Home Blog Page 251

Magecart Hacking Group Arrested in Indonesia

New Programming Language

Indonesian Police and Interpol recently arrested three men who belong to Magecart hacking group for involvement in Magecart attacks. The police officials stated that it’s the first arrest of Magecart gang members.

The suspects, identified by initials ANF (27 years), K (35 years), and N (23 years), were accused of injecting JavaScript sniffers into websites to capture information entered by the site visitors. It’s said that the suspects allegedly used the stolen payment card data to purchase electronic and luxury goods.

“The three of them have carried out their actions since 2017 until now, and each has similar hacking abilities. The arrest of the hacking suspects began with the collaboration of Subdit II Dittipidsiber Bareskrim Police, Interpol, ASEAN Desk and IB-Group in the Night Fury Operation activities, which are joint operations with several communities both nationally and internationally in order to combat Malware used by hackers,” the officials said in a media statement. 

Macy’s Magecart Attack

In October 2019, Macy’s, an American department store chain, stated that its customers have been hit by an attack that affected countless numbers of credit cards. The retailer stated that unknown intruders planted a card-stealing malware script on its payment site and collected customer details.

According to an official statement, the attackers installed a Magecart script on the checkout page of its website and siphoned off customers’ payment card details between October 7 and October 15,  this year.

The compromised data included customers’ names, addresses, phone numbers, credit card numbers, card verification codes, and expiration dates.

What is Magecart Attack?

Magecart attack, also known as web skimming or e-skimming, is a form of cybercrime where attackers plant malicious JavaScript code on online stores.

In a Magecart attack, hackers gain access to a company’s online store website by compromising and hiding malicious code in it. The malicious code then collects the payment card information from users while making purchases on the infected site. It’s said that hackers either sell the stolen card data on the darknet or uses it to make fraudulent purchases.

JhoneRAT Malware Attacks Middle East Countries

RAT, Trojan, Remote Access Trojan

Security researchers from Cisco Talos recently discovered a new version of remote access trojan (RAT), which attacks a victim’s device via malicious Microsoft Office documents. The RAT malware, tracked as “JhoneRAT”, was developed using Python and targeted a set of Middle East countries by checking keyboard layouts of the infected devices.

The researchers identified three malicious MS Office documents that were used to infect the device.  The first document “Urgent.docx”, discovered in November 2019, asks the victim to enable English and Arabic-language editing.  The second document named “fb.docx”, discovered in January 2020, claims to contain data on leaked Facebook accounts from 2019. The third document, found at the end of January 2020, contains blurred content and is alleged to be from a legitimate United Arab Emirates organization. 

How JhoneRAT Works

Attackers trick the victims to click and download a malicious document from the internet. The malware then gets divided into multiple layers and each layer downloads a new malware payload. Once JhoneRAT is deployed, it gathers information from the victim’s cloud services like Google Drive, Twitter, ImgBB, and Google Forms.

Countries Attacked

According to the researchers, JhoneRAT targeted UAE, Saudi Arabia, Iraq, Libya, Algeria, Egypt, Morocco, Tunisia, Oman, Yemen, Syria, Kuwait, Bahrain, and Lebanon.

How to Prevent JhoneRAT

Hackers try to lure their victims into opening malicious documents by labeling it as “Urgent.docx” or “fb.docx” or other strange image files. It’s advised to avoid clicking such file extensions from unknown sources.

“The fact that this attacker decided to leverage cloud services and four different services—and not their own infrastructure—is smart from an opsec point of view. It is hard for the targets to identify legitimate and malicious traffic to cloud provider infrastructure. Moreover, this kind of infrastructure uses HTTPS and the flow is encrypted that makes man-in-the-middle interception more complicated for the defender. It is not the first time an attacker used only cloud providers,” the researchers said.

Singapore Blocks Malaysian Website Under Falsehoods Law

network and ransomware attacks in Singapore, Singapore Ranks Most Prepared in Cybersecurity Readiness: Deloitte

The Singapore government issued directives to local ISPs for blocking a Malaysian website, Lawyers for Liberty (LFL). These measures were taken because Lawyers for Liberty failed to comply to the correction directives issued by the Singapore government under the Protection from Online Falsehoods and Manipulation Act (POFMA) guidelines.

What is POFMA?

POFMA was passed in the Parliament on May 9, 2019, and came into effect from October 2, 2019. In the lead up to this act, public consultations were being conducted including eight days of Select Committee hearing.

Under POFMA, which is aimed at protecting society from fake news that harms the public interest, a falsehood is defined as, “A statement of fact that is false or misleading.” It doesn’t cover opinions or criticisms. Falsehoods that may harm a person, organization or group’s public interest, may have to be updated with a correction. The real facts should be placed alongside the falsehoods so that people can always check the truth for themselves. In certain serious cases though, the post may have to be taken down.  

What is Lawyers for Liberty Case?

On January 16, 2020, Lawyers for Liberty published a post which the Ministry of Home Affairs for Singapore found factually untrue and spreading online falsehood directed towards them. The ministry further requested the POFMA office for issuance of correction directives to LFL as per the guidelines laid in the Falsehoods law. LFL, however, did not pay heed to this notice. It failed to comply with the directive, which prompted the Singapore government to order its industry regulator Infocomm Media Development Authority (IMDA) to issue the access blocking orders. These blocking orders given to all local ISPs will be lifted only when LFL complies with the original correction directives.

Lawyers for Liberty, on the other hand, has filed a motion in the Kuala Lumpur High Court in Malaysia against Singapore’s Home Affairs Minister, K Shanmugam, stating that POFMA cannot be constitutionally imposed on Malaysians. LFL adviser N Surendran said, “The reason for the lawsuit is because this is an attempt by Singapore to encroach upon or crackdown on freedom of speech in Malaysia.”

Ryuk Ransomware Strikes Again, Affects Tampa Bay Times

Ransomware, supply chain and ransomware

The Tampa Bay Times is the latest victim of a ransomware attack. The popular U.S.-based news organization reported that attackers infiltrated its computer systems with Ryuk ransomware. The exact number of devices affected in the incident is unknown. However, the company clarified that the attack didn’t compromise any of its or its customers’ information.

According to a report from Malwarebytes Labs, the Tampa Bay Times did not respond to the attackers and refused to pay any ransom. The company stated that it is in the process of removing the ransomware and restoring its affected systems via backup files.

Ransomware Attacks on News Agencies

Ryuk ransomware affected several newspapers/news agencies in the U.S.last year. In Los Angeles, San Diego Union-Tribune, The Wall Street Journal, Los Angeles Times, The New York Times (West Coast Editions), and several Tribune Publishing newspapers faced printing and delivery issues after they suffered a ransomware attack.

The Chicago Tribune reported that its publishing and printing systems were affected in the attack. The publisher stated that its print edition was published without paid classified ads and death notices, due to the attack. However, the company clarified that no customer and financial information was leaked.

Tribune Publishing spokeswoman, Marisa Kollias, said, “This issue has affected the timeliness and, in some cases, the completeness of our printed newspapers. Our websites and mobile applications, however, have not been impacted. There is no evidence that customer credit card information or personally identifiable information has been compromised.”

Ryuk in the News

In a related development, the officials of the U.S. Coast Guard (USCG) recently disclosed a Ryuk ransomware infection that had taken down the entire corporate IT network of a Maritime Transportation Security Act (MTSA) regulated facility for more than 30 hours. According to the USCG officials, the ransomware interrupted the camera and physical access control systems. It’s believed that a malicious email sent to one of the maritime facility’s employees was the entry point for the ransomware infection.

The ransomware corrupted the enterprise IT network files, encrypted them, and prevented the facility’s access to critical files. The officials stated that the incident affected the facility’s IT network and industrial control systems that monitor and control cargo transfer operations.

SecureLink Partners with ShiftLeft to Cater GCC and African Businesses

Thoma Bravo Acquires Sophos for US$3.9 Billion

Dubai-based risk advisory firm SecureLink has entered into a partnership with ShiftLeft, an application security testing provider, to specifically cater to businesses in the Gulf Cooperation Council (GCC) region and Egypt. This is a strategic alliance as ShiftLeft has a real-time application security product suite and SecureLink is a well-established firm assisting its customers to identify, mitigate and manage their cybersecurity risks in GCC and certain African countries including Egypt.

ShiftLeft provides a continuous application security platform, built for the modern software development life cycle (SDLC). It combines static code analysis to quickly and accurately identify vulnerabilities and protect the application in an automated workflow. It integrates directly into DevOps pipelines via pull request or build and analyzes over 500,000 lines of code in under ten minutes. This enables AppSec teams to insert security into DevOps without slowing down innovation. This combination of runtime code analysis and runtime protection makes ShiftLeft’s product suite, a comprehensive application security solution.

The partnership means that SecureLink will now have distribution rights for the entire ShiftLeft product suite which includes ShiftLeft Inspect, ShiftLeft Ocular and ShiftLeft Protect.

Reghu Mohandas, Director of SecureLink said, “Adoption of DevOps requires organizations to be agile and secure at the same time. Using platforms like ShiftLeft, we believe our customers can ensure that their applications are secure, both during build-time and run-time. Under this partnership, we will jointly focus on engaging with customers who require advisory services around application security and leverage the ShiftLeft platform in providing continuous assessment and protection.”

“The GCC and Africa is one of the fastest-growing, and most dynamic, regions powering the global economy,” said Manish Gupta, CEO, and Founder of ShiftLeft. “Combining our fastest and most accurate code analysis with the top application security advisory will provide our customers with the most advanced application security solution.”

Data Privacy Day 2020: Five Learnings from the Past

Data Privacy Day 2020

This Data Privacy Day 2020, we urge individuals and organizations around the world to learn from the fallout of the mega-breaches of the recent past. We provide five positive steps that companies around the world can take to better protect consumers, employees and more.

Until recently, data privacy was only considered critical in the digital world. But as the digital and physical worlds intersect, it is now integral not only to secure an individual or a corporation’s digital identity but also to avoid the safety of citizens being compromised. Data privacy considerations should underpin all company decisions, whether on the board level or on the shop floor and, this Data Privacy Day, organizations should encourage their entire workforce–not just IT teams–to re-evaluate how they secure and manage data.

By David Higgins, Technical Director, CyberArk

It’s now well-established that data is the world’s most valuable asset and a tempting target for malevolent hackers with varying motivations. More often than not, they are pursuing credentials that they can use to infiltrate businesses and target sensitive and valuable data. Attackers seek ways to cause irreparable damage across a whole range of industries, from seizing companies’ administration logins to hacking into medical data so as to hold individuals to ransom over the disclosure of sensitive personal information. As a tragic, but potentially realistic scenario, this could even result in a doctor being unable to perform a life-saving operation due to a lack of availability of the patient’s records, for example.

Hackers will inevitably be successful from time to time. Addressing this threat, and limiting how far they can infiltrate a network after a successful breach, is imperative in order to safeguard national security. Infiltration or compromise of CNI, for instance, could plausibly result in the loss of control of public services such as utilities, healthcare and government, posing a severe risk to public safety. This Data Privacy Day, we need to take a step back to not only understand the value in the data we hold but also the importance of only allowing individuals and systems that need it to access it.

Lesson #1: Equifax Breach
 (reported in 2017)

Several tech failures in tandem–including a misconfigured device scanning encrypted traffic, and an automatic scan that failed to identify a vulnerable version of Apache Struts–ultimately led to the breach which impacted 145 million customers in the U.S. and 10 million U.K. citizens.

Data Privacy Day Learning – get security basics right. Cyberattacks are growing more targeted and damaging but a good industry reminder from the Equifax breach is that standard security basics should never be ignored. Patches should be applied promptly, security certificates should be maintained, and so on. This breach also inspired elected officials to push for stronger legislation to tighten regulations on required protection for consumer data. 

Lesson #2: Uber Breach
 (reported in 2017)

In 2017 Uber revealed it had suffered a year-old breach that exposed personal information belonging to 57 million drivers and customers.

Data Privacy Day Learning – don’t store code in a publicly accessible database. Uber data was exposed because the AWS access keys were embedded in code that was stored in an enterprise code repository by a third-party contractor. A clear takeaway is that no code repository is a safe storage place for credentials.

Lesson #3: Facebook’s Cambridge Analytica Breach
 (reported in 2018)

Cambridge Analytica harvested the personal data of millions of peoples’ Facebook profiles without their consent and used it for political advertising purposes. The scandal finally erupted in March 2018 with the emergence of a whistle-blower and Facebook was fined £500,000 (US$663,000), which was the maximum fine allowed at the time of the breach.

Data Privacy Day Learning – protect user data (or pay up). Lawmakers claim Facebook “contravened the law by failing to safeguard people’s information” – and suffered the consequences. Now the U.S. government is placing additional pressure on Facebook to stop the spread of fake news, foreign interference in elections and hate speech (or risk additional, larger fines). 

Lesson #4: Ecuadorian Breach
 (reported in 2019)

Data on approximately 17 million Ecuadorian citizens, including 6.7 million children, was breached due to a vulnerability on an unsecured AWS Elasticsearch server where Ecuador stores some of its data. A similar Elasticsearch server exposed the voter records of approximately 14.3 million people in Chile, around 80 percent of its population.

Data Privacy Day Learning – adhere to the shared responsibility model. Most cloud providers operate under a shared responsibility model, where the provider handles security up to a point and, beyond that, it becomes the responsibility of those using the service. As more and more government agencies look to the cloud to help them become more agile and better serve their citizens, it’s vital they continue to evolve their cloud security strategies to proactively protect against emerging threats – and reinforce trust among the citizens who rely on their services. 

Lesson #5: Desjardins Breach
 (reported in 2019)

The data breach that leaked info on 2.9 million members wasn’t the result of an outside cyber attacker, but a malicious insider–someone within the company’s IT department who decided to go rogue and steal protected personal information from his employer.

Data Privacy Day 2020 Learning – be proactive in identifying unusual/unauthorized behavior. While insider threats can be more difficult to identify, especially in a case where the user had privileged access rights, having a solution in place to monitor for unusual and unauthorized activities that can take automated remediation steps as needed can help reduce the amount of time it takes to stop an attack and minimize data exposure. This breach shows that a defense in depth security strategy that includes privileged access security, multi-factor authentication, and the detection of anomalous behavior with tools such as database activity monitoring has never been more crucial.

 About the Author

David Higgins is EMEA Technical Director at CyberArk. Data Privacy Day 2020David Higgins is EMEA Technical Director at CyberArk. Since joining CyberArk in 2010, David has worked to help the world’s leading – and most complex – organizations secure and protect their privileged access. Today David works with clients to advise on threats associated with privileged escalation, lateral movement and credential theft as well as discussing best practices and driving innovation around privileged management processes. David is a frequent speaker at events as well as with media. He holds a BSc. in Computer Systems and Information Systems.

Disclaimer: CISO MAG does it endorse any of the claims made by the writer. The facts, opinions, and language in the article do not reflect the views of CISO MAG and CISO MAG does not assume any responsibility or liability for the same. Views are personal.

FIFA World Cup 2022: Too much at stake for Qatar

FIFA World Cup 2022

If there is a thing or two that can be learnt from the previous editions of all major sports tournaments, it is the fact that literally all the beloved tournaments will be the hot favorites for hackers. Nearly eight million people visited Russia for the 2018 World Cup, and much ahead of the inauguration of the tournament, the event witnessed a slew of cyberattacks targeted at the federal bodies, fans, and even soldiers sitting and watching the game from another part of the globe. Even Russian President Vladimir Putin declared that during the World Cup period the nation was a target for almost 25 million cyberattacks. With such limelight on the previous edition of the World Cup, the stakes for the upcoming FIFA World Cup 2022 are raised and it is imperative for Qatar to ensure the safety of its infrastructure as well as the Football World Cup.

How prepared is Qatar?

According to IDG Connect, the Arab nation has been heavily investing in digitization and is keen on positioning itself as a provider of a modern competition with its reputation at stake. “Both Qatar and FIFA are already up against it from a perception point of view and any sort of data breach that affects fans in the build-up or during the event could be catastrophic for the reputation of both parties,” Geoff Anderson, CEO of mobile security firm PixelPin told IDG Connect.

The Supreme Committee for Delivery & Legacy of Qatar also hosted global cybersecurity experts along with collaboration with Interpol’s Stadia–a special initiative to ensure the cybersecurity of sporting events, especially the 2022 World Cup–last year to understand the threats in the space and to be prepared against the attacks. The meeting also stressed on several vectors including IoT, industrial control systems, cybersecurity capabilities of the nation and the football federation, cybersecurity risk management as well as cybersecurity operations for venues.

According to Homeland Preparedness News, “Through Project Stadia, Interpol has created a ready network of specialists around the world to shape future efforts for securing major public events. Better understanding of the global threat environment and its implications is vital for nations hosting future major events.” Falah Al Dosari, the senior project manager of Project Stadia, said.

Support from other nations

In October, last year, Angelo Tofalo, Italian Undersecretary of the Minister of Defense also stated that Italy can provide Qatar with a full range of cyber and defense capabilities as well as expertise by leading Italian cybersecurity companies. According to Peninsula Qatar, Tofalo who opened the workshop on Italian Cyberprotection of the Defense Sector and of Critical Infrastructures during Qitcom 2019 suggested that Italy can help Qatar protect its infrastructures, including its transportation infrastructures, military boats, and borders. Italian businesses can also help provide security solutions for the stadiums which will be used for the upcoming FIFA World Cup 2022. “We have good relationship in defense with Qatar. We want to exchange experience and train together also in cybersecurity. We can offer greater assistance to Qatar in this field,” said Tofalo.

Apart from this, Qatar has been working parallelly with the U.K and has been exploring opportunities in co-operating cybersecurity efforts. Qatar and Singapore have also been working on enhancing their bilateral relations while focusing on expanding cooperation in the fields of security, fintech, and even cybersecurity.

The World Cup is still two years away. With several projects already being undertaken toward bettering the cybersecurity of the event and nations across the globe pledging to extend their support to Qatar, we can hope the Arab nation will be prepared for the worst that could emerge from the digital world.

U.K. Government to Strengthen Consumer IoT Security Standards

IoT attacks

The U.K. government recently introduced new legislation to improve security standards of the consumer Internet of Things. The law, launched by the Department for Digital, Culture, Media, and Sport (DCMS), will mandate that IoT devices sold in the country must adhere to advanced security standards.

The new regulations, jointly developed by DCMS and the National Cyber Security Centre, are intended for companies that manufacture and sell consumer IoT devices.

The legislation will make all IoT manufacturers in the country follow three critical security requirements:

  • All consumer internet-connected device passwords must be unique and not resettable to any universal factory setting.
  • Manufacturers of consumer IoT devices must provide a public point of contact so anyone can report a vulnerability and it will be acted on time.
  • Manufacturers must explicitly state the minimum length of time for which the device will receive security updates at the point of sale, either in store or online.

According to DCMS, the use of connected devices is on the rise. It’s estimated that there will be around 75 billion IoT devices in homes globally by the end of 2025.

Digital Minister Matt Warman said, “We want to make the U.K. safest place to be online with pro-innovation regulation that breeds confidence in modern technology. Our new law will hold firms manufacturing and selling internet-connected devices to account and stop hackers threatening people’s privacy and safety. It will mean robust security standards are built-in from the design stage and not bolted on as an afterthought.”

Recently, U.K.’s Ministry of Defense announced contracts to use AI-based technology in warships to help warship crews make quick decisions and process data efficiently.

According to a source, Defense and Security Accelerator (DASA) will fund £1 million (around US$1.3 million) for AI contracts as part of its “Intelligent Ship – The Next Generation” competition, which was aimed at using innovative approaches for Human-AI and AI-AI teaming for various defense platforms like warships, aircraft, and land vehicles.

Random Thoughts on Data Privacy Day

personal data collection, Personal data. Data Privacy

The world marks 28th January 2020 as Data Privacy Day (also called Data Protection Day in Europe). On this occasion, it’s essential to revisit the concerns that consumers have about data privacy. While laws are yet to be established or just rolling out (notably CCPA and India’s Data Protection Bill), consumers need to step forward and question services organizations who are custodians of their data and Personally Identifiable Information (PII). As we go about reporting news daily here at CISO MAG, it is alarming to note that almost every other week, we read about organizations getting hacked and about their customer databases leaked online. Yes, data has become the fluid that keeps the business machinery moving, and it is up to organizations to prioritize the security of this data.

Manish Sehgal, Partner, Deloitte India, said, “Over the past years there have been many conversations on ‘data as new oil,’ or ‘data as an asset.’ However, flipping the coin, if data (personal data to be specific) across its lifecycle is not safeguarded, and is used or processed beyond defined purposes, it may become a liability.”

Countries have taken steps to secure consumer data, and businesses are bound by regulation, some with strict penalties and hefty fines. The EU’s GDPR is an example, and other countries are also working on similar laws and regulations. However, that alone does not guarantee that your data is in safe hands. Organizations in possession of consumer data need to do a lot more and deploy the right security solutions (to address data leakage and ransomware, for instance). They need to go further and ensure that partners in their ecosystem also secure their customer databases. If the data is on the cloud, on a service provider’s server, then the service provider also shoulders that responsibility. And the organization needs to take adequate steps right at the beginning to ensure it.

Sehgal added, “With growing regulations and strengthening rights for data owners, organizations around the world are becoming more answerable than ever before regarding data’s usage, storage, and erasure. Given the anxiety around the protection of data and its storage today, real value for any organization is to be proactive to become privacy enabled and not just a privacy compliant.”

It comes down to legalities, frameworks, policies and guiding principles—and Generally Accepted Privacy Principles (GAPP) is an example.

“Leading practices and frameworks such as GAPP offer necessary guidance for organizations to embark on their data journey. The need of the hour for the majority of Indian enterprises is to strategize, prioritize and initiate their growth path harnessing the power of data,” concluded Sehgal.

So, this is not just another special day marked on our calendars. On Data Privacy Day, we all need to ask ourselves if we are doing enough to protect our data and our customers’ data. We need to raise more awareness and listen to the privacy concerns of our customers.

A responsible organization gains trust and credibility–which leads to business success.

New York Senators Proposes Bill to Ban Ransomware Payments

Two senators of New York state recently came up with two bills to ban government agencies and local municipalities from using public money for paying ransomware to cybercriminals.

The first bill, proposed by Republican NY Senator Phil Boyle, and the second bill, proposed by Democrat NY Senator David Carlucci, are currently under discussion in committee. Apart from ransomware payments, the proposed bills also recommended creation of a state fund to aid government entities improve their cybersecurity capabilities.

“The cybersecurity enhancement fund that will make available grants and financial assistance to villages, towns, and cities with a population of one million or less for the purpose of upgrading the cybersecurity of their local government,” the bill stated.

Several industry experts opined that this is the first time the state authorities have proposed a law that bans paying the ransom.

Earlier this year, the New York State Legislature passed a bill “Stop Hacks and Improve Electronic Data Security Act (SHIELD)” to strengthen its data breach policies.

The bill provides more transparency to consumers while also impose stringent penalties on companies without proper cybersecurity measures.

According to the Attorney General Letitia James, the SHIELD Act updated the state’s breach notification laws, extended notification requirements for companies, and increases the rights of consumers in the event of a breach. The bill also imposed tough obligations on businesses that handle sensitive data of customers.

“It is critical that our laws keep pace with the rapidly changing world of technology,” said State Senator Kevin Thomas. “I’m proud to announce the passage of the SHIELD Act today, as it will allow for increased accountability and diligence in regard to consumer privacy. Now more than ever, it is important that businesses protect the private information of the consumers they serve.”

1...250251252...410Page 251 of 410