Home Blog Page 136

Theresa Payton is CISO MAG Cybersecurity Crusader of the Year (2020)

The CISO MAG Cybersecurity Crusader of the Year recognition honors the most influential personalities in cybersecurity. They have, over the years, been committed to bringing awareness into the realm of cybersecurity – to whom the information security industry is profoundly indebted. The parameters of selection include experience, contribution to industry, spreading cybersecurity awareness, authorship, speaking roles, awards & recognitions, influencer status, and patents.

Theresa Payton remains the cybersecurity and intelligence operations expert that people and companies turn to regard efforts to strengthen their privacy and cybersecurity. She is one of America’s most respected authorities on security and intelligence operations.

As the first female to serve as White House Chief Information Officer, Payton oversaw IT operations for the President and his staff from 2006 to 2008. Previously, she held executive roles in banking technology at Bank of America and Wells Fargo, facilitating her broad knowledge of cybersecurity risks and measures in the financial services industry. Currently, as the founder, president, and CEO of a world-class cybersecurity consulting company, Fortalice Solutions, LLC, and co-Founder of Dark3, a cybersecurity product company, she remains the expert that organizations call for discretion and help to understand and improving their IT systems.

Payton collaborated with cybersecurity and privacy attorney, Ted Claypoole, to author two books focused on helping others learn how to protect their privacy online, after receiving a number of pleas from friends and strangers regarding account hacking. Hailed as must-reads, “Privacy in the Age of Big Data” and “Protecting Your Internet Identity: Are You Naked Online?” outline peoples’ rights, as well as tips and strategies for building and maintaining a positive online image. Jon Stewart had Payton on The Daily Show to discuss her book and the emerging threats to our privacy and security.

Payton is often sought out by media news outlets to explain complex security issues in business and consumer terms to get behind the hype to understand, in layman’s terms, how to protect your privacy and security. She has been a repeat guest on the Today Show, Good Morning America, Fox Business Shows, Fox News Shows, CBS Morning & Evening News, CNN, NBC News, MSNBC, and even news outlets in Canada and Ireland. Recognized as a 2015 William J. Clinton distinguished lecturer by the Clinton School of Public Service, Payton passionately protects her clients, from the board room to the server room, and helps them understand the business risks to their organization’s cybersecurity, and she and her team provide insight and methods critical to protecting people and organizations from rapidly evolving cyberattacks. She and the Fortalice team were recently named to the Top 5 Most Innovative Cybersecurity Companies in NoVa/MD/DC.

Our December issue on Endpoint Security is now live. Subscribe now!

Federated Learning Can Solve Security and Data Privacy Challenges: Intel Labs

Federated Learning, Intel Labs
Image Credit: Intel Labs

In many fields like medicine and financial services, the owners of data are bound by regulatory restrictions around data privacy. That can be a real inhibitor to bringing larger data sets together, which in turn limits how much we can learn from that data. To tackle these issues Intel Labs has been making advances in Confidential Computing and Federated Learning.

By Brian Pereira, Principal Editor, CISO MAG

Speaking at Intel Labs Day on December 3, Jason Martin,  Principal Engineer, Secure Intelligence at Intel Labs, explained Intel’s Confidential Computing initiative.

“Today encryption is being used to protect data while it is being sent across the network and while it is stored. But data can still be vulnerable when it is being used. Confidential Computing allows data to be protected while in use,” said Martin.

There are three tenets to Intel Labs’  Confidential Computing:

  1. Data confidentiality –  to protect secrets from exposure.
  2. Execution integrity – to protect the computation from being changed.
  3. Attestation –  to verify the hardware and software are genuine, and not fake.

Trusted execution environments provide a mechanism to perform confidential computing. They’re designed to minimize the set of hardware and software you need to trust to keep your data secure.

“To reduce the software that you must rely on, you need to ensure that other applications, or even the operating system, can’t compromise your data, even if malware is present. Think of it as a safe that protects your valuables even from an intruder in the building,” said Martin.

In the early 2000s Intel Labs began research in ways to isolate applications using a combination of hardware access control techniques and encryption in order to provide confidentiality and integrity. The latest example of putting the capabilities of confidentiality, integrity and attestation together, to protect data in use, is Intel Software Guard Extensions.

All this will protect data on a single computer.

But what if you have multiple systems and data sets and with different owners? How can we support multiple parties to collaborate in a secure way with their sensitive data?

This is where Federated Learning comes in.

RELATED STORY:

Google Cloud Levels-up Confidential Computing with Latest Updates

What is Federated Learning?

Martin explained: “In many industries such as retail, manufacturing, health care, and financial services, the largest data sets are locked up in what is called data silos. These data silos may exist to address privacy concerns or regulatory challenges, or in some cases, the data is just too large to move. However, these data silos create obstacles, when using machine learning tools to gain valuable insights from the data.”

Take medical imaging, for instance. Machine learning has made advances in identifying key patterns in MRIs such as the location of brain tumors. However, getting multiple entities to collaborate in the processing/computation of the data is an inhibiting factor, due to data privacy concerns. Patient data and medical records are protected by standards like HIPAA.

Intel Labs has been collaborating with the Center for Biomedical Image Computing and Analytics at the University of Pennsylvania Perelman School of Medicine (Penn Medicine) — on federated learning.

“In our federated tumor segmentation project, we are co-developing technology to train artificial intelligence models to identify brain tumors,” informed Martin.

Federated Learning
Image Credit: Intel Labs

With federated learning, Intel’s scientists can split the computations, such that each hospital trains the local version of the algorithm on their data at the hospital. And the hospitals can send what they learn to a central aggregator. This combines the models from each hospital into a single model without sharing the data.

However, this poses another challenge. When the computation is split in this manner, you increase the risk of tampering with the computation. To tackle this, each hospital uses confidential computing. This protects the confidentiality of the machine learning model. Intel Labs and the hospitals also use integrity and attestation, to ensure that the data and model are not manipulated at the hospital level.

Federated Learning
Image Credit: Intel Labs

Penn Medicine and Intel Labs published a paper on Federated Learning in the medical imaging domain. The study demonstrated that the federated learning method could train a deep learning model, with 99% accuracy of the same model trained with the traditional non-private method.

The combined research also showed that institutions did on average 17% better when trained in the federation, compared to training with their own validation data (2.6%).

Federated Learning
Image Credit: Intel Labs

Work on this continues and will eventually enable a federation of over 40 international health care and research institutions to collaborate on creating new state-of-the-art AI models, without sensitive patient data leaving the hospitals.

Keep track of Intel Labs’ progress on Federated Learning here: Intel Labs Day 2020 | Intel Newsroom

Brian Pereira

About the Author

Brian Pereira is the Principal Editor of CISO MAG. He has been writing on business technology concepts for the past 26 years and has achieved basic certifications in cloud computing (IBM) and cybersecurity (EC-Council).

 

Sodinokibi Rundown: What it is, why it’s a growing problem, and how to protect against it?

paying ransom, Conti Ransomware Attacks

Sodinokibi ransomware has been wreaking havoc across the globe, hitting high-profile targets like CTAG, one of Europe’s leading automotive research centers, and a housing association in the U.K. Sodinokibi ransomware is currently ranked as one of the most widely distributed ransomware strains worldwide making it a nightmare for the corporate sector.

By Jeff Stout, Chief of Operations, BeforeCrypt GmbH

So, what makes Sodinokibi so dangerous, and how can you protect yourself and your organization?

The Sodinokibi Threat 

Sodinokibi is one of the most common variants of ransomware used by the REvil ransomware gang. It’s especially dangerous because the gang is highly skilled at exfiltrating data which it uses to “double-extort” victims. Ordinary ransomware attacks only encrypt data, locking users out of their own system, and forcing them to pay to regain access to their files.

Data exfiltration attacks collect sensitive data and then demand more money from victims to keep the data private. For some companies, particularly in the finance, legal and health sectors, leaking client data can cause a devastating blow to their reputation. When hackers obtain data, they threaten to publish it on the dark web. In this way, they can demand much larger ransoms.

For this reason, REvil intentionally targets businesses and organizations that are responsible for safeguarding important client data. A ransomware attack with data exfiltration can be more complicated to deal with than a normal encryption attack because of the legal implications of data breaches.

In recent months, Sodinokibi has become even more dangerous as it made the jump from Windows to Linux. Since most servers run on Linux, this means the virus is now even more capable of targeting large corporate or governmental networks.

REvil’s Modus Operandi

REvil is one of the most prolific ransomware gangs in the world. Part of the secret to their success is the use of affiliates to shield themselves. They develop sophisticated ransomware software and then license it out to other criminals in exchange for a percentage of the profits. This approach is termed “ransomware-as-a-service” (RaaS). Some of these affiliates have been arrested, but it doesn’t appear to have any effect on the core gang, which simply recruits new affiliates.

Many experts believe that Sodinokibi was designed by the same hackers who developed GandCrab, Sodinokibi’s predecessor, which collected over $2 billion in ransoms before its retirement.

Since the developers of the software don’t conduct the attacks themselves, they are able to specialize and develop more advanced viruses that are more difficult to detect and can circumvent antivirus software. Sodinokibi is one of the most effective ransomware in terms of data exfiltration; it’s estimated that over 50% of Sodinokibi attacks lead to data exfiltration.

How Sodinokibi attacks happen, and how to protect against them?

The majority of Sodinokibi attacks are highly targeted in nature. Jeff Stout, a ransomware expert at BeforeCrypt, a firm specializing in ransomware recovery and decryption, says that in most cases, Sodinkobi infiltration occurs via phishing.

“Our case data shows that less than 20% of Sodinokibi cases involve random brute force attacks against vectors such as RDP, with the vast majority of attacks being highly targeted and perpetuated as part of sophisticated spear-phishing attacks employing exploits with various characteristics.”

Spear phishing attacks are becoming more sophisticated all the time, and hackers are increasingly known to effectively impersonate trusted businesses, partners, or even family and friends in order to trick victims into clicking malicious links.

The risk of these attacks can also be reduced substantially by adopting strict guidelines to ensure that employees don’t do any personal communications on work computers or networks. Social media giant Twitter was recently hit by a spear-phishing attack that infiltrated the network by targeting employees’ phones. Similar attacks have hit dozens of other companies since.

Training employees to carefully verify all links and downloads before clicking on them is a good start, but a highly effective ransomware prevention strategy may even require some level of structural reorganization. For example, many targeted attacks will attempt to trick dozens of employees before one falls for it, so by adding tiers of access levels to networks and limiting the number of employees with the access necessary to mount an attack, it’s possible to lower the chances of a successful attack.

Of course, there are still a small number of Sodinokibi attacks that utilize conventional exploits. This risk can be minimized by normal countermeasures, like strong antivirus software, regularly updating all software, and keeping up to date with exploit databases.

What to do if you get hit?

There is no easy way out of a Sodinokibi attack. Like most ransomware, Sodinokibi uses military-grade encryption, so there are no free Sodinokibi decryption tools. It’s a bitter pill to swallow, but the reason many organizations pay ransoms is nothing more than an economic decision; if the cost of the ransom is less than the cost of the data loss that would result from not paying it, it just makes sense to pay it. However, paying ransoms empower the hackers who deploy them, so if a company can handle a loss it’s a more responsible decision to take their losses and start from scratch.

Paying a ransom is not as simple as it might sound, however. Ransomware gangs using Sodinokibi will often demand a first ransom to decrypt the data and restore access to a network and then ask for a second ransom to keep the data private. In some cases, attackers will demand a third ransom even after the second one. For this reason, experts track the behavior of individual gangs in order to know what to expect and how to best deal with them.

Contracting a ransomware incident response team can be worthwhile, as specialists have a good idea of what to expect from different gangs. This makes it easier to calculate the real cost of the attack and make a more informed decision about whether or not paying the ransom is the most economical decision.

When will it end?

Unfortunately, it appears that dealing with ransomware, as well as the data exfiltration threat, may become the new normal. Both GandCrab and Sodinokibi were designed with code embedded which prevents them from infecting computers in Russia, Iran, and former Soviet countries. This indicates that the hackers may be operating with the approval of a government in that region.

Since the criminals behind it may have some level of state protection, it is very difficult to bring them to justice. This means organizations of all shapes and sizes must devote more time and resources to their cybersecurity training, especially when it comes to employee training and awareness. This means increased cybersecurity budgets are needed, but the longer the ransomware epidemic continues, the clearer it becomes that these costs are insignificant compared to the costs of falling victim to ransomware extortion.

SPECIAL FEATURES

Disclaimer

CISO MAG did not evaluate the advertised/mentioned product, service, or company, nor does it endorse any of the claims made by the advertisement/writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same.

Supply Chain Security Takes Center Stage in Dell’s Latest Offering

Supply chain

Dell is known to deliver innovative and extremely critical solutions to the world. Continuing this tradition, on December 3, 2020, Dell introduced a new set of security offerings to mainly strengthen its supply chain security product suite. It includes SafeSupply Chain Tamper Evident Services and SafeSupply Chain Data Sanitization Services.

SafeSupply Chain Tamper Evident Services adds tamper-evident seals that ensure the integrity of a device during transport. This enables the receiver to know if any modifications were made to the device during transit — for extra security, customers can also request pallet seals.

Similarly, SafeSupply Chain Data Sanitization Services enable organizations to perform a hard drive wipe before installing their images on the drive. With this, they can be sure that there is no spyware or other malware on the device.

Additionally, Dell also announced that its EMC PowerEdge server portfolio will now be laced with Secured Component Verification. This is an embedded certificate that allows companies to verify whether their servers have arrived as they were ordered and built – without any hardware compromise. When it comes to boot security for PowerEdge customers, Dell said that they can now customize the boot process on their servers to trim down the attack surface. This capability is called PowerEdge UEFI Secure Boot Customization.

As an add-on feature, Dell has also integrated Dell Remote Access Controller (iDRAC) for PowerEdge servers. This gives its users the power to enable or disable a system lockdown without needing to do a reboot, thus, preventing inadvertent or malicious modifications to firmware or configuration data. To beef up the security of iDRAC Dell has also provided multi-factor authentication (MFA) to it.

The tech giant has already rolled out most of its offerings, however, iDRAC security updates will be available by year-end.

Related News:

Update Now! Dell EMC Releases Patch for iDRAC Path Traversal Vulnerability

Lazarus Strikes Again, Attacks Supply Chain in South Korea

Diversify Your Supply Chain to Survive Pandemics, says Deutsche Telekom CSO

4 Times Data Regulators Slapped High Penalties in 2020

France Fines Facebook and Google,Russia fines Google, Meta heavily New York City Law Department Hit by a Cyberattack

Apart from information leaks and reputation damage, data breaches cause a huge financial impact on organizations globally. Ever since the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) came into effect, data regulators got stringent about organizations that are not serious about their consumer data protection.

By Rudra Srinivas, Feature Writer, CISO MAG

A recent survey on the financial impact of data breaches on organizations revealed that security incidents cost $3.86 million per breach on average for companies. It is found that around 80% of security incidents resulted in the exposure of customers’ personally identifiable information (PII), which in turn led to huge losses for businesses.

Various organizations have been slammed with sizable fines and settlements for data breaches or misusing customers’ information. The year 2020 has witnessed a significant number of organizations that settled their long-awaited class-action lawsuits. These include:

1. Hanna Andersson

U.S.-based kids wear retailer Hanna Andersson recently agreed to pay $400,000 to settle a data breach lawsuit related to the California Consumer Privacy Act (CCPA). The lawsuit claimed that Hanna Andersson and its third-party vendor Salesforce violated the CCPA by exposing customers’ personally identifiable information (PII) in a 2019 data breach. Unknown threat actors compromised Hanna’s retail website in December 2019. The attackers stole credit card details, including customer name, payment card number, CVV code, expiration date — along with billing and shipping addresses from the checkout and payment page of the online portal.

The class-action lawsuit, which is the first monetary settlement under CCPA, was filed in the U.S. District Court for the Northern District of California in February 2020. As per the settlement, more than 200,000 U.S. customers, who made purchases from the Hanna Andersson online store from September 16 to November 11, 2019, will receive $500 to $5,000 compensation.

2. Home Depot

The popular U.S. home improvement retailer Home Depot Inc. recently agreed to pay $17.5 million to settle a multistate investigation related to a data breach, which occurred between April 10, 2014, and September 13, 2014. The threat actors illicitly accessed the payment card details of 40 million customers. Cybercriminals misused a vendor’s username and password to break into Home Depot’s network and install a malicious code to obtain customers’ payment card data. The breach affected the customers who used self-checkout terminals of Home Depot stores across the U.S. and Canada. It is also estimated to have affected over 52 million customers’ data.

3. Anthem

Health insurer Anthem committed to pay $39.5 million to resolve a class-action suit related to a cyberattack in 2015 that exposed the personal data of nearly 79 million people. The settlement is related to an investigation brought by the U.S. states’ attorneys general, including New York, Indiana, Connecticut, Illinois, Kentucky, Massachusetts, and Missouri. The cyberattack, which, in its time, was considered one of the biggest cybersecurity attacks the nation had ever witnessed, had compromised users’ names, addresses, social security numbers, and medical identification numbers. Anthem also agreed to enhance its ongoing data protection measures.

4. Equifax

Atlanta-based consumer credit reporting agency Equifax settled multiple class-action lawsuits this year. In January 2020, the company agreed to pay $380.5 million to resolve a lawsuit, brought forward by the U.S. Federal Trade Commission (FTC), relating to a 2017 data breach that leaked a massive amount of information about more than 147 million people in the U.S. alone. Despite knowing the breach on July 29, 2017, Equifax waited nearly six weeks to disclose the incident to its consumers and investors, after hackers exfiltrated data for 76 days. The class-action members can withdraw up to $20,000 as compensation along with ten years of free credit monitoring services from Equifax.

In April 2020, Equifax resolved another lawsuit with the State of Indiana in a $19.5 million settlement, brought forward by the State’s Attorney General Curtis Hill. The lawsuit concerns the same 2017 data breach that also leaked 3.9 million Indiana residents’ personal information. The lawsuit claimed that Equifax failed to protect its residents’ social security numbers and other private information. As per the settlement, Equifax is also required to correct Indiana’s security deficiencies and safeguard consumer information in the future. Multiple organizations are making the headlines for weakly protected enterprise networks and poor handling of data breaches. It’s high time organizations take information security and compliance very seriously and have strict access controls on the data, or we may continue to see the number rising.

About the Author

 

Rudra Srinivas is a Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

Lisa Ventura is CISO MAG Infosec Superwoman of the Year (2020)

Infosec Superwoman of the Year

The CISO MAG Infosec Superwoman of the Year recognition honors the most influential women in cybersecurity. These are women who have, over the years, been committed to bringing awareness into the realm of cybersecurity – to whom the information security industry is profoundly indebted. The parameters of selection include experience, contribution to industry, spreading cybersecurity awareness, authorship, speaking roles, awards & recognitions, influencer status, and patents.

Lisa Ventura is an award-winning cybersecurity and content marketing consultant whose career spans over 23 years in PR marketing, technology, and cybersecurity. She entered the cybersecurity industry in 2009 when she became the Chief Operations Officer/PR & Marketing Director at Titania Ltd., a leading cybersecurity software development company in the U.K.

During her time at Titania, she saw the company grow from a tiny start-up to a successful small business with members of staff, offices, and a network of distributors and resellers globally.

Since her time at Titania, Lisa has utilized her expertise in cybersecurity in many other organizations including BT, and more recently as Cyber Security Awareness Professional.

Lisa is a published author and has recently contributed articles to Counter Terror Business Magazine, Europa Business Magazine, and the BPMA Magazine amongst others. Her book entitled “The Rise of the Cyber Women,” which is a collection of interviews and accounts from some of the most inspiring women in the cybersecurity industry today, was released in August 2020.

She also has other books in the pipeline including “Picking Apart The Threads: How One Docu-Film About Nuclear War Influenced a Cold-War Generation,” which was conceived through her strong interest in all things related to nuclear war.

As the Founder and CEO of the U.K. Cyber Security Association, Lisa is known for her expertise as a thought leader and commentator. The U.K. Cyber Security Association is a not-for-profit organization that raises awareness of the importance of cybersecurity for small businesses and SME’s and provides education on the growing cyberthreat to individuals and businesses. As a result of this work, Lisa is also in high demand as a speaker and panelist at various cybersecurity, technology, and IT conferences and events.

Neurodivergent and proud, Lisa is a strong advocate of all things related to neurodiversity since she was diagnosed as being #ActuallyAutistic in June 2018. She is also a strong supporter of promoting cybersecurity as a career path to those who are autistic and neurodivergent and is a mentor to those who are considering entering the cybersecurity and marketing industries. In addition, Lisa is a strong business mentor for Women in Business, Women in Cyber Security, Women in Tech, and more.

Our December issue on Endpoint Security is now live. Subscribe now!

 

FireEye Discloses Breach and Theft of its Red Team Tools

FireEye’s Red Team tools breach

Popular cybersecurity firm FireEye announced that it is a victim of a sophisticated state-sponsored cyberattack. In an official release, the company stated that the attacker compromised its Red Team software tools and accessed information from its internal systems. While there is no information on whether any customers’ data has been misused, the company stated that it is likely a government-backed cyber operation performed using new hacking techniques.

“A highly sophisticated state-sponsored adversary stole FireEye Red Team tools. Because we believe that an adversary possesses these tools, and we do not know whether the attacker intends to use the stolen tools themselves or publicly disclose them, FireEye is releasing hundreds of countermeasures to enable the broader security community to protect themselves against these tools,” FireEye said.

FireEye stated has incorporated certain countermeasures in its security products and shared the same with its partners and government agencies to prevent malicious actors from trying to exploit the Red Team tools.

What’s a Red Team?

A Red Team is a group of security experts who penetrate the network systems or exploit capabilities to test an enterprise’s security standards. The purpose of ​​this exercise is to determine potential vulnerabilities and find the organization’s abilities to prevent, detect, and respond to cyberattacks. The alternative to the Red Team experts is the Blue Team, a team of network defenders trying to protect the security perimeter of the organization.

Experts Tweet

“The Red Team tools stolen by the attacker did not contain zero-day exploits. The tools apply well-known and documented methods that are used by other red teams around the world. Although we do not believe that this theft will greatly advance the attacker’s overall capabilities, FireEye is doing everything it can to prevent such a scenario. It’s important to note that FireEye has not seen these tools disseminated or used by any adversaries, and we will continue to monitor for any such activity along with our security partners,” FireEye added.

From Data Leak to Dark Web: What Happens to Your Stolen Credit Card Data?

From Data Breach to Darknet

There might be various cybercriminal activities operating online, but stealing users’ sensitive information and peddling it on darknet markets is the primary activity for most threat actors. Cybercriminals focus more on pilfering financial data like credit and debit card details, bank account numbers, and login credentials. A recent survey revealed that the rate of cyberattacks in the financial industry increased exponentially. Nearly, 65% of major financial services organizations have suffered a cyberattack in the last 12 months.

This article explains how attackers obtain financial data, what happens to stolen data, and how do criminals sell stolen credit card details on the dark web.

By Rudra Srinivas, Feature Writer, CISO MAG

 How do Attackers Obtain Financial Data?

Usually, threat actors obtain credit card or payment information in two ways: after a data breach and/or via the e-skimming technique. Scammers pilfer sensitive data by exploiting a vulnerability/unsecured database containing valuable data. For instance, consider the Capital One data breach. Attackers exploited a specific configuration vulnerability in its digital infrastructure and allegedly accessed the data of over 100 million individuals in the U.S. and approximately six million in Canada.

In an e-skimming attack, also known as Web-skimming or Magecart attack, adversaries inject malicious JavaScript code into website payment processing pages to steal payment card details from customers. The malicious code then collects the payment info from users while making purchases on the infected site. Recently, Magecart operators compromised over 2,000 Magento online stores and stole tens of thousands of customers’ personal information. They injected malicious code on the website checkout pages to exfiltrate payment information.

What Happens to the Stolen Data?

Ever wondered where your stolen financial data is moved? Well, it is mostly misused by attackers for their criminal activities or it ends up on the dark web for sale. Cybercriminals often use the stolen financial data to make fraudulent purchases online or to compromise other accounts via credential stuffing attacks. Most scammers obtain credit card numbers and other financial data from various darknet forums.

An investigation from security research firm Cyble disclosed that threat actors kept details of 80,000 credit cards on the darknet forum for sale in exchange for cryptocurrency. It was found that the stolen credit card details include both Visa and MasterCard users from various countries, including 33,000 credit card details from the U.S.; 14,000 from France; 5,000 from the U.K.; 2,000 from Canada; 1,200 from Singapore; and 1,300 from India. The exposed information included cardholder name, CVV code, billing details, and expiration date, which were selling at $5 per card, paid in cryptocurrency.

How do Criminals Sell Stolen Credit Card Details on the Dark Web?

Cybercriminals trade their illicitly acquired data on various dark web/hacking forums by advertising or leaking a sample of the data to lure other malicious actors in the community. Recently, adversaries illicitly obtained over three million customers’ credit card information after compromising Dickey’s BBQ Pit Point-of-Sale (POS) systems in 156 restaurant locations. Attackers posted the stolen data for sale on Joker’s Stash, a dark web marketplace that exclusively trades stolen card data. The hackers’ group advertised a massive collection of payment card details for sale, dubbed “BLAZINGSUN,” at $17 per card.

Dark Web – The Hackers’ Paradise

From gamers’ cheat codes to users’ login credentials, everything is traded on darknet markets.  Several new cybersecurity scams and malicious activities originate from these underground forums. Threat actors discuss and share knowledge on new hacking techniques and tools. Some senior threat groups even provide tutorials and share their attacking procedures to the budding hackers.

What’s the Worth of Your Stolen Data?

The stolen information is usually sold in exchange for Bitcoins. In some cases, cybercriminals leak the data they obtain on the dark web for free to threaten the victims in case they don’t receive the demanded ransom.

According to a recent investigation from Privacy Affairs, stolen users’ personal information like credit card details, online banking credentials, and social media logins are put up for sale on several darknet forums at low prices. Forged documents including passports, driving licenses, and auto-insurance cards are also available on these platforms. While online banking credentials cost an average of $35 on the dark web, credit card details including associated data are available for $12 to $20, respectively. Forged or counterfeit documents can be obtained for $1,500.

About the Author

 

Rudra Srinivas is a Feature Writer and part of the editorial team at CISO MAG. He writes news and feature stories on cybersecurity trends.

 

 

Barracuda Alerts APAC Holiday Shoppers of Possible Bot Attacks

bot attack, Google recaptcha bypass

Christmas is around the corner and the festivities have just begun. In a year that was rather dull and marred with the COVID-19 pandemic, this season brings a breath of fresh air. Market experts believe the festive season is changing public sentiments and people are now spending positively. However, with social distancing and other stricter protocols in place, people are preferring online shopping now, more than ever. But this has its own issues. Enterprise cybersecurity provider, Barracuda, has warned APAC users of a substantial threat arising from bots that can run DDoS attacks while you shop online.

The Bad Bot Attacks

As part of their research activity and continuous analysis, Barracuda’s researchers ran their proprietary Bot Protection solution on a test web application. In just a few days, it detected millions of attacks coming from multiple IP addresses. The researchers said, “Attacks like these are often used to make fraudulent purchases while helping cybercriminals to scan for any vulnerabilities they can exploit.”

Known as the “bad bot personas,” these bots are malicious in nature and are grouped together by User-Agent. The trouble is, that some User-Agents include “good bots”. For example, GoogleBot. GoogleBot crawls sites and adds them to search rankings. It is highly difficult to differentiate between the two without deeper investigation, as bad bots will often spoof good User-Agents.

Another trait that Barracuda researchers observed was that these cybercriminals have “a regular working day.” Usually, bot attacks peak at midnight to avoid the human eye. However, in this case, their activity peaks late in the morning and does not go down until 5 p.m.

Image source: Barracuda

It’s clear that cybercriminals are powering up for the Christmas rush, so with holiday shopping season now in full swing across the region, it’s crucial that e-commerce teams take the appropriate steps to safeguard their applications against bad bots.

 

– Mark Lukie, Engineer Manager, Barracuda, APAC

The To-Do for Avoiding Bot Attacks

Researchers suggest that to protect yourself from such attacks, one should install properly configured web application firewalls or WAF-as-a-Service solutions. Additionally, the application security solutions must include anti-bot protection to effectively detect advanced automated attacks. Also, to prevent account takeover attacks, inclusion of credential stuffing protection is mandatory.

CISO MAG, in partnership with Rapid7, is hosting a virtual roundtable on Effective Security Incident Handling on December 15, 2020.
For more information visit: https://cisomag.com/cyber-security-webinars/ Register now!
1...135136137...410Page 136 of 410