Home Blog Page 201

Online Fraudsters Steal Over $21 Mn Amid COVID-19 Pandemic

Ask Yourself These 4 Questions Before Shopping Online

Action Fraud, the U.K.’s National Fraud and Cybercrime Reporting Center,  reported that consumers have lost more than £17 million (US$21 million) to online frauds during the COVID-19 lockdown. It received multiple reports of online shopping frauds since March 2020, affecting over 16,352 online shoppers. It was found that young shoppers aged between 18 to 26 are the most affected (24%).

According to Action Fraud, most of the fraudulent sellers were found on eBay (18%), Gumtree (10%), Facebook (18%), and Depop (6%). Shoppers complained that purchased items including electronics (10%), mobile phones (19%), vehicles (22%), and footwear (4%), were never delivered. Attackers used phishing scams on online shoppers residing London, Leeds, Birmingham, Bristol, Manchester, Sheffield, Liverpool, and Nottingham.

Pauline Smith, the Head of Action Fraud, said, “The global outbreak of coronavirus has seen all our lives turn upside down. With the lockdown being introduced, so many more people are now online shopping, including those who have never done so before. It is therefore unsurprising that there has therefore been an increase in fraud being committed. However, we are still seeing young people in their 20’s falling victim the most. This has been the case for the last 18 months which implies this is not just a trend brought about because of coronavirus. We would make a plea to this group to take extra care when shopping online.”

Action fraud recommended certain security measures to protect against online shopping frauds, these include:

  • If you are purchasing from a company or seller you do not know and trust, carry out some research first and ask a friend or family member for advice before completing the purchase.
  • Use a strong, separate password for your email account. Criminals can use your email to access other online accounts, such as those you use for online shopping.
  • Some of the emails or texts you receive about amazing offers may contain links to fake websites. Not all links are bad, but, if you are unsure, do not use the link and type the website directly into your browser instead.
  • If you decide to go ahead with the purchase, use a credit card if you have one. Other payment providers may not provide the same protection.

“It’s important to shop on sites you know and trust. If you’re using a site you’ve not used before, do your research and check reviews before making a purchase. Always be wary of emails, texts and social media posts that offer products for considerably less than their normal price – this is a common tactic used by criminals. Where possible, use a credit card to make online purchases as this will offer you more protection if anything goes wrong,” Smith added.

 

Over 230K Indonesian COVID-19 Patients’ Records Exposed on Darknet

Only 44% of Health Care Providers Meet National Standards on Cybersecurity, OpenEMR vulnerabilities

Security researchers from threat intelligence firm Cyble  discovered more than 230,000 Indonesian COVID-19 patients’ records on the dark web during their regular deep web and dark web monitoring activity. Cyble claimed that its researchers found a threat actor selling the database of COVID-19 patients on various dark net forums.  The exposed data dump includes names, phone numbers, address, present address, citizenship, test results, diagnosis date, result date, and other sensitive information.

The researchers also analyzed the leaked data and confirmed its authenticity. “Cyble has acquired, validated and, indexed the leak on their data breach monitoring and notification platform, AmiBreached.com – people who’re concerned about their information exposure can register on the platform to ascertain the risks,” the company said in a post.

Risk Mitigation

Cyble also recommended certain mitigation measures to defend against data breaches, these include:

  • Never share personal information, including financial information over the phone, email, or SMS
  • Use strong passwords and enforce multi-factor authentication where possible
  • Regularly monitor your financial transaction, if you notice any suspicious transaction, contact your bank immediately
  • Turn-on automatic software update feature on your computer, mobile and other connected devices where possible and pragmatic
  • Use a reputed anti-virus and internet security software package on your connected devices including PC, Laptop, and Mobile

Data Breaches on Indonesia

Recently, Indonesian e-commerce giant Tokopedia suffered a massive data breach after hackers leaked over 15 million user records. It was also discovered that threat actors kept the details of 91 million users up for sale on the darknet for $5,000. According to Under the Breach, the leaked records contained names, emails, password hashes, and other personal information. Tokopedia’s spokesperson, Nuraini Razak, also confirmed the breach and claimed that the company had ensured the security of its users’ information. While Tokopedia is investigating the incident, Razak clarified that users’ financial details like credit/debit card numbers and e-wallet information were not affected. She also advised the users to change their passwords to prevent further damage.

 

Remote Working: Are You Really Secure?

remote work, Remote workforce security

As cities across the globe begin to ease their COVID-19 restrictions, this year’s transition back to the office could take place in stages — or not at all. Prior to the pandemic, data had already shown a steady increase of remote work employees — growing by 173% over the last 15 years, with nearly 5 million telecommuters in the U.S. alone.

By Andrew Milne, CRO at Field Effect

Research now shows nearly 40% of global companies expect work-from-home policies to be permanent.  Supporting this data, a study last month shows 65% of UK workers believe remote working could become more common after COVID-19. In Canada, 66% of Canadians who shifted to remote work earlier this year, reported a high success rate.

While businesses and organizations consider their next steps, what impact will this have on your cybersecurity strategies?

Working Safely, Securely, and Remotely

Whether you are transitioning back to the office or working remotely long-term, cybersecurity best practices remain as important as ever — and it is equally critical that employees stay vigilant about new COVID-19 scams, and web and email threats.

You can also bet that cybercriminals are tracking these next steps. One look at this year’s cybercrime numbers, provides a good reminder.

Consider these recent risks, in just the first quarter of the year:

  • Over 25,000 malicious COVID-19 websites were created on March 19 — a record for the first quarter.
  • In March, phishing and counterfeit websites increased to 8,342 — from just 3,142 in January.
  • More than 80% of remote work employees surveyed recently claimed awareness of COVID-19 phishing scams, yet 24% clicked on a link from an unknown sender before determining their legitimacy and only 12% reported the email.
  • An estimated 36% of these employees are using one or more personal devices to access company files and 29% also share that device with other members of their household.
  • The reality is, as lockdown restrictions change, you should not change the attention placed on cybersecurity and remote work risks.

Secure your teams working from any location 

As companies consider their transition options, ensuring employees can work from any location, productively and securely — without compromising the security of networks, devices, and users — remains a critical challenge.

That is why our team at Field Effect recently introduced Covalence for Remote Work.

Based on the technologies and capabilities of our flagship Covalence threat detection and monitoring platform, Covalence for Remote Work provides a complete solution in one platform for monitoring and detecting cyberthreats to email and cloud services, devices that support remote work, vulnerabilities in cloud networks, and more.

Here is a quick look:

  • Personalized cloud security monitoring: Gain the insights to detect malicious or suspicious activity to your endpoint devices, email, and cloud services. Covalence uses data, logs, and APIs from your cloud service providers to monitor and identify threats to your services, administrative components, user accounts, and more.
  • Advanced monitoring and analytics: Benefit from machine learning and cloud analytic capabilities that provide continuous analysis of user and service data to identify threats. The result is real-time visibility to detect, monitor, measure, manage, and reduce attackable points.
  • Simple, affordable, powerful: Priced affordably, Covalence integrates easily with all existing systems. Set it up in just a few clicks and it does the heavy lifting to protect you as quickly as possible.

Visibility to the threats and risks facing your remote, distributed workforce will help businesses and organizations build safe IT environments for any stage of the pandemic, as well as into the future.

Get the visibility, protection, and confidence to secure your work from home employees.

Find more information about Covalence for Remote Work here or contact us to get started!

About the Author

Andrew MilneAndrew Milne is the Chief Revenue Officer (CRO) at global cyber security firm Field Effect. His career in Sales & Marketing spans over more than two decades. Milne is a much sought-after speaker on marketing, digital transformation, audience engagement, and how these topics will shape the future of business. He is also an active blogger and the host of “The Brief”, a video series focused on conversations with key players in business of digital transformation today.

Disclaimer

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

Authomize Raises $6Mn to Come out of Stealth Mode

Startup funding

Tel Aviv has been a launchpad for many cybersecurity startups in recent years. Continuing this trend, Authomize, an Identity and Access Management (IAM) solutions provider, has come out of stealth mode by raising raised a seed funding of $6 million. The funding round was led by Blumberg Capital, M12, and Entrée Capital.

This is a special time, with special requirements. When the workforce is spread out, organizations take on a lot of cloud services and run a risk of losing control.

What does Authomize Offer?

Authomize stands for Authority + Automation. It provides a non-intrusive path to turn authorization management chaos to operational efficiency. It provides a singular platform to view and manage authorization and permission sprawls of all scattered applications across all environments. The artificial intelligence (AI) based platform monitors and generates prescriptive security and operational recommendations.

How it Works?

The platform consists of a prescriptive analytics engine called SmartGroups. This engine continuously monitors the data from all apps that the user accesses. It learns the network architecture between resources, identities, entitlements, and their usage. The AI component of the engine then applies these observations and recommends user to take grant only necessary authorizations.

Additionally, the Authomize platform offers compliance templates, automated (re)certification campaigns, alerts on violations and generates audit and compliance reports to help the already overwhelmed IT teams.

Dotan Bar-Noy, Co-Founder of Authomize said,  “This is a special time, with special requirements. When the workforce is spread out, organizations take on a lot of cloud services and run a risk of losing control. The current Identity Governance and Administration (IGA) tools lack the ability to provide the intelligence and automation needed to make informed and efficient decisions. With Authomize, IT and Security teams can make highly informed decisions or choose to automate processes, removing the need to compromise between IT efficiency and impeccable security hygiene.”

4 in 10 Organizations Struggle with SOC Staff Shortages: Report

4 in 10 Organizations Struggle with SOC Staff Shortages: Report

A recent survey from the security management provider Exabeam revealed that 82% of security operations centers (SOCs) are confident to detect potential cyberthreats. According to the survey “2020 State of the SOC Report,” 40% of organizations still struggle with  SOC staff. Only 22% of frontline staff tracking mean time to detection (MTTD), which helps to determine attackers’ dwell time. It is also found that the dwell time, the time between when a breach first occurs and when it is first detected, has increased exponentially.

The survey also highlighted that there is a disparity between SOC leaders and frontline analysts on the most common cyberthreats on organizations. It is found that SOC leaders believe phishing and supply chain vulnerabilities are critical issues, while analysts see DDoS attacks and ransomware as major threats.

Other research findings include:

  • Small- and medium-sized teams are especially more concerned with downtime or business outage (50%) over threat hunting as an operational metric, yet threat hunting stands out as a must-have hard skill (61%)
  • SOC outsourcing in the U.S. has declined year over year (36% to 28%)
  • K.’s outsourcing had a year over year increase (36% to 47%)
  • Australian SOCs struggle in most categories and need improvement in technology updates, monitoring events and responding to incidents
  • More than 50% of SOCs were found to log at least 40% of events in a SIEM
  • The U.K. utilizes logging the most, compared with other geographic counterparts
  • Most SOCs expect to see security orchestration, automation and response (SOAR) tools take precedence over other technologies in upcoming years
  • The U.S. and the U.K. SOCs have shown year over year improvements in recruiting costs and identifying candidates with the right expertise. Workplace benefits, high wages and a positive culture were this year’s top drivers for retention in nearly 60% of SOCs
  • 23% of SOC personnel across the U.S. and 35% across Canada report being understaffed by more than 10 employees
  • 64% of frontline employees in the SOC reported a lack of career path as a reason for leaving jobs
  • Less effective SOCs reported feeling they lacked the necessary investment in technology, training and staffing to do their jobs well

The survey findings were based on the responses from security decision-makers across the U.S., the U.K., Canada, Germany, and Australia. The survey is aimed to determine how analysts and SOC management view key aspects of their operations, hiring and staffing, retention, technologies, training, and funding.

Steve Moore, the chief security strategist at Exabeam, said, “We see great progress in the SOC with attention paid to employee well-being, measures for better communication and more. However, disparate perceptions of the SOCs’ effectiveness could be dangerously interpreted by the C-suite as assurances that the company is well-protected and secure, when it’s not.”

 

Australia Lost Over $630 Mn to Phishing Scams: Report

Cryptocurrency scams in Australia

A recent survey from the Australian Competition and Consumer Commission (ACCC) revealed that Australians lost over $634 million to scams in 2019, which is a 30% increase compared to $489 million in 2018. The survey “Targeting Scams 2019 Report” stated that Australians reported around 167,797 reports to Scamwatch.gov.au, a primary government website used to report scams, in 2019. It was found that 33% of people or enterprises who had lost money to scams in the last five years did not report to any agency about it.

Losses by Scams

It suggested that Australians lost $132 million to business email compromise (BEC) scams, $126 million to investment scams, identity theft scams reported $4.3 million losses, $83 million lost to dating and romance scams, and losses for cryptocurrency scams exceeded $21.6 million. It was found that phishing was the most common method used by attackers for scamming people, with 25,168 phishing scams reported in 2019.

Image Source: www.accc.gov.au

Only 11.8% of scam reports included a financial loss, according to the data obtained from four popular banks in Australia- the Australia and New Zealand Banking Group (ANZ), Commonwealth Bank of Australia (Commonwealth Bank), National Australia Bank (NAB), and Westpac Banking Corporation (Westpac).

“Scammers continue to adapt their strategies and technology use. In the past scams have relied on persuading a victim to hand over money or personal information. While this is still the norm, many scams, including phone porting scams, now operate with limited contact or none at all, making it difficult for targets to recognize and avoid them. Scammers have moved to unexpected platforms to target victims. In 2019, we saw dating and romance scammers targeting unsuspecting victims through gaming apps such as Words With Friends, and investment scammers targeting Facebook and Instagram users with get rich quick cryptocurrency investment scams,” the report said.

Hackers Target Australians Amid COVID-19

A new threat report from the Australian Cyber Security Centre (ACSC) revealed that Australia has seen a sudden surge in cyberattacks amid the pandemic. It highlighted how cybercriminals are exploiting the situation for their own gain through phishing schemes and malicious activities. The report is intended to raise awareness of increasing COVID-19-related malicious cyberthreats and provide cybersecurity advice in real-time that organizations and individuals can follow to reduce cyber risks.

 

SMEs Likely to Invest More on Cyber Insurance: Report

cyber insurance in SMEs

A recent survey by Cowbell Cyber revealed that 65% of SMEs are likely to spend more on cyber insurance in the next two years, compared to 58% of large enterprises. The survey report “The Economic Impact of Cyber Insurance” also found that 70% of SMEs have cyber insurance coverages with limits lesser than $1 million. The cyber insurance coverage limits varied from one sector to another. According to the report, life sciences, retail, health care, hospitality, and telecom sectors are severely under-covered with gaps in insurance limit and lose coverage.

Image Source: Cowbell Cyber

Other notable findings include:

  • 45% of SMEs and large enterprises converge on the likelihood of their business experiencing a breach in the next one year.
  • 62% of SMEs in the early stages of cybersecurity maturity believe that cyber insurance is well worth the protection. Only 13% felt otherwise.
  • 35% of SMEs buy cyber insurance because it is a customer requirement.
  • 30% of SMEs buy insurance because of regulations requiring restitution to individuals / third-parties.
  • 6 in 10 organizations plan to spend more on cybersecurity insurance over the next two years and more than half believe the cost of insurance is well worth the protection.
  • On average, organizations opt for cybersecurity insurance coverage limits of about 0.14% of revenue.
  • Cyberattacks using password and credential reuse cause the greatest losses today and the greatest risk over the next two years.
  • Multi-Factor Authentication (MFA) is significantly under-deployed in SMEs (18%) compared to very large enterprises (43%).
  • 55% of SMEs point to employee-owned end-user devices as the highest risk in two years.

“Cyber breaches are no longer an if scenario but rather a when scenario. Cyber insurance is becoming increasingly popular for SME organizations that want to protect their assets and accelerate the response and recovery process in the aftermath of a cyber incident. Cyber insurance is now a necessity and not a luxury for organizations,” said, Isabelle Dumont, VP of Market Engagement at Cowbell Cyber.

The survey findings are based on the responses from security professionals at 1,009 organizations across 13 different industries from November 2019 to January 2020. The survey helps understand the cyber insurance buying intentions, limits, and discrepancies between SMEs and large organizations in the U.S.

 

Know the Worth of Your Stolen Data on Dark Web

digital assets on dark web forums, Know the Worth of Your Data on the Dark Web Price Index 2021

Since the onset of the COVID-19 outbreak, cybercriminals have been using sophisticated hacking techniques to benefit from the crisis. Several new cybersecurity scams and malicious activities have been originating from the darknet forums. According to a recent investigation from Privacy Affairs, stolen users’ personal information like credit card details, online banking credentials, and social media logins are put up for sale on several darknet forums at really low prices.

Image Source: Privacy Affairs

The investigation report “Dark Web Price Index 2020” stated that forged documents including passports, driving licenses, and auto-insurance cards are also available in these dark web forums. The researchers at Privacy Affairs scanned various dark web marketplaces, forums, and websites, to know the price index for a range of products and services related to users’ sensitive data, counterfeit documents, and social media accounts.

Image Source: Privacy Affairs

According to researchers, online banking credentials cost an average of $35 on the dark web and credit card details including associated data range between $12 and $20. Forged or counterfeit documents can be obtained for $1,500. PayPal accounts information is the most commonly listed data and is available at low costs. In addition, counterfeit banknotes are regularly available in 20 or 50 denominations. “We came across USD, EUR, GBP, CAD, AUD most often. Some come with a UV pen test guarantee. The quality ones tend to cost around 30% of the banknote value,” the researchers said.

Image Source: Privacy Affairs

“Whilst there are many marketplaces on the dark web, there are even more forum posts warning of scammers. This makes verified prices difficult to obtain without ordering the items to find out, which of course we did not. Our methodology was to scan dark web marketplaces, forums, and websites, to create an index of the average prices for a range of specific products,” the researchers added.

Malware and Malicious Tools for Sale

A similar study from research organization CyberNews.com revealed that the main reason for the constant surge in cybercrimes is because of the availability of malware and malicious tools on darknet marketplaces at low cost. The study found that threat actors can easily buy and own malware and ransomware via underground message boards and dark web market networks at a surprisingly low cost, ranging from free of cost to $50. The researchers also stated that they found various categories of malware programs for sale on the darknet. A list of malware bots, ransomware builders, data stealers, Remote Access Trojans (RATs), banking trojans, and other viruses are kept for sale with a price ranging from free to maximum of $5,000.

 

Sophisticated State-Actor Behind Sustained Cyberattacks: Australian PM

Remote Access Scams

Australian Prime Minister Scott Morrison, in an urgent press conference held in Canberra, briefed about sustained cyberattacks carried out by a sophisticated state-sponsored actor. These cyberattacks are not only targeted toward government organizations but also toward known corporate entities in the country.

The Australian government is not making any public attribution in regards of the state-actor involved, but investigations confirm that there are not a very large number of state-based actors that can engage in this type of activity.

What the PM Says…

After a detailed briefing received from the Australian Cyber Security Center (ACSC), Prime Minister Morrison told the media, “Australian organizations are currently being targeted by a sophisticated state-based cyber actor. Organizations across a range of sectors, including all levels of government, industry, political organizations, education, health, central service providers, and operators of other critical infrastructure, are all being targeted.”

When quizzed about China’s involvement in this series of sustained cyberattacks, Morrison quickly retorted, “The Australian government is not making any public attribution on these matters. What I simply can confirm is there are not a very large number of state-based actors that can engage in this type of activity and it is clearly based on the advice that we have received (from ACSC) that this has been done by a state-based actor with very significant capabilities.”

Australian Cyber Security Center Findings

Based on the intensive investigation carried out by the ACSC, an advisory has been released by them for all businesses and organizations in Australia against the ongoing campaign. The Advisory 2020-008  titled “Copy-paste compromises” derives its name from the state actor’s heavy use of proof-of-concept (POC) exploit code, web shells, and other tools copied from the open-source.

A few of the logged vulnerabilities exploited by the state-actor are:

  • Vulnerabilities in the unpatched versions of Telerik UI
  • Deserialization vulnerability in Microsoft Internet Information Services (IIS)
  • A 2019 SharePoint vulnerability
  • The 2019 Citrix vulnerability

Advise Given

Although there are no specifically applicable mitigation measures to these sustained cyberattacks, yet, ACSC suggested these two key steps for reducing the risk of compromise:

  1. Immediately apply the latest updates and patches available to all software, operating systems, and devices connected to the internet.
  2. Employ multi-factor (MFA) authentication for all services accessed remotely (like web and cloud-based email, collaboration platforms, VPN connections, RDP services).

IBM Fixes a Security Vulnerability in its Maximo Software

Security researchers from Positive Technologies discovered a critical vulnerability in IBM Maximo software. According to the researchers Arseny Sharoglazov and Andrey Medov, the vulnerability “CVE-2020-4529” allows threat actors to compromise internal enterprise networks. It was found that the severity of the vulnerability is high with a 7.3 CVSS (Common Vulnerability Scoring System) score and also involves server-side request forgery (SSRF).

“IBM Maximo Asset Management vulnerability may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks,” IBM said in a statement.

The vulnerability affects two versions of the IBM Maximo Asset Management core products:

Affected Products Versions
IBM Maximo Asset Management 7.6.0
IBM Maximo Asset Management 7.6.1

 

However, IBM fixed the vulnerability by releasing the latest version with a patch and has requested the users to update the Maximo software immediately. IBM Maximo is an enterprise asset management software used by large businesses to run maintenance and repairs in their asset-intensive industries like pharmaceuticals, auto manufacturing, oil and gas, utilities, aerospace, railways, airports, and nuclear power plants.

Explaining about how an attacker can abuse the vulnerability, security expert Arseny Sharoglazov, said, “IBM Maximo Asset Management software is used at major critical facilities. Any vulnerabilities in it could attract APT groups interested in access to the internal network. One example of a low-privileged attacker is a warehouse worker, who remotely connects to the system and enters items into a database. A threat could also come from the warehouse worker’s workstation itself, if infected by a virus.”

“IBM Maximo web interfaces are usually accessible from all of a company’s warehouses, which could be located in multiple regions or countries. So, if our warehouse worker or equivalent connects through a properly configured VPN, that person’s access within the corporate network is restricted to what they need— from that particular system and email, for example. But the vulnerability we found allows bypassing this restriction and interacting with other systems, on which an attacker could try for remote code execution (RCE) and potentially access all systems, blueprints, documents, accounting information, and ICS process networks. Sometimes employees connect to IBM Maximo directly over the Internet with weak passwords and no VPN, making an attack easier to perform,” Sharoglazov added.

 

1...200201202...410Page 201 of 410