Home Blog Page 206

Cyberattacks on Automated Vehicles Rise by 99%: Report

Cyberattacks on Automated Vehicles Rise by 99%: Report

A recent study from Uswitch, a UK-based price comparison service and switching website, stated that threat actors are constantly enhancing their attack vectors and targeting linked devices for data theft. Smart vehicles saw a 99% increase in cyberattacks  in 2019, which is seven times higher from 2018 alone. Uswitch revealed that over 67% of new cars registered in the U.K. are smart cars,  which is estimated to rise to 100% by 2026 and a market worth up to £52 billion (US$ 65.71 billion) by 2035.

According to the study, connected cars produce up to 25 GB of personal data every hour, including data about the driver, the vehicle, and passengers. It is said that a Boeing 787 jet has about 6.5 million lines of code, while a standard connected car has about 100 million lines of code.

Vulnerabilities in Connected Cars

Uswitch also found certain key vulnerabilities in connected cars that attackers can abuse to take control of the car, these include:

  • Bluetooth
  • Remote Key
  • On-Board Diagnostics (OBD)
  • Tire Pressure Monitoring System (TPMS)
  • Remote Link Type App
  • Steering and Braking ECU
  • Lighting System ECU
Image Courtesy: USWITCH

Risks of Data Theft

The study stated that connected cars collect information like location and movement information. It may also store personal data like messages, phone numbers, calls made, and financial information provided by car owners. This occurs when users sync their phones with the car’s entertainment system. This allows hackers to find vulnerabilities in the car system and steal users’ data via remote access.

Keyless Car Theft

The study also revealed that “Keyless Theft” attacks are increasing significantly. Hackers scan for the signal your key passively sends out to the car, and remotely access the car. “This approach is sometimes known as “relay theft”. Essentially, a thief can receive signals coming from your car key fob, even through windows and walls. The hardware they use tricks the car into thinking the key is nearby and unlocks the doors. The process can take as little as 10 seconds,” the report said.

Image Courtesy: USWITCH

Preventive Measures

Uswitch listed certain guidelines to protect connected cars:

  • Limit the number of devices connected to your vehicle
  • Use steering or wheel locks that can discourage car thieves
  • Keep your car’s software up to date
  • Be mindful of what apps you download – it is best to install only trustworthy applications from Google Play or the App Store
  • Wipe any personal data from your vehicle before selling it

With the number of connected cars increasing significantly, industry regulators should ensure that connected car data is both encrypted end-to-end to reduce cyber risks from third parties and monitor what data it should store.

 

“SFERS” Suffers Data Breach

credential phishing campaigns

San Francisco Employees’ Retirement System (SFERS) admitted it become a victim of a data breach that exposed information of around 74,000 beneficiaries, including names, addresses, birth dates, banking and IRS data, and other details. However, SFERS clarified that no social security numbers or bank account details were exposed in the breach. In case any member had registered at the site, it is also possible that their login name and security questions and answers may have been compromised.

According to the official statement, On February 24, 2020, an unauthorized third-party accessed its database that an SFERS vendor, 10up Inc., was using in a test environment. 10up discovered the intrusion later on March 21 and reported SFERS about the security incident on March 26, 2020.

“On March 21, 2020, 10up Inc. learned that this server had been accessed by an outside party on February 24, 2020.  The vendor promptly shut down the server and began an investigation.  The vendor found no evidence that the information of SFERS members was removed from its server, but at this time, it cannot confirm that the information was not viewed or copied by an unauthorized party.  On March 26, 2020, the vendor notified SFERS of the server breach and both SFERS and the vendor continue to investigate the potential exposure of data,” the breach notification said.

SFERS stated that it is going to offer all the affected members a complimentary one-year membership of Experian’s credit monitoring service. The organization also urged the members to monitor their credit history and bank accounts for any authorized transactions, as the exposed information can be used in phishing attacks.

Risks with Exposed Data

Cybercriminals make use of the stolen data in credential stuffing attacks. In credential stuffing attack, a hacker tries to log into various user accounts with known email and password combinations. Attackers take advantage of the fact that most people reuse email ids and passwords for multiple accounts. Once hackers gain access to an account, they try hacking other accounts by changing password combinations. The compromised accounts are used for a variety of purposes including spam, phishing, fraud, identity theft attacks, and selling on darknet forums.

 

Remote Workforce in APAC Region Not Fully Secure: Report

Data Breach at CDSL

The COVID-19 outbreak forced organizations globally to work remotely, while cybersecurity risks increased exponentially as threat actors prey on fear and disinformation to launch cyberattacks.

According to CrowdStrike’s “2020 Work Security Index” survey, around 54% of employees working at home believe their organizations are likely to suffer a cyberattack during the COVID-19 pandemic. The study surveyed 4,048 senior decision-makers globally including 1,780 from four Asia-Pacific markets– 252 from Singapore, 526 in India, 502 from Japan, and 500 in Australia.

The survey found a 100x increase in COVID-19 themed malicious attacks from February to March 2020 alone. Around 30% of SMBs surveyed believe that cyberattacks are more likely to occur during the COVID- 19 situation than before; 30% of them stated they are less likely to use company-provided devices to work from home compared to large companies (68%).  Nearly 73% of senior business decision-makers surveyed admit that they are using personal devices to work from home.

In India, 9 out of 10 security leaders surveyed believe that the devices they use at home are secure from advanced cybersecurity threats. Nearly 61% of Indian business leaders surveyed think their business is more likely to suffer a cyberattack during the current crisis, while 45% of them opposed it. According to the survey, 72% of respondents are using personal devices like laptops and mobile devices, to do their jobs in India, while 93% use a mix of company-issued and personal devices. 62% of organizations in India stated that they provided additional security training for their employees to avoid threats while working from home.

CrowdStrike also recommended certain guidelines to improve remote workers cybersecurity, which include:

  • Update your current cybersecurity policy to include remote working
  • Implement a secure access plan for BYOD on corporate networks
  • Prepare for sensitive data being accessed via unsecured networks
  • Maintain cybersecurity hygiene and comprehensive visibility into endpoints
  • Continue cybersecurity training as coronavirus-themed scams escalate
  • Prepare crisis management and incident response plans to be executable by a remote workforce

Remote Working Threatens Business Operations

A similar study from HiveIO revealed the impact of COVID-19 on corporate data security. It highlighted the effect of the new virtual economy on security professionals and organizations across a wide variety of industry verticals. Nearly 85% of organizations anticipate a larger remote workforce will threaten operations because of new risks. The study stated that several organizations are unable to introduce new security solutions designed to improve the efficiency of work-from-home employees. Around 70% of respondents admitted that they have suffered increased costs due to the ongoing pandemic. Nearly 25% of respondents reported shrinking staff support and another 18% fear additional staff reductions.

 

Coinsquare Data Theft Flags Insider Threat Issue

Insider Threats

Coinsquare, a Canadian crypto exchange that enables its users to trade Bitcoin, Ethereum, and other cryptocurrencies, confirmed that its customer information was stolen by an ex-employee last year. Cybercriminals laid their hands on this data and are now reportedly going to carry out SIM swapping attacks.

According to Stacey Hoisak, Coinsquare’s general counsel, the data theft took place a year ago by a now ex-employee of the company from the Customer Service system. They had notified the law enforcement and data protection authorities concerned, as well as all known impacted users at the time as soon as the data theft was detected.

As per Vice Media’s interview with an anonymous hacker, the cybercriminals want to “embarrass the company (Coinsquare) for claiming they were the most secure Canadian exchange on their website.” Initially, they thought of selling or auctioning this data which includes CoinSquare clients’ email addresses, phone numbers, and physical addresses. However, they later thought of using it in SIM swapping attacks as it would bring them additional monetary benefits.

Since the data theft, Coinsquare has streamlined and introduced sophisticated internal controls to avoid insider threats. They have also re-written their older data management policies and changed their customer management systems for an increased level of protection.

Insider Threat: A Rising Concern

A recent survey report “2020 Cost of Insider Threats: Global Report” from the Ponemon Institute revealed that insider threats increased by 47% from 3,200 in 2018 to 4,716 in 2020. It also revealed that the cost of insider threat incidents surged by 31% from $8.76 million in 2018 to $11.45 million in 2020.

According to the survey, negligent employees are responsible for around 62% of security incidents, costing organizations an average of $307,111 per incident. The fastest-growing industries for insider threats are the retail sector (38.2% two-year increase) and the financial services sector (20.3% two-year increase). It takes 77 days for a company to contain each insider threat incident, and only 13% of the analyzed security incidents were contained in less than 30 days, the report stated.

8 in 10 Australian Companies Say Cybersecurity Investments Fail

Cryptocurrency scams in Australia

A new research from Accenture revealed that 80% of companies in Australia believe that their cybersecurity investments are failing. The research also reported a 50% increase in security incidents in Australia from 2018 to 2019.

According to the survey, nearly 91% of respondents admitted that their organizations are spending more than 20% of the cybersecurity budgets on advanced security technologies to bolster their cyber resilience.

Around 70% of organizations stated that staying ahead of attackers is a constant battle. The survey also revealed that the security costs incurred to strengthen cyber resilience are skyrocketing, with 43% of organizations reported their expenditure increased within their cybersecurity space in the last 24 months, and 11% recorded costs rising more than 25% in the same period. Only 43% of respondents stated that they are actively protected by their security programs, while 90% of all breaches in Australia lasted more than 24 hours.

Other Key Findings Include:

  • More than half (58%) of breaches in Australian companies are identified by the security team
  • 38% of security breaches at Australian organizations are indirect attacks that target weak links in the supply chain
  • 38% of breaches have no impact on organizations
  • Almost three-quarters (71%) of breaches were fixed in less than 15 days

The research findings are based on the responses of 373 security leaders in various Australian companies.

Joseph Failla, Security Lead, Accenture Australia and New Zealand, said, “Now, more than ever, cybersecurity is an increasing challenge for Australian organizations, as the prevalence of sophisticated and insidious cyberattacks continues to grow. Organizations are grappling with the new and sudden reality of COVID-19 which is putting even greater strain on their already under-pressure security systems.”

“Using threat intelligence and more strategic approaches to cybersecurity can help Australian organizations stay protected and better equipped to respond effectively when the enemy strikes. By becoming more resilient and agile, businesses will be able to grow confidently through this turbulent time,” Failla added.

Australia Ranked World’s 15th Secure Country

A study on global comparison of cybersecurity defenses ranked Australia as the world’s 15th secure country. According to the security research firm Comparitech, Australia climbed 12 positions in its latest cybersecurity ranking report. The study evaluated 76 countries’ exposure to security vulnerabilities to find which countries are well prepared for cyberattacks. Comparitech stated that it found improvement in Australia’s cybersecurity readiness with an overall score of 13.95 when compared to the previous year’s 16.34 (lower scores represent better ranking). The scores are based on the indicators of compromise like the percentage of mobiles infected with malware, the frequency of financial malware attacks, and the number of computers infected with viruses in a country.

 

Beware of these “fleeceware” VPN apps on Apple App Store

Beware of these “fleeceware” VPN apps on Apple App Store, SonicWall hacked

Avast, a maker of digital security and privacy products, has discovered and reported three fleeceware apps to Apple’s App Store, which overcharge users, do not provide the services they promote and appear to be “fleeceware”. The apps are available on the Apple App Store as Beetle VPN, Buckler VPN, and Hat VPN Pro, and according to data from Sensor Tower, a mobile apps marketing intelligence and insights company, the apps have been downloaded over 420K, 271K, and 96K times, respectively, between April 2019 and May 2020.

How to identify Fleeceware

“Fleeceware” has a characteristic of overcharging users for functionality that is widely available in free or low-cost apps.

Fleeceware apps can come in any category. The reviews for fleeceware apps tend to look fake, with multiple users leaving a review like “Exciting” or “My love”, and real reviews reveal the app does not actually work, or unknowingly charge users large sums of money. Fleeceware apps typically offer a free, three to seven day trial, but can require users to enter their payment information before the trial begins, and automatically charge users unreasonable sums of money after the trial ends.

Users should carefully note what happens after an app’s trial period ends and how much an app will charge after a free trial period, to check if the charge will be automatically deducted from their card on an ongoing basis unless they cancel the subscription.

What Avast researchers observed

The apps claim to be VPN apps, charging $9.99 (USD) a week for a weekly subscription once their free three-day trial expires. The apps all have high ratings, ranging from 4.6 to 4.8, and include enthusiastic reviews, all similarly written, which Avast thinks could potentially be fake. In between the rave reviews, there are a few reviews warning of the scams. The apps’ privacy policies also have very similar language and structure.

Avast researchers installed the three apps and successfully purchased subscriptions to each app; however, when they tried to use the VPNs, the apps only provided subscription options again. After attempting to purchase the subscriptions again, Avast researchers were notified they already have a subscription and thus were unable to establish a VPN connection using any of the apps.

“Fleeceware apps fall into a gray area, because they are not malicious per se, they simply charge users absurd amounts of money for weekly, monthly or yearly subscriptions for features that should be offered at much lower costs. In this case, the VPNs are being sold for $9.99 (USD) a week, when trustworthy VPNs cost ten times less,” said Nikolaos Chrysaidos, Head of Mobile Threats & Security at Avast. “These apps are not behaving maliciously so they circumvent screening processes to be added to the official app stores’ that users trust. With many people turning to VPN apps to protect their data while working remotely, this illustrates how important it is for users to research VPN apps before installing them, including who is behind the product, their track record with other products and user reviews, and experience in offering security and privacy apps.”

You can read the privacy policies of these apps here:

Buckler VPN: https://bucklervpn.com/policy.html

Hat VPN: https://hatvpnpro.com/data-policy.html

Beetle VPN: https://beetlevpn.com/data-policy.html

Over 329,000 Canadians’ Data Compromised After Cyberattack on CPA Canada

CPA Canada cyberattack

The Chartered Professional Accountants of Canada (CPA)  disclosed a security breach that affected over 329,000 members and stakeholders of the association. It is said that unknown hackers compromised the CPA Canada website and obtained information related to the distribution of its magazine. The exposed information includes names, home addresses, email addresses, and other sensitive information.  However, CPA clarified that information like passwords and credit card numbers were protected by encryption. “There is no evidence that the encryption keys were affected in this incident and we have no reason to believe the encryption was compromised,” the company said in its security incident report.

According to CPA Canada, the attack by unauthorized third-party members occurred between November 30, 2019 and May 1, 2020. The company warned the compromised data could be used in phishing scams and urged the affected users to remain vigilant. While hackers behind the cyberattack are unknown, CPA Canada stated that it beefed up its security measures and contacted the Canadian Anti-Fraud Centre and privacy authorities for further investigation on the incident.

CPA Canada is the national organization representing the Canadian accounting profession, with over 210,000 chartered professional accountants in Canada and around the world. It conducts research on business issues, supports the setting of accounting, auditing and assurance standards for businesses, non-profits, and the government.

“CPA Canada worked closely with cybersecurity experts to conduct its investigation, to ensure that its systems were promptly secured and to identify what information was involved. In addition to notifying potentially affected individuals directly, we have contacted law enforcement, the Canadian Anti-Fraud Centre, and privacy authorities where applicable,” the company said in a statement.

The statement added, “We encourage individuals to remain vigilant, as always, about any emails, text messages or phone calls you may receive asking you to provide sensitive information or click on links or attachments, or that use urgent or threatening language, even if they appear to come from CPA Canada or an individual or company you know or trust.”

Canadians Refuse to Divulge Personal Data

A survey report from the Canadian Internet Registration Authority (CIRA) revealed that most Canadians refuse to provide their personal information to access free online services. The report “2020 Canadians Deserve a Better Internet Report” disclosed that except online banking services (52%), most Canadians stated that they are unwilling to share their sensitive data for better products and services online. Only 26% of respondents admitted that they are willing to give personal information in return for better video streaming services. Around 23% of Canadians stated that they disclose personal details to use social media services and 15% are willing to share personal data for access to internet-connected devices like baby monitors.

 

Looking for a Job? Beware of Fake CV Phishing Scams!

phishing scam, fake CV phishing scam

The unemployment ratio around the globe has skyrocketed amid the COVID-19 crisis painting a somber image of what can be termed as “The Great Economic Depression 2.0”. As per CNBC’s report, the unemployment rate in the U.S. alone is expected to reach around 20%. With 20.5 million jobs already lost in April, economists estimate another 8.33 million job cuts in May. However, cybercriminals are using this opportunity for luring this already vulnerable group of unemployed people into fake CV phishing scams.

The Fake CV Phishing Scam

Researchers at Check Point, a cybersecurity service provider, have discovered that in May 2020, nearly 250 new domains have been registered that consist of the word “employment.”  Of these, 7% of domains were found to be malicious and 9% were ought to be suspicious. They also observed a doubling-up of the ratio for the past two months with 1 out of every 450 malicious files being a fake CV phishing scam.

The cybercriminals lured potential victims into opening the malicious .xls attachments, firstly by naming the files as a person’s name, which indicated that it is that person’s CV and secondly by using phishing email subject lines such as “applying for a job” or “regarding job.” Victims were then asked to render “enable content” permission, which further initiated the malicious macro file downloading the final payload like a malware, trojan, ransomware.

The U.K. and Romanian Version

Check Point researchers also found another version of a similar campaign running in the U.K. and Romania.

fake CV phishing scam
Image Source: Check Point

However, these emails had a different subject line and a different file format of the malicious attachment. Its subject said, “CV from China” and contained an ISO format file (CV.iso). On opening this .iso file, a malicious .exe file (CV.exe) would run, installing an info-stealing malware on the victim’s system.

With nations coming out of the lockdown and businesses gradually coming back to life, economists expect to see a dip in unemployment ratio from June onwards, while cybersecurity experts hope to see a subsequent dip in the fake CV phishing scams.

1...205206207...410Page 206 of 410