Home Blog Page 245

Personal Data Protection Commission Fines Multiple Firms on Data Breaches

American Cybersecurity Literacy Act

The Personal Data Protection Commission (PDPC) of Singapore found seven organizations that violated the Personal Data Protection Act and has fined them a total of S$66,000 (approximately US$47,514). According to an official release, the penalties were issued to Singtel, SCAL Academy, SPH Magazines, and Royal Caribbean Cruises for failing to protect customers’ data.

Details of Penalties

Singtel

Singtel was fined S$9,000 (US$6479) for a data breach involving its ‘My Singtel’ mobile app. The breach occurred when the firm was migrating to a new billing system back in 2018 which resulted in the exposure of personal data of 750 mobile subscribers.

SPH Magazines

SPH Magazines, owned by Singapore Press Holdings, was fined S$26,000 (US$18,718) for a data leak of its forum site HardwareZone. According to a source, a hacker gained access to the system in 2017 and hacked in a senior moderator’s account and accessed information of 704,764 profiles.

Royal Caribbean Cruises

The cruise company was fined S$16,000 (US$11,518) for a ransomware attack on its vendor’s system that exposed personal data of 6,000 of its customers, including the personal data of its 25 employees. The incident occurred when hackers broke into the database of the receipt system and left a ransom note demanding a payment of 0.08 bitcoin for the data.

SCAL Academy

PDPC charged SCAL Academy with a fine S$15,000 (US$10798) for failing to protect the personal data of 3,628 people who had attended its programs. It’s claimed that the Academy failed to secure the scanned registration documents that held personal data like name, race, nationality, date of birth, identity card number, address, and company name of its attendees.

Besides imposing penalties, PDPC also imposed directives on Henry Park Primary School Parents’ Association for breaching the Protection and Accountability Obligations of the PDPA. Also, a warning was issued to NTUC Income and AXA Insurance for failing to maintain the necessary security requirements to prevent unauthorized disclosure of personal data they held.

New Bill Grants US$400 Million to Address Cybersecurity Risks in the U.S.

CISA VDP platform, U.S. export ban on cybersecurity items

A new federal legislation was introduced recently to address cybersecurity threats to information systems of state, local, and territorial governments in the U.S. The legislation, “the State and Local Cybersecurity Improvement Act”, will create a grant program worth US$400 million to finance cybersecurity improvement attempts in communities across the country. The legislation was introduced by a group of bipartisan representatives, Rep. Cedric Richmond, Rep. John Katko, Rep. Derek Kilmer, Rep. Michael McCaul, Rep. Dutch Ruppersberger, Rep. Bennie G. Thompson, and Rep. Mike Rogers, who are associated with the House Committee on Homeland Security.

According to an official statement, the funds will be provided to eligible communities by the Department of Homeland Security to assist in areas like vulnerability scanning and testing, cyber workforce development, and intelligence sharing.

Apart from cybersecurity funding, the bill requires DHS’ Cybersecurity and Infrastructure Security Agency (CISA) to develop strategies to improve the cybersecurity posture of the communities. It also establishes a state and local cybersecurity resiliency committee, giving state and local communities a venue to report their security needs to CISA.

Commenting on the newly released legislation, Congressman Cedric Richmond, Chairman of the Homeland Security Committee’s Cybersecurity, Infrastructure Protection, said, “The State and Local Cybersecurity Improvement Act is a critically important piece of legislation that provides state and local governments the tools they need to significantly invest in their cybersecurity infrastructure. Louisiana has long been vulnerable to cyber-attacks, and this bill offers the resources needed to ensure protection against potential threats. I’m proud to introduce this comprehensive measure to give Louisiana and other states across the country the proper framework they need to implement vital cybersecurity plans.”

Energy Sector Pathfinder

Recently, the U.S. Departments of Defense (DoD), Department of Energy (DoE), and Department of Homeland Security (DHS) joined hands to work on a new initiative “Energy Sector Pathfinder”, which was intended to protect the U.S. Energy Critical Infrastructure and bolster cybersecurity partnerships in the sector. The three federal departments signed a Memorandum of Understanding (MOU) to partner on the new initiative, which is aimed to improve training and education to understand cyber risks, advance information sharing, and develop joint operational preparedness and response activities to cybersecurity threats.

CryptoAG: The Swiss Spying Machine

Network Encryption, DSCI Whitepaper on Encryption

According to The Washington Post and German broadcaster ZDF, encryption device provider Crypto AG has been deemed as “The Swiss Spying Machine”, since for half a century it sold technology to nearly 120 countries while it was secretly controlled by the CIA and German intelligence services.

History of Crypto AG

The Swiss company, which was established during the World War II, manufactured encryption devices and machines that were sold to countries in the Latin American region including Brazil and Argentina, Asian rivals India and Pakistan, Iran , African countries of Egypt, Algeria, Libya, Morocco, Tunisia, Ethiopia, Ivory Coast, Nigeria, Tanzania, South Africa and even the Vatican.

Boris Hagelin, the founder of Crypto who had fled to U.S during the beginning of the Word War II, previously worked with the CIA and National Security Agency  (NSA). While nearing retirement, Hagelin put the company on sale. CIA and Germany’s spy agency BND, in a bid to keep their upper hand in the encryption technology and in order to decode other countries’ secrets during the rising geopolitical tensions of the Cold War, showed keen interest in buying the company’s stakes.

Thus, CryptoAG was secretly bought by a Liechtenstein front company (in future known as the SIEMENS group) that was owned 50-50 by the CIA and Germany’s BND for US$8.5 million. The two nations agreed to let the Swiss spies know this little secret, while only a few from the top Crypto AG management knew about it. Both U.S. and Germany asked for an intentional weakening of its encryption products sold to other nations, this meant that whenever required, they could break the encryption algorithms and intersect secret communications of these countries.

The Suspicious Success of the Swiss Spying Machine

One such example is when U.S. and Germany were able to intersect the communication where the Libyan officials were heard celebrating after terrorists exploded a bomb in a Berlin nightclub in 1984. As this ownership of CIA was a top secret, even the then President of the U.S., Ronald Reagan had no idea about it as he was publicly quoted suspecting the Crypto AG’s involvement in this incident. But these suspicions were never confirmed.

However, Crypto AG’s products are still in use in at least a dozen countries around the world, which means secrets of these nations could still be monitored. But the company was dismembered in 2018 and liquidated by its shareholders whose identities have been permanently protected under the byzantine laws of Liechtenstein, a tiny European nation with a reputation of high financial secrecy.

Deep Instinct Raises US$43 Million in Late-Stage Funding

Startup funding

New York-based cybersecurity firm Deep Instinct, with offices in Tel Aviv and Sydney, raised US$43 million in late-stage funding. The funding round was led by Millennium New Horizons, with participation from online trading and technology firms Unbound, LG, and Nvidia. With the current funding, the company has seen an investment of US$100 million.

The company plans on going on an expansion spree with the new funding. Deep Instinct now counts the largest technology companies in the world among its investors. These include LG, Nvidia, and even HP and Samsung, who had participated in previous financing rounds of the company.

“This significant round of new funding highlights the importance of prevention for every enterprise. The economic impact of repairing a breach is too high to ignore the need to prevent threats before they occur. The message to the market is that to fight today’s cyber threats, true prevention will become more critical than detection and response.” said Lane Bess, Deep Instinct’s Chairman, in a release.

The company has a patented technology that disrupts traditional security solutions. Unlike traditional solutions, which guard enterprises against known threats in operating systems (OS) and help identify the attack after it has been breached, Deep Instinct leverages its patented deep learning platform trained to identify and prevent first-seen, sophisticated and advanced cyberthreats. The company affirms that threats are prevented anywhere within the enterprise from any type of file-based or file-less cyberattacks in zero-time, with unmatched accuracy and speed.

“Traditional cybersecurity is broken,” said Guy Caspi, co-founder and CEO of Deep Instinct. “Current solutions based on ‘assume breach’ are simply insufficient for the highly sophisticated attack landscape we all face. Deep Instinct takes an entirely new approach, preventing attacks before they are executed.”

“There is no shortage of cybersecurity software providers, yet no company aside from Deep Instinct has figured out how to apply deep learning to automate malware analysis,” said Ray Cheng, Partner at Millennium New Horizons. “What excites us most about Deep Instinct is its proven ability to use its proprietary neural network to effectively detect viruses and malware no other software can catch. That genuine protection in an age of escalating threats, without the need of exorbitantly expensive or complicated systems, is a paradigm change.”

Fake Dating Apps Bring Majority of Malware Attacks in South Africa

Dating Apps

South Africa is one of the most malware attacked countries via fake dating applications, a research from Kaspersky revealed. According to research findings, 7,734 attacks were detected on 2,548 users in 2019. The country saw a circulation of 1,486 malware threats disguised as over 20 popular dating apps. It’s said that South Africa is the most targeted country by fake dating apps accounting to 58 percent, while Kenya reported 10 percent and Nigeria 4 percent.

The research highlighted that hackers used popular dating apps like Tinder, Bumble, and Zoosk as bait to spread malware and access personal data. Cybercriminals used the Tinder app to cover their malware files, with 493 files detected only in South Africa. Once infected, the malware brings a variety of issues.

“The danger these malicious files bring varies from file to file, ranging from Trojans that can download other malware to ones that send an expensive SMS, to adware, making it likely that every ping a user gets is some sort of annoying ad notification rather than a message from a potential date,” the researchers explained.

Kaspersky also recommended a few guidelines to avoid threats from fake apps:

  • Always check application permissions to see what your installed apps are allowed to do
  • Do not install applications from untrusted sources, even if they are actively advertised, and block the installation of programs from unknown sources in your smartphone’s settings
  • Find more information about the dating website you are planning to visit, look into its reputation on the internet and try to find user feedback
  • Use a reliable security software that delivers advanced protection

Vladimir Kuskov, head of advanced threat research at Kaspersky, advised users to download only legal versions of applications from official application stores. Kuskov also stressed, “Online dating has made our lives easier and yet uncovered new risks on the path to love. We advise users to stay attentive and use legal versions of applications that are available in official application stores. And, of course, we wish you best of luck finding the perfect date for this special day.”

Security Incidents from Dating Apps  

Dating apps were used to infiltrate smartphones used by military personnel. Earlier, Hackers honeytrapped the U.K.’s Royal Air Force (RAF) personnel by hijacking an RAF airwoman’s Tinder profile and reaching out to another RAF serviceman to get details of the F-35 stealth fighter from him. The source of the hack remains unknown but comes amid concerns of China and Russia staging state-sponsored attacks.

In a similar incident, Palestinian Sunni-Islamist fundamentalist organization Hamas was accused by the Israel army’s intelligence directorate for building fake dating and FIFA World Cup 2018 applications to entice soldiers into downloading malware on to their mobile phones, with intentions to gather sensitive information about the military activities around Gaza strip.

Cybersecurity Startup spiderSilk Secures US$500,000 in Seed Funding

Axonius Raises US$58 Million to Accelerate its Security Management Tool

spiderSilk, a Dubai-based cybersecurity startup specialized in helping organizations design their cybersecurity defenses by providing offensive cyberattack simulations, raised US$500,000 in its seed funding round. The seed round was led by a UAE-based venture capital firm Global Ventures and included a few other co-investors like Magnus Olsson, co-founder of Careem, FutureTech and Xische Ventures.

Co-founded in 2019 by Mossab Hussein, an ex-product manager at Careem, and Rami El Malak, spiderSilk was founded with the aim of protecting organizations against constant cyberthreats, especially in the currently tensed geopolitical environment. The company focuses on finding vulnerabilities and loopholes in applications within the public as well as private infrastructure domains. spiderSilk simulates cyberattacks and then sends reports to its clients based on this simulation to safeguard their business networks and systems.

The cybersecurity startup came into the limelight when it first found vulnerabilities in WeWork’s GitHub repository that was leaking confidential contracts and customer data. In the subsequent months, spiderSilk’s team also exposed a database on MoviePass’ subdomains that listed the personal details of their customers along with respective credit/debit card numbers.

spiderSilk’s proprietary machine-driven technology has without notice already had a humongous impact on humankind as it has detected threats that would have potentially impacted around 120 million people to date. Owing to this revolutionary technology, it has garnered successful collaborations and clientele, which includes the likes of Samsung, Huawei, EA Games, Navblue and WeWork.

When asked about Global Ventures’ interest in the seed funding of the cybersecurity startup, Noor Sweid, General Partner at Global Ventures, said, “The company has already onboarded a list of regional and international clients such as the Ministry of Justice in KSA, Dubai Police, the UAE Government Office,  Huawei, and a large data analytics company in the U.S., amongst others. This truly illustrates spiderSilk’s ability to scale not only regionally, but also internationally. Thus, we look forward to working closely with the founders to enable the Company to scale its true potential.”

Miami Beach Police Department Suffers Ransomware Attack

Ransomware Attack on Azusa Police

The North Miami Beach Police Department was recently attacked in a ransomware campaign that encrypted files on the police computer networks. The department immediately took down the affected computers and alerted the FBI, the U.S. Secret Service, and the Miami-Dade Police Department to investigate the issue. However, the police officials noted that there was no interruption in public safety services post the attack.

The officials stated that attackers demanded millions of dollars in ransom to restore access to their network systems. The department has not revealed any information on the identity of the attacker group and about what information was compromised in the incident.

In an official statement, the City of North Miami Beach said, “We continue to work closely with these federal partners, as well as the county police department and a third-party forensic investigator, to determine the extent and objectives of the attack and how best to address it. The City of North Miami Beach’s investigation will include an analysis to determine whether any resident’s, employee’s, or vendor’s personal information may have been subject to unauthorized access or acquisition.”

“The City of North Miami Beach takes this attack seriously, and is determined to take all steps necessary to protect itself and its citizens from those who would do them harm. No other information will be released at this time,” the statement added.

Multiple cities in the U.S. have fallen victim to ransomware attacks over the past couple of years and incurred huge data and money losses in ransom demands. Earlier, NYPD’s fingerprint database was shut down for a few hours, when an accidental ransomware infection which affected nearly 23 machines linked to the department’s LiveScan fingerprint-tracking system. The incident occurred at the Police Academy in Queens when a third-party contractor was setting up a digital display system. As soon as the contractor connected the already infected NUC mini-PC to the police network, the virus attached itself to the system.

Hackers Target Supply Chain Companies with “Kwampirs” Malware

Rootkits, Mobile Malware in Asia

The FBI recently gave a security warning to private organizations in the U.S. about an ongoing hacking campaign targeting software supply chain companies. It’s said that attackers are targeting companies with a remote access trojan (RAT) malware tracked as “Kwampirs”, according to a source.

“Software supply chain companies are believed to be targeted in order to gain access to the victim’s strategic partners and customers, including entities supporting Industrial Control Systems (ICS) for global energy generation, transmission, and distribution,” the FBI said in a media statement.

Kwampirs Malware

Apart from attacks on supply chain software providers, hackers also deployed Kwampirs malware in attacks against companies in the health care, energy, and financial sectors. The FBI alert didn’t mention the targeted software providers or any other victims of Kwampirs malware. However, it shared IOCs (indicators of compromise) and YARA rules so that companies can scan their networks for signs of the Kwampirs malware used in the recent attacks. The FBI urged organizations to scan their networks for any signs of the Kwampirs malware and report if they find any. Kwampirs malware was first discovered by Symantec in April 2018. It’s said that a hacking group named Orangeworm used Kwampirs to attack the health care, pharmaceutical, IT, manufacturing, agriculture, and logistics companies.

Updated Version of Shamoon Malware

The FBI claims that Kwampirs malware has numerous similarities with “Shamoon”, a data-wiping malware developed by the APT33 hacking group. Once injected, Shamoon malware destroys data, disrupts operations, and can lead to hijacking an organization’s network.

The agency also stated that attacks which employ Kwampirs have now targeted companies in the ICS (Industrial Control Systems) sector. The FBI said, “While the Kwampirs RAT has not been observed incorporating a wiper component, comparative forensic analysis has revealed the Kwampirs RAT as having numerous similarities with the data destruction malware Disttrack, commonly known as Shamoon.”

Intelligence in the Enterprise

Threat Intelligence

Intelligence became an integral military discipline centuries ago. More recently, this practice evolved into what is called Intelligence Preparation of the Battlefield, or IPB. In both military and civilian agencies, the discipline uses information collection followed by analysis to provide guidance and direction to operators making tactical or organizational decisions. Used strategically, this type of intelligence puts an organization in a stronger position to operate offensively or defensively because in theory, they now know more than their enemy.

By Patrick Flynn, Director of National Security Programs, McAfee

This same concept can be applied in the theater of cybersecurity operations. However, the current scope of intelligence in many enterprises describes just one aspect of the IPB discipline: information collection. The critical component missing to complete the process is a specialized researcher trained in this type of analysis and subsequent application of intelligence.

A disciplined intelligence cycle goes deep—applying advanced data collection methodologies from open, closed and propriety sources, social media, human intelligence and the dark web against areas such as cybercrime, hactivism, or cyber espionage, to thoroughly analyze the adversary. Intelligence can ultimately be used to prepare organizations tactically and strategically to both anticipate and mitigate modern threats.

The latest research and analysis from McAfee Advanced Program Group (APG) researcher Anne An, detailing the actions of Chinese non-state threat actor groups is a great example of intelligence that is invaluable for organizations. This unique take on Chinese cyber criminality educates practitioners on the threats around them, empowering them to prepare their organization to be proactive, rather than reactive. Further, there are many times where organizations are unaware that they have been a victim of a cyberattack. This could include stolen data, which McAfee APG may find being sold on the dark markets, and in some cases, could have a devastating effect on their business.

Editor’s note: Read Anne An’s story in the next issue of the CISO MAG e-zine. Download the e-zine here: https://cisomag.com/magazine/

Sun Tzu, the Chinese general, and military strategist once articulated, “The art of war teaches us to rely not on the likelihood of the enemy’s not coming, but on our own readiness to receive him; not on the chance of his not attacking, but rather on the fact that we have made our position unassailable.” These ancient words are still very meaningful today. If organizations robustly embrace the intelligence process, their defensive posture will exponentially improve.

Intelligence in the EnterprisePatrick Flynn is a public sector security expert with more than 25 years’ experience in the federal government. Flynn is currently Director of National Security Programs for McAfee and previously served in similar roles at Northrop Grumman and General Dynamics. Flynn’s public sector experience includes work at the U.S. Department of Homeland Security as the Director of Communications of the Joint Wireless Program Office. He also served as Assistant Chief of the CBP Office of Border Patrol. Prior to that role he served as a U.S. Border Patrol Agent. Flynn is retired from the U.S. Naval Reserve, Office of Naval Intelligence, and was awarded a Bronze Star for his service in Operation Enduring Freedom in Afghanistan. He serves on the President’s National Security Telecommunications Advisory Council, most recently co-chairing the production of the Information and Communications Technology Management Service Mobilization Report. Flynn holds a B.S. in the Administration of Criminal Justice.

Disclaimer: The article has been edited in accordance with the guidelines of CISO MAG. CISO MAG does not endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. Views expressed in this article are personal.

Software Bug Exposes CPR Numbers of 1.26 million Danish Citizens

Denmark, Danish citizens, DESMI

A software bug in Denmark’s tax service portal, TastSelv Borger, accidentally exposed 1.26 million Danish citizens CPR numbers to Google and Adobe analytics services for more than five years. The issue, which was discovered by the Danish Agency for Development and Simplification (Udviklings-og Forenklingsstyrelsen) during their audit activity, has affected one fifth of the total population of Denmark.

The TastSelv Borger tax service portal is managed by a U.S. company DXC technology. It is used by the Danish citizens to view and change their tax returns and annual statement, along with payment of residual taxes. While filing taxes, users are required to enter the CPR number, which is a ten-digit civil registration number assigned to all the people who reside in Denmark and acts as a unique identifier for every individual. Additionally, CPR number provides information of the citizen’s date of birth as the first six digits denote the same, whereas the last digit gives information on the gender of its owner (an odd number in the last digit indicates the owner is male and even number indicates the owner is a female).

The Three Instances of CPR Number Leaks

The Danish Agency for Development and Simplification found that the CPR numbers of its citizens were erroneously getting attached to a web address due to a software bug in DXC’s application, which was further shared with Google and Adobe for analytical purposes. Confirming the findings, DXC stated that there were three separate instances when the said CPR numbers were exposed:

  1. In the first instance, in a span of five years (February 2, 2015, to January 24, 2020) approximately 1.26 million CPR numbers were exposed.
  2. The second instance included the exposure of approximately 1,330 Danish citizens from January 29, 2020, to February 1, 2020.
  3. During an internal investigation into the first two instances of CPR number leaks, DXC itself encountered a third instance, where 4,735 citizens’ CPR numbers were sent from TastSelv Borger to another vendor company MaxCDN, between 2015 and 2016.

Additionally, DXC mentioned that although the citizens’ CPR numbers were exposed due to the bug, the chances of its abuse were next to nil as the data is sent through a secured and encrypted channel. DXC also clarified that no other personal data of Danish citizens such as payroll, tax details, etc. have been disclosed to IT providers.

Andreas Berggreen, director of the Danish Development and Simplification Board said, “This is an older software bug that has been fixed today (on February 7, 2020). It is important to note that in any of the reported cases there is no risk that the information sent has been misused. In fact, in one of the cases, the information has been deleted as an integral part of the recipient process, meaning it is neither logged in nor stored with Google.”

1...244245246...410Page 245 of 410