Home Blog Page 225

PII of 115 Million Pakistani Mobile Users Up for Sale on Dark Web

Dark Web

Pakistan-based cybersecurity company, Rewterz Threat Intelligence, discovered a sale advertisement of 115 million Pakistani mobile users’ data being put up on the dark web by an undisclosed hacker.

Researchers at Rewterz said that the threat actors are monetarily motivated as they have placed a minimum price tag of 300 bitcoins amounting to approximately $2.1 million for the leaked data. Researchers added that the threat actors hold a premium account on the dark web forum where it has been advertised. The uploaded data dump had been recently hacked and was still being updated as per the advertisement. However, it is still unclear if any specific telecom operator(s) or all telecom operators in Pakistan fell victim to this malicious attack, and whether the data was collected through a single data breach or over a period of time from multiple data breaches.

The threat actors have organized the data neatly in a CSV file. It contains personally identifiable information (PII) of all its users including name, address, phone numbers as well as their CNIC and NTN numbers.

The Dark Web Ad says…

PM (personal message) offers and Questions

Database is freshly hacked this week. That data was still being updated as I took the data down. Beautifully organized in a CSV with headers for your pleasure.

Headers: ID, MSISDN, ACT_DATE, STATUS, L_DATE, NAME, CNIC, TAX_NO, ADDRESS, PHONE1, PHONE2, CITY, REGION

Starting Cost: 300BTC (Bitcoins)

Rewterz researchers said, “It might be possible that these (compromised) telecoms companies have failed to disclose the data breach because they aren’t aware of the hack or have intentionally opted not to reveal it. Either ways, it’s concerning for customers whose information has been published.”

Freedom Mobile Users’ Data Leak

Earlier, Freedom Mobile, a Canada-based mobile network company, suffered a data breach that exposed the personal information of around 1.5 million of its customers. According to the security researchers Noam Rotem and Ran Locar from the security firm vpnMentor, a technical glitch in an Elasticsearch server exposed five million logs that contained Freedom Mobile customers’ data. The researchers stated the server was left online without password protection, allowing anyone to access the data.

Freedom Mobile stated the unprotected server revealed its users’ sensitive information, including customer names, email addresses, phone numbers, postal addresses, dates of birth, customer types, Freedom Mobile account numbers, and credit card information.

Experts Predict High Demand for Cybersecurity in India Post COVID-19

SideCopy Malware Campaign

With organizations working remotely, cybersecurity works as a core technology to keep companies secure. The Indian cybersecurity market will witness an increase in the demand for cybersecurity and privacy post the COVID-19 pandemic, according to IANS.

Experts opined that, once the pandemic settles, organizations will focus on digitization, including traditional sectors like education and hospitals. Since companies struggle to integrate cybersecurity in the initial stages, there will be an increase in the demand for cybersecurity professionals in the country.

According to Ajay Sawhney, Secretary, Ministry of Electronics and Information Technology (MeitY), the Indian government has collaborated with DSCI (the Data Security Council of India) to establish a National Center of Excellence that will accelerate innovation in the Indian cybersecurity market.

“Currently, all focus lies on COVID-19 management and innovation challenges are running to help us tackle the pandemic but all this will possibly transform into something larger, and we should never waste a crisis but take it as an opportunity,” Sawhney stated.

Rama Vedashree, CEO of DSCI, said, “As India gears up to become a hub for cybersecurity, investment becomes the game-changer to nurture startups. We have seen an uptick in cybersecurity patent filing and grants in India which proves the growing innovation ecosystem in our country. As Big Data, AI, Cloud and other deep tech emerges, cybersecurity serves as a foundational tech across all technologies and for that, we need a spurt in innovation and investment.” 

Growth in the Indian Cybersecurity Market

According to a joint study by PwC India and DSCI, the cybersecurity market in India will grow from $1.97 billion in 2019 to $3.05 billion by 2022, at a compound annual growth rate (CAGR) of 15.3%. The study also stated that Banking, Financial Services and Insurance (BFSI), IT, and government are the top three sectors with the largest market share in cybersecurity expenditure in the country.

The study highlighted that cybersecurity products in India will grow at a higher rate. It is believed that data protection and endpoint security tools will grow at a CAGR of 22.2% and 19.1% respectively over three years. DSCI also mentioned that global regulations like GDPR, Health Insurance Portability and Accountability Act (HIPAA), and Health Information Trust Alliance (HITRUST) will continue to have an impact on the Indian cybersecurity market.

Stay Operational Regardless of What Tomorrow’s Headlines May Bring

Global Cybersecurity Outlook 2022,Cybersecurity, CEO, CISO

Introduction

Whether for ensuring business continuity or enhancing workforce retention and productivity, more organizations are embracing mobility, work-at-home and flex-time for their employees. To achieve business goals with a mobile and remote workforce, having a robust and reliable access security service has never been more critical. A key element of ensuring reliable mobile access is maintaining security updates, but maintenance can disrupt service and performance. Organizations need to maintain a flexible work environment without losing availability, but deploying a highly available service can be complex, costly and time consuming.

Contributed by SonicWall

Effective cybersecurity must include secure mobile access

Providing mobile access in today’s anywhere/anytime, hyper-distributed world opens an explosion of exposure points over a myriad of potentially insecure mobile endpoint devices. Human fallibility and risky online behavior mandate that employees cannot be trusted to ensure the security of their own mobile devices.

Moreover, the array of threat types is expanding, deepening and getting smarter, including targeted ransomware, never-before-seen threats, memory-based malware, side-channel attacks and encrypted threats. Ultimately, the security of your mobile network must match that of your wired network.

IT must also secure access from these mobile endpoints with limited budgets and skilled staff resources. This means streamlining deployment, availability and support to lower total cost of ownership.

Best Practices: Simple, safe and agile mobility

To be effective, cybersecurity must provide mobile employees with easy and secure 24/7 access to key business resources in an agile, easy-to-use, cost-effective and scalable way.

This requires a zero-trust posture regarding any mobile device attempting to connect with corporate resources, whether those resources be on-prem or in the cloud. Secure mobile access is a core component of a zero-trust approach to anywhere, anytime access.

IT must also secure access from these mobile endpoints with limited budgets and skilled staff resources. This means streamlining deployment, availability and support to lower total cost of ownership.

SonicWall Secure Mobile Access

The SonicWall Secure Mobile Access (SMA) solution enables anywhere, anytime access across hyper-distributed enterprises. This gives your business the agility to stay operational regardless of what tomorrow’s headlines may bring.

The SonicWall SMA 1000 Series provides distributed enterprises with comprehensive end-to-end secure remote access to corporate resources hosted across on-prem, cloud and hybrid datacenters. It applies identity based, policy enforced access controls, context-aware device authentication, and application level VPN to grant access to data, resources and applications after establishing user and device identity and trust. Flexibly deployed as a hardened Linux appliance or virtual appliance in private clouds on ESXi or Hyper-V, or in AWS or Microsoft Azure public cloud environments. It supports up to 20,000 concurrent connections with a single unit and scale upwards of hundreds of thousands of users through horizontal clustering.

SMA streamlines your company’s flex work initiatives with:

  • Always-On VPN
  • Single Sign On (SSO) using SAML Identity Provider
  • High Availability
  • Multi-Factor Authentication (MFA)
  • Capture Advanced Threat Protection (ATP) sandboxing
  • TLS 1.3 Support
  • Flexible and Scalable Deployment
  • Centralized management
  • Low TCO

Conclusion

Whether for ensuring business continuity or enhancing workforce retention and productivity, secure mobile access is a strategic business imperative. The SonicWall Secure Mobile Access (SMA) solution enables anywhere, anytime access across hyper-distributed enterprises. This gives your business the agility to stay operational regardless of what tomorrow’s headlines may bring.

Best practices for mobile security include zero-trust access control, seamless dependability and low total cost of ownership. Fortunately, there is a viable solution to help you implement all these best practices.

To learn how you can be more successful in maintaining a healthy access security environment while achieving zero downtime, write to [email protected]

CISO MAG did not evaluate/test the products mentioned in this article, nor does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. CISO MAG does not guarantee the satisfactory performance of the products mentioned in this article.

San Francisco Airport Websites Hacked; Employee Login Credentials Compromised

93% of Global Airlines are Vulnerable to Email Fraud Risk: Report

Authorities at San Francisco International Airport revealed that unknown threat actors hacked two of its websites, in March 2020, to steal usernames and passwords of its employees and contractors.

In an official notice, the authorities confirmed that its websites SFOConnect.com, which provides updates about the airport to passengers, and SFOConstruction.com, which contains information about construction and building projects at the airport, were compromised in a cyberattack. It stated that hackers inserted malicious computer code on their websites to steal user login credentials. It’s believed that attackers could use these stolen credentials to gain authorized access to the airport’s network.

“Users possibly impacted by this attack include those accessing these websites from outside the airport network through Internet Explorer on a Windows-based personal device or a device not maintained by SFO,” according to the notice.

The compromised websites were taken down and the malicious code was removed. The officials also asked users to reset their email and network passwords. “If you visited either website outside of SFO’s managed networks and were using Internet Explorer on a Windows-based device, you should change the password you use to log in to that device. You should also consider changing any credentials that use the same username and password combination,” the notice added.

Cyberattacks on Airlines

Keeping the growing cyberattacks on the Aviation industry in mind, ResearchAndMarkets.com released a report titled Aviation Cybersecurity Market – Growth, Trends, and Forecast (2019 – 2024). According to the report, the aviation cybersecurity market is expected to register a CAGR of around 11% during the forecast period of 2019-2024.

The industry relies heavily on IT infrastructure for its ground and flight operations. The security of these airline systems directly impacts the operational safety and efficiency of the industry, and indirectly impacts the service, reputation, and financial health. The report discusses cybersecurity in the aviation sector by solution and application spanning from airline management, air cargo management, air traffic control management, and airport management.

Bisq Crypto Exchange Platform’s Security Flaw Leads to Cyber Heist

Sardonic, BitMart

Decentralized exchange (DEX) platform Bisq recently fell victim to a cyber heist in which the attacker exploited a security flaw to steal more than $250,000 in cryptocurrency, Coindesk reported.

Bisq allows users to exchange bitcoin cryptocurrencies anonymously. Initially, Bisq notified its users about a software vulnerability and halted operations temporarily. However, Bisqrealized it was under a cyberattack after users reported the theft of Bitcoins from their accounts. The DEX platform developers released a hotfix (software patch) within a few hours after the attack. Bisq stated that the attacker exploited the bug in its software and stole nearly $22,000 worth of bitcoin and $230,000 worth of monero directly from the user wallets.

According to Bisq, the attacker made changes to the default fallback address. A default fallback address is a user’s destination address or wallet to which cryptocurrency is sent to, if a transaction fails in their own wallet. The attacker pretends to be a seller and leads a trade with a buyer and waits for the time to run out. Since the destination wallet is changed, the funds are directly transferred to the hacker’s wallet with the buyer’s payment and security deposit, instead of being transferred to the legitimate owner.

Hacker Cannot be Identified

Since Bisq is a DEX platform, there is no requirement for identity verification or registration. There is nothing that can prevent hackers from attacking again as their identity remains unknown.

Cryptocurrencies have always been a primary target for cybercriminals, which have resulted in the increase of cyberattacks on cryptocurrency exchanges. In a similar cryptocurrency attack, crypto exchange Bithumb lost around three million EOS (worth $13.4 million) and 20 million Ripple coins (XRP) worth $6 million. Bithumb stated that it detected abnormal withdrawals of its cryptocurrencies from its hot wallets. Describing the incident as an “accident involving insiders,”  Bithumb stated that it secured all the cryptocurrency during the detection time and confirmed that the customer assets are safe under the protection of a cold wallet.

Danish Pump Manufacturer DESMI Reports Cyberattack on IT Systems and Operations

Denmark, Danish citizens, DESMI

DESMI, a known Danish manufacturer and supplier of domestic and industrial pumping solutions, reported a cyberattack on its IT systems on April 8, 2020. The type and the scale of damages caused by the cyberattack are yet unknown, but all its IT systems were immediately taken offline to avoid further damage.

DESMI is one of Denmark’s oldest running companies. It has a wide range of pumps and pumping solution products catering to various industries like environmental, marine, defense, and utility. It has a consumer base on six different continents and provides services to more than 100 countries. However, all its operations and services came to a grinding halt since the cyberattack on its IT systems.

DESMI was quick to report the incident to the respective authorities and the Danish Police. They have sought help from external cyber forensic and cybersecurity experts to analyze the extent of damages and to get its IT systems up and running at the earliest as it affects their entire business supply chain.

All systems have been shut down and are in process of being restored. First part of our systems will be up and running within a couple of days and the rest within a couple of weeks. Operational updates will be provided to all customers and business partners asap have been shut down and are in process of being restored. First part of our systems will be up and running within a couple of days and the rest within a couple of weeks. Operational updates will be provided to all customers and business partners asap.”

– Group CEO, Henrik Sørensen.

Earlier, ISS World, a Danish workplace experience and facility management company, was hit by a malware attack on February 17, 2020, which disrupted its global operations. As per the company’s standard operating procedure (SOP), the entire global computer network of ISS World, including its website, were pulled offline to isolate the attack. In a press release, ISS World explained that this malware attack had minimal impact on the company’s daily operations as the service provider mainly delivers services on-site (i.e. on client site).

NCSC and CISA Release Joint Advisory on COVID-19 Cyberthreats and Malicious Groups

Avaddon ransomware, Microsoft and Fortinet flaws, apt

Cybersecurity officials in the U.K. National Cyber Security Centre (NCSC), the U.S. Department of Homeland Security (DHS), and the Cybersecurity and Infrastructure Agency (CISA) stated that cybercriminals and advanced persistent threat (APT) groups are targeting individuals and organizations with a variety of ransomware and malware attacks, thereby exploiting the COVID-19 outbreak for their personal gain. The security agencies have released a joint advisory describing the growing number of attackers and other malicious groups in the U.K. and the U.S.

The advisory also included a non-exhaustive list of indicators of compromise (IOCs) for cyberattacks detection and mitigation advice. It offers practical advice that individuals and organizations need to follow to mitigate the risk of being affected by cyberattacks. The IOCs provided within the accompanying .csv and .stix files of the advisory are based on analysis from CISA, NCSC, and other industry experts.

The NCSC and CISA stated that they’re working with law enforcement and industry experts to prevent  COVID-19 related cyber activities. It’s said that the NCSC and the CISA have observed hackers scanning for vulnerabilities in remote working tools and exploited the increased use of video conferencing software.

Paul Chichester, Director of Operations at the NCSC, said, “Malicious cyber actors are adjusting their tactics to exploit the COVID-19 pandemic, and the NCSC is working round the clock with its partners to respond. Our advice to the public and organizations is to remain vigilant and follow our guidance, and to only use trusted sources of information on the virus such as the U.K. Government, Public Health England or NHS websites.”

Bryan Ware, CISA Assistant Director for Cybersecurity, said, “As the COVID-19 outbreak continues to evolve, bad actors are using these difficult times to exploit and take advantage of the public and business. We urge everyone to remain vigilant to these threats, be on the lookout for suspicious emails and look to trusted sources for information and updates regarding COVID-19. We are all in this together and collectively we can help defend against these threats.”

Hackers Sell Thousands of Zoom User Account Credentials on Dark Web

Zoom, video conferencing, webinar, zoom two-factor authentication, top data breaches of 2020

With millions of office workers now using Zoom from home, opportunistic hackers are stealing their Zoom credentials and selling them on the dark web. According to a recent investigation by IntSights’ researchers, hackers have shared a database containing more than 2,300 usernames and passwords to Zoom accounts on dark web forums.

The exposed database contains usernames and passwords of personal Zoom accounts, including corporate accounts belonging to banks, consultancy companies, educational facilities, software vendors, and healthcare providers.

In addition to the credentials, some of the accounts include meeting IDs, email and passwords, names, and host keys. Researchers also highlighted that they’ve found various posts and threads of dark web forum members discussing different approaches of targeting Zoom’s conferencing services.

This will be one more blow for Zoom, as the company is already suffering severe criticism and cyberthreats globally. Recently, a cybersecurity expert Mitch@_g0dmode discovered that Zoom’s video conferencing software for Windows is vulnerable to “UNC path injection” flaw that could let hackers steal Windows passwords and execute arbitrary commands on their devices. Soon after the vulnerability was identified, the company fixed the issue by releasing a patch.

The FBI has also slammed Zoom for not maintaining proper privacy and security measures for its users. The authorities also warned that the video meeting app is prone to hacking, as it contains certain unpatched bugs.

Taiwan Government Bans Zoom

The government of Taiwan announced a ban on the official use of Zoom. In an official statement, the Executive Yuan stated that all government agencies and certain non-government organizations are restricted to hold video conferencing calls using Zoom, citing security and privacy concerns. As an alternative, the government recommended agencies to use video conferencing software offered by other companies, like Google and Microsoft.

Taiwan is not the only one to bar Zoom services. Recently, New York City officials stated that schools in the City will no longer be allowed to use Zoom for online teaching. Australia’s Defense Force and its MPs are also barred from using Zoom services.

60% of Small Businesses Do Not Have a Cybersecurity Policy: Survey

2020 is the “Worst Year on Record” in Terms of Data Breaches: Survey

Social distancing amid COVID-19 has forced millions of businesses to set up remote workstations that rely solely on Web applications and services (SaaS) to conduct business operations.  According to a new survey by the Cyber Readiness Institute (CRI), the virtual workplace has increased cybersecurity concerns for small business owners, as most of them have not implemented remote working policies to address cybersecurity threats.

The survey, which included 412 small business owners, revealed that while most small business owners are concerned about cyberattacks, many  lack the resources to invest in necessary security measures – and  half of them are worried that remote work will lead to more cyberattacks. It revealed that only 40% of small businesses have implemented a cybersecurity policy. Around 40% of businesses stated that economic uncertainty prevents them from making security investments. While 46% have offered training to help their employees stay secure while working remotely.

Nearly 51% of business owners surveyed said they provided employees with technologies to improve cybersecurity for remote work. And 55% of them said they believe federal and state governments should provide funding for cybersecurity products and services.

“These are extremely challenging times for companies, especially small businesses, as revenue and resources are as unpredictable as they have ever been. However, cybersecurity investments aren’t always tied to dollars and cents. Several free tools, that focus on human behavior, offer important guidance on helping small businesses become more cyber ready. The cyber hygiene basics will go a long way in keeping small businesses resilient in this time of increased threats,” said Kiersten Todt, Managing Director of CRI.

How Small Businesses Can Protect Themselves from Cyberattacks

Small Medium Businesses (SMBs) must start taking cyberthreats more seriously, and this starts with education – for business leaders as well as employees. Many SMBs have convinced themselves that they’re incapable of protecting themselves from cyberthreats, but this couldn’t be further from the truth. Not only are there powerful security tools at their disposal – such as data-at-rest encryption and multi-factor authentication – but they’re also capable of turning one of their biggest vulnerabilities into a strength.

Human error is by far the biggest cause of cybersecurity breaches. While this is disconcerting, it’s also empowering – when SMBs make cybersecurity training a top priority, they can drastically reduce their risk without spending tens of thousands of dollars on cutting-edge digital solutions. This isn’t to say technology isn’t an important element of cybersecurity, but it’s always worth remembering that the most advanced piece of hardware on the planet is the human brain.

One in Three SMBs Rely on Free Cybersecurity Tools or Nothing

One in three small businesses with 50 or fewer employees rely on free or consumer-grade cybersecurity tools stated a research commissioned and published by BullGuard. The research also pointed out that one in five companies do not use any endpoint security whatsoever. The research, which surveyed small businesses in the U.K. and the U.S., suggested that nearly 43% SMB owners are not prepared for a potential cyberattack or breach leaving their most sensitive financial, customer, and business data at risk.

1 in 3 Employees Don’t Use VPN to Connect to Company Network While Working from Home: CISO MAG Survey

CISO MAG Survey: With increased digitalization and cloud migration, the corporate network now extends further out into the Internet — beyond the boundaries and firewalls of an organization. Even the concept of WAN and branch offices is extended. Partners, customers, suppliers, and employees connect to the corporate network from remote locations around the globe. Employees are working from home, especially under the prevalent COVID-19 situation, with social distancing becoming a norm. In that sense, it is a borderless network of interconnected networks. That ups the risk quotient for data security, network security, and endpoint security. The threat landscape has broadened to include threats to both, wired and wireless networks.

And then, there’s the “extended” network. Now that employees work from home, CISOs need to ask: How secure are home networks and endpoint devices? How many employees use company VPNs when working from home? With businesses outsourcing more functions to external third-parties, one needs to evaluate the infrastructure security of partners, suppliers, contractors, and the Nth party services (the entire supply chain). That calls for vendor risk assessments and management.

To gauge a deeper insight on the precautions companies are taking to combat the threats looming on the cyberspace, CISO MAG re­cently reached out to all the respondents who participated in the Network Security survey.

The key findings of the snap poll were:

  • Only 70% respondents stated that they were using company VPNs to secure­ly log in to the company network, while 30% did not.
  • Almost all the compa­nies have secured endpoint devices (laptop/ phone) of employees.
  • Employees connect to the Internet either using home Wi-Fi connections or hotspot on mobile phone, while nearly 25% use company dongles along with home Wi-Fi and phone hotspot.

VPN security at homeWith more and more software as a service (SaaS) models emerging, demand for security has increased at endpoints and even cloud systems.

To validate its research on the usage of network security solutions, CISO MAG conducted a multiple-choice survey, in the month of February 2020. There were 280 respondents for this survey that included CISOs, COO, CSO, Compliance Managers, CIOs, CEOs, data protection managers, Director of IT and others.

CISO MAG Power List Survey

CISO MAG Survey Findings:

  • Even though the adoption of multiple lay­ers of protection is more than 60%, several organizations rely on Antivi­rus and Firewall solutions from vendors at 36%.
  • 6% of respondents suggest using an amalgamation of NAC policies including Identity Awareness, Centralized man­agement and monitoring, and Ease of Deployment
  • 5% companies still believe in some sort of a supervision on machine learning solutions on network traffic analysis
  • When it comes to Perimeter Security, nearly 30% organizations consider se­curing Internet, WAN, LAN, and Cloud together
  • 35% of respondents suggest that while se­curing Endpoints the key areas they focus on are Company Owned PCs/Server, Mo­bile Devices, BYOD, and IoT
  • When it comes to intrusion sensors and modules, IPS tops the chart with 22.3% followed by UTM at 18.7% and IDS at 10.8%
  • 7% opt for the hybrid approach for Network Security management 36.6% companies are already using SDN architecture while 63.3% are in the adoption stage
  • 6% organizations still consider data se­curity as the biggest security risk in cloud migration

CISO MAG Power List Network Security

The CISO MAG survey was based on the results of an online survey that was conducted by CISO MAG readers from EC-Council’s database. The respondents represent a cross-section of organizations from over 56 countries ranging from Argentina, Australia, U.S., U.K., Russia, India, France, Germany, Greece, Indonesia, Italy, Jordan, Kenya, Kuwait, Lebanon, Lithuania and even smaller countries and islands like Malawi, Mali, Nauru. Puerto Rico, Rwanda, Togo, Trinidad and Tobago, among several others. The survey was prepared in consultation with security experts and industry analysts.

Find the full survey report at: bit.ly/cisomagfree

Use coupon code CISOMAG19 at checkout for three months of free subscription of CISO MAG

1...224225226...410Page 225 of 410