The Week In Breach

 

Social Graphic_3.png (1200×627)

This week, medical data is on the menu for hackers.

Dark Web Data Trends 

  • Total Compromises: 2,368
  • Top PIIs compromised: Domains (2,366)
    • Hashed/Cleartext Passwords (36,617)
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

United States – NorthBay Healthcare Corporation

https://news.softpedia.com/news/social-security-numbers-pii-stolen-in-northbay-healthcare-data-breach-523548.shtml
Exploit: Supply chain vulnerability.
NorthBay Healthcare Corporation: A healthcare organization based in Portland, Oregon.
Risk to Small Business:1.666 = Severe: An organization that is unable to secure the data of those applying for a job could scare away potential applicants as well as customers.
Individual Risk: 2.285 = Severe: Those affected by this breach are at an increased risk of identity theft.
Customers Impacted: Those who applied to the organization between 2012 and May 2018.
How it Could Affect You: A supply chain breach can damage customer trust in an organization, and while NorthBay Healthcare is offering identity monitoring services for those affected, it will not undo what has already happened.
ID Agent to the Rescue: Spotlight ID™ by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach like this one.
Learn more: https://www.idagent.com/identity-monitoring-programs

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Girl Scouts of America

https://cyware.com/news/girls-scouts-got-hacked-and-the-personal-data-of-2800-members-compromised-8f63f56a
Exploit: Compromised email account.
Girl Scouts of America: The preeminent leadership development organization for young girls in the United States.
Risk to Small Business:1.667 = Severe: A breach that exposes medical history can foster distrust between a customer and an organization.
Individual Risk: 2 = Severe: Those affected by this breach are at an increased risk for identity theft and fraud.
Customers Impacted: 2,800 members.
How it Could Affect Your Business: This breach could damage the reputation of any business or organization, and in this case could push away current members of the organization and scare away new potential members.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach of this type.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.


In Other News:

Facebook’s Folly
Private messages between Facebook users are for sale, and there’s no shortage. 81,000 users’ private messages were accessed by a hacker who is now attempting to sell them, some for as low as 10 cents per account. Facebook has been ravaged by hacks over the last year, and the social media juggernaut appears to still be having trouble keeping their customers’ data safe.
https://www.bbc.com/news/technology-46065796

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


 

Hackers are Bundling Up This Fall.
Well, it’s nearing the end of the year. You know what that means: it’s time for the ‘best of 2018’ collections to start coming out. One category is Best Movies of 2018… personally, I think The Incredibles 2 is at the top of that list. Another category is Best of Ransomware. Yes, there is a ‘best of the year’ collection for cybercriminals. To the surprise of no one, the ransomware collection is being sold on the Dark Web, but there are many surprising elements to the bundle.

First off, the fact that the year’s most dangerous ransomware variants are being sold as a package deal at a reduced price should show the… professionalism… of the Dark Web marketplaces, as strange as it is to use that word to describe cybercriminals. This crime-as-a-service model is nothing new, but this bundle is undoubtedly a step above the norm. There are 23 ransomware variants included in the bundle, including SamSam. Yes, the notorious SamSam ransomware is included in the bundle. If you don’t know what SamSam is, it is a variant of ransomware that is infamous because of the high-profile targets it has been used against and because until now, it was under lock and key deployed only by a highly specialized group.

This bundle is not for inexperienced hackers, however, which would be worse than the current situation. An unskilled hacker would find difficulty putting most of the bundle to use. The bundle will be removed from the marketplace after sold 25 times, according to the seller, although it is unclear why this is the case. Don’t let one of the hackers who buys this bundle use it against your business!

https://www.zdnet.com/article/giant-ransomware-bundle-threatens-to-make-malware-attacks-easier-for-crooks/

 

Want some help?

 

Get a Free Dark Web Scan of your Business Domain

Get a Free Tool Kit- Phish Prone Test, Domain Spoof Test, Weak Password Tool and more!


Advertisements

The Week in Breach: 10/20/18 – 10/26/18

Halloween Breaches

Germany and Hong Kong get highlighted in this edition of The Week in Breach.

Dark Web ID Trends:

  • Total Compromises: 37,290
  • Top Source Hits: Website (36,618)
    • Disqus.com (36,618)
  • Top PIIs compromised: Domains (37,253)
    • Hashed/Cleartext Passwords (36,617)
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

Hong Kong – Cathay Pacific Airways
https://www.reuters.com/article/us-cathay-pacific-cyber/cathay-pacific-flags-data-breach-affecting-94-million-passengers-idUSKCN1MY26L
Exploit: Unclear at this time.
Cathay Pacific Airways: Hong Kong-based international airline.
Risk to Small Business: 1.666 = Severe: Customers are not soon to forget the company that failed to secure their data and waited several months to acknowledge their breach.
Individual Risk: 2.285 = Severe: Individuals affected by this breach are at a higher risk of credit card fraud and should contact their card issuer, cancel their cards immediately, and enroll in a credit monitoring service, if provided.
Customers Impacted: 9.4 million.

How it Could Affect Your Business
For any organization, a breach where the hacker obtained payment information is a customer relations disaster. A breach where almost 9.5 million customers were affected would scale this disaster up to match.

ID Agent to the Rescue:
  Spotlight ID by ID Agent offers comprehensive identity monitoring that is vital for those affected by a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

Germany – Wolf Intelligence
https://motherboard.vice.com/en_us/article/vbka8b/wolf-intelligence-leak-customer-victim-data-online
Exploit: Exposed database.
Wolf Intelligence: German-based spyware startup.
Risk to Small Business: 1.666 = Severe: A breach caused by negligence is hard to explain to a customer, which would affect the amount of time it would take to regain trust.
Individual Risk: 2.142 = Severe: Because the data exposed was highly personal, including phone conversations and texts, those affected by this breach are at a higher risk of identity theft.
Customers Impacted: 20 gigabytes of data exposed, it is unclear how many customer’s data existed within that.

How it Could Affect Your Business: An organization in the spyware industry will obviously take a SEVERE hit to their reputation, but any company would suffer the embarrassment of the founder leaving scans of his credit cards exposed on the internet.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:
Repair Your Phone Yourself:
It is now legal to break Digital Rights Management in order to repair your phone, following a ruling at the US Copyright Office. This is big news for third-party phone repair shops, as well as the repair businesses of many other products such as cars, tablets, refrigerators and even tractors. Go ahead and crack that old broken iPhone open to fix it yourself! Well… try to fix it at your own risk, but now you have the option.

https://www.zdnet.com/article/need-to-fix-an-iphone-or-android-device-you-can-now-break-drm-under-new-us-rules/

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!



Ransomscare.
There was an article that came out this week written by the previous CIO of the New York City Law Department (which is also the world’s largest public sector law firm, fun fact), discussing the best ways to avoid ransomware. In the article he discussed 3 key points:

1.Cyber Hygiene: This is an obvious one but cannot be underrated! Passwords must be changed regularly, and everyone must remain diligent while browsing their inbox.

2. Best practices: Best practices in this context covers updating existing tech, using preventative technologies, and communication. To have the best practice for updating existing tech, put a priority on pushing out patches, use cloud web application firewalls and credential monitoring to stay a step ahead with preventative tech, and communicate with your security team and employees about what they should be doing as individuals and as a team.

3. Testing disaster recovery plans: This point is self-explanatory, you need a test to see if your backup plans work. You wouldn’t leave the fire alarms untested!

With ransomware being seen all over the world from Atlanta to Moscow to Sydney, it is something every business should take into account.
https://www.darkreading.com/cloud/3-keys-to-reducing-the-threat-of-ransomware/a/d-id/1333113

 

Would you like a free report on your corporate domain credentials exposed on the Dark Web?

Six Common Computer Viruses and What They Do to Your Computer

Here is a great article from InCyberDefense that explains computer viruses.

By Marissa Bergen 
Contributor, InCyberDefense

Viruses can attack your computer at any time, so knowing how to protect yourself is helpful in preventing attacks. Part of that protection is familiarizing yourself with the different types of viruses to which your computer is vulnerable. Once you understand how viruses work, you will be better prepared to deal with them in the unfortunate event that a virus infects your computer.

Six Common Computer Viruses and What They Do to Your Computer

To avoid an infection, here are six common computer viruses you should look for:

1. Polymorphic virus: When this type of virus infects your computer, it creates copies of itself. Each copy is slightly different than the others, making it difficult for antivirus programs to detect them.

2. Resident virus: A non-resident virus needs to be executed before it begins its infection, but a resident virus can activate as soon as the operating system loads. It functions by hiding in your computer’s memory, which makes it exceptionally difficult to eradicate.

3. Boot sector virus: A boot sector is the section of a computer’s hard drive or external storage medium that contains the information required to boot (start) your computer. A boot sector virus infects that part of the sector known as the master boot record and replaces legitimate information with its own infected version. This virus activates in your computer before it loads and may make your computer unbootable, so you can’t start your computer.

4. Multipartite virus: This virus is exceptional because it has the ability to attack two components of the computer at the same time. It infects both the boot sector and system or program files simultaneously. Because of this ability, a multipartite virus infects the same operating system over and over until the system and all of its components are completely eradicated.

5. Overwriting virus: An overwriting virus destroys files by infecting them and overwriting the data they contain. It can only be removed by deleting the infected files. In these cases, files are permanently lost and clean versions of them will have to be reinstalled on your computer.

6. Browser hijacker virus: Once this virus is in your computer, it modifies the settings of your web browser, including the default search engine and the homepage. Once the takeover occurs, the virus sends users to malicious websites.

This virus can also install spyware and ransomware to an operating system, compromising sensitive data. The virus spreads through malicious email attachments, free downloads and visits to infected websites.

Education Is the First Step in Preventing Virus Infections

Unfortunately, there is not much you can do to get rid of these six common viruses once they enter your computer. But educating yourself about viruses and how to avoid them can save you from a lot of headaches and heartaches later.

 

Need help on training your staff? Want some free tools for cyber awareness? Click Here!

The Week in Breach

Data Breach October 25

 

This week Tumblr was breached and we explore Dark Web job postings.

Dark Web ID Trends:

Total Compromises: 3,767
Top Source Hits: ID Theft Forum (1,429)
Top PIIs compromised: Domains (3,761)
Clear Text Passwords (876)
Top Company Size: 11-50
Top Industry: Business & Professional Services and Finance & Insurance

Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Disqus
https://thehackernews.com/2017/10/disqus-comment-system-hacked.html
Exploit: Exposed Database
Disqus: A network community platform that allows users to blog or comment on other company’s websites. It can be installed as a plug-in or drop-in code. Disqus collects user data on the back end and allows companies to use this information for customer analytics, etc…
Risk to Small Business: 2.4444 = Severe: Although roughly 1/3 of the 17.5 million records compromised involved passwords, they happened to be salted/hashed. The company also discovered and announced the breach in a quick manner and notified the affected customers.
Individual Risk: 2.4286 = Severe: Those affected by this breach will be at a high risk of identity theft.
Customers Impacted: 5.8 million
How it Could Affect Your Customers’ Business: The breach involved a large number of customers; however, the database was from 2012 and most credentials could have already been changed. While this is damaging to Disqus’ reputation, they followed protocol and demonstrated how to do breach disclosure the proper way.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that is vital for those affected by a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs

United States – Tumblr
https://www.bleepingcomputer.com/news/security/tumblr-fixes-security-bug-that-leaked-private-account-info/
Exploit: Bug.
Tumblr: A popular blogging website.
Risk to Small Business: 2 = Severe: While Tumblr deserves some credit for 1. Having a bug bounty program that resulted in catching this bug, and 2. Fixing the bug in less than 12 hours after it was discovered, many customers will not appreciate their personal information being leaked and will react accordingly. Tumblr’s timely response, disclosure of the breach, and its bug bounty program will likely reduce the impact on the business significantly.
Individual Risk: 2.714 = Moderate: Email addresses were leaked so those affected by the breach are at a higher risk of spam.
Customers Impacted: All of the ‘recommend blogs’ shown on Tumblr.
How it Could Affect Your Business: A breach that exposes user information is always going to have a negative effect on business, but every organization should take a page out of Tumblr’s book here regarding their response to the event and how they discovered it. Customers lose trust in businesses that mishandle their information, but they also respect when a company is making a serious effort to locate vulnerabilities and can handle a problem when it arises with swift action.

In other news:
When the Dating App Stands You Up
A dating app called Donald Daters was discovered to be exposing all user information on the open internet… including personal messages. The app’s goal is to help single Donald Trump supporters connect with one another, but instead exposed all that used it. The hacker that accessed the database was able to “collect profile data, including names, photos, personal messages, and the digital access tokens to log into their accounts.” The hacker also can delete the app’s data. Watch out where you put your personal information, people!
https://in.pcmag.com/news/126298/trump-themed-dating-app-found-leaking-users-private-chats

The Dark Web Monster
When looking for a job, usually you would check one of the many job hunting sites you see in commercials or circle ads in newspapers (at least at one point you did). Some people do something very similar… but on the Dark Web searching for an illicit job. Many job postings on the Dark Web seem like normal job ads. But when you look closer you will notice that advert for a driver not only needs the person to drive but also transport drugs. The driver would make $1,000 for a week of work, not including the living expense compensation. One of the more lucrative opportunities on the Dark Web job market is the corporate insider. The most common target is financial employees who, in one example, are offered $3,150 to get a loan or increase cash withdrawal limits on a card. Postal workers are also targeted to steal packages.

The Dark Web is lucrative for those willing to risk their job and possibly their freedom for money. Be careful of both insiders and the wide array of illicit software sold there.
https://www.darkreading.com/threat-intelligence/inside-the-dark-webs-help-wanted-ads/d/d-id/1333066

The week in BREACH!!

Success Rate of Phishing by Day

 

This week you’ll hear how a supply chain attack could snatch your customers’ credit card information right from underneath you and why Google+ goes bye-bye.

Dark Web ID Trends:

  • Total Compromises: 974
  • Top Source Hits: ID Theft Forum (501)
  • Top PIIs compromised: Domains (973)
    • Clear Text Passwords (498)
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

United States – Shopper Approved
https://www.zdnet.com/article/new-magecart-hack-detected-at-shopper-approved/
Exploit: Malicious code.
Shopper Approved: Utah-based company that provides a review widget for other companies’ websites, that allows customers to post reviews.
Risk to Small Business: 2.111 = Severe: This is another attack conducted by one (or more) of the several groups who operate under a similar style, given the term Magecart as a general identifier. Magecart is also responsible for the hacking of Ticketmaster and British Airways.

If your business uses Shopper Approved, you should remove the code from your website immediately.

Individual Risk: 2.428 = Severe: Those affected by this breach should cancel their credit cards and enroll in a credit monitoring service.
Customers Impacted: Unclear how many customers were affected by this breach, but only sites with the widget code on their checkout pages had credit card information compromised. The incident only lasted 2 days before being discovered, a much shorter span than many of the other Magecart breaches.
How it Could Affect Your  Business: A breach of this kind can often go unknown for a long period of time while the hackers collect valuable user data and credit card information. Even though it is a third party who was breached, it will be your business that takes the PR damage.
ID Agent to the Rescue: Spotlight ID™ by ID Agent offers comprehensive identity monitoring that also includes credit monitoring. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Rebound Orthopedics and Neurosurgery
https://cyware.com/news/hackers-hit-rebound-orthopedics-neurosurgery-2800-patient-records-compromised-026125d8
Exploit: Compromised employee credentials.
Rebound Orthopedics and Neurosurgery: Vancouver-based orthopedics and neurosurgery practice.
Risk to Small Business: 1.555 = Severe: This breach would have a long-lasting effect on customer trust for any business, and in many countries the government will fine an organization heavily for failing to secure health data.
Individual Risk: 2.142 = Severe: Health information is valuable data for hackers and useful for identity theft. Those affected by this breach are at a severe risk for insurance fraud and identity theft.
Customers Impacted: 2800.
How it Could Affect Your Business: Organizations that store health information are held to a higher standard for securing data due to the sensitive nature of the information and HIPAA laws. When an organization fails to keep the data secure, it reflects very poorly on the company and usually results in a fine from the government.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.


In Other News:

Google –
Google+ will be shutting down, and yes Google+ is (or at least was) still around. After exposing more than 500,000 users’ data to external developers, the tech giant has decided the best course of action is to close down the failed social network. This move makes sense given the recent outrage against Facebook after the social media site exposed 50 million people’s data. An unfortunately fitting ending to the continuously failing website.
https://www.yahoo.com/news/google-exposed-user-data-feared-repercussions-disclosing-public-170304936–finance.html?soc_src=newsroom&soc_trk=com.apple.UIKit.activity.CopyToPasteboard&.tsrc=newsroom

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


A note for you:
e-mail….ware
New research has revealed that a whopping 90% of all malware is delivered via email. The team also discovered that the average employee will not go 48 hours without seeing a phishing message.  In addition, over half of the phishing messages examined used the word “invoice” in the subject line. A little under a quarter (21%) of the flagged emails also had malicious attachments sent with the phishing message.

Watch out for suspicious emails! All it takes is one employee to fall for a phishing email and an entire organization can be compromised.

https://www.darkreading.com/attacks-breaches/most-malware-arrives-via-email/d/d-id/1333023

 

Need to learn more about your Dark Web exposure? Click Here!

Want some free tools to combat phishing? Click Here

The Week In Breach

Passport Dar kWeb

Trends in data found on the Dark Web this week:

  • Total Compromises: 24,968
  • Top Source Hits: ID Theft Forum
  • Top PIIs compromised: Domains
    • Clear Text Passwords (24,884)
  • Top Company Size: 11-50
  • Top Industry: Construction and Engineering

Canada – Altima Telecom
https://techcrunch.com/2018/10/01/altima-telecom-server-flaw-customer-data-exposed/
Exploit: SQL injection attack.
Altima Telecom: Serving Montreal and Toronto, Altima Telecom is one of the largest independent Canadian internet service providers.
Risk to Small Business: 1.555 = Severe: As the risk score shows, this is a severe breach that could deal major damage to any organization. Payment info exposure is a particularly significant deterrent for customers looking to do business.
Individual Risk: 2.142 = Severe: Those affected by this breach are at an increased risk for identity theft and spam.
Customers Impacted: All of Altima Telecom’s customers.
How it Could Affect Your Business: Not only was all the organization’s customer data exposed by this breach, but the affected data was highly sensitive. This would sever trust between the customer and the organization, which could take a significant time to rebuild.
ID Agent to the Rescue: Spotlight ID™ by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Apollo
https://cyware.com/news/hackers-hit-apollo-stealing-database-containing-200-million-contact-records-d9c87501
https://techcrunch.com/2018/10/01/apollo-contacts-data-breach/
Exploit: Unclear at this time.
Apollo: New York-based sales engagement startup.
Risk to Small Business: 2 = Severe: This could deal a significant blow to an organization’s ability to retain customers.
Individual Risk: 2.428 = Severe: The customers affected by this breach will be at a higher risk for spam due to the nature of the data accessed.
Customers Impacted: 200 million.
How it Could Affect Your Business: A breach that exposes such a large number of customers will garner media attention and erode customer trust significantly.
ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs
Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk
*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.


In Other News:
The Chinese Chip
China was able to infiltrate US companies and governmental agencies with a simple but effective supply chain attack. The attack was discovered after Amazon had a third party examine the hardware of the servers they purchased from another American company that manufactures their servers in China. The company discovered a microchip on the servers that allow for attackers to make stealth doorways on their network. Hardware attacks are rarer and more difficult to execute than software attacks, but with China making 90% of the world’s PCs, they are in a good position to continue using hardware to infiltrate organizations across the world.

https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show


Planning your next vacation may have just gotten weird… 

Where should I go? This is a normal question one thinks about when planning a trip. Should I go to white sandy beaches or breathtaking mountains?
When should I go? Do I visit family during the holidays, or do I plan a summer getaway?
Who should I be? This question is asked much less, but maybe more than you think. A recent study has uncovered startling secrets surrounding the passport market on the Dark Web!

  • The average cost of a passport scan on the Dark Web is $14.71.
  • Australian passport scans are the most common, but the average cost is the most expensive at $61.27.
  • The average price of a real physical passport is $13,567, while a counterfeit physical passport is just under $1,500 ($1,478).

The Dark Web is a place where black markets and illicit activity reign. In the depths of the Dark Web, identities are traded regularly and for a low price, so why leave the unknown unchecked? With Spotlight ID, know that your identity is safe even from the darkest corners of the Dark Web.
https://www.comparitech.com/blog/vpn-privacy/passports-on-the-dark-web-how-much-is-yours-worth/

The Week In Breach October 1 2018

 

 

Cyber awareness Match

 

This week Medical Data is on our minds, due to a new study on the healthcare industry and cyber security. Facebook and the United Nations were also breached this week, and both were very large datasets, impacting tens of millions of people.

Dark Web ID Weekly Trends:

  • Total Compromises: 861
  • Top Source Hits: ID Theft Forum
  • Top PIIs compromised: Domains
    • Clear Text Passwords: 501
  • Top Company Size: 11-50
  • Top Industry: High-Tech & IT

United States – Facebook

https://www.nytimes.com/2018/09/28/technology/facebook-hack-data-breach.html

Exploit: Web vulnerability.
Facebook: Facebook is a social media platform that is one of the Internet’s most popular websites.
Risk to Small Business: 2.333 = Severe: The loss of trust any organization would feel after a breach of this magnitude would greatly harm the organization’s ability to retain or obtain customers.
Individual Risk: 2.571 = Moderate: The data accessed puts those affected by this breach at an increased risk for identity theft, spam and targeted phishing campaigns.
Customers Impacted: 50 million.

How it Could Affect Your Business: Facebook being such a large and widely-used social media platform means that it has data on a large amount of the population that uses the Internet. If employees post information to this site, they could now be open to targeted phishing campaigns and spam.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United States – Aspire Health

https://www.usatoday.com/story/money/nation-now/2018/09/26/aspire-health-hacked-phishing-scheme-patient-health-data/1430262002/

Exploit: Compromised email account hacked through a phishing scheme.
Aspire Health: According to Aspire health website, “Aspire Health specializes in providing an extra layer of support and relief from stress, pain and symptoms to patients facing a serious illness.”
Risk to Small Business: 2.333 = Severe: The risk to small business is severe due to medical data as well as confidential information being accessed.
Individual Risk: 2.571 = Moderate: The data accessed puts those affected by this breach at an increased risk for identity theft.
Customers Impacted: This information has not been released as the investigation is ongoing.

How it Could Affect Your Business: Breaches that involve medical data can have serious long-lasting effects on the reputation of a business, due to the sensitive nature of the data.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: http://downloads.primetelecommunications.com/Dark-WeB

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.

United Nations

https://cyware.com/news/united-nation-wordpress-site-publicly-exposes-thousands-of-resumes-2f2a8cf1

Exploit: WordPress Vulnerability.
United Nation: An intergovernmental organization tasked to promote international cooperation and to create and maintain international order.
Risk to Small Business: 2.333 = Severe: While the United Nations is unlikely to see any repercussions for this breach, a small business would face serious PR consequences if they experienced a breach such as this.
Individual Risk: 2.714 = Moderate Risk: Resumes contain a significant amount of personal information and job history, which can be used for spear phishing attacks and identity theft.
Customers Impacted: Resumes that have been submitted to the UN since 2016.

How it Could Affect Your Customer’s Business:  The exposure of resumes for 2 years would deal a serious blow to an organization of any size: the amount of time the data was exposed, and the type of data included in resumes makes this breach score severe on our risk score scale.

Risk Levels:
1 – 1.5 = Extreme Risk
1.51 – 2.49 = Severe Risk
2.5 – 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.


In Other News:

No Fly Zone
The Dark Web is known to have all things illegal for sale, from medical information to illicit drugs. A new trend has been discovered by researchers where frequent flyer miles are being sold for significantly less than what legitimate buyers would pay. The average rate that a batch of frequent flyer miles sells for is $31, although the price depends on the airline and number of miles.
https://www.hackread.com/stolen-frequent-flyer-miles-of-top-airlines-sold-on-dark-web/

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


A note for you:

The Cost of Healthcare on The Dark Web.
We all know that compromised health records and other medical information is highly valuable and sought after on the Dark Web. A new study by JAMA helps us conceptualize the volume of medical information for sale, and how much your health records go for on the Dark Web.

The annual data breach tally has increased every year since 2010 (except for 2015). The median number of records accessed per breach: 2,300. The mean number of records accessed per breach: 84,456. With patient records selling on the Dark Web for $300 – $500, hackers could make close to $700,000 ($690,000) by breaching an organization that stores medical information.

Who in the healthcare sector was hit the hardest?

  • Healthcare providers: 1,503 data breaches or 37.1 million records
  • Health plans: 278 data breaches or 110.4 million records

Be careful where you allow your medical records to be stored!
https://www.hcanews.com/news/yes-healthcares-data-breach-problem-really-is-that-bad

This Week in Breach September 18 2018

This week an Australian Mint was breached, as well as an airline from the UK. While searching for user credentials on the Dark Web, our team collects statistics on a wide variety of variables related to the data we unearth. The trends we see have been kept in house…until now. Introducing the newest addition to This Week in Breach:

Trends in data found on the Dark Web this week:

  • Top Source Hits: ID Theft Forums (8,534)
  • Top PIIs Compromised: Clear Text Passwords (8,460)

Australia – The Perth Mint
http://www.abc.net.au/news/2018-09-08/perth-mint-data-breach/10217258
Exploit: Under investigation.
The Perth Mint: The Online Depository of The Perth Mint that was breached allows users to buy and sell precious metals.
Risk to Small Business: Severe: A breach with sensitive data such as account information can deal a significant blow to customer trust.
Individual Risk: Severe: The victims of this breach are at risk of identity theft.
Customers Impacted: 13.

How it Could Affect Your Customers’ Business: The Mint was breached via a third – party provider. The breach was contained to customers of their online depository, and the organization has confirmed that all investments held at the mint are secure.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that can help minimize the fallout from a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs

Average: 2.22 = Severe*
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk

*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.

United Kingdom – British Airways
https://www.wired.com/story/british-airways-hack-details/
Exploit: cross-site scripting.
British Airways: A UK based airline.
Risk to Small Business: Severe: This was a targeted breach by a group that is linked to the Ticketmaster breach, the extent and type of data accessed could erode customer trust
Individual Risk: Severe: Those affected by this breach have a much higher risk of identity theft.
Customers Impacted: 380,000 payment cards.

How it Could Affect Your Customers’ Business: This was a targeted breach by a group that is linked to the Ticketmaster breach, dubbed ‘Magecart’ by researchers that is known for credit card skimming on the web. The attack was tailored specifically to British Airways infrastructure and shows a level of sophistication to the attack group and leads researchers to believe the group is increasing their efforts.

ID Agent to the Rescue: Spotlight ID by ID Agent offers comprehensive identity monitoring that is vital for those affected by a breach such as this. Learn more: https://www.idagent.com/identity-monitoring-programs

Average: 2 = Severe*
Risk Levels:
1 – Extreme Risk
2 – Severe Risk
3 – Moderate Risk

*The risk score is calculated using a formula that takes into account a wide range of factors related to the assessed breach.


In Other News:
Bluetooth Bite  Millions of mobile devices  are vulnerable to Bluetooth exploits, with a almost half of the devices being Android phones running older versions of the operating system. This vulnerability can be used to facilitate  ‘Airborne’ attacks, which allow Bluetooth devices to broadcasts malware to other devices in close proximity. This is significant because BlueBorne, a malware exploiting this vulnerability, does not need to pair with a device to infect it… in fact the target device does not even need to be in discoverable mode.

https://www.darkreading.com/attacks-breaches/2-billion-bluetooth-devices-remain-exposed-to-airborne-attack-vulnerabilities/d/d-id/1332815

Search and Destroy
Researchers have noticed an increased presence of malware that assesses the target device before delivering the full payload. This is useful for the attacker because they can now target specific computers. . Customizing the payload delivered by the malware can lead to some very tailored and hard-to-detect exploits. As of now these ‘scouting’ tactics are far from the standard, but it is likely we will continue to see these methods increase in popularity.

https://www.scmagazine.com/home/news/uptick-in-malware-designed-to-size-up-targets-before-launching-full-payload/

Podcasts:

Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show


 

Your Best Bet Is to Vet.
Two thirds of organizations sampled across sectors experienced a software supply chain attack in the last 12 months (Crowdstrike).  The increase in supply chain attacks can be linked to many things, but one of the most significant factors is the fact that cyber security is becoming a priority for organizations across the board. This pushes bad actors to try and find new ways to infiltrate their target.

These attacks often utilize compromised credentials and are widespread, attacking an organization with legitimate software packages to make the attack difficult to detect. One way that businesses can prevent supply chain attacks is better supplier vetting. If an organization can effectively vet their suppliers and hold them to the same cybersecurity standards that they hold themselves, then the chance of an attacker being able to infiltrate the network is significantly reduced. With the right tools and knowledge, supply chain attacks can be made less dangerous or avoided entirely.

https://www.darkreading.com/risk/the-increasingly-vulnerable-software-supply-chain/a/d-id/1332756

 

 

The Week In Breach September 12 2018

The Week In Breach September 12

 

It’s been one bad week for “Spyware” app developers as their customers’ data is leaked for all to see!  It’s not just misconfigured AWS buckets you have to worry about, it’s your misconfigured Tor site that’s not so secure.

Highlights from The Week in Breach:

Tor Vulnerability?
Freedom of Information Act Fail.
iSpy, uSpy… mSpy.

In Other News:

The Mask Comes Off
You may be familiar with misconfigured databases, a common reason for a breach. When setting up a database, the Admin may forget to put a password in place or just create a simple one like 1234. But what you may not have heard of before is a Tor (The Onion Router) site that is misconfigured. That’s right, just like any other website, Tor sites that are misconfigured can expose the hosted public IP address. Because a Tor browser is used for accessing the Dark Web, a part of the web that thrives on anonymity, the exposure of one’s IP address greatly reduces this coveted privacy.
https://www.bleepingcomputer.com/news/security/public-ip-addresses-of-tor-sites-exposed-via-ssl-certificates/

Three is a Crowd
A pair of Russian hackers is causing some serious damage to former Soviet Republic countries’ financial institutions. The group, known as Silence, has stolen $800,000 in just the thefts reported. It is highly likely the group is responsible for other attacks, but because of how new the duo is, and the irregular frequency of their activity, it’s difficult to discern other hacks they may have perpetrated. The organization has access to unique, advanced malware, and demonstrates great knowledge about ATMs and the inner workings of banks. This leads researchers to believe that at least one of the two is an insider or only recently left the security industry.
https://www.darkreading.com/attacks-breaches/silence-group-quietly-emerges-as-new-threat-to-banks/d/d-id/1332742

Podcasts:

Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


United States – United States Government (Freedom of Information Act Web Portal)

Exploit: Exposed database.
Risk to Small Business: HighAn exposure such as this can taint an organization’s reputation for an extended period.
Individual Risk: Extreme: The nature of the data exposed leaves those affected vulnerable to identity theft.
Freedom of Information Act Web Portal: foiaonline.gov is the website the United States government uses to process inquiries related to the Freedom of Information Act, an act that allows Americans to request information that the state has associated with them.
Date Occurred/Discovered: August 2018
Date Disclosed: September 4, 2018
Data Compromised:

  • Social Security Numbers
  • Date of birth
  • Immigrant identification number
  • Addresses
  • Contact details
  • Description of crime perpetrated against victim
  • Victims of identity theft had their SSN exposed

Customers Impacted: Unclear, dozens to hundreds.
https://edition.cnn.com/2018/09/03/politics/foia-revealed-social-security-numbers/index.html

United States – Family Orbit
Exploit: Weak password on database.
Risk to Small Business: HighA company that sells spyware to parents, exposed pictures of their kids on the internet, which will likely have catastrophic effects on their business.
Individual Risk: Moderate: The data by itself is not harmful but is pretty creepy. However, in use with other data accessible through the Dark Web, advanced spear phishing campaigns could be launched using the exposed data.
Family Orbit: A spyware application for parents to monitor their children.
Date Occurred/Discovered: August 2018
Date Disclosed: September 4, 2018
Data Compromised:

  • Pictures
  • Videos
  • Screenshots of developer desktops
    • Passwords
    • ‘other secrets’

Customers Impacted: Hundreds, 281 gigabytes of pictures and videos were exposed.
https://motherboard.vice.com/en_us/article/ywk8gy/spyware-family-orbit-children-photos-data-breach

https://securityaffairs.co/wordpress/75888/data-breach/family-orbit-hacked.html

United Kingdom – mSpy
Exploit: Exposed database.
Risk to Small Business: High: While a breach of this size with such sensitive information would normally cripple a company, this is actually mSpy’s sophomore breach, with the first happening in 2015 when similar information was leaked onto the Dark Web.
Individual Risk: High: The data that was exposed was both financial and very personal, and could be used for highly-targeted phishing attacks.
mSpy: A company that sells a software as a service product which spies on mobile devices of the customer’s kids or partner.
Date Occurred/Discovered: August 30, 2018
Date Disclosed: September 4, 2018
Data Compromised:

  • Passwords
  • Call logs
  • Text messages
  • Contacts
  • Notes
  • Location data
  • Names
  • Email addresses
  • Mailing addresses
  • Amount paid
  • Apple iCloud username
  • Whatsapp messages
  • Facebook messages

Customers Impacted: Millions.
https://krebsonsecurity.com/2018/09/for-2nd-time-in-3-years-mobile-spyware-maker-mspy-leaks-millions-of-sensitive-records/


Malwhat?
The Fortinet Q2 Threat Landscape Report is out, and with it, a load of new statistics that really show how at-risk most businesses are, even if they don’t realize it. Here are some of the most alarming malware statistics: 

  • There have been 23,945 unique variants of malware recorded this quarter.
  • On average there are 13 unique daily detections per firm.
  • There were 6 variants of malware that spread to more than 10% of firms.

Malware development is not slowing down, but it is changing. ‘Malware as a service’ is a popular model for the developers of the malicious programs. New types of malware such as ‘cryptojackers’ that mine cryptocurrency on the victim’s computer, or ransomware that extorts businesses, have become commonplace. The threat landscape is always changing, which is why it is important for every organization of every shape and size to have robust cyber security.
https://www.fortinet.com/blog/threat-research/threat-landscape-report–virtually-no-firm-is-immune-from-severe.html

The Week in Breach – Post Labor Day 2018 Edition

Breaches are flying high this week thanks to Air Canada!  China’s hospitality industry targeted and the data shows up on the Dark Web. And, in an effort to cut out Google’s cut, the creators of the game Fortnite create massive security challenges for unwitting gamers.

Highlights from The Week in Breach:

  • Fortnite on Android.
  • Hackers Take Flight!
  • Russian Breach.

In Other News:

Trust
Several companies that specialize in developing software designed to spy on one’s spouse or other unsuspecting “targets” have been compromised over the past few years. This category of software, which is essentially spyware installed on the target’s phone, collects a good bit of highly personal and sensitive data. This time, the company who makes the app, TheTruthSpy, was breached, allowing the target’s texts, location information, social media chats and other sensitive data to be extracted and posted on TOR/Dark Web forums for all to see.
https://motherboard.vice.com/en_us/article/mb4y5x/thetruthspy-spyware-domestic-abusers-hacked-data-breach

Fortnope
It seems like every kid on the planet is playing the popular video game, Fortnite, these days. Epic, who is the maker of the hit title, is planning on launching the Android version of the game soon, but not on the Google Play Store… this is an unprecedented move by a well-respected and popular game title, and likely has to do with Epic not wanting to give Google a cut of their money printing machine. This controversial move by the game developer has been made even more so due to Google researchers finding that the app is vulnerable to ‘man in the disk’ attacks. Man in the disk is an attack vector that takes advantage of Android’s less-secure external storage space. The vulnerability has since been patched, but make sure to have your kids update their app.  Scratch that… tell your kids to put the game down and go outside and play! Seriously people!
https://www.bleepingcomputer.com/news/security/fortnite-android-app-vulnerable-to-man-in-the-disk-attacks/

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
IT Provider Network – The Podcast for Growing IT Service
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Small Business, Big Marketing – Australia’s #1 Marketing Show!


Canada – Air Canada
Exploit: Unclear.
Risk to Small Business: High: The number of customers affected is a low percentage of the airline’s customer base, but to most other businesses, a breach of this scale would be much worse. Either way, the breach is extremely damaging to the company due to loss of customer trust.
Individual Risk: Extreme: The nature of the data leaked is highly sensitive and useful for identity theft.
Air Canada: Canada’s largest full-service airline.
Date Occurred/Discovered: August 22, 2018 – August 24, 2018
Date Disclosed: August 29, 2018
Data Compromised:

  • Names
  • Email addresses
  • Phone numbers
  • Passport numbers
  • Passport expiry date
  • Passport country of issuance
  • NEXUS numbers
  • Gender
  • Dates of birth
  • Nationality
  • Country of Residence

Customers Impacted: 20,000
https://techcrunch.com/2018/08/29/air-canada-confirms-mobile-app-data-breach/

China – Huazhu Hotels Group
Exploit: Unclear.
Risk to Small Business: High: The loss of customer trust alone would greatly cost the company, in addition to the other costs associated with a breach.
Individual Risk: Extreme: The information is already for sale on the Dark Web.
Huazhu Hotels Group: One of China’s largest hotel chains.
Date Occurred/Discovered: Earlier this month
Date Disclosed: August 28, 2018
Data Compromised:

  • ID card number
  • Mobile phone number
  • Email address
  • Login password
  • Customer name
  • Home address
  • Date of birth
  • Check in time
  • Departure time
  • Hotel ID number
  • Room number

Customers Impacted: 130 million
https://www.bleepingcomputer.com/news/security/data-of-130-million-chinese-hotel-chain-guests-sold-on-dark-web-forum/

RUSSIA – ABBYY
Exploit: Exposed database.
Risk to Small Business: Extreme: Sensitive internal documents were exposed that could have major effects on their business.
Individual Risk: Low: Only corporate documents were exposed.
ABBYY: Moscow-based optical character recognition software provider.
Date Occurred/Discovered: August 19, 2018
Date Disclosed: August 27, 2018
Data Compromised:

  • Contracts
  • Non- disclosure agreements
  • Memos
  • Other confidential documents

Customers Impacted: 200,000 sensitive documents.
https://cyware.com/news/abbyy-inadvertently-exposes-over-200000-sensitive-documents-via-unsecured-mongodb-database-be026aa2



Scam, Scam, Go Away.
Australia is well-known to be a dangerous place, with many poisonous plants and animals that inhabit its borders. Another danger in the outback is cybercriminals! According to the Australian Competition and Consumer Commission, Australian small businesses have been scammed out of $2.3 million so far in 2018.

The scam that most frequently targeted businesses is the false-billing scam, while employment and investment scams funneled the most amount of money away from Australian businesses.

Stay safe out there and make sure to have a healthy dose of suspicion when dealing with unexpected emails, especially those that deal with money!
https://www.arnnet.com.au/article/645826/aussie-small-businesses-scammed-2-3m-far-2018/?utm_campaign=daily-pm-edition-2018-08-28&utm_source=daily-pm-edition&utm_medium=newsletter&eid=-4152