Home Blog Page 237

Virgin Media Data Breach Affects 900,000 Customers’ Data

Data breach in 100 U.S. cities

Virgin Media, a provider of telephone, television, and internet services in the U.K., revealed that it discovered an unsecured database that exposed the personal information of around 900,000 customers, which is 15% of the company’s entire customer base. The leaked database was taken down immediately and is now password protected.

According to the Virgin Media release, the exposed information includes names, home addresses, emails, phone numbers, and product information. The incident response team at Virgin Media stated that the database was used for marketing activities and did not contain sensitive information like passwords, credit/debit card numbers, and other financial details.

The company stated it already notified the Information Commissioner’s Office, the U.K.’s data protection watchdog, for further investigation on the security incident. It also warned the affected customers to be vary of phishing attacks.

Lutz Schuler, CEO of Virgin Media, said, “Protecting our customers’ data is a top priority and we sincerely apologize. The database did not include any passwords or financial details, such as credit card information or bank account numbers, but did contain limited contact information such as names, home and email addresses and phone numbers. Based upon our investigation, Virgin Media does believe that the database was accessed on at least one occasion but we do not know the extent of the access or if any information was actually used.”

“We are now contacting those affected to inform them of what happened. We urge people to remain cautious before clicking on an unknown link or giving any details to an unverified or unknown party,” Schuler added.

Private Information of British Citizens Exposed Online

In a similar database leak incident, an unprotected AWS (Amazon Webservices) S3 database that contained personal information of British citizens was discovered by security researchers Noam Rotem and Ran Locar of the security firm vpnMentor. It included passport scans, tax documents job applications, background checks, expense forms, scanned contracts complete with signatures, salary information, emails and more.

Researchers found no security protection on this AWS database, also known as bucket, and thus were able to see all the files stored in it. The files contained a wide range of Personally Identifiable Information (PII), including names, addresses, phone numbers, dates of birth, gender, national insurance number–in short, everything that a threat actor requires to complete identity theft, fraud, or any cyberattack targeted towards the user or against him.

More Than Half Global Healthcare Organizations Suffered a Cyberattack Last Year

Healthcare Data Breaches, Premier Diagnostics data exposed

Cybersecurity firm Keeper Security revealed that nearly two-thirds of global healthcare organizations suffered a cyberattack in their lifetime, while 53% were attacked within the last 12 months. Keeper, in its report “2019 Global State of Cybersecurity in Small and Medium-Sized Businesses”, revealed that data breaches in healthcare resulted in an average of 7,202 patient and employee records lost or stolen. The most commonly reported types of attacks were phishing (68%), malware (41%) and web-based attacks (40%), according to the report.

Keeper Security provides cybersecurity platform for enterprises to prevent password-related data breaches and cyberthreats. The findings are based on the responses from 2,391 IT security practitioners in the U.S., U.K., and regions like DACH, Benelux and Scandinavia. The respondents also indicated they lack security resources to defend themselves from cyberattacks. Only one-third of healthcare organizations believe they have sufficient budget to support strong IT security and 87% said they don’t have the personnel needed to achieve a more effective cybersecurity posture.

Other highlights from the report include:

  • 66% of healthcare providers agree that passwords are an important part of cybersecurity prevention, yet over half don’t have visibility into their employees’ password practices
  • Less than half of those surveyed have a plan for responding to an attack
  • 90% of healthcare organizations dedicate less than 20% of their IT budget to cybersecurity, with an average allocation of 13%

Darren Guccione, CEO and Co-Founder of Keeper Security, said, “Electronic health records are some of the most lucrative documents on the dark web, so it’s not surprising that the healthcare industry is highly-targeted by cybercriminals. While the majority of healthcare organizations have already experienced a cyberattack, this research shows the industry still doesn’t have the necessary resources and budget allocated to preventing and responding to major data breaches. Patients depend on providers to protect their sensitive health information and moreover, their lives via connected medical devices. Therefore, it’s critical that cybersecurity become a top priority in healthcare.”

Mellanox Acquires Titan IC to Boost its Security and Data Analytics Platform

U.S. and Australia to Jointly Develop Cyber Training Platform

Israel-based chipmaker and connectivity firm Mellanox Technologies acquired Belfast-based network intelligence and security technology firm Titan IC to strengthen its capabilities in security and data analytics platform. As per the acquisition, the two companies will work on cyber intelligence, intrusion detection and protection, and advanced data analytics.

Mellanox Technologies is a supplier of end-to-end smart security solutions for data center servers and storage systems. The latest acquisition will improve Mellanox’s network intelligence capabilities delivered through the company’s advanced ConnectX and BlueField families of SmartNIC and I/O Processing Unit (IPU) solutions. Titan IC provides real-time internet traffic inspection for advanced cybersecurity and data analytics applications. With the acquisition, Titan IC will become the Mellanox center for advanced network intelligence research and development.

Speaking on the latest acquisition deal, Eyal Waldman, President and CEO, Mellanox Technologies, said, “Network Intelligence is an important technology when combined with our industry-leading networking portfolio of switches, SmartNICs, and IPUs. Our customers will benefit from the deep analytics and enhanced security that will be delivered by the integration of our best-in-class Ethernet and InfiniBand products and world-leading deep packet inspection and analytics technologies from Titan IC. With this acquisition, our M&A investments total more than 1.2 billion dollars to date and more than 53 million dollars invested in startups to further our intelligent networking strategy.”

“We have worked with Mellanox for many years to integrate our RXP regular expression processor into their advanced line of BlueField I/O Processing Units (IPUs). Now as part of Mellanox, we will be able to achieve new capabilities for cyber intelligence, intrusion detection and protection, and advanced data analytics applications,” said Noel McKenna, CEO, Titan IC.

McAfee Report Predicts 2020 to be Year of Mobile Sneak Attacks

Malware and Vulnerability Trends Report, Mobile malware threats

McAfee released its Mobile Threat Report 2020, which found that hackers are using hidden mobile apps, third-party login and counterfeit gaming videos to target consumers. Last year, hackers targeted consumers with a wide variety of methods, from backdoors to mining cryptocurrencies. Based on new research, McAfee has uncovered that hackers have expanded the ways of hiding their attacks, making them increasingly difficult to identify and remove, which makes it seem like 2020 will be the year of mobile sneak attacks.

The highlights of the report are:
  • Hidden mobile apps result in approximately 50% of all malicious threats in 2019
  • Hidden apps are the most active mobile threat category, generating almost half of all malicious telemetry, a 30% increase from 2018
  • New mobile malware uses third-party sign-on to cheat app ranking
  • A unique approach to steal sensitive data through legitimate transit app
  • Hackers use gaming popularity to spoof consumers
  • LeifAccess tricks victims into enabling risky settings using fake security warnings to perform unwanted automated actions

McAfee found that hidden apps are the most active mobile threat facing consumers, generating nearly 50% of all malicious activities in 2019–a 30% increase from 2018. Hackers continue to target consumers through channels that they spend the most time on–their devices, as the average person globally is expected to own 15 connected devices by 2030. Hidden apps take advantage of unsuspecting consumers in multiple ways, including taking advantage of consumers using third-party login services or serving unwanted ads.

“Mobile devices hold the key to our lives–both corporate and personal. Unfortunately, they are also amongst the easiest attack vectors for cybercriminals because, consumer awareness levels towards the security of their devices and apps are low. Hidden apps have emerged as the most active mobile threat category and it’s highly advisable consumers stay vigilant with regards to where they download applications from, what they click on and also ensure they use the right security software on their devices–to enable detection and protection of their digital lives,” said Venkat Krishnapur, Vice-President of Engineering and Managing Director, McAfee India.

The McAfee Mobile Threat Report 2020 highlights the following mobile trends:
  • Hackers use gaming popularity to spoof consumers – Hackers are taking advantage of the popularity of gaming by distributing their malicious apps via links in popular gamer chat apps and cheat videos, by creating their own content containing links to fake apps. These apps masquerade as genuine ones with icons that closely mimic those of the real apps but serve unwanted ads and collect user data. McAfee researchers uncovered that popular apps like FaceApp, Spotify, and Call of Duty all have fake versions trying to prey on unsuspecting consumers, especially younger users.
  • New mobile malware uses third-party sign-on to cheat app ranking systems – McAfee researchers have uncovered new information on mobile malware dubbed LeifAccess, also known as Shopper. This malware takes advantage of the accessibility features in Android to create accounts, download apps, and post reviews using names and emails configured on the victim’s device. McAfee researchers observed apps based on LeifAccess being distributed via social media, gaming platforms, malvertising, and gamer chat apps. Fake warnings are used to get the user to activate accessibility services, enabling the full range of the malware’s capabilities.
  • A unique approach to steal sensitive data through a legitimate transit app. McAfee researchers found that a series of South Korean transit apps, were compromised with a fake library and plugin that could exfiltrate confidential files, called MalBus. The attack was hidden in a legitimate South Korean transit app by hacking the original developer’s Google Play account. The series provides a range of information for each region of South Korea, such as bus stop locations, route maps, and schedule times for more than 5 years. MalBus represents a different attack method as hackers went after the account of a legitimate developer of a popular app with a solid reputation.

“There exists a growing trend for many apps to remain hidden, stealing precious resources and important data from the device that acts as the remote control to consumers digital world,” said Raj Samani, McAfee Fellow and Chief Scientist. “Now, more than ever, it is critical consumers make themselves aware of modern threats and the steps they can take to defend themselves against them, such as staying on legitimate app stores and reading reviews carefully.”

BAE Systems Obtain Five-Year Contract for U.S. Navy’s AEGIS Combat System

Cyber war

BAE Systems, a British multinational defense, security, and aerospace company, awarded a five-year US$188.2 million contracts to provide the U.S. Navy’s AEGIS Technical Representative (AEGIS TECHREP) organization with critical large-scale system engineering, cybersecurity solutions, and testing expertise for the AEGIS Weapons and Combat Systems. The company also offers security solutions, testing, evaluation personnel to provide fleet experience and operational insight, logistics, production, acquisition, and waterfront support required for upgrading and maintaining the development of AEGIS Combat System capabilities.

Mark Keeler, vice president and general manager of BAE Systems’ Integrated Defense Solutions business, said, “BAE Systems personnel have worked side-by-side with Navy sailors and civilians for nearly 40 years to strengthen and modernize the fleet of AEGIS-equipped surface ships. Our team brings a wealth of AEGIS combat system expertise with the agility, innovation, and technical acumen to ensure the U.S. Navy has the safe and effective combat capability it needs to meet mission objectives.”

U.K. Invests in Revolutionary Artificial Intelligence Warships

With an aim to help warship crews make quick decisions and process data efficiently, the U.K.’s Ministry of Defense recently announced contracts to use AI-based technology in warships. According to a source, Defense and Security Accelerator (DASA) will be funding £1 million (around US$1.3 million) for AI contracts as part of its “Intelligent Ship – The Next Generation” competition, which is aimed at using innovative approaches for Human-AI and AI-AI teaming for various defense platforms like warships, aircraft, and land vehicles.

DASA’s warship competition, in alliance with the Defense Science and Technology Laboratory (Dstl), is intended to enhance the designs of future defense platforms by using advances in automation, autonomy, machine learning, and AI.

James Heappey, U.K.’s Defense Minister, said, “The astonishing pace at which global threats are evolving requires new approaches and fresh thinking to the way we develop our ideas and technology. The funding will research pioneering projects into how AI and automation can support our armed forces in their essential day-to-day work.”

McAfee Acquires Browser Isolation Firm Light Point Security

McAfee Acquires Browser Isolation Firm Light Point Security

Device-to-cloud cybersecurity company McAfee recently entered into a definitive agreement to acquire browser isolation company Light Point Security. As per the acquisition deal, employees of Light Point Security will join McAfee.

Founded by former NSA employees, Light Point Security protects users from zero-day and other emerging malware like ransomware and credential phishing attacks by isolating browser sessions in a remote virtual environment outside of the corporate network. The acquisition integrates Light Point Security’s browser isolation technology with McAfee Secure Web Gateway for inbound and outbound protection for all web and cloud traffic. Additionally, McAfee stated that it’s going to integrate browser isolation into its newly released MVISION UCE solution, which includes McAfee Secure Web Gateway, McAfee Data Loss Prevention, and MVISION Cloud (CASB) to enable a complete implementation of the SASE Architecture.

Ash Kulkarni, EVP and Chief Product Officer at McAfee, said, “Web browsing is one of the most common threat vectors for endpoints to get infected. Adding Light Point Security’s capabilities into our products will create solutions that enable our customers to mitigate web-based threats without impacting user experience. We are constantly working to find ways to help our customers safely adopt the cloud so they enjoy increased productivity without experiencing heightened concerns about cyber-attacks. Light Point Security’s browser isolation capabilities will bolster the McAfee Unified Cloud Edge offering to make it a preferred solution for security-focused businesses without compromising on productivity.”

Commenting on the acquisition, Zuly Gonzalez, co-founder and CEO of Light Point Security, said, “Light Point Security’s technology enables users to browse any website safely, securely and without limitations, without having to keep up with website changes. This stops attacks launched against a web browser before they can even enter the network without hampering user experience. We’ve been recognized for revolutionizing the way that organizations think about security; now we will be joining a leading standalone cybersecurity player to be part of the next revolution.”

McAfee Appoints New Chief Executive Officer

McAfee, appointed Peter Leav as the new Chief Executive Officer, effective from February 3, 2020. Leav had previously served as President and CEO of BMC Software. He holds more than 20 years of executive leadership experience in large-scale technology companies like NCR Corporation, Symbol Technologies, Cisco Systems, Proofpoint, and Motorola.

Apart from addition to leadership roles, McAfee also forged multiple partnerships. The company acquired NanoSec, a container security startup, to improve its compliance and to mitigate the risk of its container deployments. NanoSec is a multi-cloud and zero-trust application security platform that’s focused on the container approach to application security. The acquisition will allow McAfee to boost its MVISION Cloud and MVISION Server Protection products.

UK ICO Fines Cathay Pacific with £500,000 for 2018 Data Breach

Cathay Pacific

UK’s Information Commissioner’s Office (ICO) has found Hong Kong-based air carrier Cathay Pacific guilty on various counts of data breach reported by the latter in 2018. Owing to this, Cathay Pacific has been asked to pay a data breach fine of £500,000 (approx. US$640,000) by March 13, 2020.

Cathay Pacific Data Breach

Cathay Pacific collects and stores flyers’ data including their names, passport numbers, contact details, date of birth and nationalities for official use. Additionally, they also store information of its frequent flyer loyalty program that includes membership numbers, previous travel and customer support interaction information.

Cathay Pacific discovered the data breach in March 2018 when one of its database was targeted with a brute force attack. It immediately assigned a cybersecurity firm to investigate into the cyberattack. While investigating the root cause and the threat actors involved in the brute force attack, the cyber forensic experts subsequently unearthed a much greater data breach.

According to the ICO’s report, between October 15, 2014 and May 11, 2018, Cathay Pacific’s computer systems didn’t have adequate security measures. This led to the compromise of approximately 9.4 million worldwide customers’ personal details of which 111,578 were from the U.K.

The air carrier officially reported the data breach episode to the IOC only on October 25, 2018, after analyzing the compromised data and the extent of the breach. Meanwhile, it also set up customer care services and precise and accurate notifications for every individual telling them of exactly what data was leaked.

IOC’s Verdict

IOC said that the breach affected Cathay Pacific’s four databases: customer database, membership details database, web applications’ back-end database and transient database used by Asia Miles members for award points redemption. After analyzing all these breaches and their corresponding causes, the commissioner found Cathay Pacific violating the Data Protection Principle (DPP7) on multiple counts. These include unencrypted database backups, security patches were not applied to known server vulnerabilities, unrestricted admin-level access through public internet, an unsupported operating system on one of the compromised server/systems, lack of two-factor/multi-factor authentication (2FA/MFA), and inadequate penetration testing, among others.

Although the £500,000 (approximately US$640,000) is huge, the IOC has also suggested a 20% reduction in the total penalty amount which brings it down to £400,000 (approximately US$516,000) if Cathay Pacific pays the data breach fine latest by March 12, 2020.

T-Mobile Reveals Security Breach, Customers’ Data Exposed

T-Mobile data breach

Mobile telecommunication company T-Mobile US, Inc. has revealed a security incident that compromised some of its customers’ personal information. In an official announcement, the company alerted customers about the attack against its email vendor that led to unauthorized access to certain T-Mobile employee email accounts, which contained account information of T-Mobile customers and employees.

The information accessed in the incident included customer names, addresses, phone numbers, billing information, email addresses, account numbers, and rate plans.  According to the company, the people behind the breach have not accessed financial data like credit card numbers, social security numbers, and passwords.

On the bright side, T-Mobile’s incidence response team has informed that they didn’t find any evidence on misuse of the exposed data. However, the company urged its users to review their account information and update account passwords. They further reported the breach incidence to the concerned authorities and are taking appropriate legal actions.

“Our Cybersecurity team recently identified and shut down a malicious attack against our email vendor that led to unauthorized access to certain T-Mobile employee email accounts, some of which contained account information for T-Mobile customers and employees. An investigation was immediately commenced, with assistance from leading cybersecurity forensics experts, to determine what happened and what information was affected. We immediately reported this matter to federal law enforcement and are actively cooperating in their investigation,” T-mobile said in a statement.

This is not the first time that T-Mobile has faced a data breach. In 2018, a data breach had compromised around 2 million users’ personal information of the U.S. telco. T-Mobile, in an announcement, informed its customers about the security breach that was discovered and stopped on August 20, 2018. The compromised data had included names, email addresses, account numbers, and other billing information of its customers. However, financial data like credit card numbers, social security numbers, and passwords were not affected in that incident as well.

CrowdStrike Report Reveals Telecommunications Industry Attacks on the Rise

Telecommunications

CrowdStrike Inc. the developer of cloud-delivered endpoint protection solutions, announced the release of the 2020 CrowdStrike Global Threat Report. Findings from the report indicate that during 2019, financially motivated cybercrime activity occurred on a nearly continuous basis. CrowdStrike observed an increase in incidents of ransomware, maturation of the tactics used, and increasing ransom demands from eCrime actors. Increasingly these actors have begun conducting data exfiltration, enabling the weaponization of sensitive data through threats of leaking embarrassing or proprietary information.

Moving beyond eCrime, nation-state adversaries continued unabated throughout 2019, targeting a wide range of industries. Another key trend in this year’s report is the telecommunications industry being targeted with increased frequency by threat actors, such as China and DPRK. CrowdStrike Intelligence assesses that various nations, particularly China, have an interest in targeting this sector to steal intellectual property and competitive intelligence.

Combatting threats from sophisticated nation-state and eCrime adversaries requires a mature process that can prevent, detect and respond to threats with speed and agility. CrowdStrike recommends organizations to pursue the “1-10-60 rule” in order to effectively thwart cyber threats. 1-10-60 guidelines are the following: detect intrusions in under one minute; investigate in 10 minutes; contain and eliminate the adversary in 60 minutes. Organizations that meet this benchmark are much more likely to eradicate the adversary before an attack spreads from its initial entry point, ultimately minimizing organizational impact.

“2019 brought an onslaught of new techniques from nation-state actors and an increasingly complex eCrime underground filled with brazen tactics and massive increases in targeted ransomware demands. As such, modern security teams must employ technologies to detect, investigate and remediate incidents faster with swift preemptive countermeasures, such as threat intelligence, and follow the 1-10-60 rule,” said Adam Meyers, Vice President of Intelligence at CrowdStrike. 

Other notable highlights from the 2020 Global Threat Report include:

  • The trend toward malware-free tactics accelerated, with malware-free attacks surpassing the volume of malware attacks. In 2019, 51% of attacks used malware-free techniques compared to 40% using malware-free techniques in 2018, underscoring the need to advance beyond traditional antivirus (AV) solutions.
  • China continues to focus many operations on supply chain compromises, demonstrating the nation-state’s continued use of this tactic to identify and infect multiple victims. Other targeting of key U.S. industries deemed vital to China’s strategic interests — including clean energy, healthcare, biotechnology, and pharmaceuticals — is also likely to continue.
  • The industries at the top of the target list for enterprise ransomware (Big Game Hunting) observed were local governments and municipalities, academic institutions, the technology sector, healthcare, manufacturing, financial services and media companies.
  • In addition to supporting currency generation, DPRK’s targeting of cryptocurrency exchanges could support espionage-oriented efforts designed to collect information on users or cryptocurrency operations and systems. In addition, CrowdStrike Intelligence suspects that DPRK has also been developing its own cryptocurrency to further circumvent sanctions.

“This year’s report indicates a massive increase in eCrime behavior can easily disrupt business operations, with criminals employing tactics to leave organizations inoperable for large periods of time. It’s imperative that modern organizations employ a sophisticated security strategy that includes better detection and response and 24/7/365 managed threat hunting to pinpoint incidents and mitigate risks,” said Jennifer Ayers, Vice President of OverWatch at CrowdStrike.

Ultrasonic Waves Used to Launch Surfing Attacks on Smartphones

Reliance Jio’s Coronavirus Symptom Checker App Exposes User Data

This might be a disturbing news for those who highly rely on smart devices. A group of researchers at the Washington University discovered a new trick to attack smartphones via inaudible voice assistant commands. The researchers demonstrated how they exploited voice assistant features in smartphones to make phone calls, take photos, and read messages without even touching the device.

According to researchers, the unknown vulnerability affects all smartphones that run voice assistant features; iPhones running Siri and Android devices running Google Assistant. Dubbed as “SurfingAttack”, this attack method is a trick to remotely control voice assistants using inaudible ultrasonic waves.

How SurfingAttack Works?

The researchers stated that ultrasonic waves can be used to send commands via air. These waves propagate through solid surfaces to activate voice recognition systems with the help of some equipment.

SurfingAttack method requires three main components: a signal processing module, an ultrasonic transducer, and a tapping device. The target device is placed on a table with a microphone (to hear the assistant’s responses) and a piezoelectric transducer is attached to the bottom of it. SurfingAttack generates signals of voice commands that can propagate in the table to be received by the device’s microphone through a mechanical coupling.

The voice commands are generated using the speech synthesis and text-to-speech (TTS) Module. The controller produces the baseband signals v(t) of the voice commands or dialogues, and then transmits them to the attack device preferably through wireless. The attack device hidden beneath the table is used for ultrasonic signal modulation and voice recording. Without direct control over the voice controllable system, the attacker needs to design inaudible voice commands.

The researchers stated that they’ve performed tests on 17 phones and discovered that the attack method worked on 15 devices from four mobile manufacturers, which include Google (Pixel 1, Pixel 2, Pixel 3), Motorola (G5, Z4), Samsung (Galaxy S7, Galaxy S9), Xiaomi (Mi 5, Mi 8, Mi 8 Lite), and Apple (iPhone 5/5s/6 Plus/X).

Explaining about the SurfingAttack vector, Ning Zhang said, “If you know how to play with the signals, you can manipulate them such that when the phone interprets the incoming sound waves, it will think that you are saying a command. We did it on metal. We did it on glass. We did it on wood. They tried placing the phone in different positions, changing the orientation of the microphone. They placed objects on the table in an attempt to dampen the strength of the waves. It still worked even at distances as far as 30 feet.”

“I feel like not enough attention is being given to the physics of our computing systems. This is going to be one of the keys in understanding attacks that propagate between these two worlds,” Zhang added.

1...236237238...410Page 237 of 410