The Week in Breach 07/09/2018 to 07/18/2018

The Week in Breach

This week there was a TON of attention in the media about dark web markets and what’s bought and sold in these shady marketplaces. Timehop, a social media nostalgia app was breached exposing the PII of at least 21 million individuals, due to lack of 2FA, while Macy’s was hit with a breach where credit card data was accessed.

 Highlights from The Week in Breach:

– Pedal to the metal! Gas stolen in hack.
– Tracking military workouts!
– Macy’s falls victim to a breach.
– Timehop wishes it could turn back time for more security!

In Other News:

Dead Men Do Tell Tales
Hackers on the Dark Web have always sold medical records, as they are valued much higher than credit card info or PII. Researchers found this week that bad actors in these dark corners of the web are also selling medical records of deceased patients, with one vendor claiming to have 60,000 available for purchase. The records for sale include name, SSN, Address, zip code, phone number, birthday, sex, insurance and even date of death. What ever happened to respecting the dead?
https://threatpost.com/deceased-patient-data-being-sold-on-dark-web/133871/

Classified Documents for $200
The U.S. military can’t escape the Dark Web either! A lot of military documents have turned up on dark web markets after a hacker, with only a moderate level of technical skill, was able to access a captain’s computer through a previously-disclosed FTP vulnerability. Some of the documents are classified, and all of them contain sensitive data about military tactics or hardware. One of the documents is a maintenance book for the MQ-9 Reaper drone which is regarded as one of the deadliest drones used by the United States. How much money will classified U.S. military documents fetch on the Dark Web? $200. That says a lot about how much information is available for criminals to buy.
https://www.theverge.com/2018/7/10/17555982/hacker-caught-selling-stolen-air-force-drone-manual-dark-web

A $10 Key into Your Network
Remote access to IT systems is a competitive market on the Dark Web, with some running an interest to criminals for as low as $10! Some of these forums have tens of thousands of compromised systems available for bad actors to choose from, across all versions of Windows and at places such as international airports, hospitals and governments. One international airport found on the site had the administrator account exposed, as well as accounts associated with the companies that provide camera surveillance and building security. That’s not a good look!
https://www.zdnet.com/article/hackers-are-selling-backdoors-into-pcs-for-just-10/

Gassed Up
This week in Detroit, two suspects managed to steal over 600 gallons of gasoline after hacking the gas pump. The fuel is worth about $1,800 and was taken in broad daylight over the course of 90 minutes. At least 10 cars benefited from the hack and the police are at a complete loss on who conducted the hack. The hacker or hackers used a remote device that was able to alter the price of the gas and lock out the clerk from being able to shut off the affected pump. With gas prices being so high, it’s likely that attacks like this will continue in the future.
https://www.clickondetroit.com/news/men-hack-into-pump-at-detroit-gas-station-steal-600-gallons-of-gas_

Fitness App Turned Finder App
A fitness tracking app hailing from Finland has disabled their global activity map after it was revealed it could be used to track the geolocation of military personnel. The map showed the biking and running routes of its users, but also included the usernames of each person, allowing one to cross-reference the username with other websites and possibly identify the person’s name. Using the map, one could see where the person jogged around their home address and around the military base; possibly even bases that are secret to foreign countries.
https://www.bleepingcomputer.com/news/technology/polar-app-disables-feature-that-allowed-journalists-to-identify-intelligence-personnel/

Sex Appall
A twist on a classic email scam has appeared this week, with the classic ‘sextortion’ scam getting an upgrade. Now rather than just an intimidation email where targeted parties pay up out of fear of friends and family finding out what they do privately, the email also includes a password. The password appears to be from a large or multiple large data breaches, but these data breaches appear to be fairly old. Those who reported receiving the email claimed that the passwords were correct… ten years ago. While the passwords are outdated in many cases, this likely indicates that we will see more complex versions of this scam appearing in the near future.
https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/#more-44406

Podcasts:

Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


United States – Macy’s

Exploit: Supply chain exploit.
Risk to Small Business: High: A bad actor accessing names and card information can severely damage consumer trust in a brand.
Individual Risk: High: Individuals affected by this breach are at high risk of their credit card details being sold on the Dark Web.
Macy’s: Large department store chain.
Date Occurred/Discovered: April 26 – June, 2018
Date Disclosed: July, 2018
Data Compromised:

  • Full name
  • Address
  • Phone number
  • Email address
  • Date of birth
  • Debit/ credit card numbers
  • Expiration dates

Customers Impacted: Unclear but the hacker operated undetected for almost 2 months.
https://cyware.com/category/breaches-and-incidents-news

United States – Timehop

Exploit: Lack of 2FA on cloud infrastructure.
Risk to Small Business: High: All of Timehop’s customers were a part of this breach, which discredits the organization and could have long-lasting effects on the business.
Individual Risk: Moderate: The credentials stolen could be used to compromise other accounts.
Timehop: Social media aggregation site that allows users to see posts made in the past.
Date Occurred/Discovered: July 4, 2018
Date Disclosed: July 8, 2018
Data Compromised:        

  • Names
  • Email addresses
  • Phone numbers
  • Date of birth
  • Gender

Customers Impacted: 21 Million.
https://www.infosecurity-magazine.com/news/timehop-breach-hits-21-million/
https://www.timehop.com/security
https://techcrunch.com/2018/07/11/timehop-data-breach/

United States – Cass Regional Medical Center

Exploit: Ransomware.
Risk to Small Business: High: A ransomware attack on any business in any sector would greatly diminish the organization’s ability to operate as needed. In some ransomware cases the data encrypted is lost entirely.
Individual Risk: Moderate: At this point in time there is no evidence that the data affected was also exfiltrated.
Cass Regional Medical Center: Missouri based medical center.
Date Occurred/Discovered: July 9, 2018
Date Disclosed: July 9, 2018
Data Compromised: The medical center’s internal communications system and access to their electronic health record system were affected by the hack, but there is no public indication that patient data has been accessed.
Customers Impacted: Many details surrounding the attack are being withheld from the public at this time, but restoration of the affected systems were at 50% as of July 10, 2018.
https://cyware.com/news/missouris-cass-regional-medical-center-hit-with-ransomware-attack-92884b12

Germany – DomainFactory

Exploit: Dirty cow vulnerability. (this is a nine-year-old critical vulnerability has been discovered in virtually all versions of the Linux operating system and is actively being exploited in the wild)
Risk to Small Business: High: A breach including banking account numbers would heavily damage the reputation of a small business.
Individual Risk: High: A wealth of PII was accessed during this breach and could leave individuals vulnerable to account takeover or identity theft.
DomainFactory: Web hosting service based in Ismaning.
Date Occurred/Discovered: July 6, 2018
Date Disclosed: July 9, 2018
Data Compromised:

  • Names
  • Addresses
  • Phone numbers
  • DomainFactory passwords
  • Dates of birth
  • Bank names/ account numbers
  • Schufa scores

Customers Impacted: The amount of customers impacted has not been made publicly available.
 https://www.zdnet.com/article/user-data-exposed-in-domain-factory-hosting-security-breach/
https://www.infosecurity-magazine.com/news/unauthorized-party-accessed/


 Did you know?

The cost of a breach
A recent study conducted by IBM provides some context to the same old story that you hear in the news of big bad breaches and how scary they are for your business. The Cost of a Data Breach Study by Ponemon* puts numbers to these stories and provides a wealth of analysis so even someone who has never used a computer before can quantify the seriousness of a breach… as long as they are familiar with money.

The average cost of a breach increased this year by 6.4%, with the per capita cost rising less, but only barely, by 4.8% (page 3). The cost of a data breach varies greatly by country, with the United States average breach price coming in at $7.91 Million and per capita costing $233. Canada’s per capita cost is the second highest out of the nations surveyed at $202 per record, and their average price of a breach is $4.74 million. Australia’s cost of a breach is less than the US and Canada, but Aussies are far from getting off free. The average cost of a breach down under is $1.99 million and the per capita cost averages at $108 (page 13).

The study also explored the main factors that were found to affect the cost of a breach, stating 5 major contributing factors that could make the difference between a manageable breach vs a mega breach. The loss of customers following a breach, the size of the data breach, the time it takes to identify and contain a breach, management of detection costs and management of the costs following a breach are the factors that most contribute to the cost of a breach (page 7). The time it takes to identify a breach being a major contributing factor to the cost of a breach is particularly important due to the fact that organizations saw an increased time to identify a breach this year. This can be contributed to the ever-increasing severity of malicious attacks companies face and highlight the need for proactive monitoring for breaches, as well as a serious focus on cybersecurity on a management level. That’s why tools such as Dark Web ID™ that dredge the Dark Web for personal information and credentials can contribute greatly to decreasing the cost of a breach. Organizations that identified breaches within 100 days saved more than $1 Million (page 9) compared to companies who did not. That says a lot because after all… money talks.

*Source: Ponemon Cost of Breach Study 2018

Advertisements

New Cybersecurity Regulations on Horizon for Corporate America

Image result for horizon

 

Prime Telecommunications, Inc., a leading managed technology services provider, is helping small to mid-sized businesses (SMBs) navigate the recent changes in cybersecurity standards that are highly likely to affect American businesses. Many have heard about Facebook’s recent controversy around Cambridge Analytica and irresponsible data sharing policies. Marc Zuckerburg even testified in front of the EU in order to address these major concerns and the result has been the passing and implementation of the GDPR (General Data Protection Regulation), which took effect in Europe in late May.

This new regulation demands transparency and responsible data practices on the behalf of all companies that do business in the EU. Some examples of GDPR in effect are 1) Requiring all subscribers to opt-in again to receiving all newsletters/marketing emails/etc. and 2) Companies need to report any major data breaches to all of their customers within 72 hours of the breach occurring. There are many more components to the regulation, however, the penalties for not adhering to these standards are in the millions.

This standard is very likely to reach the US marketplace and for most companies, this standard is already affecting their businesses. For example, if a business has any suppliers, customers, or satellite offices in countries located within the EU, they need to take a serious look at their data practices and make sure they are compliant. In time, many experts expect GDPR or some derivation of it to affect US-based businesses. “We strongly believe data regulation is coming to the US marketplace it’s certain that some form of cybersecurity regulation is imminent and severe penalties will follow businesses that aren’t compliant,” stated Vic Levinson, President of Prime Telecommunications. “There’s simply been too many data breaches that have affected major companies like Dropbox and Target for regulation not to come. When it does Prime Telecommunications’ proven cyber security program will play a major role in helping our customers meet these new regulations,” added Mr. Levinson.

Cybersecurity has transitioned from the era where an enterprise could “play dumb,” expect a slap on the wrist, pay minor fines and resume business as usual. Cybersecurity is now a central pillar of any organization’s success or demise and with the stakes as high as they are now, SMBs need to address their data policies and practices immediately.

While most business owners dread the idea of spending time, energy and money on meeting a new compliance, the simultaneous opportunity is for businesses to leverage the expertise of Prime Telecommunications to lower their operating costs through the deployment of advanced technology to offset the new investments in cybersecurity that they will likely be required to make. Whether the organization is large or small, soaring or declining, it’s time to revisit cybersecurity policies today.

The Week in Breach: 07/02/18 – 0706/18

 

While it has been a slow week in terms of the number of breaches, the severity of the breaches that did occur this week is nothing short of disturbing. The information exposed on the open web by ALERRT could be used with far-reaching effects…including both physical and permanent consequences. A cyber-attack conducted against a small business hosting provider in Australia also highlights a “WORST case” scenario for a breach. I strongly encourage everyone to check out their website here for a sobering reminder of what a company crippled by a breach looks like. When you cannot contact your customers to tell them that you have been breached, because you don’t even have a complete list of who your customers are… well, this is a good example of how damaging a breach can be.

In other news…

  • GDPR is inspiring others around the globe to enhance privacy and breach notification laws!
  • Hey T-Mobile Customers, are your photos safe?
  • Big Brother aka “Google” is exposing us again!
  • Privacy and Breach Notification laws are spreading globally

California has enacted a law similar to GDPR. This statute is widely regarded as one of the strongest privacy laws in the country and goes into effect in 2020, giving those who do business in the state some time to prepare for the change. The bill assures that organizations have to tell a consumer if their data is being collected, who it will be shared with, and the business purpose for collecting personal data.
https://www.darkreading.com/attacks-breaches/californias-new-privacy-law-gives-gdpr-compliant-orgs-little-to-fear/d/d-id/1332217

Cali is not the only place that was inspired by the implementation of GDPR. Brazil has passed a data protection bill in early June that if made into law, would prevent organizations from collecting and processing Brazilians’ data without informing users. Breaches are also covered by the bill, which requires organizations to report breaches immediately with fines up to 4% of revenue for those who don’t comply.
https://www.zdnet.com/article/brazil-moves-forward-with-online-data-protection-efforts/

Hello… Photos.
Those who have Samsung phones should be careful what they keep in their photo gallery! There are reports of Galaxy users having their photos sent to random contacts without their knowledge. This bug seems to only affect T- mobile users, but it is probably best to lean on the side of caution, considering the ramifications of sending the wrong photo to the wrong person.

https://techcrunch.com/2018/07/02/some-samsung-users-say-their-phones-randomly-sent-photos-to-contacts/

Gmail has its eye on you!
Google has been allowing third parties to read through people’s inboxes, according to a report by the Wall Street Journal. While the creator of Gmail has promised to stop scanning emails on their platform to curate ads, the organization has been allowing third parties to access inboxes if the user has opted into email-based tools like travel itinerary planners. These third parties are not just using AI to snoop through messages either…oftentimes employees of the organization go digging for information themselves.
https://www.nbcnews.com/tech/security/google-reportedly-allowed-outside-app-developers-read-user-emails-despite-n888571

Podcasts:
Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!


Australia – Cyanweb Solutions – Total Devastation Event

Exploit: DDos Attack, Web server compromise, data encryption/ ransomware & data destruction.

Risk to Small Business: Extreme/Total Devastation: This is a catastrophic event impacting Cyanweb and its 400 customers that relied on them for web hosting.

Risk to Exploited Individuals: Extreme/ Total Devastation: This breach may devastate the businesses that relied on Cyanweb. This will also impact those businesses downstream customers and the employees of the impacted businesses. The goal was maximum data loss/ total devastation.

Cyanweb Solutions: Digital marketing and web provider based in Perth.

Date Occurred/Discovered: June 27th, 2018

Date Disclosed: July, 2018

Data Compromised: Only 12% of customer data survived the attack. 1200- 2500 man hours of work between the 3 employees is estimated for a full recovery.

How it was compromised: A ‘professional’ group distracted the admin with a DDoS attack while simultaneously infiltrating the server and delivering a ‘seek and destroy’ payload.

Customers Impacted: 435 accounts.
https://www.crn.com.au/news/perth-web-hosting-provider-cyanweb-solutions-hit-by-criminal-hacking-data-and-backups-lost-496455
https://www.cyanweb.com.au/

United States – ALERRT

Exploit: Negligence (no password required to access web server.)

Risk to Small Business: High: A breach that is a result of negligence dramatically reduces confidence in the company by consumers.

Risk to Exploited Individuals: Extreme: Compromised PII, password and correspondence that can be used to target and exploit individuals including law enforcement.

ALERRT: A federally funded active shooter training center for law enforcement.

Date Occurred/Discovered: June 2018

Date Disclosed: June 2018

Data Compromised:  

  • Work contact information
  • Personal email addresses
  • Work addresses
  • Cell numbers
  • Who has taken ALERRT courses, with feedback
  • Full name of those who took the course
  • Zip code
  • Histories on instructors
  • Instructors skills and training
  • Names of instructors
  • Geolocations of:
    • Schools
    • Courts
    • Police departments
    • City halls
    • Places where people gather such as universities and malls
  • Officers home addresses
  • 85,000 emails between staff and trainees dating back to 2011 including:
    • Password reset emails
    • Names
    • Email addresses
    • Phone numbers
    • The courses taken
    • When the courses were offered
  • Highly sensitive information about weaknesses in response ability

Customers Impacted: 65,000 officers, but this information could be harmful to anyone in the U.S. given how it could be used by domestic terrorists or other bad actors.
https://www.zdnet.com/article/a-massive-cache-of-law-enforcement-personnel-data-has-leaked/

UK – National Health Service

Exploit: Coding error/ misconfiguration leading to privacy violation.

Risk to Small Business: High: A breach of this size that essentially mislead those who specifically requested for their health information to be kept private would shake the trust of any customer. Privacy laws, including the EU’s GDPR, will impose harsh fines and penalties for similar incidents moving forward.

Risk to Exploited Individuals: Lowthe data was exposed externally and picked up by hackers.

National Health Service: The public health services in the United Kingdom.

Date Occurred/Discovered: March 2015 – June 2018

Date Disclosed: July 2nd, 2018

Data Compromised: 

  • Health Data

How it was compromised: A supplier defect that did not properly indicate that the patient’s data was to be only used for medical treatment.

Customers Impacted: 150,000
https://cyware.com/news/nhs-data-breach-exposing-150000-patients-sensitive-health-details-blamed-on-coding-error-40aa0ccf

https://www.parliament.uk/business/publications/written-questions-answers-statements/written-statement/Commons/2018-07-02/HCWS813/


Often times there is no “why”, just a “because”!

The Cyanweb Solutions breach was well organized and a caused catastrophic damage to both Cyanweb and the hundreds of customers that replied on them for hosting support. It’s nearly impossible to quantify the overall financial impact that this breach has caused.

When conducting post-breach forensics, the first question often asked is “why” – what was their motivation to destroy this small business? Often times, the answer is “because they could”.  The group conducted this takedown overwhelmed Cyanweb with a massive DDos attack, and while distracted, they compromised the servers, escalated their access, encrypted user data and proceeded to destroy almost everything – including backups. It did not take long for Cyanweb to discover the attack, but by the time they did, 88% of their data was permanently deleted.

This attack demonstrates how quick and devastating an attack can be on a small business.  Cyanweb was a trusted provider to hundreds of organizations, yet they lacked the proper security controls to secure their customer’s data, thus breaching their fiduciary responsibility. Whether we like it or not, we have to proactively invest in cybersecurity solutions to protect the continuity of our business and ensure those that count on us are secured.

Regardless of the size of your business or the industry we’re in, we’re all targets.

The Week in Breach: 06/25/18 – 6/29/18

Hacks this week showed no mercy or regard to international boundaries. From North America to Australia, businesses of all sizes, across all industries were targeted. Malware injection and insecure databases were some of the most damaging compromises highlighted this week. At least 230 million individuals and 110 million businesses exposed on the dark web… YIKES.

Highlights from The Week in Breach:

  • Ransomware be gone!
  • Comcast’s leaky API
  • Another Intel CPU vulnerability?
  • Massive breach exposes how many kids you have and where you live.

In other news…
A popular Australian medical appointment booking app called HealthEngine is receiving negative attention from privacy advocates and cyber security professionals alike this week. It has come to light that they have been sharing patients’ personal information with a third-party law firm. The information sharing occurred daily as part of a referral partnership.
https://cyware.com/news/popular-medical-appointment-booking-app-healthengine-reportedly-patient-data-with-law-firm-3aba7747

Researchers at Cisco Talos have developed a tool that decrypts files affected by the ransomware Thanatos. This news is only made better by the fact that they are releasing it at no cost. The less ransomware out there, the better.
https://www.zdnet.com/article/thanatos-ransomware-free-decryption-tool-released-for-destructive-file-locking-malware/

Comcast’s website has been leaking account information, including whether a home security setup is in place. Anyone on the customer’s network could trick one of the company’s APIs into returning customer information. Comcast was quick to shut down the API after the vulnerability was revealed to them.
https://www.zdnet.com/article/comcast-fixes-another-xfinity-website-data-leak/

At Black Hat USA this year, it was revealed that Intel CPUs have a side-channel vulnerability that could be used to leak encryption keys for signing a message. Researchers at the Systems and Network Security Group at Vrije Universitet Amsterdam constructed an attack that can reliably extract an encryption key using Intel’s Hyper-Threading technology. To exploit the flaw, a hacker would need to already have malware on the system or use compromised credentials to log in.
https://www.zdnet.com/article/tlbleed-is-latest-intel-cpu-flaw-to-surface-but-dont-expect-it-to-be-fixed/

Podcasts:

Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!

Exactis
Exploit: Elasticsearch insecure database exploit.
Risk to Small Business: High: Demonstrable gross negligence while aggregating and normalizing PII. This increasingly common exploit (insecure/ publicly accessible database). This compromise will cross state and international boundaries.
Risk to Exploited Individuals: High: The data breached could be used to execute extremely effective spear phishing campaigns.
Exactis: A marketing and data aggregation firm based in Florida.
Date Occurred/Discovered: June, 2018
Date Disclosed: June 27, 2018
Data Compromised: 

  • Names
  • Address
  • Email address
  • Telephone number
  • Interests
  • Habbits
  • Number of children, their ages and gender
  • Whether the individual smokes
  • Religion
  • Pets

Etc… over 400 variables per person
How it was compromised: Negligence
Customers Impacted: 230 million Americans and 110 million businesses

https://www.wired.com/story/exactis-database-leak-340-million-records/
https://info.idagent.com/blog/big-data-big-breach

People Dedicated to Quality (PDQ)
Exploit: Hackers gained entry by exploiting an outside technology vendor’s remote connection tool. Demonstrates supply chain-based vulnerabilities.
Risk to Small Business: High: Remote session / access tools are frequently targeted. Outsourcing and the cost-effectiveness of remote support makes this a very effective attack vector for hackers. This should be top of mind especially if an organization holds PII or any customer data of value.
Individual Risk: Low: Victims of this breach are highly vulnerable to financial fraud and identity theft.
PDQ: People Dedicated to Quality, or PDQ for short, is a chicken focused food stop founded in Florida.
Date Occurred/Discovered: May 19, 2017 – April 20, 2018
Date Disclosed: June 22, 2018
Data Compromised: 

  • Credit card information
  • Expiration dates
  • CVV
  • Names

How it was compromised: PDQ believes that a hacker gained access to their customer’s credit card information using an outside technology vendor’s remote connection tool.
Customers Impacted: Unknown, but all 70 PDQ locations were compromised.
https://www.eatpdq.com/promos/news/2018/06/22/guestinfo

FastBooking
Exploit: Web Application Exploit, Remote Access, Malware injection.
Risk to Small Business: High: There seems to be several layers to this exploit. Remote access was achieved to download the data scraping malware. This breach is far-reaching globally impacting businesses and individuals globally. The forensics, mandatory credit monitoring, brand damage will be costly and will linger to years.
Risk to Exploited Individuals: High: Personal data and credit card information was compromised during the breach, leaving individuals vulnerable to identity theft.
FastBooking: Based in France, the company sells hotel booking software globally.
Date Occurred/Discovered: Occurred on June 14, 2018, discovered on June 19, 2018.
Date Disclosed: June 26, 2018
Data Compromised: 

  • Full name
  • Nationality
  • Home address
  • Email address
  • Booking information

In some cases:

  • Credit card details
  • Name on card
  • Card number
  • Expiration date

How it was compromised: Malware installed on their server which granted remote access.
Customers Impacted: 4,000 hotels in 100 countries.
Prince Hotels is the first to inform customers, with 123,963 of their customers affected. Of these, 58,003 are instances of personal information compromised. 66,960 involved credit card information.

https://www.bleepingcomputer.com/news/security/hundreds-of-hotels-affected-by-data-breach-at-hotel-booking-software-provider/

https://www.japantimes.co.jp/news/2018/06/26/business/corporate-business/prince-hotels-hack-results-loss-124000-customers-credit-card-numbers-data/#.WzOvIdVKjIW

Best Sleep Centre
Exploit: Ransomware
Risk to Small Business: High: Significant impact to business operations if data not properly encrypted and backed up.
Risk to Exploited Individuals: Moderate: Data was encrypted by the ransomware. At this point, there is no public evidence that it was also exfiltrated.
Best Sleep Centre: Winnipeg based mattress store
Date Occurred/Discovered: June 2018
Date Disclosed: June 26, 2018
Data Compromised: The company’s server was encrypted.
How it was compromised: Ransomware. The owner decided to pay the ransom, but negotiated it down to $2,000 CAD.
Customers Impacted: Unknown at this time, but the business is impacted.

https://globalnews.ca/news/4298279/hacker-hits-local-mattress-store-with-ransomware/

Ticketmaster
Exploit: JavaScript chatbot with data scraper injected in to supply chain systems.
Risk to Small Business: High: Highlights how supply chain vulnerabilities can lead to massive data loss and exposure. Companies dealing with customer data / PII should have elevated security controls in place to prevent supply chain vulnerabilities.
Risk to Exploited Individuals: High: This breach leaves Ticketmaster customers vulnerable to identity theft.
Ticketmaster: A ticket purchasing website that is used globally for many types entertainment.
Date Occurred/Discovered: Discovered on June 23, 2018. Could have occurred as early as September 2017.
Date Disclosed: June 27, 2018
Data Compromised: 

  • Names
  • Address
  • Email address
  • Telephone number
  • Payment details
  • Ticketmaster login details

How it was compromised: Malware hosted on a customer support product hosted by a third-party supplier which sent data to a remote location.
Customers Impacted: Ticketmaster has been telling the media that about 400,000 customers have been affected, but in their alert to customers they claim that ‘less than 5% of their customer base have been affected. 5 percent of their customer base comes out to 11.5 million, so we will have to see if their investigation into the breach will reveal more affected customers.

https://www.govinfosecurity.com/ticketmaster-breach-traces-to-embedded-chatbot-software-a-11144
https://security.ticketmaster.co.uk/

Facebook (yes again)
Exploit: Unsecured JavaScript file/ supply chain
Risk to Small Business: High: A supply chain vendor that leaks data will tarnish the reputation of business.
Risk to Exploited Individuals: Moderate: The data the quiz app is leaking could be used in spear phishing attacks.
Facebook: A social media site that has over 2 billion monthly active users.
Date Occurred/Discovered: End of 2016-present
Date Disclosed: June 28, 2018
Data Compromised: 

  • Facebook ID
  • First name
  • Last name
  • Language
  • Gender
  • Date of birth
  • Profile picture
  • Cover photo
  • Currency
  • Devices used
  • When your information was last updated
  • Posts
  • Statuses
  • Photos
  • Friends on Facebook

How it was compromised: Any third party can view.
https://techcrunch.com/2018/06/28/facepalm-2/

Prime Telecommunications’ Technology Thwarts Cryptojacking

Cryptojack

 

Prime Telecommunications, Inc., a leading managed technology services provider, is helping small to mid-sized businesses (SMBs) to prevent cryptojacking attacks from damaging their organizations. Cryptojacking attacks, are derived from the widely popular cryptocurrencies, such as Bitcoin and Ethereum, and occurs when a corporate server is hijacked in order to facilitate cryptocurrency transactions by leveraging the inherent power of high-performance servers. As cryptocurrencies rely on an enormous amount of server power in order to facilitate transactions, many of the corporate servers that power small to mid-sized businesses have become an obvious target of cryptojacking attacks, as they are simply the most efficient vehicle for cryptojackers to exploit. Prime Telecommunications is currently protecting SMBs from this threat.

“Businesses that are under attack are often unaware of this threat because these attacks are specifically designed to be minimally intrusive and hard to trace,” stated Vic Levinson, President at Prime Telecommunications. “Typically, cyber criminals set up their malware to run quietly in the background during daytime hours, only to extract maximum power during off-hours. It’s one of the telltale signs, yet this is rarely monitored by organizations that aren’t working with a reputable managed technology services provider. The result is that most businesses are flying blind and unaware that their security has been compromised, which doesn’t seem very dangerous on the surface. However, this leaves many cryptocurrency hackers with access to very sensitive points within an organization that can be taken advantage of later.”

Most attacks take place when businesses are most vulnerable; after-hours and during migration to cloud-based solutions. Durring off-hours, cryptocurrency mining software can be installed quickly and without detection, creating a pivot-point where hackers can later install even more malware. Another vulnerable moment is when businesses are migrating their network to the cloud. The vulnerability here is because of the complexity and level of detailed attention required to successfully navigate these kinds of infrastructure transitions. Where most business owners simply add technology piece-by-piece, this fails to address the gaps in the network that arise gloming one solution onto another. Networks can quickly become messy and this is how organizations get exposed to hackers. In the case, of cryptojacking, it’s no different.

“Business owners can protect themselves by taking the following actions, commented Mr. Levinson. “As a first step, they need to diagnose their network and segment the utilization of their data. By doing this, business owners or CTOs can see which devices, servers, and endpoints are performing optimally and which are underperforming. Underperforming servers can provide a hint that the organization may have been cryptojacked. Another action they can take is to make sure that they aren’t vulnerable to exploit kits, which are tools hackers use to infiltrate networks via common business software. Lastly, businesses can direct their attention to systems that expose the network, like VPNs (Virtual Private Networks) or other cloud-based technology. While there are many more steps to take, these are very effective first steps to protect any organization from cryptojacking.”

 

ABOUT PRIME TELECOMMUNICATIONS, INC.

For more information on Prime Telecommunications, call (847)329 8600 or visit http://www.primetelecommunications.com.

The Week in Breach June 23 to June 29 2018

 

The Week in Breach

 

It’s no surprise that this week has been busy for cyber-attacks on the web, targeting big events such as the World Cup but also continuing to pursue small-and medium-sized businesses across the globe.

– Google is still leaking!
– Another Dark Web marketplace down in a big win for French authorities.
– Do androids dream of electric… rats? A new malware for Android!
– Going phishing at the World Cup.

In other news… Google has announced that Chromecast and Google Home devices, that are easily scripted to reveal precise location data to the public, will be patched in the coming weeks. Disclosed by a researcher at Tripwire, the simple script running on a website can collect location by revealing a list of internet connections available to the device. Researchers go on to describe how easy it would be to remote into an exposed individual’s device and network.
https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/

The Dark Web marketplace known as ‘Black Hand’ was shut down by French authorities this week. The marketplace was used to sell drugs, weapons, stolen personal information and banking data, as well as fake documents. The site had over 3,000 users from France and was highly active for selling illicit materials.
https://www.hackread.com/authorities-shut-down-dark-web-marketplace-black-hand/

Researchers have come across a new malware family that takes form as an Android remote administration tool (or RAT). The malware uses the messaging app Telegram both to spread and to operate the RAT. When an attacker gains access to a device, he or she operates it by using Telegram’s bot functionality and can intercept text messages, send text messages, make calls, record audio or screen, and locate the device.
https://www.welivesecurity.com/2018/06/18/new-telegram-abusing-android-rat/

With the World Cup in full swing this week, bad actors are taking advantage of the attention on the event and spinning up malicious email campaigns. The idea is that people are less vigilant about clicking emails from unknown sources when related to an event that only occurs every couple of years. Sites selling fake tickets, offering fictitious giveaways and luring unsuspecting induvial to click on malicious links related to the World Cup are popping up all over the place.
 https://www.darkreading.com/attacks-breaches/wallchart-phishing-campaign-exploits-world-cup-watchers/d/d-id/1332080

A network worm called ‘Olympic Destroyer’ that debuted at the 2018 winter Olympics is still doing damage across Europe. Since the Olympics, the group has taken an interest in financial and biochemical organizations and oftentimes uses spear phishing as a way to gain illegal access to systems. The group has so far remained anonymous, using a complex combination of false flags and other deceptive behavior to avoid being revealed.
https://www.darkreading.com/vulnerabilities—threats/olympic-destroyer-reappears-in-attacks-on-europe-russia/d/d-id/1332094


What we’re listening to this week!

Know Tech Talks – Hosted by Barb Paluszkiewicz
The Continuum Podcast
Security Now – Hosted by Steve Gibson, Leo Laporte
Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)
Small Business, Big Marketing – Australia’s #1 Marketing Show!

Indian Government

Exploit: Leaky websites, lack of basic website/ internet security controls.

Risk to Small Business: High: Demonstrates that poor cyber hygiene and complete disregard for basic website/ internet security can be highly damaging.

Risk to Exploited Individuals: High: Sensitive personally identifiable information that can be used for identity theft.

Indian Government: The Republic of India’s government.

Date Occurred/Discovered The government has experienced a wide variety of breaches over a long span of time, but with their websites being audited in May of 2018, their continuing lack of security with such highly sensitive information proves to be a continuing problem.
Date Disclosed June 20, 2018
Data Compromised · Names and phone numbers of those who bought various medicines from state-run pharmacies

Recently but not this week:

· Aadhaar number

· Data collected in ‘Smart Pulse Survey’

· Geolocation of people based on caste/religion

· Geolocation of ambulances, why they were summoned, and the hospital destination

How it was compromised Leaky websites and dashboards allowing anyone to look up HIGHLY sensitive medical and personal information.
Customers Impacted Anyone who has purchased medicine from the state-run pharmacies.
Attribution/Vulnerability Poorly configured database.

http://www.newindianexpress.com/specials/2018/jun/19/in-wake-of-data-leaks-andhra-pradesh-orders-audit-of-all-government-websites-1830571.html

https://www.huffingtonpost.in/2018/06/19/caught-leaking-information-on-people-buying-viagra-from-government-stores-ap-orders-security-audit_a_23463256/

Med Associates

Exploit: Supply Chain/Trusted Vendor Compromise
Compromised Workstation, most likely compromised credentials and a lack of multi-factor authentication.

Risk to Small Business: High: At least 42 physician practices had their customer’s PII compromised. Lack of situational awareness within the supply chain will create significant challenges for the vendors that replied on the claims processing vendor.

Risk to Exploited Individuals: High: This breach has disclosed a massive amount of HIGHLY sensitive personal and health information leaving customers impacted significant risk of identity theft and fraud.

Med Associates: A New York-based claims processing company.

Date Occurred/Discovered March 2018
Date Disclosed June 2018
Data Compromised · Patient names

· Dates of Birth

· Addresses

· Dates of service

· Diagnosis codes

· Procedure codes

· Insurance information, such as insurance ID numbers

How it was compromised Not disclosed, but it was specified that the attack did not involve ransomware or phishing.
Customers Impacted 270,000
Attribution/Vulnerability Still under investigation, but the third party gained remote access to the workstation without phishing or ransomware.

https://www.govinfosecurity.com/hacking-incident-at-billing-vendor-affects-270000-patients-a-11116


Chicago Public Schools

Exploit: Negligence

Risk to Small Business: High: If a breach of this magnitude happened to a small business, it is unlikely it would recover. This kind of negligence causing a breach tarnishes a name to a great degree, but people do not have a choice but to continue using Chicago public schools because it is a government-run program.

Risk to Exploited Individuals: High: Unfortunately, a minor’s personally identifiable information is highly sought after and valuable as its often not monitored.

Chicago Public Schools: School district in the Illinois city of Chicago

Date Occurred/Discovered June 16, 2018
Date Disclosed June 16, 2018
Data Compromised · Children’s names.

· Home phone numbers.

· Cell phone numbers.

· Email addresses.

· School ID numbers

How it was compromised When sending out an email about applications to selective enrollment schools, an employee attached a spreadsheet containing the sensitive data which was then sent out to families in the district. The person who made the critical mistake is going to lose their job according to the superintendent.
Customers Impacted 3,700 students and families
Attribution/Vulnerability Negligence

https://chicago.suntimes.com/news/cps-data-breach-exposes-private-student-data/

An important takeaway from this week is how easy it is to unsuspectingly leak personal information. A study conducted by Positive Technologies found some alarming statistics when researching the vulnerabilities of something that is often overlooked; web applications.

The study uncovered that almost half (48%) of the web applications tested were vulnerable to unauthorized access from a third party, with 17% of the tested applications being so unsecured that full control could be acquired. Every single web app that the study looked had vulnerabilities with just over half of them (52%) being high risk. A little under half (44%) of web apps examined that processed personal data leaked that personal data and 70% of all applications were at risk of leaking critical information to the business. The study found an average of two critical vulnerabilities per web application, and where the researchers had access to the source code of the web app they uncovered high-severity vulnerabilities 100% of the time. The industries used in this study of web applications include: finance, IT, e-commerce, telecom, government, mass media, and manufacturing.

Make sure to consider what web applications you are using in both your professional and personal life, otherwise, your information could end up on the Dark Web.

https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Web-application-vulnerabilities-2018-eng.pdf

https://www.darkreading.com/attacks-breaches/most-websites-and-web-apps-no-match-for-attack-barrage/d/d-id/1332092

 

The Week In Breach! June 15 to June 22 2018

Dark Web

It should serve as no surprise, two of the breaches profiled this week occurred as the result of compromised email address and passwords. The particular events highlight the need to make password hygiene and compromised credential monitoring front and center.

This week also demonstrates that healthcare organizations are increasingly targeted by bad actors. Heathcare related PII/PHI is increasingly valuable and sought after in dark web markets and forums.  

A few more highlights…

– Malware on the move!  New Malware targeting Android phones making the rounds 

– Cortana… the weakest link? An exploit in Windows 10 was patched on Tuesday that allowed one to change passwords

– AI startup working on the United States drone program finds Russian malware on their server

– The Nigerian princes are back! This time, they want to be business partners…

There is a new mobile malware targeting Android phones, containing a banking Trojan, keyloggers, and ransomware. The malware, called MysteryBot will exfiltrate your data and send it back to LokiBot assets. While it’s still not in wide circulation, Android users should exercise caution when downloading apps both in and out of the play store.
https://www.bleepingcomputer.com/news/security/new-mysterybot-android-malware-packs-a-banking-trojan-keylogger-and-ransomware/

A vulnerability that used Cortana to access computer files even if the device was locked was revealed this week… just after patch Tuesday.
https://securingtomorrow.mcafee.com/mcafee-labs/want-to-break-into-a-locked-windows-10-device-ask-cortana-cve-2018-8140/

Across the globe, email scammers are a consistent source of problems for those who use the web. This week the FBI made 74 arrests across 7 countries and an email scam bust that targeted mid-sized businesses. The scam originated in Nigeria, the same country where the notorious ‘Nigerian prince’ email scam comes from.
https://www.cnet.com/news/fbi-busts-international-email-fraud-ring-that-stole-millions/

Look out for suspicious .men! Some top-level domains are more likely to be malicious than others, with .men .gdn and .work being the most abused. If you open a .men link there is about a 50/50 chance that you are going to a site loaded with spam or malware. Check those hyperlinks!
https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/

What we’re listening to this week!

Know Tech Talks – Hosted by Barb Paluszkiewicz

Security Now – Hosted by Steve Gibson, Leo Laporte

Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)

Small Business, Big Marketing – Australia’s #1 Marketing Show!

Elmcroft Senior Living

Exploit: Outside actor.

Risk to Small Business: High: Lack of Data Loss Protection (DLP) and chain of custody leading to breach

Risk to Exploited Individuals: High: Elevated probability for Identity theft and fraud based on PII compromised.

Elmcroft: Recently ending its management of more than 70 assisted living, memory care, and inpatient hospital rehabilitation, Elmcroft was in wind-down mode when the breach occurred.

Date Occurred
Discovered
Occurred May 10th 2018, Discovered on May 12th
Date Disclosed Elmcroft made an official statement on June 8th, 2018
Data Compromised Names

Date of birth

Social Security Numbers

Personal health information

How it was Compromised A third party had access to information being transferred from Elmcroft to the new management company
Customers Impacted
Residents

Residents family members

Employees

Possibly others

Attribution/Vulnerability Undisclosed at this time.

https://www.mcknightsseniorliving.com/news/data-breach-puts-personal-information-of-residents-workers-at-risk-elmcroft-senior-living-says/article/772385/

Terros Health

Exploit: Phishing scam that compromised one account.

Risk to Small Business: High: Demonstrates phishing is still a primary tactic to generate exploits and how one compromised email account can end in a major breach.

Risk to Exploited Individuals: High: Sensitive personal information, Social Security numbers and medical information were leaked all of which can be used maliciously by an outside actor.

Terros Health: Phoenix-based mental health and addiction services provider.

Date Occurred
Discovered
April, 2018
Date Disclosed June 8th, 2018
Data Compromised
Patient names

Date of birth

Social Security number

How it was Compromised
Phishing scam that compromised a single email account
Customers Impacted
1,600 patients
Attribution/Vulnerability One compromised email due to a phishing scam

https://www.bizjournals.com/phoenix/news/2018/06/10/terros-healthwarns-of-patient-data-breach.html

Clarifi
Exploit: Malware exploit to steal IP

Risk to Small Business: High: Demonstrates the need to harden security when dealing with Intellectual Property and being targets as a Federal Contractor/Supply Chain Sub-contractor.

Risk to Exploited IndividualsHigh: Highly sensitive military information is located at the company, making individuals who work their targets for state-sponsored hacking.

Clarifi: An artificial intelligence startup based in New York involved in improving U.S. military drones.

Date Occurred
Discovered
November, 2017
Date Disclosed June 2018
Data Compromised
Possibly customer data, although Clarifi denies that any data was compromised.
How it was Compromised Unclear, although the origin of the malware is believed to be Russian.
Attribution/Vulnerability Malware
Customers Impacted The company assures that no customer data was compromised

https://www.wired.com/story/startup-working-on-contentious-pentagon-ai-project-was-hacked

https://cyware.com/news/ai-startup-clarifai-working-on-pentagons-project-maven-was-allegedly-hacked-by-russian-source-8a171b30

HealthEquity
Exploit: Compromised email.

Risk to Small Business: High: Demonstrates the need for compromised credential monitoring and implementing stronger authentication tools.

Risk to Exploited Individuals: High: sensitive personal information and Social Security numbers were accessed during the breach.

HealthEquity: Utah based firm that handles millions of health savings accounts.

Date Occurred
Discovered
April 11, 2018
Date Disclosed June  2018
Data Compromised Names of members

HealthEquity ID numbers

Names of employers

Employers HealthEquity IDs

Social Security numbers

How it was Compromised
An email account of a HealthEquity employee was compromised, and the outside actor was able to gather data for two days before the malicious activity was noticed by the company.
Attribution/Vulnerability Compromised employee email.
Customers Impacted 23,000

https://www.infosecurity-magazine.com/news/23000-individuals-affected-in/

https://www.darkreading.com/operations/23000-compromised-in-healthequity-data-breach/d/d-id/1332050

Dixons Carphone
Exploit: Investigation ongoing.

Risk to Small Business: High: Breach response requirements of GDPR will significantly change how quick companies must disclose breach incidents and respond.

Risk to Exploited Individuals: High: Card data of customers was accessed by an outside actor.

Dixons Carphone: Electronics company located in the UK.

Date Occurred
Discovered
July, 2017
Date Disclosed June  2018
Data Compromised Customer Cards

Names

Addresses

Email addresses

How it was Compromised
The investigation is currently ongoing into how the breach happened, but it was only just discovered a little under a year after it happened.
Attribution/Vulnerability Unauthorized access to company data
Customers Impacted 5.9 million

An important takeaway from this week is the damage that a single compromised email account can have on an organization of any size. With one compromised email account a bad actor can send countless employees malware from an unsuspicious and legitimate email, often times without the employee knowing their email is compromised. Don’t let your business end up on the next Week in Breach. Make sure you and your employees’ passwords are strong, not reused or shared, and that your credentials aren’t up for sale on the Dark Web, by monitoring with Dark Web ID™ by Prime Telecommunications.  Please share this week’s breach news with a coworker or friend.

This week in Breaches!

full frame shot of abstract pattern

Photo by Sabrina Gelbart on Pexels.com

 

This week shows no shortage of targeted attacks designed to extract large datasets from a broad range of consumer sites.  Travel, finance and entertainment sites were targeted, impacting more than 100,000,000 unsuspecting victims.  If anything, this week clearly demonstrates why individuals need to proactively monitor for their compromised data with tools like our SpotLight ID – Personal Identity & Credit Monitoring Solutions.  The events of this week also clearly demonstrate why businesses must monitor for compromised credentials that can be used to exploit internal systems and to compromise or takeover customer accounts.

Highlights:

  • Leaked credentials from a 3rd party data breach used to exploit 45,000 Transamerica customers 
  • No Tickets for You! – TicketFly shuts down to identify and fix the source of leak impacting 26M customers
  • Booking.com shows that phishing attacks never take a vacation
  • Google Groups – taking a page right out of Amazon’s leaky bucket playbook?

In other news…

The City of Atlanta’s losing streak continues thanks to ransomware hacks! This time, the city’s evidence chain of custody breached, allowing police evidence to be destroyed – impacting investigations and prosecutions.
https://cyware.com/news/atlanta-ransomware-attack-destroyed-years-of-police-dashcam-footage-potentially-critical-evidence-9e8134ac

Europol has a new team dedicated to cybercrime on the Dark Web, hoping to monitor and mitigate criminal activity. Multiple law enforcement agencies throughout Europe are participating in this team, in addition to some non-European organizations. Keep fighting the good fight!
https://www.welivesecurity.com/2018/06/01/europol-eu-team-fight-dark-web/

Google Groups can’t get its act together when it comes to privacy settings, resulting in accidental disclosure of users’ private documents. If your business uses Google Groups, make sure to set your group to private!
https://www.securityweek.com/thousands-organizations-expose-sensitive-data-google-groups

It looks like there’s more than just gators to watch out for in the sunshine state… Florida named the worse state in consumer cybersecurity.

https://www.darkreading.com/vulnerabilities—threats/survey-shows-florida-at-the-bottom-for-consumer-cybersecurity/d/d-id/1331983


 What we’re STILL listening to this week!

Security Now – Hosted by Steve Gibson, Leo Laporte

Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)

Small Business, Big Marketing – Australia’s #1 Marketing Show!

TicketFly

Exploit: Database misconfiguration, hacker doxing/ransoming

Risk to Small Business: High: Demonstrates the impact of database misconfiguration and security controls.
Risk to Exploited Individuals: High: Social engineering and identity theft as a large amount of personal information including names, addresses and phone numbers of customers were leaked.
TicketFly: Owned by Eventbrite, TicketFly is a popular site where customers can purchase tickets online for upcoming events and shows.

Date Occurred
Discovered
May 30, 2018
Date Disclosed TicketFly made an official statement on June 6, 2018
Data Compromised Email addresses, Phone Number, Billing Address and Home Addresses
How it was Compromised A hacker attempted to contact the company about a vulnerability, demanding 1 Bitcoin as ransom to reveal the weakness. The hacker claims the emails to the company went unanswered so the cybercriminal vandalized the TicketFly site and leaked some of the information acquired to the press.
Customers Impacted
26 million, and even more if you consider the customers who are unable to buy tickets while the site has been down.
Attribution/Vulnerability Undisclosed at this time.

https://www.marketwatch.com/story/ticketfly-breach-may-have-exposed-data-of-26-million-customers-2018-06-03

MyHeritage

Exploit: Unsecured/misconfigured data store. Poor data at rest encryption. Poor password encryption.
Risk to Small Business: High: Demonstrates the impact of database misconfiguration, security controls and weak encryption.
Risk to Exploited Individuals: Moderate: Email addresses leaked but DNA/family history data supposedly stored separately.
MyHeritage: Users search historical records and create a family tree using this web-based service from Israel.

Date Occurred
Discovered
October 26, 2017
Date Disclosed June 4, 2018
Data Compromised
All email addresses and hashed passwords of users up to October 26, 2017
How it was Compromised
The CISO of MyHeritage received a message from a researcher that he had found a great deal of MyHeritage’s data on a server not connected with the site. The CISO confirmed that the data originated from their site but exactly how the data was acquired is not clear as of now.
Customers Impacted
92,283,889 Users
Attribution/Vulnerability Unclear, but MyHeritage did not store passwords, instead of storing a one-way hash of each password that has a key unique to each user. All credit card information is located on third party sites and the most sensitive information the website holds such as family tree and DNA data is stored in segregated systems with additional layers of security.

https://blog.myheritage.com/2018/06/myheritage-statement-about-a-cybersecurity-incident/#

https://motherboard.vice.com/en_us/article/vbqyvx/myheritage-hacked-data-breach-92-million

Transamerica
Exploit:  Compromised credentials
Risk to Small Business: High: Demonstrates the need to proactively monitor for compromised credentials from 3rd party data breaches and phishing attack mitigation.
Risk to Exploited IndividualsHigh: Highly sensitive personal information was stolen and could be used to impersonate an employee; or an outside agent could pose as a relative of an employee to phish for information

Transamerica: This company offers mutual funds, retirement strategies, insurance, and annuities.

Date Occurred
Discovered
Between March 2017 and January 2018
Date Disclosed May 2018
Data Compromised
Names, Addresses, Social Security Numbers, DOB, Financial data And Employment Information
How it was Compromised Third party compromised credentials were used to access user’s account data
Attribution/Vulnerability Outside actor

https://cyware.com/news/transamerica-hacked-nearly-45000-retirees-personal-and-sensitive-details-stolen-c2c419f5

https://www.theregister.co.uk/2018/06/05/transamerica_retirement_plan_hack/

Booking. com
Exploit: Phishing

Risk to Small Business Risk: High: Demonstrates how well-crafted phishing attacks can lead to massive data loss even with strong end-user security awareness training program and security tools in place.

Risk to Exploited Individuals: High: Money was stolen from the individuals who responded to the convincing email, and their stolen personal information could be used again.

Booking. com: A popular site for booking hotels, houses, apartments and boats.

Date Occurred
Discovered
June 2018
Date Disclosed June 3, 2018
Data Compromised Names, Addresses, Phone Numbers, Dates, Price of bookings and Reference Numbers
How it was Compromised
Certain properties of Booking.com received a link that detailed a security breach and urged them to change their password. Once the link was clicked the hackers had access to booking information that they used to send highly convincing phishing emails to customers asking for advance payments. The emails contained booking and pricing info for previously booked rooms, making the emails almost indistinguishable from an actual email from the company. The company reported that there was no compromise on their systems and that any customers who lost money due to the incident will be reimbursed.
Attribution/Vulnerability Outside actors, deployed through spam email campaign

https://www.independent.co.uk/travel/news-and-advice/travel-website-hackers-cyber-crime-phishing-holidays-a8382771.html

https://www.thesun.co.uk/money/6437309/hackers-target-booking-steal-thousands/

https://www.scmagazine.com/cybercriminals-phish-bookingcom-customers-after-possibly-breaching-partner-hotels/article/771091/

PageUp
Exploit: Malware
Risk to Small Business Risk: High: Demonstrates that malware exploits are often very difficult to detect and defend against.

Risk to Exploited Individuals: High: It is unclear what information has been compromised and from which customers of PageUp, but given the nature of the company and the information they store, the risk is serious.

PageUp: A large Australian company that provides HR, career, and recruitment service to large and small businesses around the world.

Date Occurred
Discovered
May 23, 2018
Date Disclosed June 6, 2018
Data Compromised Unclear, but passwords were hashed and salted
How it was Compromised
The investigation into the breach is ongoing, but due to the new implementation of GDPR in Europe and Australia’s Notifiable Data Breaches Scheme, PageUp disclosed the breach in compliance with the laws.
Attribution/Vulnerability Malware was found on one of PageUp’s IT systems, but how the malware entered the system is still being investigated

https://www.bleepingcomputer.com/news/security/malware-infection-at-hr-company-triggers-flurry-of-data-breach-notifications/


An important takeaway from this week finds its origin in research done by Dr. Michael McGuire, funded by Bromium and titled ‘The Web of Profit’ : The unfortunate truth is that crime does pay.Cybercrime produces 1.5 Trillion each year, which rivals Russia’s GDP and would place cybercrime at number 13 in a comparison of the world’s highest gross domestic product. $500 Billion of that can be contributed to intellectual property theft and data trading accounts for $160 Billion.

The scope of cybercrime profits and influence points to the conclusion that it is an economy in and of itself, a conclusion that is supported by the growth of platform criminality. Platform criminality is much like the business models of platform businesses such as Google, Uber, or Amazon that trade in data. Data is a profitable business as demonstrated by these famous companies (or at least two of them), and criminals have taken note.

Using the Dark Web as a means of facilitating transactions, cyber criminals are able to buy and sell anything from data to a day-zero exploit. The main takeaway from looking at how cybercrime has evolved is that cyber criminals are selling crime rather than committing it. Much like how Uber is selling a platform where drivers are paired with passengers, criminals are selling the tools and data needed to commit cybercrimes over ‘back alley’ marketplaces.

The research done by Dr. McGuire also highlights the importance of monitoring the Dark Web for personal information, stating:

New kinds of software tools are required for uncovering how cybercriminals are using digital technologies for hiding and laundering revenues. One example would be virtualization tools that can generate safe havens, isolated from the internet, where illicit revenue-generating activity can be diverted and neutralized. Another would be more sophisticated scanning tools capable of better tracking and locating items of value across the net – in particular, personal data”(125).

The Dr. also concluded that while Dark Web monitoring is vital to combatting the economy of cybercrime, it is far from an easy task. The difficult nature of monitoring the Dark Web is not just because it is harder to navigate than the traditional web… explains McGuire, it is “because many of the sites only grant access by word of mouth, or on the basis of ratings status and trust, which may take some time to build up” (57). The Dark Web and the economy surrounding it is nothing to take lightly, and ignoring its existence only adds to the ability for cyber criminals to go about their work unscathed. Dark Web ID by ID Agent fulfills this need for Dark Web monitoring, instead of turning a blind eye to the complex and dynamic reality of the cybercrime economy our services dive right in.

https://learn.bromium.com/rprt-web-of-profit.html

https://www.darkreading.com/cloud/cybercrime-is-skyrocketing-as-the-world-goes-digital/a/d-id/1331905

Highlights from The Week in Breach: May 30 to June 6 2018

Highlights from The Week in Breach:

– Finance sector attacks ramping up
– BackSwap JavaScript injections effectively circumventing detection
– Honda has leaky buckets too

This week in breach has all been about money, money, money. The finance sector is getting pelted with attacks recently – even more than usual – and Mexico, Canada, and Poland have been hit the worst.

In other news…

North Korea is still up to their old tricks, targeting South Korean websites with advanced zero-day attacks.
https://www.bleepingcomputer.com/news/security/activex-zero-day-discovered-in-recent-north-korean-hacks/

School is letting out which means grade changing breaches are in season! Two students at Bloomfield Hills High School attempted to fudge their report card and refund lunches for themselves and 20 other students.
https://www.forbes.com/sites/leemathews/2018/05/22/school-hackers-changed-grades-and-tried-to-get-a-free-lunch/#478b6d026e7d

The government of Idaho was hacked 2 times in 3 days which is not a very good look.
https://idahobusinessreview.com/2018/05/22/state-government-hacked-twice-in-three-days/

Coca-Cola had a breach that compromised 8,000 employees’ personal data, but they are also providing identity monitoring for a year at no cost. Ahh… refreshing, isn’t it?
https://www.infosecurity-magazine.com/news/no-smiles-for-cocacola-after-data/


 What we’re STILL listening to this week!

Security Now – Hosted by Steve Gibson, Leo Laporte

Defensive Security Podcast – Hosted by Jerry Bell (@maliciouslink) and Andrew Kalat (@lerg)

Small Business, Big Marketing – Australia’s #1 Marketing Show!

Simplii Financial (CIBC) & Bank of Montreal
Exploit: Spear Phishing
Type of Exploit Risk to Small Business:  High: Personal and account information from a large number of customers were compromised, opening up the possibility of identity theft for business owners or employees.

Risk to Exploited Individuals: High: A large number of both personal and account information was breached from both banks including social insurance numbers and account balances. 

Simplii Financial: Owned by CIBC, Simplii Financial is a Canadian banking institution offering a wide array of services for their customers such as mortgages and investing.

BMO (Bank of Montreal): BMO is also a Canadian banking institution that offers investing, financial planning, personal accounts, and mortgages.

Date Occurred/
Discovered
The weekend of the 25th
Date Disclosed May 28, 2018
Data Compromised Personal and account information of the two bank’s customers. The hackers provided a sample of the breached data, containing the names, dates of birth, social insurance number and account balances of two customers.
How it was Compromised It is believed that both bank data breaches have been carried out by the same group of fraudsters, due to the time frame and ‘blackmail’ strategy of the group rather than selling of the data. It is suspected that a spear phishing attack was used, focusing on individual employees with targeted phishing attempts rather than a ‘dragnet’ approach typically seen in phishing attacks.
Customers Impacted
Between the two banks over 90,000 people’s personal and account information was compromised during the breach. CIBC owned Simplii Financial reported 40,000 accounts compromised compared to BMO who declared 50,000 accounts compromised later on the same day.
Attribution/Vulnerability Undisclosed at this time.

http://www.cbc.ca/news/business/simplii-data-hack-1.4680575

Honda Car India
Exploit: Misconfigured/ Insecure Amazon S3 buckets
Type of Exploit Risk to Small Business: High
Risk to Exploited Individuals: Moderate: Presumably low-risk PII and vehicle information exposed.
Honda Car India: Honda is an international cooperation from Japan that specializes in cars, planes, motorcycles and power equipment.

Date Occurred/
Discovered
The details were left exposed for at least three months. A security researcher who was scanning the web for unsecured servers left a message of warning timestamped February 28.
Date Disclosed May 30 2018
Data Compromised
Names
User gender
Phone numbers for both users and their trusted contacts
Email addresses for both users and their trusted contacts
Account passwords
Car VIN
Car Connect IDs, and more
How it was Compromised
A researcher who was scanning the web for AWS S3 buckets with incorrect permissions left a message in Honda Car India’s server to try and warn them to secure their server. Honda was not even aware that the note was added, signaling a complete lack of monitoring on the companies part.
Customers Impacted
50,000 of Honda Car India’s customers have had their personal info exposed on the internet for three months at the minimum.
Attribution/Vulnerability Negligence. Once the researcher noticed that Honda had still not secured their buckets, he reached out to them but it still took the company 2 weeks to respond.

https://www.bleepingcomputer.com/news/security/honda-india-left-details-of-50-000-customers-exposed-on-an-aws-s3-server/

SPEI
Exploit: Man in the Middle Attack
Type of Exploit Risk to Small Business: Severe: Security certificate exploit, website login spoofing, traffic re-direct. Significant financial loss. Threat intelligence/ data share fail.
Risk to Exploited IndividualsLow:  Financial Institutions will absorb the loss.

SPEI: Mexican domestic payment system.

Date Occurred/
Discovered
A breach was first detected on April 17th, with 5 more financial institutions being breached on April 24th, 26th, and May 8th.
Date Disclosed May 2018
Data Compromised
$15 Million stolen
How it was Compromised The central bank of Mexico experienced a man in the middle attack in April that it was able to stop, but failed to warn other financial institutions in the country about the severity of the incident. This led to 5 other financial institutions being compromised except the attacks were successful. It is unclear exactly how the hackers were able to enter the network, but the situation is constantly developing.
Attribution/Vulnerability Outside actors/ not disclosing breach possibly facilitated more breaches.
Customers Impacted Multiple financial institutions in Mexico

https://www.bloomberg.com/news/articles/2018-05-29/mexico-foiled-a-110-million-bank-heist-then-kept-it-a-secret

Polish Banks
Exploit: JavaScript malware injection named BackSwap
Type of Exploit Risk to Small Business: High: Sophisticated JavaScript injection designed to bypass advanced security/ injection detection.
Risk to Exploited Individuals: High: those who used the polish banks targeted by the new malware will take a financial loss, 2FA does not combat this.

Polish Banks: 5 Polish banks are being targeted

Date Occurred/
Discovered
The banking malware was first introduced in March 2018. The malware has been increasingly active since then.
Date Disclosed May 2018
Data Compromised Banking account information and funds
How it was Compromised
A new malware family. This family of banking malware uses an unfortunately elegant solution to bypass traditional security measures, using Windows message loop events rather than process injection methods to monitor browsing activity. When an infected user begins banking activities, the malware injects malicious JavaScript directly into the address bar. The script hides the change in recipient by replacing the input field with a fake one displaying the intended destination.
Attribution/Vulnerability Outside actors, deployed through spam email campaign

https://www.welivesecurity.com/2018/05/25/backswap-malware-empty-bank-accounts/

The last couple of months has seen an increase in the number of attacks on financial institutions around the world. Both the Bank Negara Malaysia and Bancomext were targeted in SWIFT-related attacks while two Canadian banks’ data was held at ransom in a massive breach. The largest three banks in the Netherlands were hit by DDoS attacks, the Swiss Financial Market Supervisory Authority stated that cyber-attacks were the greatest threat to their banks, while at the same time British banks spending on fighting financial crime sits at 5 billion pounds.

While no sector is immune from cyber-attack, the nature of the financial industry makes an attractive target. The sector is made up of institutions that store large quantities of sensitive data that can be sold on the Dark Web, as well as institutions that have access to large sums of capitol.

Additional Sources:
https://www.hstoday.us/uncategorized/cyber-attacks-on-banking-infrastructure-increase/

Surprise! What’s The Country Where All The CEO Fraud Gangs Are?

KnowBe4’s Stu Sjouwerman wrote a really great blog about Business Email Compromise. Once upon a time, about 5 years ago, if you got a letter from a Nigerian prince or some sad story about not being able to transfer funds, that was obviously a scam. You knew, I knew, anybody but the most gullible knew it. Those were referred to as Nigerian 419 scams- 419 is the section of the Nigerian criminal code where this practice is codified as illegal.

Image result for nigerian prince

But times have changed and so have the gangs…

What if your CFO got an email from your COO or your CEO? What if your AP clerk got an email from your CFO- or your Comptroller?

A new study by Agari concludes that, despite all the attention nation-state espionage services have been getting for their phishing attacks, the big threat still comes from criminal gangs.

Here is your quick Executive Summary:

  • 97% of people who answer a Business Email Compromise (aka CEO Fraud) email become victims
  • The average BEC incident included a payment request of $35,500 (ranging from $1,500 to $201,805)
  • 24% of all observed email scam attempts between 2011 and 2018 were BEC even though BEC only started in earnest in 2016

And What’s That Country?

Many of those criminal gangs continue to operate from Nigeria, of the ten gangs engaged in the email scams that Agari studied, nine were based in Nigeria. Conclusion: the old Nigerian 419 scam has upgraded big time.

While business email scams are relative newcomers to the world of online crime, becoming popular only as recently as 2016, they’re now the most common kind of attack, accounting for 24% of phishing emails.

Patrick Peterson, Agari’s Executive Chairman said: “The sad irony is that these foreign adversaries are using our own legitimate infrastructure against us in attacks that are far more damaging and much harder to detect than any intrusion or malware.”

BEC, in which the scammer poses as an executive of the business being phished, has the greatest potential for a large, immediate payout. All organizations should make it their policy never to use email to direct fund transfers, and they should train their employees to be aware of this social engineering tactic.

Other scams have similar potential to bankrupt their targets. Real estate brokers, for example, have been targeted with malicious attachments that enable criminals to conduct man-in-the-middle account takeover scams that hit escrow accounts.

Scammers Use A Multi-Step Process

An interesting finding of Agari’s study is the multi-step process many of the scammers use: a probe email is followed by one or more follow-ups that deliver the scammer’s punch.

In the case of business email compromise, a common and effective probe might ask, “Are you at your desk to make a payment?” We have seen that these organized crime groups are starting to automate and script the process of sending these initial probes to their targets.

Interactive training can help a business arm its employees against social engineering. KnowBe4 actually allows you to monitor what an employee who falls for a simulated CEO fraud attack writes back, and automatically step them through immediate remedial training.

Want a free tool to see how vulnerable you are to spoofing? Cut and paste this link to your browser- https://info.knowbe4.com/domain-spoof-test-partner?partnerid=0010c00001wis6gAAA