana Iuit, PhD AI/ML Researcher of Visual Phishing and Scam Cyber-threats Detection, GEN

How Does Modern Phishing Work?

¿Cómo funciona el phishing moderno?

Comment fonctionne le phishing moderne ?

आधुनिक फ़िशिंग कैसे काम करती है?

最新のフィッシングはどのように機能するのでしょうか?

Como funciona o phishing moderno?

Lừa đảo hiện đại hoạt động như thế nào?

现代网络钓鱼是如何运作的？

In the ever-evolving digital landscape, web security has become an imperative concern. Among the myriad threats lurking in cyberspace, hostile bots are a formidable adversary. Bots (an abbreviation for “web robots") are software applications programmed to execute tasks autonomously on the internet. While certain bots play a positive role and contribute to diverse online functions like aiding search engine indexing or providing customer support through , there are hostile bots, created and used with malicious intent. These automated entities, capable of executing a wide array of actions, have escalated from minor annoyances to serious security challenges. chatbots This article explores the current state of hostile bots, their multifaceted applications, the ingenious ways in which threat actors are using them, and how to defeat them. Understanding the State of Hostile Bots In the current digital landscape, hostile bots encompass a spectrum of capabilities, ranging from basic data scraping to complex distributed denial of service (DDoS) attacks. Many bots have a high degree of versatility and sophistication; this adaptability allows them to evolve their tactics and evade conventional detection methods, posing significant challenges to web security. have evolved beyond their rudimentary origins to adopt human-like behaviors. Many can mimic genuine user interactions, making it increasingly difficult to distinguish them from legitimate human traffic. Their evasion tactics, such as IP rotation, browser emulation, and behavior mimicry, challenge traditional security measures and demand innovative countermeasures. Malicious bots Diverse Attack Vectors While some bot-driven threats are widely recognized, others remain relatively obscure, making the defense against them an ongoing challenge. Below are some of the most common of these attack vectors. 1.  DDoS Attacks are ubiquitous on the modern web. In these incidents, attackers attempt to overwhelm a target website or service with a massive volume of traffic, rendering it inaccessible to legitimate users. Hostile bots are used to wage these attacks, at the scale of the attacker’s choosing. These events can disrupt online services, cause downtime, and result in financial losses. Distributed denial of service assaults 2. Web Scraping and Data Theft Hostile bots are often used for web scraping, where they gather information from websites for various purposes, including market research, content theft, and competitive intelligence. While web scraping itself may not always be malicious, it can lead to intellectual property theft and loss of revenue for businesses. 3. Credential Stuffing Attacks Another common use of hostile bots is in credential stuffing attacks. Hackers attempt to use previously stolen usernames and passwords to gain unauthorized access to various online accounts. Bots automate the process of trying these credentials across multiple platforms, exploiting users who reuse passwords across different sites. The goal is to gain access to sensitive information, financial accounts, or even corporate networks. 4. Impersonation and Fake Accounts Threat actors deploy hostile bots to create fake accounts on social media platforms, forums, and other online communities. These fake profiles can be used for , conducting scams, or promoting malicious content. They can also be leveraged for social engineering attacks, exploiting trust and credibility to manipulate users into taking harmful actions. spreading misinformation 5. Scraping and Data Theft Many types of sites are threatened by bots designed to wage custom forms of attack. Data aggregators, apps that quote prices or rates, and certain other types of sites must defend against bots that scrape private data and exploit it in ways that are harmful to the owners of that data. E-commerce websites can be attacked by competitors using bots to scrape pricing information and dynamically adjust their own prices, leading to distorted market dynamics and unfair competition. These subtle manipulations can create an unfair competitive advantage and inflict significant financial damage. 6. API Abuse and Brute-Force Attacks Hostile bots can exploit weaknesses in Application Programming Interfaces (APIs), gaining unauthorized access, exploiting data leaks, or facilitating further attacks. , where bots systematically try various combinations to break into systems or accounts, pose a persistent threat. These attacks can have far-reaching consequences, from data breaches to compromised infrastructure. Brute-force attacks 7. Inventory Hoarding Specialized hostile bots can attack e-commerce sites and make inventory unavailable to legitimate customers. For example, they can add products to shopping carts, but never complete the purchases. Another example is travel sites that are attacked by bots that abuse time-to-checkout policies, continually looping and starting to book reservations without ever purchasing tickets. This prevents actual customers from purchasing, and other financial damage can occur as well. 8. Political Influence Hostile bots have been used to amplify fake news, manipulate public opinion, and spread misinformation during political events and elections. They can create the illusion of widespread support for certain ideas or candidates, impacting democratic processes. 9. Automated Fraudulent Activities Hostile bots are also used for various forms of fraud, such as ad fraud and fake account creation. Ad fraud involves generating fraudulent ad impressions and clicks to siphon off advertising revenue. Similarly, the creation of fake accounts can deceive users, inflate follower counts, and artificially boost engagement metrics, thereby undermining the authenticity of online interactions. Defeating Hostile Bots Why Bots Can Be Difficult to Detect Bots range from simple simple scripts to advanced AI-driven agents. The most sophisticated ones can be very difficult to recognize. Advanced hostile bots can mimic human behavior by simulating mouse movements, keyboard input, and browsing patterns. Further, threat actors have developed ways to bypass CAPTCHAs and other security measures designed to distinguish between humans and bots. To make matters worse, underground markets have arisen that include the sale of botnet services. Even non-technical threat actors can now rent and deploy advanced hostile bots to wage their attacks. As a result, while older and simpler bots are still common on the web today, there is a rising percentage of advanced threats that are more difficult to defend against. Effective & Efficient Bot Detection An must be able to block highly sophisticated bots that can evade conventional identification techniques. As mentioned earlier, modern hostile bots are often programmed to mimic human behavior, making their detection challenging. However, with advanced algorithms and detection mechanisms, an effective bot management system can accurately distinguish between genuine users and malicious bots. effective bot management solution Efficiency plays a crucial role in bot management, particularly in handling large traffic volumes in real time. The detection of sophisticated bots may necessitate significant computational capabilities, all while ensuring that the performance of the protected system remains uncompromised. An efficient bot management solution must be capable of consistently mitigating and detecting bot traffic while maintaining high performance levels. This can be done through a multi-step bot detection process, filtering traffic through multiple stages. The process should start with rapid and computationally economical techniques like signature profiling, threat intelligence feed verification, and environmental profiling. These initial steps quickly eliminate a significant portion of easily identifiable bots. Another key technique is rate limiting, which is important for blocking bots that are submitting requests (such as login attempts) that otherwise appear to be legitimate. Subsequent stages, such as dynamic filtering, demand more resources but have the capacity to detect and block more sophisticated bots. The most resource-intensive analysis, which encompasses biometric behavioral assessment, is solely employed on traffic that has successfully traversed all preceding stages. This strategic approach facilitates precise identification of even the most intricate bots, while keeping latency to a minimum. Manipulating Bots and Deceiving Threat Actors While the primary focus of a bot management solution revolves around achieving effective and efficient detection, advanced systems can surpass mere bot mitigation, and actively mislead threat actors. For example, the solution can return custom responses to specific bot activities. Threat actors will use the http response status codes from a web application or API to orchestrate their activities; a solution can confuse their actions by returning unexpected or deceptive codes. Another example: imagine an e-commerce establishment besieged by competitor-driven price-scraping bots. Instead of simply blocking these bots, a strategy that rivals might notice and strive to overcome, the targeted store can manipulate the bots' encounters by presenting them with fabricated information. By adopting this approach, the affected store disrupts the rivals' endeavors to pilfer and exploit sensitive data. As a result, rather than reacting in a passive manner to the presence of bots, the victimized entity in effect takes charge and directs the bots' behaviors, ultimately thwarting their harmful motives. Other examples could be given. By assuming control over bot activities, victims can frustrate the efforts of malevolent bot operators, safeguard their data and intellectual assets, and gain valuable insights into potential risks. This proactive engagement level significantly contributes to shielding websites and online services against the deleterious effects of bot assaults. Conclusion The diverse and creative ways in which hostile bots are used today pose significant challenges to web security. From credential stuffing attacks to political influence campaigns, the impact of these automated threats can be far-reaching and damaging. As technology continues to advance, threat actors will likely find new and innovative ways to exploit vulnerabilities. To safeguard modern digital ecosystems, a proactive and multi-faceted approach that combines advanced security solutions and vigilant monitoring is essential. By staying informed about the tactics employed by hostile bots and implementing effective countermeasures, we can collectively defend against these evolving threats and ensure a safer online experience for all.

Hostile Web Bots: Why Modern Bots are Difficult to Detect and Defeat (and How to Do it Anyway)

Bots web hostiles: por qué los bots modernos son difíciles de detectar y derrotar (y cómo hacerlo de todos modos)

Bots Web hostiles : pourquoi les robots modernes sont difficiles à détecter et à vaincre (et comment le faire quand même)

शत्रुतापूर्ण वेब बॉट्स: क्यों आधुनिक बॉट्स का पता लगाना और उन्हें हराना मुश्किल है (और इसे वैसे भी कैसे करें)

敵対的な Web ボット: 最新のボットの検出と撃破が難しい理由 (そしてそれを行う方法)

Bots hostis da Web: por que os bots modernos são difíceis de detectar e derrotar (e como fazer isso de qualquer maneira)

Các bot web thù địch: Tại sao các bot hiện đại khó phát hiện và đánh bại (và cách thực hiện bằng mọi cách)

恶意网络机器人：为什么现代机器人难以检测和击败（以及如何做到这一点）

Remote desktop protocol (RDP) isn’t as secure as most people think. While it’s an incredibly convenient tool, it poses serious risks when it lacks the proper security measures. Why is RDP not secure, and how can users fix it? The answer lies within its core vulnerabilities. cybersecurity What Is RDP? RDP is a communications protocol that allows someone to remotely access a device over a network connection. It links a computer to a client and server, creating an interface for the original user to interact with. Even at great distances, users can use it to view and control the computer just like they could if they were sitting right in front of it. It’s useful for people who work from home, travel frequently, work in tech support, or are system administrators. Since it’s typically free and easily accessible, many businesses rely on it to support their remote workers. However, it’s valuable to hackers who want to exploit its extensive access capabilities. They often target it to rapidly deploy malware, attack critical systems, or extract data. Is RDP Secure by Default? RDP is not secure by default and has multiple high-risk vulnerabilities. How secure is RDP for daily use? Although it’s generally acceptable to use it in passing, continuous long-term use increases the chances of a cybersecurity incident occurring. It can lead to distributed denial-of-service, man-in-the-middle, ransomware, and brute-force attacks. Hackers have as an intrusion vector since it lacks built-in protection. Although organizations can strengthen it with additional cybersecurity measures, it’s still relatively easy to compromise. Thanks to it, some cyberattack types hit an all-time high in 2020. used RDP most frequently In fact, nearly say they’ve experienced more cybersecurity incidents since their employees began working remotely, with some claiming the amount has doubled. Even though RDP isn’t the only factor contributing to the sharp increase, it plays a prominent role. one-quarter of organizations Why is RDP not secure by default when it has a high potential for damage? While developers established basic security controls, it’s ultimately up to the user to protect themselves. It isn’t ideal, but there are far too many attack surfaces and entry points for them to cover everything. How Do Hackers Exploit RDP? There’s such a large variety of ways for hackers to take advantage of RDP. They can buy stolen credentials off the dark web, but phishing and brute-force attacks work just as well if those details aren’t available. Alternatively, they exploit vulnerabilities — like the one that affected Windows 7 through 10 in 2019 — or use unsecured ports as direct entryways. For example, Port 3389 is among the , so hackers target it frequently. Is RDP secure enough to keep it open? Generally, the answer is no. To be safe, users should check their settings and ensure they close it. most vulnerable RDP ports People who think they’re safe should take precautions, as anyone can easily search online to find openings. Shodan — a search engine for finding servers, devices, or ports connected to the internet — has found more than and over 14,000 vulnerable Windows servers as of 2021. 4 million exposed RDP ports Since using Shodan to find security vulnerabilities is perfectly legal, there’s no telling how many people could stumble across someone’s open port. All it takes is one malicious individual to take things further and launch a cyber attack. Why Do Hackers Target RDP? Hackers target RDP because it typically grants them access from any remote location. Instead of having to be discreet and wait for months to gain access to critical systems or data, it provides them with everything at their fingertips. They can find its vulnerabilities through a quick online search and easily exploit them, resulting in a low-risk, high-reward situation. Additionally, they target RDP because they can use it as a jumping-off point to gain entry into separate critical systems and infect them with malware. What begins as a brute-force credential attack turns into a full-blown cybersecurity incident. RDP is a hacker’s intrusion vector of choice since it can grant them generally unrestricted access. In fact, it was behind in 2020 alone. Instead of needing complex workarounds, they could easily navigate the desktop to find and encrypt files or even steal other credentials for future attempts. one in five ransomware attacks Many people used RDP when the COVID-19 pandemic forced them to work from home, making it an even bigger target. Unsurprisingly, using it had significant cybersecurity consequences. Astonishingly, the number of in 2020 alone. While it is a practical tool for remote workers, its security vulnerabilities make it one of the least ideal long-term solutions. RDP attacks grew by 768% Can RDP Users Make It More Secure? Users can make RDP more secure if they implement additional security measures. Whether they use it routinely for work or only occasionally to get tech support, proven cybersecurity tools are essential. Here are several ways to make RDP more secure: MFA requires users to validate login attempts on a separate, secure device. With this, hackers would have no luck exploiting RDP, even with valid stolen credentials or a successful brute force attack. Multi-factor authentication: How secure is RDP over the internet when users have a firewall? If a server is behind one, hackers can’t use Shodan to find and exploit unsecured ports. If people are intent on keeping them open, it’s a necessity. Firewall: A self-signed certificate is a that safeguards information integrity. People can use it to restrict RDP capabilities, limiting a hacker’s ability for lateral movement through a system. Self-signed certificate: type of public-key certificate Network-level authentication uses the credential security support provider (CredSSP) — a security protocol for remote authentication — to validate a user’s identity before allowing a connection. Network-level authentication: A jump host is a server between the computer and the destination server. It blocks access so administrators can verify a user’s identity, preventing hackers from gaining entry. Jump host: How secure is RDP with a VPN? It increases protection significantly since it encrypts network traffic between remote users and their organization’s network. Virtual private network: This approach only permits specific instances of system or data access. Even if a hacker successfully exploits RDP, it prevents them from accessing files or progressing further through the network. Principle of least privilege: How secure is RDP when it has multiple security measures backing it? These solutions make it much more secure because they cover the main vulnerabilities. Even though some have their own flaws, their benefits generally outweigh the potential risks. Is RDP Secure Enough? With additional security measures, RDP is secure enough. However, users should be cautious, considering any vulnerabilities become public on Shodan. Continued preventative care is essential for maintaining cybersecurity despite its weaknesses.

How Secure Is Remote Desktop Protocol (RDP)?

CREDENTIAL ENGINE

credentialengine.org

-- employees

Since n.d.

COMPANY RANKING

CREDENTIAL ENGINE

EVERGREEN INDEX #3093

Representing this company? Click here to claim and customize this page!

Credential Engine WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

CREDENTIAL ENGINE

credentialengine.org

-- employees

Since n.d.

COMPANY RANKING

CREDENTIAL ENGINE

EVERGREEN INDEX #3093

RELATED COMPANIESRANK

STORIES ABOUT CREDENTIAL ENGINE

Representing this company? Click here to claim and customize this page!

Credential Engine WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!