Home Blog Page 197

Medfin Australia Reports Targeted Cyberattack

Remote Access Scams

Medfin Australia, a subsidiary of National Australia Bank (NAB), confirmed that they were targeted with a sophisticated cyberattack that was spotted on June 14, 2020. Although the attack could have been severe, however, no loss of customer data has been noted to date.

While acknowledging the cyberattack, Medfin’s CEO Paul Freeman said that the cyberattack by a malicious actor was identified and due to the proactive measures it was stopped instantaneously without affecting the business operations.

Medfin’s wide network, which is spread across various cities in the country including Sydney, Canberra, Melbourne, Brisbane, Adelaide, and Perth, along with its services to the healthcare industry and medical practitioners — makes it a vital supply chain in the nation’s critical infrastructure. Thus, the possibility of a state actor’s involvement in this cyberattack attempt cannot be ruled out.

The internal team of Medfin terminated this cyberattack and carried out a detailed investigation with the help of cybersecurity experts from NAB and the Australian Cyber Security Centre (ACSC) to know the extent of damages. On the question of why Medfin took so long to come out in open about the cyberattack, Mr. Freeman added, “We were completing a full and thorough investigation. We wanted to be sure that customer information is not being affected.” Medfin also confirmed that the cyberattack was limited to its own network and did not spread laterally into a third-party network.

Australia Under Constant Threat

Earlier, the Australian Prime Minister Scott Morrison briefed the nation about sustained cyberattacks carried out by a sophisticated state-sponsored actor. To fortify the cyberspace, the ACSC has been ever since taking countermeasures and giving advisories to businesses around the country to defend themselves from cyberattacks. In continuation, Australia has now decided to add yet another defensive shield in the cyberspace – the AUSHIELD.

Read more about the AUSHIELD platform here!

DDoS Attacks and Credential Abuse Doubling Year-on-Year: Akamai

DDoS Attacks

The key message that came through at the Akamai Edge Live APAC Virtual Summit 2020 on  July 2, 2020, was that the nature of cyberattacks on organizations was growing in scale and sophistication. And the only way to contain DDoS and other attacks and mitigate the impact was to opt for automation, sophisticated monitoring tools, and expertise provided by security operations centers (SOCs) and managed service providers (MSPs).

–Brian Pereira, Principal Editor, CISO MAG

Dr-Tom-Leighton_CEO-and-Co-Founider_Akama
Dr. Tom Leighton, CEO and Co-Founder, Akamai

Delivering the keynote, Dr. Tom Leighton, CEO and Co-Founder, Akamai, spoke about Internet security and some of the trends observed in the past few months.  Dr. Leighton said, “There is a lot of business disruption out there… companies are dealing with the new reality. There are workforces working remotely, people are unable to travel, and this is creating a lot of security concerns. The trends that we are seeing on the Internet have been pretty much stable over the past few months. Traffic continues to be at a very high level and the attack rates continue to be very high. The bad actors are not disrupted by having to work remotely because they have been doing it for a long time, and they are trying to take advantage of the new situation, where the security levels could be lower with remote workforces.”

Dr. Leighton pointed out that there were a lot of DDoS attacks happening and companies in all industries were getting attacked. In recent weeks, there were targeted DDoS attacks on gaming companies, financial services, and internet and telecom firms.

He gave an example of a global DDoS attack against an internet hosting provider on June 4. The attack was huge and was directing 385 million packets per second at the server or 1.44 Tbps (Terabits per second) over a two hour stretch; there were 9 different attack vectors. Dr. Leighton said the bulk of the attack was “automatically and instantly mitigated” by Akamai Prolexic Services, which is a DDoS mitigation service for Terabit scale attacks. The remainder was mitigated by Akamai’s SOCC (global Security Operations Command Center).

“Our customer was able to maintain operations through a large DDoS attack,” said Dr. Leighton. The point he was trying to make was, the attacks are getting more sophisticated and targeted, and no single organization can block these on its own. DDoS attacks can be contained only with SOCC expertise and managed services, with automated capabilities.

DDoS attacks by vertical
Source: Akamai

Dr. Leighton also disclosed an on-going attack against a major gaming company. “There are 30 billion bot requests against this website and 6 billion malicious login attempts. These anomalies were identified and blocked by the Akamai Bot Manager and Akamai SOCC,” informed Dr. Leighton.

He also noted that web application attacks have grown 42% year-on-year. Web apps and their APIs continue to be exploited. Commerce, high-tech and financial services are the most targeted sectors for these types of attacks.

Credential Abuse doubles
Source: Akamai

“Credential abuse attempts have nearly doubled compared to last year.  Credential abuse attacks are the toughest and criminals are trying to take over accounts to steal merchandise, personal information and money,” said Dr. Leighton.

The other type of attacks that are increasing are malware injected by third-party scripts on retail websites. This is called Formjacking and the MageCart malware is the most infamous example.

“Third and fourth parties add their scripts to a shopping website, so most of what comes to a customer’s browser isn’t authored by the shopping website,” said Dr. Leighton. “61% of desktop content and 68% of mobile content comes from third parties.”

Compromised third-party scripts and domains can result in data breaches wherein customer credentials and card details are stolen.

John Summers, SVP and CTO, Akamai said there are typically 20 – 50 Javascripts executing on customers’ browsers when a web page downloads at their end. And each Javascript calls additional fourth and fifth-party scripts to enhance the customer experience.

Akamai offers a tool for anyone to test their page integrity at akamai.com/pageintegrity. With this tool one can determine from where their third-party and fourth-party content is coming from.

1 in 5 Risky Links Contain Hidden Malware: Report

BotenaGo, malware over encrypted connections

Opening or downloading malicious links or attachments could result in severe security issues. With employees working remotely across the globe,  corporate data security has become a challenge for organizations. A research from security firm NetMotion revealed that cyberthreats soared as remote workers visited risky websites outside of corporate networks. The analysis found that remote employees clicked on 76,440 links that redirected them to malicious websites.

NetMotion highlighted that they collected a sample of network traffic data to find users who accessed blocked URLs or risky content. All these sites were visited on office laptops while working from home via home or public Wi-Fi or a data network.

Image Source: NetMotion

“Several primary risk categories, which were identified using machine learning and based on the reputation scores of over 750 million known domains, include more than 4 billion IP addresses and in excess of 32 billion URLs. The assumption is that a large number of employees connected to protected internal (non-public) networks would have been prevented from accessing this risky content,” the research stated.

Other notable findings include:

  • Employees, on average, encounter 8.5 risky URLs per day, or 59 per week.
  • Remote workers also access around 31 malware sites per month, and 10 phishing domains, that equates to one malware site every day, and one phishing domain every 3 days.
  • The most common types of high-risk URLs encountered, in order of prevalence, were botnets, malware sites, spam and adware, and phishing and fraud sites.
  • Over a quarter of the high-risk URLs visited by employees were related to botnets.
  • Almost 1 in 5 risky links led to sites containing spam, adware, or malware.
  • Phishing and fraud, which garner an outsized proportion of news, account for only 4% of the URLs visited.
  • The other category, representing 51% of the data in the chart above, is made up of ‘low-severity’ risky content, such as websites that use proxies, translations and other methods that circumvent URL filtering or monitoring.

“Remote workers are frequently accessing risky content that would normally be blocked by firewalls and other security tools that monitor internal network traffic. Naturally, this poses an enormous threat to the enterprise. Added to this, many organizations have no visibility into the activity taking place on external networks, let alone any means to prevent it. With such a rapid shift to remote work, enterprise security teams have been left flat-footed, unable to adequately protect users in the face of increasingly sophisticated cyberattacks,” the research added.

The NetMotion analysis is based on the aggregated data sourced from anonymized network traffic gathered between May 30, 2020, to June 24, 2020.

 

CISA Issues Advisory on Mitigating Risks Originating from Tor

Tor Network

The Cybersecurity and Infrastructure Security Agency (CISA) in the U.S. issued security guidelines on how to  mitigate cyber risks  originating from anonymity networks like Tor. In collaboration with the FBI, CISA released an advisory explaining how attackers use Tor’s network infrastructure.

Tor, also known as the Onion Router, is a software that provides user anonymity by automatically encrypting and rerouting web requests through multiple layers of Tor nodes. Threat actors often use Tor services to hide their identity and IP locations when performing malicious activities.

“The risk of being the target of malicious activity routed through Tor is unique to each organization. An organization should determine its individual risk by assessing the likelihood that a threat actor will target its systems or data and the probability of the threat actor’s success given current mitigations and controls. This assessment should consider legitimate reasons that non-malicious users may prefer to, or need to, use Tor for accessing the network. Organizations should evaluate their mitigation decisions against threats to their organization from advanced persistent threats (APTs), moderately sophisticated attackers, and low-skilled individual hackers, all of whom have leveraged Tor to carry out reconnaissance and attacks in the past,” the advisory said.

Image Source: US-Cert.Gov

Security Guidelines

CISA recommended certain protective measures for organizations to reduce the risk posed by threat actors who use Tor. These include:

  • Block all web traffic to and from public Tor entry and exit nodes. (It does not completely eliminate the threat of malicious actors using Tor for anonymity, as additional Tor network access points, or bridges, are not all listed publicly.)
  • Tailor monitoring, analysis, and blocking of web traffic to and from public Tor entry and exit nodes: orgs that do not wish to block legitimate traffic to/from Tor entry/exit nodes should consider adopting practices that allow for network monitoring and traffic analysis for traffic from those nodes, and then consider appropriate blocking. This approach can be resource-intensive but will allow greater flexibility and adaptation of defensive.
  • Block all Tor traffic to some resources, allow and monitor for others. This may require continuous re-evaluation as an entity considers its own risk tolerance associated with different applications. The level of effort to implement this approach is high.

Productivity and Stress Concern Risk Managers While Working from Home

Productivity and Stress Concern Risk Managers While Working from Home

A survey from the Global Association of Risk Professionals (GARP) revealed that risk managers across the world effectively handled the sudden transition to work-from-home amid COVID-19. According to the survey, 87% of risk professionals globally are working remotely compared with only 2% before COVID-19. It is found that 89% and 82% of respondents, respectively, admitted risk and incident reporting to be functioning properly than prior to the pandemic.

However, a few respondents said challenges related to key data and systems (5%), cybersecurity issues (5%), business operations (4%), and firm communications (4%)  worsened  due to remote work. While 60% of respondents admitted that they are working more than before COVID-19, 44% said they witnessed a drop-off in productivity. Also, 46% reported feeling more stressed out by their work than before, and 71% said their work hours have become irregular.

“Despite company-wide adaptations and successes in working from home, risk professionals reported experiencing a noticeable reduction in work-life balance. Respondents said they are working more, but at the same time, feel less productive and engaged,” the report stated.

Other key findings from the survey include:

  • Risk professionals in Asia appear to be experiencing the most challenges — 56% reported lower productivity, compared with only 36% and 42% for North America and Europe — though it may be too soon to tell whether successes or failures can be evaluated geographically.
  • Risk managers in Asia were noticeably less positive about their work-from-home experience; 30% said cybersecurity issues worsened and 28% said access to systems deteriorated.
  • Risk professionals at banks were more likely to be working longer (60%), more irregular hours (80%) and be experiencing more work-related stress (51%) than respondents at asset managers and consulting companies.
  • Companies with 100 or fewer employees faced the largest increase in risk across three key areas: market risk, cybersecurity risk, and credit and counterparty risk.
  • Nearly all financial institutions, regardless of size, type or location, have experienced elevated levels of risk as a result of the COVID-19 pandemic. On a scale from 1-9, with 1 meaning decreased sharply, and 9 meaning increased sharply, risk managers rated market risk, credit and counterparty risk, and liquidity risk at a striking 7 or higher, with banks reporting the highest overall increases in risk levels since the start of the pandemic.

Chris Donohue, Managing Director of GARP, said, “In addition to showcasing the resilience of firms and professionals, the survey results indicate that risk management has functioned well on a remote basis. However, there are still necessary improvements to be made on the work-life front. Professionals cannot be primed and ready to tackle risks that may arise if productivity, engagement, and stress-levels are suffering.”

The findings are based on the responses from 250 certified risk managers to understand the effect of the COVID-19 pandemic on the remote work culture on both companies and risk professionals.

 

Cloud-Ready Shared Responsibility TPRM Tips for CISOs

Misconfigured Cloud Storage Services Led to Over 200 Breaches in Past Two Years

Third-Party Risk Management (TPRM), commonly referred to as vendor or supply chain risk management, is not a new concept. It was originally founded with a more traditional on-premises IT mindset and was centered on an expectation of always having a significant level of visibility into and control of an organization’s most prized cyber assets; this meant companies asked their most important business partners to share their internal security posture with them.

By Becky Swain, Director of Standards, HITRUST

Then came cloud computing, a catalyst that fundamentally changed how companies do business and consume technology. The cloud, as the epicenter of IT, led to the need for the TPRM model to adapt, necessitating a fundamental change in the mindset to address the emerging risks posed by off-premises cloud-hosted technology services.

Most of the time, it is the obvious 1:1 connection that most organizations consider. They forget the fact that, even though the supply chain by name can be viewed as a “chain,” the growth of technology and the cloud, in particular have turned this chain into more of a mesh. And, as the saying goes, a chain is only as strong as its weakest link.

The question is, where is that weak link in the mesh? Maybe, more importantly, who owns security and risk management for that link — or links? A change in mindset here involves two primary transformations:

(a) A more externally facing view of risk and policy enforcement.

(b) A realization that in the cloud, controls are shared with the use of common technology platforms.

As a result, this realization has forced a new “we” rather than an “us vs. them” dialogue with cloud service providers.

At first, these conversations were uncomfortable, if non-existent. Therefore, this realization and related mind shift did not happen overnight. It took two key changes in industry trends to start the TPRM-in-the-cloud journey that finally got us to where we are today:

The democratization and consumerism of IT: With the birth of the cloud — and its ease of accessibility and consumption — emerged a new “shadow-IT” developer community, which was no longer bogged down by the traditional, enterprise IT, process-heavy red tape. With the shadow IT approach, developers bypassed all the existing enterprise security controls baked into those processes.

In turn, this renewed sense of empowerment enabled developers to accelerate their time-to-market. They could also deliver new, innovative solutions to keep pace with an emerging competitive landscape of technology service providers that demanded increased shareholder value and revenue growth.

From the TPRM perspective, this became problematic when customers sought answers to their supplier risk due-diligence questionnaires. But no one within the enterprise IT function could respond, as had been the prior modus operandi.

This forced CISOs — along with their CIO partners — to redefine their cross-functional engagement model to strengthen their partnerships with the company’s lines of business and associated product teams. They did this in hopes of building a similar partnership to the one they had previously matured with their enterprise IT counterparts. Further, it accompanied the new addition to the company’s set of most prized cyber assets: customer data.

With this new supply chain risk perspective on customer data protection — along with the expansion of global privacy regulation — there emerged a new set of security and privacy industry standards and unified compliance control frameworks. These frameworks were more suitable for addressing the cloud security risks that CISOs would need to adopt and integrate into their information security and governance, risk, and compliance (GRC) programs. The frameworks also helped CISOs safeguard and appropriately manage both their own supply chain risks and the supply chains of their customers.

Technology innovation and cloud supply chain ecosystem complexities: With the promise of the cloud came the next big innovation and a new term added to our tech-savvy vernacular: “Big Data.” Since then, there have been significant advancements in the types of technology solutions commonly used by consumers and businesses today—with further growth expected to continue in the future — e.g., artificial intelligence (AI), robotics, and the Internet-of-Things (IoT), to name a few.

These advancements have resulted in the creation of a vast and complex ecosystem of cloud service providers, solution partners, and consumers. They all share a common cloud platform, characterized by a comingled and integrated set of varying types of technologies, which are primarily hosted off-premises — e.g., web and mobile applications that are hosted on highly-mutable virtual infrastructures.

From the TPRM perspective, the CISO’s quality of engagement with their cloud service providers to appropriately manage supply chain risk is paramount. In addition to gaining transparency, visibility, and auditability to understand third- and fourth-party risk factors, CISOs will need to transform their existing GRC programs to support continuous compliance monitoring of the cloud services they consume. This is obviously counter to their more traditional IT enterprise approach to SRCM, with its much slower rate of change that warrants a much longer supplier risk assessment cycle of cadence — e.g., on an annual or biennial basis.

The Journey is Just Beginning

Traditionally, TPRM processes have been disengaged, with one-way forms of communication by way of questionnaires. With the continued optimization of the cloud, the risk management landscape has evolved; however, we have not seen TPRM evolve at the same rate.

The time for dynamic, cooperative engagement between cloud service providers and their tenants is now upon us and grows more prevalent every day.

The “new normal” of managing risk in the cloud grants CISOs the opportunity to embrace being an advocate — not only for their own corporate innovation, but also the customers they serve, thus leading to new revenue potential.

The journey to TPRM in the cloud is just beginning. The cloud service provider you choose to partner with will go a long way in determining just how smooth or bumpy that road will be. The HITRUST Shared Responsibility Program simplifies and streamlines the process for determining shared control roles and responsibilities between organizations and third-party service providers for greater clarity on the ownership and operation of security controls.

Key Questions to Ask When Vetting Cloud Service Providers

As your business makes the transition to a cloud-ready TPRM program, the following questions can assist a CISO during the early stages of the procurement process in vetting cloud service providers and achieving an appropriate level of quality engagement:

  1. Does the cloud service provider have an adequate understanding and appreciation for your concerns pertaining to the required information security and privacy measures to protect the data and cyber assets you have entrusted to them? Similarly, does the cloud service provider acknowledge your compliance obligations that they must inherit?
  2. Can the cloud service provider readily articulate which information security and privacy standards and/or control frameworks they comply with, align to, and benchmark against?
  3. Does the cloud service provider demonstrate a higher level of assurance with independent third-party validation or attestation for the applicable standards and compliance frameworks? Are you able to inspect the validation to ensure any potential supply chain risk gaps are addressed?
  4. Does the cloud service provider go into further detail with respect to scope and depth, specifying how each of the control requirements for the applicable standards and compliance frameworks are implemented?
  5. Does the cloud service provider explain which control requirements are common and therefore shared with their customers based on which cloud services have been purchased? Can they explain why the responsibility is shared for these controls?
  6. Does the cloud service provider allow customers to “inherit” the common — or shared — controls from the applicable standards and compliance frameworks to prevent supply chain risk gaps while alleviating waste in duplicative assessments and audits?

It is also important to check the cloud service provider’s contractual agreements to ensure the level and quality of the engagement persists post-procurement. You also want to make sure they actively involve customers in their security and privacy incident planning, notification, and response processes. Another key attribute to look for is a service provider that ensures customers maintain awareness of any changes that may impact the cloud supplier’s risk posture and thus warrant a risk re-assessment.

There is a lot that should be available to you as you embark on this path — are you getting the visibility necessary to effectively and efficiently evaluate the security posture of the cloud services you are using?

Learn more at: https://hitrustalliance.net/hitrust-shared-responsibility-program/

About the Author

Becky SwainBecky Swain is the Director of Standards and Shared Responsibility Program Lead, HITRUST. Her expertise encompasses cybersecurity, privacy, supply chain assurance, and GRC frameworks, in addition to IT audit and compliance. Swain has been a contributor for cloud standards as co-founder and author of the Cloud Security Alliance Cloud Controls Matrix (CSA CCM) and project co-editor for ISO/IEC 27036- 1:2014.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

72% of Remote Workforce Gained Cybersecurity Awareness in Lockdown: Report

CISO, Cybersecurity

A survey from cybersecurity solutions provider Trend Micro revealed that nearly 72% of remote workers are more conscious about their organization’s cybersecurity and data handling policies since the lockdown began.

The survey “Head in the Clouds” stated that 85% of respondents admitted that they take instructions from their IT team seriously, and 81% agreed that cybersecurity within their organization is their responsibility. Nearly 64% of respondents stated that using non-work applications on a corporate device is a security risk.

The survey also highlighted that certain employees are still neglecting security practices because of limited understanding or resource constraints. 56% of employees admitted to using a non-work application on a corporate device and 66% of them have uploaded corporate data to that application. 80% of respondents confess to using their work laptop for personal use, while only 36% of them fully restrict the sites they visit. 39% of respondents stated they often access corporate data from a personal device, almost breaking corporate security policy.

The survey findings are based on the responses from 13,200 remote workers across 27 countries on their attitudes towards corporate cybersecurity and IT policies.

Bharat Mistry, Principal Security Strategist at Trend Micro, said, “In today’s interconnected world, unashamedly ignoring cybersecurity guidance is no longer a viable option for employees. It’s encouraging to see that so many take the advice from their corporate IT team seriously. Having said that, there are individuals who are either blissfully ignorant or worse still, who think cybersecurity is not applicable to them, and will regularly flouter the rules. Hence, having a one size fits all security awareness program is a non-starter as diligent employees often end up being penalized. A tailored training program designed to cater to employees may be more effective.”

Remote Work Threatens Businesses

A similar study from HiveIO revealed that nearly 85% of organizations anticipate a larger remote workforce will threaten operations because of new risks. “The IT departments are working at a deficit in their ability to support and maintain business continuity while optimizing IT support,” the report said. The study stated that several organizations are unable to introduce new security solutions designed to improve the efficiency of work-from-home employees. Around 70% of respondents admitted that they have suffered increased costs due to the ongoing pandemic. And 25% of respondents reported shrinking staff support and another 18% fear additional staff reductions.

 

Europe Introduces 13 New IoT Cybersecurity Provisions

IoT attacks

To address the concern over the rising number of devices at home being connected to the Internet, the European Telecommunications Standards Institute (ETSI) launched a new cybersecurity standard (ETSI EN 303 645) to establish a security baseline. From large scale to prevalent attacks, this cybersecurity standard for Internet of Things (IoT) devices is an attempt to cover them all with 13 new provisions.

The Cybersecurity Standard for IoT Devices

Work from home has seen a major shift in the number of home devices connected to the internet. This has challenged the very fabric of traditional cybersecurity measures as they often do not cover the home periphery. To address these issues, ETSI  sought help from industry experts, academics and the government to define a standard that aims to restrict the ability of cybercriminals to control devices across the globe.

ETSI EN 303 645 includes the security of a wide range of IoT consumer devices and their associated services, including:

  • Connected children’s toys and baby monitors
  • Connected home safety products such as smoke detectors and window sensors
  • Smart cameras, TVs, and speakers
  • Wearable health trackers
  • Connected home automation and alarm systems
  • Connected appliances such as washing machines, and fridges
  • Smart home assistants

13 cybersecurity measures for consumer IoT devices listed under this standard:

  1. No universal default passwords
  2. Implement a means to manage reports of vulnerabilities
  3. Keep software updated
  4. Securely store sensitive security parameters
  5. Communicate securely
  6. Minimize exposed attack surfaces
  7. Ensure software integrity
  8. Ensure that personal data is secure
  9. Make systems resilient to outages
  10. Examine system telemetry data
  11. Make it easy for users to delete user data
  12. Make installation and maintenance of devices easy
  13. Validate input data

It is a known fact that many IoT devices store and process users’ personal data. IoT manufacturers are expected to provide security features to these devices for the protection of such personal user data. Apart from these 13 new cybersecurity measures and already defined GDPR compliance policies for data protection, the ETSI EN 303 645 standard provides five specific data protection provisions for consumer IoT devices.

IoT Devices to Dominate the Market

Earlier, research by Transforma Insights revealed that the number of active IoT devices globally is expected to grow from 7.6 billion in 2019 to 24.1 billion in 2030, thereby generating revenue of more than $1.5 trillion, at 11% CAGR. The findings also stated that North America, China, and Europe are expected to have a lion’s share in this growth of IoT devices with 26%, 24%, and 23% respectively of the total value.

PII of Thousands of Users Exposed in Multi-Stage Bitcoin Scam

multi-stage bitcoin scam, Google Ads crypto wallet scam

Threat intelligence firm Group-IB discovered personal records of thousands of users from the U.K., the U.S., South Africa, Spain, Australia, Singapore, Malaysia, and other countries exposed in a multi-stage bitcoin scam. It is found that the attackers used 248,926 sets of stolen personally identifiable information (PII) to pull people into a fake cryptocurrency investment scheme.

According to Group-IB’s investigation, a majority of the victims were from the U.K. with 147,610 records exposed, followed by Australia (82,263), the U.S. (4,147), South Africa (4,149), Singapore (3,499), Malaysia (2,491), and Spain (2,420). While the source of the data leak is still unknown, the researchers stated that the information has been provided to relevant authorities in the affected countries.

Image Source: Group-IB

“Victim’s phone numbers, which in most cases came with names and emails, were contained in personalized URLs used to redirect people to websites posing as local news outlets with fabricated comments of prominent local personalities about cryptocurrency investment platform that helped them build a fortune,” the researchers said.

Attack Vector

Group-IB identified all the stages of the attackers’ fraud scheme. Initially, hackers send a phishing message to the victim mimicking a popular media outlet. The message contains a malicious link that redirects the victim to another URL which is designed to trick users into entering their personal information like phone numbers, first and last names, and email addresses.

Image Source: Group-IB

The malicious URLs take users to fraudulent websites that host false interviews and comments attributed to local celebrities saying that they have made a fortune with this new cryptocurrency investment platform.  The researchers spotted six fake active domains showcasing the same bitcoin investment platform with different names like Crypto Cash, Bitcoin Rejoin, Bitcoin Supreme and Banking on Blockchain.

Image Source: Group-IB

“If a victim decides to click any link in the article, they are taken to a bitcoin investment platform website, where their data, contained in the URL, would already be pre-filled in the registration form without a user’s consent. Later a victim would be asked to add to their account balance in BTC,”  the researchers added.

Ilya SachkovIlya Sachkov, CEO and founder at Group-IB, said, “The bitcoin investment scams have been around for quite a while and we regularly detect new instances of crypto fraud. This time however the scheme was significantly upgraded, and a tremendous amount of personal information was leaked. The bad guys got smarter in a bid to increase the success rate of their fraudulent operations. Using personal data allows them to carry out targeted attacks and make a victim’s journey easier and smoother, which levels up the overall effectiveness of the scheme.”  

Stolen Data From 945 Websites Exposed on Darknet Forums: Report

SEO poisoning

Researchers from cybersecurity firm Lucy Security discovered a collection of two SQL databases exposed on darknet forums. It was found that the databases contain stolen information from 945 websites, hacked by different attackers from across the world. The databases host around 150GB SQL files which were released on June 1  and June 10 2020, respectively. The exposed information included usernames, phone numbers, full names, hashed and non-hashed passwords, IP, email addresses, and physical addresses.

Among the 945 compromised sites, the researchers identified 14 government sites belonging to Ukraine, Israel, the U.K., Pakistan, Russia, Lebanon, Belarus, Rwanda, and Kyrgyzstan. Over 14 million users are said to be affected in the incident.

“As if this was not alarming enough, this might be only the beginning. The entity who collected and shared the databases on the dark web claims to have gathered these so-called private databases without having committed any hacking by themselves, yet they also claim to possess even more databases, which they are planning to share or sell to the highest bidder,” the researchers said in a statement.

Connection to Collection #1 Breach

The researchers at Lucy Security clarified that the new data leak does not relate to Collection #1, a massive data leak that exposed 773 million records from different sources on dark web last year. “This is an entirely new threat, none of the databases were known to the public before,” the researchers said.

Darknet Flooded with Leaked Databases

Researchers from security firm Cyble stated that a hacking group “Shiny Hunters” is selling Wishbone.io database on darknet forums. The leaked database contained over 40 million records of Wishbone users–a social platform that allows users to compare social content via voting poll. It is found that the Shiny Hunters group was responsible for numerous data breaches including the breach of 73.2 million user records from over 11 companies. The hackers are also behind the Tokopedia data breach, in which 91 million user records were compromised and kept on sale on the hacking forums for $5,000. Later, the group breached India-based online learning platform Unacademy, which exposed details of 22 million users and kept the records for sale on the darknet forums for $2,000.

 

1...196197198...410Page 197 of 410