Cybersecurity firm McAfee Corp. has entered into a definitive agreement to sell its enterprise business unit to a software firm Symphony Technology Group (STG) in an all-cash deal of $4 billion. The acquisition deal, which is subject to customary regulatory approvals, is expected to close by the end of 2021. McAfee’s enterprise business is one of the recognized device-to-cloud cybersecurity companies in the security industry for more than 30 years.
McAfee to become a pure-play consumer cybersecurity company
McAfee expects to issue an estimated $4.50 special dividend per Class A common share upon transaction close
McAfee expects to reduce debt by approximately $1 billion, which is expected to result in a neutral impact on to net leverage ratio
Until the closure of the deal, McAfee will continue to operate the enterprise business. After the transaction, McAfee will focus on delivering personal security solutions to consumers.
McAfee President and Chief Executive Officer, Peter Leav, said, “STG is the right partner to continue strengthening our Enterprise business, and this outcome is a testament to the business’ industry-leading solutions and most notably to the outstanding contributions of our employees. This transaction will allow McAfee to singularly focus on our consumer business and accelerate our strategy to be a leader in personal security for consumers.”
McAfee has made a place within the tech industry for its device-to-cloud cybersecurity software solutions. For more than 30 years, it has held a reputation of enterprise security, creating both consumer and business value.
Researchers found a security vulnerability in the iOS call recording app “Automatic call recorder” that gave access to the conversations of thousands of app users. According to Anand Prakash, security researcher and founder of PingSafe AI, who discovered the flaw, the vulnerable app used open-source intelligence and exposed hostnames and other sensitive data from its cloud storage.
With more than a million downloads from the App Store, the Automatic call recorder app is a popular mobile application used by iPhone users to record their calls. The app developer fixed the vulnerability and released a new version after the researcher notified the issue.
Prakash stated that he discovered the vulnerability while performing open-source intelligence across mobile applications in various categories. The flaw has been leaking the cloud storage URL of the victim’s data to an unauthenticated API endpoint. It allowed attackers to listen to any user’s call recording from the cloud storage bucket used by the application.
Reproducing the Vulnerability
Install the “Automatic Call Recorder” application on your phone.
Intercept application’s traffic in Burp Suite/Zap Proxy.
The response will have an s3 URL for the recording and other sensitive details.
“Security issues like this are catastrophic in nature. Along with impacting customer’s privacy, this also dents the company’s image and provides added advantage to the competitors. PingSafe AI uses the state-of-the-art intelligent risk evaluation engine to monitors the security health of a company comprehensively by assessing all domains, IPs, mobile applications, source codes, and leaked credentials,” Prakash said.
Flagstar Bank suffered a data breach after cybercriminals compromised Accellion file transfer software, which the bank uses for sharing sensitive information. In an official release, the U.S.-based bank and mortgage lender revealed that threat actors belonging to the Clop ransomware group exploited the vulnerabilities in Accellion FTA servers. Based in California, Accellion is a private cloud solutions company that provides software for third-party secure file transfers.
The Breach Impact
Flagstar stated that the threat actors obtained access to some of its information on the Accellion platform. However, it clarified that its IT infrastructure outside of the Accellion platform was not impacted and all its functions are fully operational. However, Flagstar discontinued using Accellion’s file sharing platform and notified the users about the breach.
“Upon discovery, we acted immediately to contain the threat and engaged a team of third-party forensic experts to investigate and determine the full scope of this incident. We are working expeditiously with our internal and external teams to determine what data may have been accessed and will notify any impacted customers directly after we complete a thorough, diligent review of the data,” Flagstar said.
Flagstar is also offering free credit monitoring, fraud consultation, and identity theft restoration services to the affected individuals.
The Ripples of Accellion’s Flaw
Till now, threat actors attacked several organizations globally by exploiting the Accellion vulnerability. Multiple critical organizations including the Office of the Washington State Auditor (SAO), the Australian Securities and Investment Commission (ASIC), and New Zealand’s Reserve Bank suffered security breaches. Recently, Singapore telco giant Singtel issued a statement confirming that over 129,000 of its customers’ data has been breached after attackers exploited a bug in Accellion’s software used by the company.
Chinese state-actor hacker groups launched attacks on ten Indian power sector companies and two seaports since early last year. The latest attack occurred on February 28, which is attributed to the Chinese state-backed hacker group RedEcho. This was revealed in a webinar on March 9, by the U.S.-based cybersecurity organization Recorded Future. In its report “China-linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions,” Recorded Future cites geopolitical reasons and heightened border clashes between the two Asian neighbors – India and China – since last May, as the reasons for these attacks. The report does not include any activities post-February 7. For the news story, which CISO MAG published on RedEcho, click here.
— Brian Pereira, Editor-in-Chief, CISO MAG
Recorded Future recently launched a network traffic analysis source which helps it trace the attacks from the targets/victims back to the attackers. It collects threat intelligence from various sources and transforms the information into actionable intelligence, through its platform and security intelligence graph. And it offers six solutions: brand intelligence, SecOps intelligence, threat intelligence, vulnerability intelligence, third-party intelligence, and geopolitical intelligence. Recorded Future disseminates threat intelligence through its portal, mobile application, browser extension, and API for integrations. It also advises governments and institutions alike, on mitigation strategies.
Since early 2020, Recorded Future’s Insikt Group observed a large increase in suspected targeted intrusion activity against Indian organizations from Chinese state-sponsored groups. From mid-2020 onwards, Recorded Future’s midpoint collection revealed a steep rise in the use of infrastructure tracked as AXIOMATICASYMPTOTE, which encompasses ShadowPad command and control (C2) servers, to target a large swathe of India’s power sector. Ten distinct Indian power sector organizations, including four of the five Regional Load Despatch Centres (RLDC) responsible for the operation of the power grid through balancing electricity supply and demand, have been identified as targets in a concerted campaign against India’s critical infrastructure. Other targets identified included two Indian seaports.
Suspected Indian power sector victims of RedEcho targeted intrusions Source: Recorded Future (Map Data: Google – 2021)
“We have been tracking the malicious activities of the RedEcho group since October 2020. And we have observed significant, sustained, high-volume traffic from Indian power sector assets to RedEcho infrastructure. RedEcho has overlapping MO with several Chinese groups, but we chose to name them because at this time, we do not have information to make a definitive connection to a specific existing group. The RedEcho infrastructure is still active, with the last observation on February 28, with comms to NTPC infrastructure,” said Charity Wright, Cyber Threat Intelligence Analyst with Recorded Future’s Insikt Group.
It was observed that RedEcho attacked National Thermal Power Corporation (NTPC) infrastructure. Recorded Future first observed RedEcho’s activity in October 2020. It also informed the Indian Government about the intrusion on October 10, which was two days before the major power outage experienced in the city of Mumbai and its satellite towns and cities.
However, Recorded Future cannot ascertain if the Mumbai power outage on October 12 was due to the RedEcho attacks.
According to a report in India Today, the Maharashtra state load despatch centre was targeted in October 2020.
“We cannot link that particular incident to RedEcho at this time,” said Wright.
Recorded Future again notified the Indian Government about the attacks on infrastructure on February 10 this year, and on February 11, India and China signed an agreement for de-escalation along Pangong Lake near the LAC (line of actual control).
Power companies in other counties have been targeted as well.
“A year ago, Recorded Future revealed an intrusion into a European energy organization (ENTSO-E), by a non-Chinese group. We used a similar methodology based on combining adversary infrastructure detection with network traffic analysis. We discovered a PuppyRAT malware campaign in late 2019. We published those findings on January 23, 2020 and the victim announced the intrusion on March 9, 2020,” added Wright.
The targeting of Indian critical infrastructure offers limited economic espionage opportunities; however, we assess they pose significant concerns over potential pre-positioning of network access to support Chinese strategic objectives.
Pre-positioning on energy assets may support several potential outcomes, including geostrategic signaling during heightened bilateral tensions, supporting influence operations, or as a precursor to kinetic escalation.
RedEcho has strong infrastructure and victimology overlaps with Chinese groups APT41/Barium and Tonto Team, while ShadowPad is used by at least five distinct Chinese groups.
The high concentration of IPs resolving to Indian critical infrastructure entities communicating over several months with a distinct subset of AXIOMATICASYMPTOTE servers used by RedEcho indicates a targeted campaign, with little evidence of wider targeting in Recorded Future’s network telemetry.
To view the complete list of IoCs related to the RedEcho threat group, click here.
Stanley Mierzwa, Director, Center for Cybersecurity at Kean University, U.S., said, “Those organizations recently attacked should consider studying, or if unavailable, employing proper Information Governance strategies to help with the protection of data, as an invaluable asset. This effort will entail going back to the drawing table to study the legal and sector-related regulations, so that they are met, but more importantly so that they are exceeded! This focal action will include a process to employ tasks to help categorize the most critical and important information and data. Ensure to engage appropriate Information Governance policies that will help to enforce security-related information technologies, such as encryption, strict access controls, information rights management, digital shredding capabilities, auditing, and logging.”
Mierzwa lectures at Kean University on Cybersecurity Risk Management, Cyber Policy, Digital Crime and Terrorism, and Foundations in Cybersecurity. He is a regular contributor to CISO MAG. Be sure to read Mierzwa’s article in the April 2021 issue of CISO MAG.
About the Author
Brian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 26 years.
It has been an age-old myth that women prioritize family over work. Women are under-represented in tech and leadership. According to an (ISC)² Cybersecurity Workforce Report, women working in cybersecurity account for about one quarter (24%) of the overall workforce. Though there’s a continuing inequity, things have begun to look brighter. Workforces – especially post-COVID-19 pandemic and lockdown – have been offering flexibility in timings, empowering women to lead, and showing support through digital mediums. Change happens with time, but it requires consistency. There is a need to go beyond the 24%.
Let’s hear what Julie Beck, Information Security Analyst, Homestar Financial Corp., Georgia, has to say about Women in Cybersecurity:
Less representation of women: I don’t think this is a “one size fits all” answer. I believe there are numerous reasons for different people.
One would be the cost of investing in education. Had I not had my company paying for my education and the scholarships I received, I would not have been able to afford the tuition as a single mom. The same goes for the cost of certification classes and certifications.
When I grew up, I was still a part of the generation who was told that women were not good in Science and Math. I still think we have a generation who is being taught this, but it is improving with STEM classes in our schools.
Then I believe that there are women who are intimidated to work in a male dominant industry. I will say that I’ve met few “bad apples,” but for the most part, men counterparts have been very supportive and accepting women into conferences and this industry.
Lack of women role models: I feel the dearth of women role models has lessened over the years. I do feel like there is still a slight dearth. I think it is more about getting to know the women in the field. I think that the women in this industry need to be more outspoken and stand up to be seen and heard so other women know we are here. In the years I was developing an interest in this field, one of my instructors was a woman. She had a passion for the material and presented herself in a way I admired and wanted to be like her. Having this role model gave me someone to look up to and to know that it is possible for women to be successful in this industry.
Cybersecurity scholarships for women:Yes! I absolutely feel that scholarships for women are important! For me, as a single mom, I prioritized spending money for my family and felt guilty for spending money to invest in myself. Programs like IBM’s, which paid for admittance to Hacker Halted, are needed. Scholarships for women are needed to help them get in and get interested. Once I landed a job in cyber, I was fortunate enough that my work would reimburse these costs. I still had to have the money or the credit to invest upfront many times though. Many women who have yet to enter the field do not have this luxury of getting reimbursed. We must alleviate the burden and financial strain to enter the industry.
What can men do?In my experience, I have had men mentor me and encourage me along my path. I feel it is important to not only have women role models but men who are accepting and encouraging. My mentor saw potential in me and invested in me. He encouraged me to take training and took the time to speak words of encouragement to me. Having someone from the opposite sex tell you in a professional manner that you have what it takes helped me from getting discouraged and prevented me from quitting numerous times.
Cybersecurity experts from Check Point found threat actors dropping new malware via nine malicious Android apps on the Google Play store. Dubbed as Clast82, the new malware allows an attacker to illicitly obtain victims’ financial information by taking full control of their mobile devices. The search engine giant has removed the apps from the Play store after being notified by Check Point researchers.
Clast82 Malware Dropper
The researchers stated that Clast82 malware can avoid Google Play Protect detection and change the payload dropped from a non-malicious payload to the AlienBot Banker and MRAT. Upon taking control of a device, the attacker can perform certain functions like installing a new application on the device or even control it with TeamViewer.
“The AlienBot malware family is a Malware-as-a-Service (MaaS) for Android devices that allows a remote attacker to inject malicious code into legitimate financial applications,” Check Point said.
The Nine Malicious Apps
“The malware’s ability to remain undetected demonstrates the importance of why a mobile security solution is needed. It is not enough to just scan the app during the evaluation period, as a malicious actor can, and will, change the application’s behavior using 3rd party tools. As the payload dropped by Clast82 does not originate from Google Play, the scanning of applications before submission to review would not prevent the installation of the malicious payload. A solution that monitors the device itself, constantly scanning network connections and behaviors by application would be able to detect such behavior,” Check Point added.
Several cybersecurity experts have reported an increase in phishing attacks using Google’s reCAPTCHA feature to hide malware and escape security detections. A research team from Zscaler recently discovered a series of Microsoft-themed phishing attacks targeted at high-ranked employees in multiple organizations globally. Zscaler stated that it prevented over 2,500 such phishing attempts over the last three months.
“The attack is notable for its targeted aim at senior business leaders with titles such as Vice President and Managing Director who are likely to have a higher degree of access to sensitive company data. These campaigns aim to steal these victims’ login credentials to allow threat actors access to valuable company assets,” Zscaler said.
Scammers have been spreading their phishing campaigns across multiple industries, especially in the banking and IT sectors. While it is still unknown who is are behind these attacks, Zscaler stated that the phishing campaigns have been active since December 2020.
Purpose of reCAPTCHA
reCAPTCHA walls are typically used to verify and differentiate between human users and bots. Once the human intervention is verified, only then access to web content is allowed. It is also commonly used as one of the multi-factor authentication (MFA) techniques, which helps legitimate companies restrict bots from scraping and hijacking their content.
ExploitingGoogle reCAPTCHA
The campaign begins with cybercriminals sending phishing emails that appear as automated emails from their unified communications tools indicating that they have a voicemail attachment.
The phishing pages are hosted by using .xyz, .club, and .online generic Top Level Domains (TLDs).
When a user opens/clicks the attachment, it redirects the victims to a fake Google reCAPTCHA screen.
After verifying the reCAPTCHA, the page takes the user to a fake Microsoft login screen, allowing threat actors to steal victims’ login credentials.
After entering the login credentials, the campaign prompts a fake message saying, “Validation successful” and then shows a recording of a voicemail message to play, adding legitimacy to the phishing campaign.
“Similar phishing campaigns utilizing fake Google reCAPTCHAs have been observed for several years, but this specific campaign targeting executives across specific industry verticals started in December 2020,” Zscaler added.
WhatsApp has been feeling the heat of governments and its users for quite some time now. Be it for the “discriminatory policy” labeled by the Indian Government or the vulnerability that made WhatsApp account takeover possible, it has been in the news for all the wrong reasons. However, it has now decided to work towards a much-needed and highly appreciated offering – password-protected, encrypted chat backups for Google Drive and iCloud.
What is Encrypted WhatsApp Chat Backup
At the moment, this unique feature is still under development and there is no official feature release date made available by WhatsApp, said WABetaInfo who first broke the news on Twitter.
As previously announced, @WhatsApp is working on cloud backups encryption.
The chat database and media will be safe from unauthorized access when using a password. The password is private and it’s not sent to WhatsApp.
It will be available in a future build for iOS and Android. pic.twitter.com/Lp06PaECBX
WhatsApp provides its users two options of performing chat backup and chat history, first is on the device itself and the second is on cloud storage like Google Drive for Android devices and iCloud for iPhone and Apple devices. WhatsApp already has End-to-End (E2E) encryption for their chat feature. However, the chat backups stored on cloud storage were not encrypted. Considering how privacy and security have now become the center of all discussions – especially post their new privacy policies issuance, which had been deferred by three months citing rumors and misinformation issues – WhatsApp seems keen on covering this base at the earliest to avoid more flak.
According to the screenshots shared by WABetaInfo on Twitter, it seems like the user will be required to enter their phone number to confirm password protection for their backups. However, there is a catch in this, because if any user forgets the password, WhatsApp does not give any “Forgot Password” link. This means it will simply not allow any user to access or restore the backup data if they do not remember the password.
So, memorize this password thoroughly, else there will be no backup to your WhatsApp chats available. We also recommend a password vault app like Norton Lifelock.
The U.K. is one of the most developed markets in Europe in terms of 5G deployments, as people and critical national infrastructure become more dependent on these next-generation networks. Apart from mobile network operators (MNOs) even utility providers, banks, manufacturers, and others are accelerating their deployments of private 5G. As these next-generation networks roll out this year, we can expect to see new and sophisticated attacks on 5G networks and attacks aimed at compromising the IoT devices on these networks.
And all this will cause substantial national security, cybersecurity, and privacy risks.
In November 2019, the U.K. government introduced the Telecommunications Security Bill which imposes harsher fines for operators who fail to protect their networks and subscribers. The European Union also released the EU Toolkit, which was supported by a document from ENISA, the European Union’s cybersecurity agency.
In this episode, we have Dmitry Kurbatov, Chief Technology Officer at Positive Technologies. He tells us how telecom operators have been impacted by the Bill. In February 2021, Positive Technologies launched a 5G Security Program to support mobile operators in securing their next-generation networks against new and hidden threats. Kurbatov offers some details of this program, and how will it help Telecom operators in the U.K. comply with the Telecoms Security Bill.
Dmitry worked as a network engineer for system integrators from 2006. He joined Positive Technologies in 2010. First, he was engaged in the development of an automated security analysis system. Then he switched over to telecom security research, where his work included finding vulnerabilities in network equipment, errors in data transfer network design, protection of signaling protocols (SS7, Diameter, GTP). And then he moved on to IoT security. Since 2014, he has been Director of Telecom Security at Positive Technologies.
He holds a degree in information security of telecommunications systems from Moscow Technological University (MIREA).
Positive Technologies is a global cybersecurity company. They offer a Telecom Cybersecurity Suite that enables network operators to drive business performance while protecting their subscribers and services.
By providing greater visibility into infrastructure vulnerabilities and securing customer services, Positive Technologies helps to strengthen loyalty, drive revenue with value-added security offerings, and protect emerging telecom technologies such as 5G and the IoT.
It has been an age-old myth that women prioritize family over work. Women are under-represented in tech and leadership. According to an (ISC)² Cybersecurity Workforce Report, women working in cybersecurity account for about one quarter (24%) of the overall workforce. Though there’s a continuing inequity, things have begun to look brighter. Workforces – especially post-COVID-19 pandemic and lockdown – have been offering flexibility in timings, empowering women to lead, and showing support through digital mediums. Change happens with time, but it requires consistency. There is a need to go beyond the 24%.
Let’s hear what Roota Almeida, Chief Information Security Officer, Delta Dental of New Jersey and Connecticut, has to say about Women in Cybersecurity:
Less representation of women: There are several reasons for this. The first and the most important reason is that cybersecurity is still not something that is discussed as an option for a college degree in schools for graduating high schoolers. It gets buried under IT for these students and is seen by young women as “something only boys are interested in” or “geeks do”. I have spoken to many seniors in high school during career coaching events and have noticed that they do not know Cyber Security as an option to choose for college courses. Hence, few women take cybersecurity courses in college, and fewer join the workforce. The problem is at the grass-root level and needs to be fixed there.
There is also an issue with having women stay in this field for a longer time. Due to the stress and high demand of the job they do not pursue this career or choose other options.
In addition, the number of women supporting families on their own is increasing quickly. The proportion of families headed by a single mother is growing. These numbers are dramatically higher in certain demographics. Our country (U.S.) unlike many other countries like the EU, lag way behind in efforts to help parents take care of their children and stay in the workforce. Most companies have 6-8 weeks of maternity leave depending on regular delivery or a C-section. This significantly impacts the number of women who stay in the workforce after having children.
Lack of women role models: I don’t think so. There are many women role models in technology and cybersecurity. LinkedIn and Forbes have listed several women over the years who have been great role models in cybersecurity. It does not have to be women’s role models; men could be great role models too — for women. There are many men I have worked with that support women and can be amazing role models.
Cybersecurity scholarships for women: Scholarships can help the underprivileged and can boost confidence. It is a great way to open doors for women who traditionally might’ve not taken up that cybersecurity course or certification, if not for a scholarship.
What can men do? Like in any other field, it is important to have sponsors and mentors who can support you. Men can be great sponsors who can invest in and work actively to advance your careers, and they can be excellent mentors as well, who can guide you through your career aspirations. It is important you choose the right sponsor/mentor for you.
Roota Almeida is the Chief Information Security Officer at Delta Dental of New Jersey and Connecticut (DDNJ, Inc.). She believes more women should be encouraged to pursue STEM careers and has started a summer internship program at DDNJ, Inc. specifically designed to give graduating female high school students insight into the field of corporate cybersecurity.
Roota is a recognized industry thought leader who serves as a member of the Board of Advisors at several organizations, a governing body chair for Evanta’s NJ CxO Summits and other technology conferences, a faculty and a security awards judge. Her in-depth experience and expertise in the field of information security and risk management can be measured by the various articles, eBooks, interviews, and podcasts she has to her credit. Roota is also working to build and encourage new talent and solutions in the security arena.
Roota holds CCISO, CISSP, CISM and CRISC certifications.
Ensuring that you get the best experience is our only purpose for using cookies. If you wish to continue, please accept. You are welcome to provide a controlled consent by visiting the cookie settings. For any further queries or information, please see our privacy policy.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Stanley Mierzwa, Director, Center for Cybersecurity at Kean University, U.S., said, “Those organizations recently attacked should consider studying, or if unavailable, employing proper Information Governance strategies to help with the protection of data, as an invaluable asset. This effort will entail going back to the drawing table to study the legal and sector-related regulations, so that they are met, but more importantly so that they are exceeded! This focal action will include a process to employ tasks to help categorize the most critical and important information and data. Ensure to engage appropriate Information Governance policies that will help to enforce security-related information technologies, such as encryption, strict access controls, information rights management, digital shredding capabilities, auditing, and logging.”
Brian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 26 years.
Roota Almeida is the Chief Information Security Officer at Delta Dental of New Jersey and Connecticut (DDNJ, Inc.). She believes more women should be encouraged to pursue STEM careers and has started a summer internship program at DDNJ, Inc. specifically designed to give graduating female high school students insight into the field of corporate cybersecurity.