Home Blog Page 207

Hackers Expose 5 Bn Records in 2019, Costing U.S. Firms $1.2 Tn

BlackMatter Group, Volvo Cars ransomware attack

According to a survey report from identity and access management firm ForgeRock, threat actors exposed more than 5 billion consumer records in 2019, costing over $1.2 trillion to organizations in the U.S.

The report “2019 Consumer Identity Breach Report” revealed that the total data breach incidents over the last two years have cost U.S. enterprises $1.8 trillion. The survey found that the data breaches increased both in numbers and cost. While unauthorized access was the most common attack vector accounting to 40% of breaches,  ransomware and malware was at 15% and phishing at 14%.

Attacks on the Health Care Sector

According to the report, the health care industry emerged as the most targeted industry in 2019, accounting for 382 breaches and costing over $2.45 billion in 2019. Health care providers have become an easy target for attackers, as they hold sensitive information of their patients. Medical records are the most targeted data type in Q1 2020, accounting for 25% of all exposed data. Even though health care being the most targeted industry, technology firms had the highest number of records compromised from data breaches with over 1.37 billion exposed in 2019, costing a total of over $250 billion.

Data Breaches in 2020 Outpace 2019

According to the Q1 2020 data,  this year is set to outpace 2019 in terms of records breached, despite the fact the number of breaches dropped by 57%. There have been 92 data breaches affecting 1.6 billion records in Q1 2020 alone, accounting to 9% more records than Q1 2019. Health care is still the most breached industry in Q1 2020, accounting for 51% of the incidents, which may be due to hackers targeting health care organizations amid the COVID-19 pandemic.

Other Key Findings Include:

  • After health care, the banking, insurance, and financial industries was the second most targeted in 2019, accounting for 12% of all breaches. This is followed by education (7%), government (5%), and retail (5%)
  • Social security numbers and date of birth details were the most targeted data – accounting for 37% of breached information, yet this is down from 54% in 2018
  • Name and addresses (18%) and personal health information (17%) were the second and third most breached data types, respectively
  • Personally identifiable information (PII) remained the most targeted data by attackers and was exposed in 98% of 2019 breaches

Eve Maler, CTO at ForgeRock, said, “When it comes to data breaches, we’re seeing the biggest cybersecurity problem continues to be an identity problem. The Consumer Identity Breach Report’s findings demonstrate that enterprises need to increase their identity and access management maturity. The secret is democratizing data control so organizations can allow known users to hop onto authentication express lanes for a great experience, entrusting them with convenient consent options, and make bad actors jump through extra hoops to help prevent fraud.”

 

Indian Professionals to Set Up Intensive Cybersecurity Training Programs: JA Chowdary

SideCopy Malware Campaign

Covid-19 has pushed everyone to go digital, but they need to adapt and learn to use digital assets securely, said JA Chowdary, IT Advisor, Government of Tamil Nadu, India. Speaking at EC-Council’s Masterclass Virtual CISO Summit on 4 June, Chowdhury said even farmers and non-technical people in India are now using digital tools, but they face the risk of getting hacked, and their data could be stolen. He encouraged Indian startups to create ”Made in India” apps that are more secure. Apps from other nations could have malware and ransomware, he said. Chowdhury also spoke about the educational initiatives taken by professionals in the private sector who are working with some state governments to set up training schools and platforms to spread cybersecurity awareness.

JA Chowdary, IT Advisor, Government of Tamil Nadu, India.
JA Chowdary, IT Advisor, Government of Tamil Nadu, India.

“I observed that the state of Andhra Pradesh was the first to implement eSeva. But IIT students did ethical hacking on the state government assets and found vulnerabilities. We advised the government about this,” said Chowdary.

eSeva is a portal for government to citizen services.  It lists various services, government notices, forms, and orders. It is also a gateway to other industry portals in the state. A note on the homepage says the portal uses “State-of-the-art” technology.

Chowdary said that there are ongoing efforts to set up training institutes and online platforms like Upgrad to increase cybersecurity awareness and address the skills shortage in the country, naming the International Institute of Digital Technologies (IIDT) as an example.

Chowdary who is also the Chairman of the Indian Blockchain Standards Committee, said “This institute will be run by industry professionals and will implement the latest cyber curriculum. It will offer a one-year course. We also plan to introduce a two-year cybersecurity program in Coimbatore run by industry professionals. The pedagogy will include business case studies,” informed Chowdary.

In his role as IT Advisor to the Government of Andhra Pradesh, India, his task was to mobilize investments, create an IT ecosystem, and create employment opportunities. Chowdary will also serve as ex-officio Secretary to the Government in the Chief Minister’s Office. His role includes advising and assisting the government in bringing in investments, generating employment, and encouraging innovation and start-up activities.

He earlier served as the Chairman of the Board of Software Technologies Parks of India (STPI), Hyderabad and Chennai, India. He was one of the key personalities instrumental in bringing about an IT revolution in Hyderabad. He is a well-networked in the Indian IT industry and is a close advisor to former Andhra Pradesh Chief Minister N. Chandrababu Naidu.

Cyberattacks to be the Biggest Challenge for Companies for the Next 12 Months: Report

Cloud Security

Cyberattacks and cyberthreats continue to be the biggest challenges faced by organizations. Cloud data management firm Veeam in its latest “2020 Data Protection Trends Report” has highlighted the same as well as stated that an average ransomware attack costs over $80,000 to restore data. The research paints and alarming figure at a time when organizations are looking to transform their business operations and customer service while embracing digital transformation. Digital Transformation (DX) is at the top of most CXOs’ agendas; in fact, DX spending is expected to approach $7.4 trillion between 2020 and 2023, a CAGR of 17.5%.

The report also indicates that nearly half the global organizations have been impacted in their digital transformation journeys by unreliable, legacy technologies as well as lack of IT skills or expertise which stood at 44%.

“It’s great to see the global drive to embrace technology to deliver a richer user experience, however the Achilles Heel still seems to be how to protect and manage data across the hybrid cloud.  Data protection must move beyond outdated legacy solutions to a higher state of intelligence and be able to anticipate needs and meet evolving demands.  Based on our data, unless business leaders recognize that – and act on it – real transformation just won’t happen,” said Danny Allan, CTO and SVP of Product Strategy at Veeam.

Other key highlights of the report include:

  • The biggest challenge that will impact organizations within the next 12 months is cyberthreats (32%). Shortage of skills to implement technology (30%) and meeting changing customer needs (29%) were also cited as key hurdles.
  • Lack of staff to work on new initiatives (42%) was cited as the most impactful data protection challenge organizations currently have. Lack of budget for new initiatives and lack of visibility on operational performance were also cited.
  • Over a third (39%) of respondents said the ability to improve the reliability of backups is the most likely reason to drive their organization to change its primary backup solution.
  • Over a quarter (27%) of organizations’ data is backed up to the cloud by a Backup as a Service (BaaS) provider. 14% of data across organizations globally is not backed up.
  • Over two in five (43%) organizations plan to leverage cloud-based backup managed by a BaaS provider within the next two years.

“By already starting to modernize their infrastructures in 2020, organizations expect to continue their DX journey and increase their cloud use. Legacy solutions were intended to protect data in physical datacenters in the past, but they’re so outdated and complex that they cost more money, time, resources and trouble than realized. Cloud Data Management provides a simple, flexible and reliable solution that saves costs and resources so they can be repurposed for future development. Data protection can no longer be tied to on-premises, physically-dedicated environments and companies must have flexible licensing options to easily move to a hybrid/multi cloud environment,” Allan concluded.

Remote Work Jeopardizes Corporate Network Security: Report

Remote Security Policy, Remote Work Jeopardizes Corporate Network Security: Report

A recent survey from security firm CyberArk revealed how cyber habits of remote workforce is compromising business systems and making sensitive data vulnerable to attacks. It stated that the surge in remote work brought a new wave of security concerns.

The survey “How Cyber Habits at Home Threaten Corporate Network Security” revealed that work from home employees threaten corporate security.  Nearly 93% of them admitted they reuse passwords and 29% allowed other family members to use their company-issued devices for personal activities like schoolwork, shopping and gaming. It is found that 77% of remote employees are using unmanaged, insecure BYOD (Bring Your Own Devices) to access corporate systems.

While 37% said they insecurely save passwords in browsers on their corporate devices, 66% of employees stated that they are using third-party communication tools like Zoom and Microsoft Teams while working at home. The survey also highlighted that 94% of IT and security teams are confident in their ability to secure the new remote workforce, however, 40% have not increased their security protocols despite the significant change in the way employees connect to corporate systems and the addition of new productivity applications.

The study surveyed 3,000 remote workers and security decision makers across the U.S., U.K., France, and Germany,  and is intended to determine the current scenario of cybersecurity during the ongoing COVID-19 crisis.

“The rush to onboard new applications and services that enable remote work combined with insecure connections and dangerous security practices of employees has significantly widened the attack surface and security strategies need to be updated to match this new dynamic threat landscape. This is especially true when it comes to securing privileged credentials of remote workers, which if compromised could open the door to an organization’s most critical systems and resources,” the report said.

Marianne Budnik, CMO of CyberArk, said, “The security posture of organizations continues to be tested as many remote employees face daunting challenges balancing productivity and security across their professional and personal workspaces. As more organizations extend work-from-home policies for the long term, it’s important to capture lessons learned from the initial phases of remote work and shape future cybersecurity strategies that don’t require employees to make tradeoffs that could put their company at risk.”

Remote Workers Lack Cybersecurity Training

A similar research from cybersecurity firm Promon found that 66% of remote workers in the U.K. haven’t been trained on cybersecurity in the past 12 months, whereas 77% said that they aren’t worried about the security while working remotely. Around 61% said they are using personal devices while working from home. This is adding further security concerns as many of these are likely to be less secure than corporate-issued ones. Cybercriminals are exploiting the current working conditions by carrying out COVID-19-related phishing campaigns and other malicious activities. The findings are based on the responses from 2,000 remote workers in the U.K.

 

Japanese Cryptocurrency Exchange Coincheck Hacked; Customers’ Emails Exposed

Cryptocurrency mining

Cryptocurrency exchange Coincheck admitted that it has become a victim of a security incident in which unknown hackers accessed emails sent to the firm by its customers.

In an official statement, the Tokyo-based firm stated that attackers gained access to DNS records for the coincheck.com domain at the firm’s third-party domain registrar, and altered the records to forward incoming emails to them. It is believed that some emails received between May 31  and June 1, 2020 could be illegally accessed by unauthorized members.

Coincheck stated that compromised mails could have exposed email addresses listed in the recipient and the information listed in the customer’s email, which could later be exploited by cybercriminals. It also said that certain personal information like names, registered address, birth date, phone number, and ID Selfie were exposed in the incident.

While the hackers behind the security incident are unknown, Coincheck clarified that customers’ digital assets are not affected. The company also suspended the remittance of crypto assets temporarily. “Although there is no impact on your assets at this time, we will stop the remittance of crypto assets in our service again, considering the progress of the investigation by the domain registration service operator. Services such as depositing/withdrawing Japanese Yen and receiving/purchasing/selling crypto assets can be used as usual,” Coincheck said.

Coincheck Massive Data Breach

Earlier, in a major cryptocurrency heist, Coincheck lost 58 billion yen ($530 million) after hackers compromised its exchange platform. According to Reuters, the digital coins were stored in a hot wallet instead of the more secure cold wallet, which is not connected to the internet. Coincheck assured that it would return about 90% with internal funds. Japan’s finance regulator Financial Services Agency instructed the company to improve its operations and to submit an incident report.

Surge in Cryptocurrency Crimes

According to a report from U.S. based blockchain security firm CipherTrace, the cryptocurrency industry experienced a huge surge in thefts and frauds in 2019. In its “2019 Cryptocurrency Anti-Money Laundering (AML)” report, CipherTrace revealed that cryptocurrency crimes across the world hit over $4.3 billion in 2019. The report stated that hackers are using sophisticated methods to beat even advanced cybersecurity measures. It also highlighted that cybercriminals robbed around $125 million in Ethereum, Bitcoin, and other digital currencies from different cryptocurrency exchanges in Q2 2019.

 

DopplePaymer Gang Claims it Hit NASA Contractor with Ransomware Attack

NASA

The world was in awe of the successful launch of SpaceX and NASA’s first human-operated rocket. It was a breakthrough and a huge leap forward towards placing humans in space. Soon, wishes and congratulatory messages started pouring in, however, the celebratory mood turned gloomy when an unusual pleasantry was exchanged by the DopplePaymer ransomware gang. They congratulated both SpaceX and NASA for the successful launch, but also announced that they infected a NASA IT contractor with a ransomware attack.

We congratulate SpaceX & NASA for a successful launch. But as for NASA, their partners again don’t care for their data…

– DopplePaymer Ransomware Gang

NASA IT Contractor Concedes Ransomware Attack? 

The cybercriminals published this post on a dark web portal, Dopple Leaks, which is DopplePaymer gang’s auction website launched in February 2020. They said that the network perimeter of Digital Management Inc. (DMI), a Maryland-based company providing managed IT and cybersecurity services to corporate and government agencies, was breached. The notorious gang placed the URL of the company hacked along with 20 archive files as proof of their breach. However, this is not the end of the damages done. The gang also posted a long list of 2,583 servers and workstations on DMI’s internal network that have been encrypted and held-up for ransom.

NASA’s Warning

Since COVID-19 forced a majority of Federal workforce to be confined to their homes and work remotely, NASA had warned about a “new wave” of cyberattacks targeted at all Federal Agency Personnel. An agency-wide memo issued by the CIO stated that “NASA employees and contractors should be aware that nation-states and cybercriminals are actively using the COVID-19 pandemic to exploit and target NASA electronic devices, networks, and personal devices. Some of their goals include accessing sensitive information, usernames and passwords, conducting denial of service attacks, spreading disinformation, and carrying out scams.”

The Online Auction Websites Trend

Back in the day, ransomware operators demanded a ransom in exchange for decryption keys. If the victim refused to give in, they simply did not release the keys. This forced the users to completely wipe off previous data and/or replace old systems with new one’s post plugging the security holes. But this model now seems to be an outdated one. However, the ransomware gangs have now started stealing critical and confidential data before encrypting the compromised systems. They then use the stolen data to leverage negotiations. Many ransomware gangs such as Sodinokibi  (also known as REvil) have launched auction websites where they first publish few samples of the leaked data for compelling the victim. If the victim still refuses to pay the ransom, then they hold an auction to sell this leaked data. Either way, it is a win-win scenario and a full-proof plan for the ransomware operators.

80% of Organizations Suffered a Cloud Data Breach in the Past 18 Months

Cloud Security, 80% of Organizations Suffered a Cloud Data Breach in the Past 18 Months

A new research has revealed that 80% of organizations suffered at least one cloud data breach in the past 18 months, while 43% of companies reported 10 or more cloud data breaches.

Ermetic’s research disclosed that nearly 80% of respondents are unable to identify excessive access to sensitive data in IaaS/PaaS environments,  while the top three security concerns associated with cloud production environments include:

  • Security misconfiguration (67%)
  • Lack of adequate visibility into access settings and activities (64%)
  • Identity and access management (IAM) permission errors (61%)

According to the research, most of the cloud data breaches occur due excessive permissions to access cloud data. Cybercriminals could use this opportunity for malicious activities like stealing sensitive data, deploying malware, or disrupting critical business operations. “Excessive permissions may go unnoticed as they are often granted by default when a new resource or service is added to the cloud environment,” the report said.

Shai Morag, CEO of Ermetic, said, “Even though most of the companies surveyed are already using IAM, data loss prevention, data classification and privileged account management products, more than half claimed these were not adequate for protecting cloud environments. Two-thirds cited cloud-native capabilities for authorization and permission management, and security configuration as either a high or an essential priority.”

Some other key findings of the report include:

  • Top three cloud security priorities are compliance monitoring (78%), authorization and permission management (75%), and security configuration management (73%)
  • Top cloud access security priorities are maintaining confidentiality of sensitive data (67%), regulatory compliance (61%) and providing the right level of access (53%)
  • Top cloud access security challenges are insufficient personal/expertise (66%), integrating disparate security solutions (52%) and lack of solutions that can meet their needs (39%)

The research findings are based on the responses from 300 senior security decision makers in the U.S. across the banking (12%), insurance (10%), health care (11%), government entities (8%), utilities (9%), manufacturing (10%), retail (9%), media (11%), software (10%), and pharmaceutical (10%) sectors.

 

Not a Hoax! REvil Ransomware Operators Launch Auction Website

ransomware

The operators of REvil ransomware, better known as Sodinokibi, have launched an auction website on the dark web, Happy Blog, to sell stolen data from victims who have denied paying ransom.

By Pooja Tikekar, Feature Writer at CISO MAG

REvil is auctioning the stolen data of a U.S. food distributor and a Canadian agricultural company, for a starting price of $100,000 and $50,000 respectively. However, bidders are expected to agree to the following rules:

  • To bid on an auction, you must register for each auction separately.
  • After registration, you will need to make a deposit of 10% of the starting price. At the end of the auction the amount will be refunded (except for blockchain commission).
  • If you have not paid your bid on the winning auction, you will lose your deposit. This is to ensure that none of the bidders make fake bids.
  • All computational operations are performed in the cryptocurrency Monero (XMR).
  • By clicking Continue you confirm that you agree to the terms above. You will be given a username/password and details of deposit payment.

In their auction website announcement, the REvil operators hinted that other auctions are coming soon.

REvil has made dozens of high-profile victims, including healthcare facilities and local governments. Furthermore, its distributors’ toolkit has expanded way beyond leveraging unpatched software flaws to gain a foothold in computer networks. It follows a Ransomware-as-a-Service (RaaS) model and the ransoms raked in by the crooks reportedly reach hundreds of thousands of dollars per compromised organization.

REvil’s Online Auction Threats

REvil operators recently carried out a cyberattack on New York-based law firm Grubman Shire Meiselas & Sacks. In the attack, the cybercriminals claimed to have stolen nearly 756 GB data of several high-profile celebrities like Lady Gaga, Elton John, Robert DeNiro, and Madonna. Grubman Shire Meiselas & Sacks is a premier entertainment and media law firm handling the legal profiles of Hollywood A-listers. They also threatened to hold an online auction of pop sensation Maddona’s stolen data at a reserve price of $1 million.

REvil Amid COVID-19

The operators also targeted California-based biotechnology company 10x Genomics to steal sensitive information, as the firm is part of an international alliance sequencing cells from patients who have recovered from the Coronavirus.

About the Author

Pooja Tikekar is a Feature Writer, and part of the editorial team at CISO MAG. She writes news and feature stories on cybersecurity trends.

More from the author.

 

 

Hackers Selling Stolen YouTube Credentials on Dark Web: Report

Hackers Selling Stolen YouTube Credentials on Dark Web: Report

Security researchers from cyber intelligence firm IntSights revealed that they have noticed a surge in demand for stolen YouTube account credentials on several darknet forums. Researchers also stated that threat actors may use these account credentials to spread malware, launch fraud scams against viewers, or even use these it to blackmail the account owners.

“Over the past few weeks, IntSights researchers have observed yet another new trend in black markets and cybercrime forums that has rapidly growing demand: stolen credentials for prominent YouTube accounts. It should come as no surprise that global reliance on the internet has skyrocketed during quarantine, with surges in internet usage and streaming services in particular,” said Etay Maor, CSO at IntSights.

According to researchers, cybercriminals use multiple attack vectors to target YouTube channel owners. It is found that most recent accounts were stolen from databases containing Google credentials as well as from malware-infected computers.

Maor also highlighted that underground hacking forums run a quick poll to find if this is of interest to other forum members. One such poll revealed that 80% of the forum members wanted to see more YouTube credentials to be put up on sale. Researchers also found a seller auctioning over 680 accounts for a starting price of $400, some of which had over 40,000 subscribers.

Image Courtesy: IntSights

“YouTube accounts from compromised computers or from logs of credentials can be of high value. While smaller channels may not be as lucrative as larger ones, YouTubers rely on them as revenue streams and might be willing to pay money to attackers to get their content and access to their channels back. Below is an example of such a case from a Google support thread,” Maor added.

Hackers Flood Dark Web with Stolen Data

In recent security discovery, researchers found and reported a massive data breach, in which the members of the “Shiny Hunters” hacking group compromised 73.2 million user records from over 11 companies and kept them on the darknet for sale. The hackers are from the same group who are behind the Tokopedia data breach, in which 91 million user records were compromised and kept on sale on the hacking forums for $5,000. Later, the group breached India-based online learning platform Unacademy, which exposed details of 22 million users and kept the records for sale on the darknet forums for $2,000.

Several incidents have been reported in recent times on hackers selling stolen information on the darknet markets. According to Cyble, attackers were also selling over 267 million Facebook records for £500 (US$623) on dark websites and hacker forums.  The records contain information that could allow attackers to perform spear phishing or SMS attacks to steal credentials.

 

8Belts Exposes PII of e-learners in a Data Breach: Report

Data breach

Researchers from cybersecurity firm vpnMentor discovered a data breach related to a popular Spanish e-Learning platform 8Belts, exposing personal data of over 100,000s of e-learners across the globe.

In its primary investigation report, the researchers claimed that 8Belts database was stored on a misconfigured Amazon Web Services (AWS) S3 bucket which resulted in the data leakage. “By our estimates, the breach – which originated from a misconfigured Amazon Web Services S3 bucket – affected 100,000s of people across the globe, exposing their private data, and making them vulnerable to dangerous attacks and frauds from cybercriminals. By not securing its user data, 8Belts compromised the safety and privacy of its users and the future of the company itself,” the researchers said.

According to VpnMentor, the exposed database contained different forms of Personally Identifiable Information (PII) of 8Belts users, including:

  • Full names
  • Email addresses
  • Phone numbers
  • Dates of birth
  • Country of residence
  • National ID numbers
  • Skype IDs

“All of these private data could be combined and exploited in various ways to target those exposed for fraud, theft, and online attack. While most of 8Belts’ users reside in Spanish-speaking countries, people from all over the world were exposed. Records included data from residents in almost every country on the planet, across six continents. From the U.S. to Uzbekistan, Australia to Angola, Belgium to Barbados, this data breach covered the entire globe,” researchers added.

In addition to PII data, information like students’ account details, course history, performance report, courses they had taken, account user IDs, evaluation scores, and certificates of completion were also exposed in the incident.

Data Breaches on E-Learning Platforms

Recently, India-based online learning platform Unacademy suffered a data breach that exposed details of 22 million users. It was also found that the unknown hackers kept 21,909,707 user records for sale at $2,000 on darknet forums. The compromised information included usernames, hashed passwords, date of joining, last login date, account status, email addresses, first and last names, and other account profile details. Hemesh Singh, Co-founder and CTO of Unacademy, confirmed the data breach and stated that only 11 million users were affected and no sensitive information like financial data, location or passwords were exposed.

 

1...206207208...410Page 207 of 410