Home Blog Page 120

India Reported More than 2.9 Lakh Digital Banking Security Incidents in 2020

Acronis Cyber Readiness Report, cyberattacks in India, cybercrime in India, India’s Private Sector

As per a survey conducted by U.S.-based financial technology firm FIS, around 68% of Indian consumers now use digital banking services, for both online and mobile banking. Digital transactions rose by 46% in 2020 (45.72 billion transactions) compared to the F.Y. 2018-19 (31.34 billion transactions). The uptake of these services was due to the COVID-19 pandemic, which meant buying day-to-day groceries online.

Considering this boom and the rapid rise of the use of Bitcoin, India is also getting ready to soon launch its digital currency that would “mostly be based on the blockchain technology,” informed Anurag Thakur, the Minister of State for Finance. However, to learn about the threats harming the digital banking landscape, the Rajya Sabha (the upper house of the bicameral Parliament of India) had asked for a comprehensive report that would give a clear picture of the tasks ahead. Responding to Rajya Sabha’s query, Sanjay Dhotre, Minister of State for Electronics and IT, informed the upper house that more than 2.9 Lakh (290,445) cybersecurity incidents related to digital banking have been reported in 2020.

Related News:

Airtel Data Leak: Close to 2.5 Mn Indian Users Likely Affected

Referring to the findings from the Indian Computer Emergency and Response Team (Cert-In), Dhotre said that the number of incidents reported has nearly doubled as compared to 2018 when it was 1,59,761. The reported “incidents included phishing attacks, network scanning and probing, viruses and website hacking.”

Responses to Other Queries

The Rajya Sabha had also made some additional requests to get deeper insights on the number of fraudulent and cheating cases reported in the same period, along with the number of websites blocked as evasive measures. To this, Dhotre responded with the following details:

  • As per the National Crime Records Bureau (NCRB) data, 6,233 cases were registered in 2019 under fraud and cheating (involving communication devices as medium/ target as per Information Technology Act 2000). This number too has nearly doubled since 2018 when only 3,353 cases were reported.
  • Approximately 9,849 websites/webpages/or respective accounts were blocked in 2020 as opposed to 3,635 in 2019 and 2,799 in 2018. The section 69A of the IT Act was enforced by the Government in such cases which empowers it to “block any information generated, transmitted, received, stored or hosted in any computer resource in the interest of sovereignty and integrity of India, defense of India, security of the State, friendly relations with foreign states or public order.”

Related News:

Indian Government Asks WhatsApp to Withdraw its “Discriminatory” Policy

Unpatched Vulnerability in WordPress Plugin Affects 50,000 Sites

Attackers Target 900,000 WordPress Sites in a Week

Threat intelligence team from security firm Wordfence discovered a Cross-Site Request Forgery (CSRF) to Stored Cross-Site Scripting (XSS) vulnerability in Contact Form 7 Style, a WordPress plugin installed on over 50,000 sites.

The vulnerability, with a CVSS Score: 8.8, could allow a remote hacker to inject malicious JavaScript on a site using the plugin. Upon successful exploitation, an attacker can trick the site’s admin into clicking on a malicious URL or attachment. The vulnerable plugin was temporarily removed from the repository after Wordfence reported the issue to the WordPress officials.

As the vulnerability remains unpatched, Wordfence said, “We strongly recommend deactivating and removing this plugin and finding a replacement as it no longer appears to be maintained by its developer.”

“This vulnerability can only be exploited if a user with administrative capabilities performs an action while authenticated to the vulnerable WordPress site. As a general recommendation, site administrators should always be alert when clicking on any links. If you feel you must click a link, we recommend using incognito windows when you are unsure about a link or attachment. This precaution can protect your site from being successfully exploited by this vulnerability along with all other CSRF vulnerabilities,” Wordfence added.

Contact Form 7 Style is used to add additional styles to forms created with Contact Form 7. It allows users to customize Cascading Style Sheets (CSS) code to customize the appearance of contact forms.

Wordfense researchers recommended users deactivate or remove the Contact Form 7 Style plugin until they find a replacement, as it appears the vulnerable plugin won’t be fixed soon.

700,000 WordPress Users at Risk

In a similar discovery, Wordfence found a zero-day vulnerability in the File Manager plugin, which could allow cybercriminals to execute arbitrary code on a WordPress site. The File Manager plugin is intended to help WordPress admins manage files on their websites. To read the full story, click here… 

Woodland Trust Hit by High-Level Cyberattack

initial access brokers

Woodland Trust, a charitable trust organization that protects and restores woodland in England, Scotland, Northern Ireland, and Wales, was hit by a sophisticated, high-level cyberattack in December 2020. Woodland Trust stated that unknown attackers illicitly obtained access to the charity’s IT systems. The organization temporarily disconnected all its systems to prevent any further unauthorized access after being hit by the security incident. While there is no information on what data has been accessed by the threat actors, Woodland Trust claimed that an investigation is ongoing to determine the data loss.

“We believe the incident took place after 7 pm on December 14, 2020. As soon as we became aware of the incident, we took immediate action to mitigate the impact, appointing a number of third-party experts including forensic IT specialists and legal counsel, to determine the nature of the criminal activity,” Woodland Trust said.

Woodland Trust reported the security incident to the Information Commissioner’s Office (ICO), the Charity Commission, and the Police department. Besides, the organization has notified its supporters and partners and assured to alert individuals whose information may have been impacted in the incident, as per GDPR guidelines.

“Investigations of this nature take time due to the complexity of the work being carried out. As soon as new information becomes available, we will of course share further updates with you. In the event of confirmed data loss, we will identify and inform those affected immediately, in accordance with GDPR. As a precaution, we are encouraging all our supporters to be mindful of any suspicious activity, especially unexpected emails or phone calls from unknown sources or purporting to come from your bank. Your bank can also help you to protect your account further,” Woodland Trust added.

“We believe there is a large opportunity in the digital identity and privilege management space”

In an exclusive interview with Brian Pereira of CISO MAG, Umesh Padval, Venture Partner at Thomvest Ventures shares his thoughts on the current and future state of cybersecurity from a VC perspective. He also tells us about the type of companies he would like to invest in during 2021, and the potential he sees in Indian companies. Thomvest has an extensive network of CIOs and CISOs and Umesh tells us what the C-suite is looking for in terms of cybersecurity skills and technical prowess.

Thomvest Ventures is based in San Francisco, California, and has invested in companies like Thousandeyes, Lastline, Shiftlift Inc., and more recently, in Harness.io.

Umesh has a keen insight as he has been actively investing in the cybersecurity and cloud infrastructure space over the last 5 – 7 years.

Umesh has served on over 30 public and private company boards, bringing extensive operating experience and skill set valued by CEOs and founders. He currently serves as a Board Member at Avalanche Technology, Bolster, ShiftLeft, and Tactus Technology and Impinj (public company), and as a Board Observer at Clari and ShieldX. He is also an investor in Baffle and Harness.

Prior to joining Thomvest, Umesh was a successful entrepreneur, investor, and CEO of a public company. He most recently worked for over eight years at Bessemer Venture Partners in their Menlo Park offices. Prior to Bessemer, he was an Executive Vice President at LSI after its acquisition of a public video infrastructure and distribution company in C-Cube Microsystems, where he served as President and CEO.

BP: With increased cybersecurity incidents last year, demand for cybersecurity professionals soared. And the valuation of cybersecurity companies, especially startups, should have skyrocketed. But why did investors, particularly for early-stage, hold back?

Umesh: Venture investments in cybersecurity and cloud Infrastructure accelerated in the second half of 2020, across all stages and exits. This was driven by the increase of remote work during the COVID-19 pandemic. Remote work forced enterprises to accelerate their already in-progress transition to the cloud and digitization. The first half of 2020 started off well, but as the pandemic hit in late February and early March, investors became very cautious as to its impact on companies and paused their investments — or even bailed out of committed investments.

We, just like other venture firms, assessed the impact first on our existing portfolio companies. We took appropriate actions to react to the impact of the pandemic over the first 3 to 4 months and made sure they were well-funded so that they would come out stronger post-pandemic. As we got comfortable with our existing portfolio companies, we began focusing on new early-stage investments. One obstacle we had to overcome was becoming comfortable investing in startups over Zoom meetings, without a single in-person meeting. In-person meetings have always been key for fully evaluating a team. Over time, we got comfortable and started investing again. As you saw, there was a massive amount of capital invested in all stages of private companies, and many were sold or went public. Overall, the 1H20 investments were lower due to the pandemic, but then accelerated in 2H20 with a vengeance.

BP: Companies accelerated their digital transformation plans during the pandemic, as business models changed, and supply chains were disrupted. While many rushed to adopt cloud, it threw up new cloud security issues. This was attributed to misconfigurations, over or under-provisioning. Analysts say that there will be a recalibration this year. What do you think will happen on the cloud security front? How will technology like secure containers, threat intelligence, and AI help?

Umesh: The move to the cloud happened overnight when employees started working from home. The only way remote work would “work” was to adopt cloud-based tech versus on-premise infrastructure. When that happened, CIOs and CISOs had to suddenly deal with all kinds of security issues and policies, which they had not planned for. This opened up massive opportunities for bad actors to infiltrate enterprises demanding ransomware or accessing large amounts of sensitive data.

The most infamous one was the SolarWinds hack in December — the impact of which we will not know for many months to come. However, CISOs across all sectors have had almost a year to develop cybersecurity strategies to make the enterprises secure and safe. This accelerated the adoption of new platforms from cybersecurity and cloud infrastructure companies with increased cybersecurity spend. It was a major boom to innovative companies in this space, and many of our portfolio companies benefited from this.

Looking into 2021, this trend will continue and perhaps accelerate. The adoption of containers driven by Kubernetes and container security, all workload protection in the hybrid and multi-cloud environment, the digital identity and privilege management platforms, and the governance and compliance platforms driven by privacy issues will accelerate in 2021. ML/AI has become a major horizontal technology used by all technology companies in every vertical to increase the productivity and efficiencies of businesses and will continue for a long time.

BP: What types of startups do you want to invest in this year? What kind of security technology and skills are you looking for in these companies?

Umesh: In the cloud infrastructure space, we are focused on software development platforms. There are over 25 million software developers around the globe developing and releasing multiple software releases a day, compared to one or two releases per year, 10 years ago. This is in response to their customers’ desire for more features and capabilities. This acceleration provides a massive opportunity for companies to automate the software development process, to allow creative developers to release their products faster.

In January 2021, we invested in Harness.io which is a market leader in providing the best in class rapid automated software delivery (CI/CD) platform via integration with best in class tools. Another company in our portfolio, Shiftleft Inc., integrates security into this DevOps automation platform, enabling software developers to secure the code in their development and release process. We will continue to look at more opportunities in this space.

We also believe there is a large opportunity in the digital identity and privilege management space for hybrid and multi-cloud environments. The use of APIs has skyrocketed, especially in the API security space. We are so excited that Thomvest has been focused on cybersecurity and cloud infrastructure space over the last 5–7 years, which provides tremendous opportunities to invest in companies.

BP: As you interact with CISOs, what are the security skills they look for when hiring staff?

Umesh: We have an extensive network of advisor CIOs and CISOs who are looking at two things:

  1. People with the right cybersecurity skillset. But that pool of talent is very small relative to the needs in the market. The best way to address that problem is using the latest cybersecurity platforms to automate as much vulnerability management on the secondary security alert and complement it with the scarce security analysts’ talent to identify and proactively fix the most critical high priority alerts in the enterprises.
  2. Long term, we need colleges and universities to focus on educating and graduating new security talent to help fill the void for small and large companies. Secondly, companies need to implement formal training programs to continue to educate and train their talented employees as the sector continues to evolve on a daily basis.

BP: Why do we see security startups flourishing in pockets like Israel?  What drives such communities?

Umesh: Israel is second only to the Bay Area for security talent and startups. Most of these entrepreneurs in Israel come from the Israeli Defense Forces, which has developed many sophisticated cybersecurity platforms for its defense industry. The mandatory military service for all Israeli residents has created a well-trained cybersecurity workforce. Combined with an incredible entrepreneurial culture and the “can do” attitude of the people, Israel has created amazing cybersecurity companies. As more and more companies exit over time, there will continue to be a large pool of security talent in Israel over the years. This talent, along with entrepreneurial risk and venture capital available in Israel, is why they are and will be a global force in cybersecurity.

BP: What about India? Do you see promising cybersecurity startups here? Can you comment on local talent?

Umesh: With over a billion people, India is very promising. The country’s cultural focus on education, combined with high-quality engineering schools like the IITs around the country, has educated a massive workforce of software and hardware professionals. They are a global force in software and technology development for enterprise software and have an entrepreneurial risk-taking culture as well. There are many CEOs at top cybersecurity and software companies in the U.S. who are of Indian origin and act as mentors. However, India does not yet have the DNA for cybersecurity and a skilled workforce to create a critical mass of talented entrepreneurs in cybersecurity. As more and more security companies open small offices and development centers in India, we see a bright future for cybersecurity startups in the next 3–5 years.

BP: What are the risks you see in cybersecurity startups and what kind of startups do you avoid?

Umesh: The cybersecurity market is massive and competitive; there are over 1,500 companies and over 18 subsegments in this space. Expect a few companies in each of the subsegments to break out and have a massive exit. The rest will either not succeed or will be sold for low to modest value. We look at companies with successful repeat or amazing new founders solving a major CISO pain point in a large market. But when you invest early in startups, it is all about team, team, team!

Brian PereiraAbout the Author

Brian Pereira is the Editor-in-Chief of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

References:

Securing Bytes to Prevent Bites in the Enterprise Network

4 in 10 Companies Expose Unsafe Network Services Online, network and security

Today, everywhere you turn, there are warnings about the surge in cybercrimes, as miscreants take advantage of the globe’s newfound dependence on the virtual world. This has also drawn attention to the breeding ground of cybercrime – the dark web. A haven for communication and exchange between cybercriminals, the dark web is easily accessible and owing to anonymization and digital currencies, a full-fledged economy is now looming on a global scale, right under the nose of law enforcement agencies.

By Sridhar S, Head of Managed Cloud and Security Services, Tata Communications

If you looked closer, this digital black market devotes a good chunk to trading stolen enterprise, financial, and personal information. Recently, a cloud-based instant messaging service provider became a victim of one such attack. The leaked data, which included personal information like user identities, phone numbers, and e-mail IDs, was eventually discovered on the dark web with most of it belonging to large enterprises, whose annual incomes run into hundreds of millions of dollars.

The ongoing and ever-shifting threat environment necessitates real-time monitoring and exposure scanning on the dark web for data leakage and attack anticipation, which can help an organization identify, assess, monitor, and respond to cyberthreats posted on the unregulated part of the internet.

But the bigger question here is that with employees across the world still working from home, how can enterprises mitigate security lapses on the network perimeter? Given the dark web’s sophisticated privacy and encryption techniques, traditional cybersecurity measures cannot promise substantial cyber safety. Consequently, enterprises must rethink their remote working solutions and implement better security controls and more stringent policies. For instance, putting in place zero-trust solutions can help them leverage micro-segmentation and limit remote users’ access to enterprise data based on their locations and other credentials. However, to do this, the zero-trust model relies on technologies, such as orchestration and multi-factor authentication. While multi-factor authentication can add extra layers of security and prevent cybercriminals from breaking into the enterprise’s network and stealing confidential data, orchestration is focused on integrating security tools and systems into an automated workflow. These automation tools issue an alert when new and relevant information emerges on the dark web, enabling the organization to determine which instance requires escalation and investigation. Further, automation tools can also help businesses to understand emerging malware and accordingly develop cybersecurity technology stacks.

Additionally, emerging machine learning and data analytics tools can also become strong weapons to provide early warnings on threats by enabling cyber-threat intelligence, which integrates a combination of open source and commercial threat providers.

However, as we look at the post-COVID-19 scenario, we can only expect digitization to grow dramatically across the globe, especially in India. This in turn will increase demand for cybersecurity and privacy regulations, which can play a critical role in creating a culture of compliance, addressing the current gaps, and providing a strong framework to handle issues related to cybersecurity. Along these lines, the Government of India has envisioned the National Cyber Security Strategy 2020, to focus on all areas of cybersecurity through its three key pillars – secure, strengthen, and synergize. Further, the Government of India has also initiated the setting up of the National Cyber Coordination Centre (NCCC) to generate awareness on potential threats on the dark web and other cybersecurity risks.

While the reality of the dark web can be unsettling, even scary, the security community must rethink its approach and come together to deal with cybercrime. Though endpoint protection can help to an extent, understanding the dynamic and nonlinear network mechanics can help disrupt the supply chain of tools between criminal groups. Until then, enterprises need to continually access the value of their confidential data and prepare their defense cybersecurity strategies accordingly.

About the Author

Sridhar S. heads the Managed Services businesses of Cloud, Hosting and Security for Tata Communications. He has been in the IT industry for nearly 30 years and has held several leadership roles in blue-chip companies such as Dell, IBM, Intel, and HCL, working across markets such as India, Asia, and the U.S. He is based in Bangalore, India.

DISCLAIMER

Views expressed in this article are personal. The facts, opinions, and language in the article do not necessarily reflect the views of CISO MAG.

Read Sridhar’s interview here.

 

Fortinet Fixes Four Critical Vulnerabilities in FortiWeb

Vulnerabilties

Fortinet, a cybersecurity solutions provider, has addressed four critical vulnerabilities in its FortiWeb web application firewalls. Tracked as CVE-2020-29015, CVE-2020-29016, CVE-2020-29019, and CVE-2020-29018, the vulnerabilities were discovered by Andrey Medov, a security researcher from Positive Technologies.

Vulnerability Details

  1. CVE-2020-29015 – This vulnerability exists in a blind SQL injection in the user interface of FortiWeb. The flaw, with CVSS v3.1 score 6.4, allows an unauthenticated, remote attacker to execute arbitrary SQL queries or commands by sending a request with a crafted authorization header containing a malicious SQL statement.

Affected Products

  • FortiWeb versions 6.3.7 and below
  • FortiWeb versions 6.2.3 and below

Fix

  • Upgrade to FortiWeb versions 6.3.8 or above
  • Upgrade to FortiWeb versions 6.2.4 or above 
  1. CVE-2020-29016 – The stack-based buffer overflow vulnerability, with CVSS v3 score 6.4, exists in FortiWeb, which allows a remote attacker to overwrite the content of the stack and potentially execute arbitrary code by sending a crafted request with a large certname.

Affected Products

  • FortiWeb versions 6.3.5 and below
  • FortiWeb versions 6.2.3 and below

Fix

  • Upgrade to FortiWeb versions 6.3.6 or above
  • Upgrade to FortiWeb versions 6.2.4 or above
  1. CVE-2020-29018 – A format string vulnerability, with CVSS v3 score 5.3, in FortiWeb allows a hacker to read the content of memory and retrieve sensitive data via the redir parameter.

 Affected Products

  • FortiWeb versions 6.3.5 and below

Fix

  • Upgrade to FortiWeb versions 6.3.6 or above
  1. CVE-2020-29019 – This is also a stack-based buffer overflow vulnerability in FortiWeb. The flaw, with CVSS v3 score 6.4, allows a remote hacker to crash the httpd daemon thread by sending a request with a crafted cookie header.

Affected Products

  • FortiWeb versions 6.3.7 and below
  • FortiWeb versions 6.2.3 and below

Fix

  • Upgrade to FortiWeb versions 6.3.8 or above
  • Upgrade to FortiWeb versions 6.2.4 or above

Fortinet issued fixes for all the vulnerabilities and urged users to install updates as soon as possible.

“The most dangerous of these four vulnerabilities are the SQL Injection (CVE-2020-29015) and Buffer Overflow (CVE-2020-29016) as their exploitation does not require authorization. The first allows you to obtain the hash of the system administrator account due to excessive DBMS user privileges, which gives you access to the API without decrypting the hash value. The second one allows arbitrary code execution. Additionally, the format string vulnerability (CVE-2020-29018) also may allow code execution, but its exploitation requires authorization,” said Medov.

Meet Kevin Fu – The FDA’s First Acting Director of Medical Device Cybersecurity

Kevin Fu

In December 2020, we reported a data leak that potentially exposed 45 million unique medical images due to unprotected servers. It exposed the increasing vulnerability of the health care industry towards the ever-rising cyberthreats. However, the U.S. Food and Drug Administration (FDA) has always been proactive in warning the health care sector about the potential threats in the past. Keeping up with their relentless pursuit of providing the best security standards to medical device manufacturers and owners alike, the FDA has now appointed Kevin Fu as the first acting director of medical device cybersecurity at its Center for Devices and Radiological Health.

Related News:

FDA Reveals Potential Vulnerabilities in Certain Medical Devices

More About the First Director

Kevin Fu has been an associate professor of electrical engineering and computer science at the University of Michigan since 2013. He also wears a badge of honor for being the Dwight E. Harken Memorial Lecturer and the founder of the Archimedes Center for Medical Device Security in his career, which spans over more than 20 years.

Fu has always been an advocate of bridging the gap between medicine and computer technology. He believes that the marriage of these two fields is inadvertent in today’s digital world. Looking at his resume and expertise in the associated field of medical device security, it is obvious why he is the most suitable candidate for the job. However, there was one more thing that could have added as brownie points in his selection – his stint as the Federal Advisory Board Member who advised the National Institute of Standards and Technology (NIST).

Fu worked for four years (from 2011 – 2015) with NIST and advised them, the Secretary of Commerce, and the Director of the Office of Management and Budget, on information security and privacy issues about the federal government’s information systems. His responsibilities included a thorough review of proposed standards and guidelines developed by NIST and annually addressing the congress about his findings.

Naturally, his experience of how government policies and agencies work, made him a perfect fit for the position.

Fu’s Immediate Plan of Action

In comparison to a decade ago, today’s medical devices are heavily dependent on computer software. However, Fu states that changing legacy device software is a huge task. And this is what the threat actors seem to be exploiting, as was evident in the recent spate of ransomware attacks on hundreds of hospitals. Thus, keeping the medical devices safe despite the growing cybersecurity risks is Fu’s top priority.

Fu, in an interview for his University’s publication, discussed the importance of building cybersecurity into the design of medical devices itself. He finds it amusing that legal experts, engineers, patients, and clinicians, are all considered as stakeholders, but “there simply is no software security expert at the table.”

Fu also highlighted the importance of imparting security training to manufacturers of both IoT and medical devices. He said, “We are not providing the necessary level of security engineering training that companies need. Right now, though, I’m focused on medical device safety. I’m really looking forward to working at the FDA to help build public trust in the safety and effectiveness of medical devices despite the inherent cybersecurity risks.”

During his 12-month long appointment as the director, Fu shall retain his other positions and appointments, including his work at the University of Michigan.

Related News:

45 Mn Unique Medical Images Exposed Online via Unprotected Servers

Scammers Use Bots and Automation to Make Cyberattacks Effective

Cloud Security

Since organizations are working remotely, most IT and cloud security professionals globally are concerned about their cloud environment’s security. Besides, the security vulnerabilities created during the adoption of new access policies, networks, and devices used for managing cloud infrastructure remotely became a challenge for many organizations. Alternatively, cybercriminals too changed their attacking vectors by leveraging botnets and automation techniques to exploit victims’ cloud environments.

According to a report from Barracuda, a provider of cloud-enabled security solutions, threats actors are shifting to bots and automated attacks to evade threat detection tools.  Barracuda researchers analyzed a sample of global data on web application attacks and found a surprisingly high number of automated attacks reported across the world, especially in Asia-Pacific.

In automated attacks, cybercriminals use bots to exploit vulnerabilities in web applications. They often send web or mobile requests to the targets to perform malicious operations like sensitive data theft, compromise users’ login credentials, automated password reset, and account takeover attempts.

“These kinds of attacks are often used to retrieve sensitive data, and Barracuda researchers noted an overwhelming number of exfiltration attempts focused on stealing credit card numbers, with Visa being the clear focus, accounting for more than three-quarters of these attacks,” Barracuda said.

According to Barracuda, the top attack vectors that are deployed using automated tools include fuzzing attacks, injection attacks, fake bots, application distributed denial-of-service (DDoS), and blocked bots.

Fuzzing attacks, which use automation to break into applications, accounted for nearly 20% of attacks, followed by injection attacks at 12%, which sees hackers using automated tools like SQL map to access applications. Bots, pretending to be a Google bot or similar, also stood at 12%. Application DDoS attacks made up more than 9% of the sample across all geographies, followed by bots blocked by site admins, which accounted for just under 2%.

“Automated tools continue to advance in their level of sophistication, allowing even the most unsophisticated hacker with a convenient way to successfully steal valuable data from unsuspecting users. Our research shows that these attacks can take many forms, making it crucial to invest in a cloud-based solution that offers total application security to find and remediate vulnerabilities automatically. This, coupled with the right cyber awareness training for your team, will give you the best possible chance of staying protected against these evolving threats,” said Mark Lukie, Engineer Manager, Barracuda, Asia-Pacific.

NCIJTF Releases Ransomware Fact Sheet for Public Awareness

Ransomware attacks, ransomware, Sinclair Broadcast group

The U.S. National Cyber Investigative Joint Task Force (NCIJTF) published a new ransomware fact sheet intending to spread public awareness on the ransomware threat landscape. The fact sheet details the critical information on the current ransomware threat scenario and the government’s response to it. Besides, the sheet describes the common infection vectors, tools for attack prevention, and the contacts in the event of a ransomware attack.

The NCIJTF is responsible for coordinating, integrating, and sharing information in support of cyberthreat investigations, supporting intelligence analysis for community decision-makers, and providing value to other ongoing efforts in the fight against cyberthreats to the nation.

NCIJTF estimated that victims paid over $144.35 million in Bitcoin as ransom between 2013 and 2019.  While ransomware attacks can impact any business in any sector, the FBI is particularly concerned about attacks on the networks of police and fire departments, state, local, territorial governments, municipalities, hospitals, and other critical infrastructure. “These types of attacks can delay first responders in responding to emergencies or prevent a hospital from accessing lifesaving equipment. It is imperative these organizations be prepared in the face of the ransomware threat,” the FBI said.

Common Ransomware Attack Vectors

Though ransomware operators leverage various attack methods to spread malware, the most common attack vectors include:

  • Email Phishing Campaigns
  • Exploiting Remote Desktop Protocol (RDP) Flaws
  • Misusing Software Vulnerabilities

How to Minimize Ransomware Risks

  • Backup your data, system images, and configurations Test your backups and keep the backups offline.
  • Enable multi-factor authentication.
  • Update and patch systems.
  • Make sure your security solutions are up to date.
  • Review and exercise your incident response plan.

NCIJTF advised the victims of ransomware attacks to file a complaint with Law Enforcement Authority or report the incident to the Internet Crime Complaint Center (IC3) or the Cybersecurity and Infrastructure Security Agency (CISA).

DriveSure Suffers Data Breach, Users’ Data Leaked on “Raidforums”

zero-day vulnerabilities

Adversaries posted sensitive information of 3.2 million DriveSure users on the underground hacking forum – Raidforums. Dubbed “pompompurin,” the hacker group advertised the leaked files and user data in a post, as proof of compromise. DriveSure is a car dealership service provider focused on employee training programs, customer retention, and maintains client data in large quantity.

According to Risk Based Security, the exposed information included full names, full addresses, contact details, email address, hashed passwords, car model, VINs, records of how much they paid for service, warranty status, emails to customers, texts sent to customers, IP addresses, damage claims, survey responses, logs of edits to customers, and current status of the car.

Hackers dumped two databases that hosted sensitive data of DriveSure users. One database has over 22 GB of the company’s MySQL files, which detailed dealer and inventory information, sales data, reports, claims, and customer data. The second compromised database contained 11,474 files in 105 folders and is 5.93 GB in size in their “parserfiles” s3 bucket.

The Impact

The exposure of sensitive data may bring severe consequences to the users whose data was affected in the incident. Cybercriminals can easily misuse users’ information for personal gains.

“The information leaked in these databases is prime for exploitation by threat actors, and in particular for insurance scams. Criminals can use personally identifiable information, damage claims, extended car details, and dealer and warranty information to target insurance companies and policyholders. Moreover, user credentials are used by threat actors to break into other valuable platforms such as bank accounts, personal email accounts, and corporate systems. The diverse set of user data can also be used to guess, and crack security questions often used by companies to reset passwords. Commercial email addresses can even be targets for spear-phishing or extortion,” Risk Based Security said.

1...119120121...410Page 120 of 410