Home Blog Page 270

RIplace – A Security Evading Ransomware Technique

ransomware, fonix, fonix ransomware, Cybereason Partners with Intel for Hardware-Enabled Ransomware Prevention, Kronos

Nyotron’s research team has discovered a new ransomware technique that goes undetected in most antivirus, anti-ransomware and Endpoint Detection and Response (EDR) solutions. The researchers have named it “RIplace”, as it bypasses latest security products by replacing all sensitive files on victim’s machine.

What’s different in RIplace Ransomware Technique?

Generally, all ransomwares follow a similar flow as shown below.

Ransomware-Flow

But the RIplace technique is different when it comes to the last step. It creates a new encrypted file and replaces both, the original and sensitive data files using the Rename request (specifically, IRP_MJ_SET_INFORMATION with FileInformationClass set to FileRenameInformation). The Rename operation is used widely by Microsoft and other security vendors to call filter drivers. If prior to calling Rename, DefineDosDevice (a legacy function that creates a symlink) function is called, then an arbitrary name can be passed as the device name, and the original file path, as the target to point on.

The RIPlace discovery team further stated that “the callback function filter driver fails to parse the destination path when using the common routine FltGetDestinationFileNameInformation. It returns an error when passing a DosDevice path (instead of returning the path, postprocessed); however, the Rename call succeeds. “

Riplace Ransomware Flow

Using this technique, it is possible to maliciously encrypt files and bypass antivirus/anti-ransomware products that do not properly handle IRP_MJ_SET_INFORMATION callback.

Nyotron Raises the Red Flag

Nyotron told BleepingComputer that they tested RIPlace technique over a dozen vendors including Microsoft, Symantec, Sophos, McAfee, Carbon Black, Kaspersky, Trend Micro, Cylance, SentinelOne, Crowdstrike, PANW Traps, and Malwarebytes. They have followed the responsible disclosure policy by informing Microsoft and other security vendors and all relevant law enforcement and regulatory authorities.

Nyotron also released a demo video of the RIPlace evasion technique with Windows Controlled Folder Access (CFA) and announced a free testing tool any organization can download to check its systems.

Singapore to Adopt New Data Protection Measures

Singtel data breach

In order to boost cybersecurity and tackle next-generation cyber threats, the Singapore government decided to adopt new data protection measures. The government also established a committee, named Public Sector Data Security Review Committee, to review its data security practices.

The latest move comes after a series of cyber-attacks on public and private organizations in the country.

As per the reports, the newly established committee inspected around 336 network systems across 94 government agencies and observed international data security practices in the financial and healthcare sectors.

The committee, which is chaired by the Minister-in-charge of Public Sector Data Governance, Teo Chee Hean, suggested five recommendations to better protect citizens’ data. 

The five recommendations from the committee include:

  1. The need to enhance technology and processes to safeguard data against threats.
  2. Building data security competencies and training all public officers on data security.
  3. Improving the Government’s expertise in data security technology.
  4. Amending the Personal Data Protection Act to cover third-party vendors handling Government data.
  5. Improving the accountability and transparency of the public sector data security regime.

The government has accepted the committee’s proposals and aims to implement them by the end of 2021.

In his response to the Committee, Prime Minister Lee Hsien Loong said, “The Government accepts all the recommendations by the Public Sector Data Security Review Committee to secure and use data and digital solutions to deliver better services and policies for Singaporeans.”

PM Lee also said, “Data is the lifeblood of the digital economy and a digital government. We need to use and share data as fully as possible to provide better public services. In doing so, we must also protect the security of the data and preserve the privacy of individuals, and yet not stifle digital innovation. This is especially so in healthcare, but it is true of every other field of government too.”

Recently, Singapore and the United Kingdom joined hands to promote user “Security by Default” in both countries. According to the official report, the Chief Executive of the UK’s National Cyber Security Centre, Ciaran Martin, and Chief Executive of Singapore’s Cyber Security Agency, David Koh, signed a joint statement on cooperation between Singapore and the United Kingdom on the Internet of Things.

Both countries agreed to work together on areas of common interest, including alignment, cooperation, and coordination to support the cause “secure by default.” The Singapore-UK strategic alliance is intended to drive improvements in the security of smart consumer devices.  The agreement also accelerates the IoT industry to grow and innovate.

Statinko Botnet Uses YouTube as a Gateway for Cryptomining

Hackers Selling Stolen YouTube Credentials on Dark Web: Report

Statinko Botnet has been around since 2012 and has kept evolving. The latest addition to its wide portfolio of malicious activities like click fraud, ad injection, social network fraud and password-stealing attacks, is Cryptomining. According to the researchers at Slovakian software security firm, ESET, Statinko is capable of installing crypto malware on victims’ devices using YouTube.

Stantinko’s Cryptomining Module

Researchers found that Stantinko’s cryptomining module, exhausts most of the resources of the compromised machine by mining cryptocurrency using a highly modified version of the xmr-stak, an open-source cryptominer. Also, all unnecessary strings and whole functionalities are removed in attempts to evade detection.

Use of YouTube in Cryptomining

As mentioned earlier, Stantinko is constantly developing and improving its existing custom modules. This is evident from the fact that CoinMiner.Stantinko doesn’t communicate directly with its mining pool but uses proxies whose IP addresses are acquired from the description text of YouTube videos.

The description of such a video consists of a string composed of mining proxy IP addresses in hexadecimal or enclosed in “!!!!” format. This simplifies the process of parsing and prevents possible changes in the HTML structure of the YouTube video turning the parser, dysfunctional.

YouTube has now taken down all the channels containing these videos after the ESET researchers informed the video-sharing platform of the abuse.

Statinko Botnet’s Cryptomining Prowess

ESET has briefly described the cryptomining abilities of Statinko Botnet. It said, “The main part performs the actual cryptomining; the other parts of the module are responsible for additional functions such as:

  • Suspending other (i.e. competing) cryptomining applications.
  • Detecting security software.
  • Suspending the cryptomining function if the PC is on battery power or when a task manager is detected, to prevent being revealed by the user.”

Stantinko botnet has typically targeted users in the Soviet countries of – Russia, Ukraine, Belarus and Kazakhstan. It is still active, and, with the wide outreach of YouTube, this botnet has the capability of spreading like wildfire in other parts of the globe.

A McAfee Labs Threats Report revealed that the cybercriminals were generating 480 new threats per minute. It also highlighted that the IoT malware had increased to 73 percent, while the cryptocurrency mining malware was up to 71 percent in the third quarter of 2018.

“The variety of endpoints presents great challenges at many levels”

Rajesh Ganesan, Vice President, ManageEngine

Rajesh Ganesan, Vice President, ManageEngine has been associated with Zoho Corporation for over 22 years and is currently is the Vice President for ManageEngine, the IT management division of Zoho Corporation. He brings in more than two decades of experience in building products in the areas of telecommunication, enterprise IT management, and enterprise IT security. At ManageEngine, he is responsible for all business operations for Products – Defining, Developing, Delivering, Marketing, and Selling software products for identified viable markets.

In an exclusive email interaction with Brian Pereira of CISO MAG, Rajesh talks about the security challenges in managing endpoints and the right strategies to counter these challenges.

What is the challenge that CISOs and CIOs face today when it comes to managing endpoints? Is the challenge primarily about the visibility of the endpoints? How can they counter the challenges?

The variety of endpoints that the businesses have at their disposal to bring about productivity benefits presents great challenges at many levels. First, as the endpoints freely move across the corporate-governed network boundary, they become a primary vector for external attacks that are targeting access to critical internal resources. An endpoint used by a privileged but unassuming user can get infected with malware, which could then become the vector for external attacks when the users get back into the company network. Attackers can then execute command and control attacks leveraging the privileges of the user.

Second, is the case of dealing with the far greater menace of insider attacks, as endpoints tend to be the easiest medium to leak critical data. An attack like data exfiltration can be camouflaged as a normal activity, by leaking small amounts of information through multiple endpoints and assembling them later to get the entire data set. Or it could be simple cases of doing a print screen of sensitive data or downloading an attachment into a cloud service.

While the IT and IS leadership must build multiple layers of protection for securing endpoints, a common thread across many security incidents is how the privileges are defined and handled. This is strictly defining, enforcing, and monitoring the privileges for users to access the endpoints and the resources within, and also for the applications that run on those endpoints. For example, the privileges of a user could dynamically change depending on their location. They could have the highest privileges while in the office, moderate privileges while working from home, fewer privileges within the city of work, and minimum privilege outside the user’s usual region. Hence, privileged access management, which is “governing who has what kind of access to what resources for what reason and who approved the access” is fast becoming a top priority area for IT and Infosec leaders.

How does the PAM360 solution address this challenge?

Securing endpoints has to be done at many layers and PAM360 focusses on the privileged access management part. This is basically providing a holistic way for governing and managing “who has access to what endpoints for doing what operations, and who approved the access, and what do they do with the access.” While this sounds simple at the surface level, a lot goes inside to implement and run an effective privileged access management program. Each aspect mentioned needs a thoughtful definition of policies, processes, procedures, and controls implemented through a tool.

For example, to ascertain all the information access a user has, there must be a defined list, which includes systems and applications, types of roles, types of access, duration of access, and mechanisms to grant and revoke access. The same goes for controlling what actions a user can perform after getting access.

And speaking of users, they are not just employees within the organization. They could also be customers, partners, contractors, temporary workers, or others whose access to information needs to be managed. A contractor may not even need full-time access to all systems but just for a period of 30 minutes to get her job done. Yet, that access needs to be managed and monitored. Different tools exist to focus on specific aspects of privileged access, but PAM360 unified them all and provides one complete solution with which enterprises can implement a holistic program, regardless of the type of the endpoints.

What are the risks faced today, with regard to privileged accounts?

A primary risk with privileged accounts is they come with very high privileges but very little accountability. Most privileged accounts are system defaults like “administrator” and “root” without any explicit association with a human user. This leads to privileged accounts getting shared with whoever requires privileges for a certain period of time, but that poses a risk of anyone getting hold of the credentials to immediately inherit the privileges.

Because they are system defaults and are shared, often the credentials are not randomized periodically. This presents a huge risk of brute force attacks succeeding against these accounts and breaking one could open the floodgates.

When there is no proper monitoring of who has access to the credentials, there is a huge risk of the enterprise never being able to reconcile who performed a particular operation, especially malicious ones. And even when the access is controlled and monitored, unless the privileged actions performed are continuously monitored, malicious users can plant malware or logic bombs in software that manifest much later, obscuring all association of that particular user.

In the age of cloud and DevOps and IoT, many system and software components talk to each other and invoke actions across the network, and this access needs credentials. Often, the credentials are loosely stored or hardcoded in scripts and programs, leaving them open to anyone with access.

Why are legacy solutions inadequate to address today’s risks?

An effective privileged access management solution is not standalone but one that integrates with every component in the infrastructure. Legacy solutions often lack this support, especially when it comes to cloud, DevOps, RPA, and IoT. When it comes to cloud for instance, the requirements are elasticity and scalability as the number of managed endpoints could be large and dynamically changing. For DevOps, the requirements would be agile and velocity, in terms of how many operations per second the solution can perform. The rapidly changing requirements present lots of challenges, and the legacy solutions simply are not architected for today’s technologies and infrastructure.

Brian Pereira is the Principal Editor of CISO MAG. Apart from his editorial responsibilities, he enjoys writing features, interviews and technical articles.

Adobe Discloses Data Breach that Impacted Magento Marketplace Users

Panasonic network breach

Adobe, a provider of multimedia and creativity software products, recently disclosed a security breach that impacted users of its Magento Marketplace.

Magento Marketplace is an online portal for buying, selling, and downloading themes and plugins for Magento-based online stores.

In a notification sent to its customers, the company stated that a security vulnerability in Magento’s website allowed unknown intruders to access registered users’ account information. It’s unclear when the attackers exploited the vulnerability, but the company’s security team said they discovered the intrusion on November 21, 2019.

The exposed information included usernames, email addresses, store usernames (MageID), billing and shopping addresses, phone number, and limited commercial information. However, the company clarified that account passwords and financial data were not exposed in the incident.

“On November 21, we became aware of a vulnerability related to Magento Marketplace. We temporarily took down the Magento Marketplace in order to address the issue. The Marketplace is back online. This issue did not affect the operation of any Magento core products or services,” the company said in a statement.

“We have notified impacted Magento Marketplace account holders directly. We take these issues seriously and are committed to helping ensure our platforms are secure. We are reviewing our processes to help prevent these types of events from occurring in the future,” the statement added.

In a recent security incident, Adobe mistakenly exposed around 7.5 million user account details. This vulnerability was brought to light by Security Researcher and Consultant Bob Diachenko and reported in the press by Paul Bischoff Tech Journalist, Privacy Advocate and VPN Expert from Comparitech.

As per Adobe’s whitepaper, most components of Creative Cloud are hosted on Amazon Web Services (AWS) which include Amazon Elastic Compute Cloud (Amazon EC2) and Amazon Simple Storage Service (Amazon S3). The Elasticsearch database is used to store, search, and analyze large volumes of data in near real-time. Diachenko’s analysis spotted that this Elasticsearch database was left exposed as there was no password protection provided for it.

China Closes 173 Cryptocurrency Exchanges and Token-Issuing Platforms

Chinese Government Shuts 173 Cryptocurrency Exchanges

The Chinese government has reportedly shut down almost all the cryptocurrency exchanges and token issuing platforms that are operating within the country. The move was taken in order to tighten its grip over the financial industry in the country.

The shocking news came to light after the Chinese blockchain outlet CnLedger stated that “the 173 Chinese virtual-currency trading and token issuing platforms have all exited without risk,” referring to the People’s Bank of China (PBoC) Financial Stability Report (2019).

According to the PBoC’s Financial Stability Report, the country is going to eliminate “Unlicensed payment” businesses, which include online lending institutions and other financial companies.

“Some long-term accumulated deep-seated contradictions in the Chinese economy are gradually exposed, financial risks are prone to occur, and economic growth is facing more difficulties. From an international perspective, the possibility of “peaking down” in world economic growth has increased, and unilateralism and protectionist sentiment have increased worldwide, financial markets are highly sensitive to the trade situation, and uncertainty about global liquidity conditions has increased,” the report stated.

A wide range of uncoordinated laws and regulations governed the Internet in China.

Recently, China passed a new law on cryptography to ensure the security of cyberspace and information in the country. This paves the way for the country to release its own digital currency, which is aimed at cutting costs of circulating paper money and to help policymakers control the money supply.

The new cryptography law, which comes to effect on January 1, 2020, is designed to assist the development of the cryptography business and enhancing the security of cryptocurrency.

In 2014, China’s Central Bank set up a research team to work on its digital currency to cut the costs of traditional paper money and to control the money supply. The new digital currency can be used across major payment platforms like WeChat and Alipay, according to the Central Bank.

Firefox 72 to Block Fingerprinters by Default

Mozilla-Firefox

Mozilla is all set to launch its Firefox 72 nightly (beta) version in the first week of December followed by Firefox 72 stable release on January 7, 2020. In a bid to improve its Enhanced Tracking Protection feature and provide more control to its users, Firefox is now planning to, by default block the Fingerprinters in this version.

What is Fingerprinters?

Human fingerprints are unique and the same implies to fingerprints in the virtual world. A digital fingerprint is a unique set of information that can be used to detect software, network protocols, operating systems or hardware devices of a certain user.

Fingerprinting is an art of using this information to correlate with data sets and identify high probability—network services, operating system number and versions, software applications, databases, configurations and more. Unlike cookies, Fingerprinters collect data without user consent. A penetration tester with apt amount of fingerprinting data can define an exploit strategy against the target. Fingerprinting can also be misused for data mining, as seen in the case of Cambridge Analytica. Thus, this leads to the question, “Can we protect our user’s digital privacy?” Firefox says, “Yes. We can, through Enhanced Tracking Protection.”

Firefox’s Enhanced Tracking Protection

Enhanced Tracking Protection in a literal sense acts as a shield for the users. It helps in protecting them from ad and analytics, cryptomining and fingerprinting trackers. Earlier, with the release of Firefox 70, a provision was made for users to block the Fingerprinters manually under Custom Content Blocking section on its Privacy & Security tab. Once enabled, Firefox blocks any scripts that have been identified by Disconnect to participate in cryptomining or fingerprinting.

Firefox’s “Strict” and “Custom” presets already included protection against Fingerprinters ever since. But now it plans to make Fingerprinters blocking a default feature in “Standard” preset as well. When Enhanced Tracking Protection is active, a shield icon appears in the address bar. Its color indicates whether a site has active trackers such as:

  • Blue shield: the site has trackers that are being blocked.
  • Black shield: protection is on but there are no trackers present on the site.
  • Cross-out shield: protection is off for a specific site.
  • No shield: protection is off across all sites.

Although enabling Fingerprinters restricts user data mining, it could also cause issues like erroneous page display, trouble interacting with the website utilizing them, and so on.

In a recent news, Mozilla announced that it has doubled the rewards for its bug bounty program. It said: “To celebrate the 15 years of the 1.0 release of Firefox, we are making significant enhancements to the web bug bounty program. We are doubling all web payouts for critical, core and other Mozilla sites as per the Web and Services Bug Bounty Program page”

This Tool Predicts Cybercriminal Activity Even Before It Happens

Group-IB’s Graph Network Analysis tool

Group-IB, an international cybersecurity company that specializes in preventing cyberattacks, has launched a new tool for clients, which helps to predict and attribute attacks, even before they can occur. The Singapore-based company has granted its clients access to its internal tool for graph network analysis, which is capable of identifying links between scattered data, attributing an attack to a specific hacker group in seconds, as well as examine and predict possible threats that are relevant to a particular organization or industry.

Group-IB’s patented graph network analysis technologies are integrated in the company’s products, namely Threat Intelligence, Threat Detection System, Secure Bank, and Brand Protection Service. The company’s decision to make its internal tool available to clients aims to help SOC and CERT analysts, threat intelligence experts and forensic researchers explore the tactics and infrastructure of the attackers, while at the same time improving their own cybersecurity systems and boosting their threat hunting skills.

Group-IB graph network analysis was designed based on indicators of compromise found during years of cybercrime investigations, incident response operations and malware analysis by Threat Intelligence and Threat Detection System. The historical data on cybercriminals, gathered in 16 years, includes billions of records from domain names, IP addresses, server digital fingerprints, which have been used in attacks, as well as tagging them to specific hackers or groups.

“It is nearly impossible to protect oneself against attacks and prevent possible damage without knowledge of their enemies,” commented Dmitry Volkov, Group-IB CTO and Head of Threat Intelligence. “We had considered dozens of graph network analysis providers before deciding to develop our own instrument. We did not find a single solution that met all our requirements. None of the graphs had the entire scope of historical data: domains, Passive DNS, Passive SSL, DNS records, open ports, services running on ports, and files that have connections with domain names and IP addresses. We started gathering such data records ourselves, updating them on an ongoing basis, with some of them covering a period of 15 years. We also did not like the fact that other solutions provided options only for manual graph creation, therefore, we built our graph to be completely automated. To tackle the problem of irrelevant links that is common for other products, we have taught our system to identify irrelevant links based on the logic of our experts who did it previously in manual mode. The main goal of our graph is threat hunting, the most accurate attribution and the deepest analysis of adversaries. This instrument is now available in our products.”

How Graph Network Analysis helps

Group-IB’s graph network analysis leaves unverified indicators of compromise behind and focuses on the attacker examination and threat management that are relevant to a particular business area. Analysts using Group-IB graph network analysis can type a suspicious domain, an IP address, email or SSL certificate fingerprint in the search bar, after which the system automatically creates a network graph based on the search element that shows linked domains, IP addresses, digital fingerprints and etc. Despite the fact that the majority of attackers – specifically cybercriminal and APT groups – try to remain undetected online, the majority of them have paid much less attention to their anonymity and operational security and resulting have made mistakes at the beginning of their criminal journey.

Graphs help to identify not only linked elements but also common features – patterns that characterize one specific cybercriminal group to another. The knowledge of such unique features helps to identify the elements of the attackers’ infrastructure at the attack preparation stage even without evidence confirming the attack such as phishing emails or malware.

For example, in December 2018, Cobalt hacker group, which is known for targeting banks, sent out emails disguised as the National Bank of Kazakhstan. If cybersecurity experts, for example, had not found the phishing emails and did not have an opportunity to carry out the comprehensive analysis of malicious files, they could have created a graph based on the malicious domain nationalbank[.]bz, used by the cybercriminals. The created graph would have immediately shown the links to other malicious domains and Cobalt cybercriminal group, revealing what files have already been used in earlier attacks.

Group-IB’s Graph Network Analysis tool

When Group-IB investigates phishing attacks, the activities of fake or pirate web sources, the company’s experts normally create graphs to identify linked web sources and check all the found hosts for analogous content. This enables Group-IB to find both old phishing pages, which remained active but undetected, and absolutely new phishing pages, which were created for future attacks and were not utilized so far.

Moreover, the graph network analysis is indispensable in searching for backends: 99 percent of cardshops, hacker forums, numerous phishing resources and other malicious servers are hiding both behind their own proxy servers and legitimate ones. The knowledge of the real location of a malicious server helps to identify the hosting service and create links to other malicious projects of the threat actors.

About Group-IB

Group-IB is a Singapore-based provider of solutions aimed at detection and prevention of cyberattacks, online fraud, IP protection and high-profile cyber investigations. Group-IB’s Threat Intelligence system has been named one of the best in class by Gartner, Forrester, and IDC. Group-IB’s technological leadership is built on the company’s 16 years of hands-on experience in cybercrime investigations around the world and 60 000 hours of cyber security incident response accumulated in one of biggest forensic laboratory and a round-the-clock center providing a rapid response to cyber incidents—CERT-GIB. Group-IB is a partner of INTERPOL, Europol, and has been recommended by the OSCE as a cybersecurity solutions provider.

Group-IB’s experience, threat hunting & intelligence have been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyber threats.

Hackers Demand US$14M in Ransom to Unlock Systems in U.S. Nursing Homes

Only 44% of Health Care Providers Meet National Standards on Cybersecurity, OpenEMR vulnerabilities

Virtual Care Provider, a technology services provider for nursing homes and acute care sites, was hit with a ransomware attack that seized access to patients’ health records. The Milwaukee-based company reported that unknown attackers injected ransomware known as “Ryuk” inside its network systems.

The company stated that hackers demanded US$14 million to restore access to its hijacked servers. Virtual Care Provider said around 110 nursing homes across the country are unable to access their patient records, use the Internet, pay employees, and order crucial medications.

According to the Chief Executive and owner of Virtual Care Karen Christianson, the incident had affected 80,000 computers and other facilities, including Internet service and email, access to patient records, client billing, phone systems, and payroll operations.

“We have employees asking when we’re going to make payroll. But right now, all we’re dealing with is getting electronic medical records back up and life-threatening situations handled first,” Karen Christianson said in an interview with KrebsOnSecurity.com.

“We’ve got some facilities where the nurses can’t get the drugs updated and the order put in so the drugs can arrive on time. In another case, we have this one small assisted living place that is just a single unit that connects to billing. And if they don’t get their billing into Medicaid by December 5, they close their doors,” Christianson added.

Ransomware attacks on healthcare organizations have become a rising concern. With sensitive information about their patients, healthcare providers have become a hot favorite for attackers.

Recently, multiple hospitals and health service providers from the U.S. and Australia were forced to shut down some of their operations after being hit by ransomware attacks. According to an official statement, the attack affected and disrupted the IT systems of the DCH Regional Medical Center, Northport Medical Center, and Fayette Medical Center from West Alabama’s Tuscaloosa, Northport, and Fayette.

The Victorian Government stated that seven hospitals and health services from south-west Victoria and Gippsland have lost access to their IT systems and went into manual operations.

The affected hospitals are turning away new patients and even canceling some surgeries. The government authorities stated that they’re working with the impacted health services and cybersecurity professionals to investigate the incident.

Hundreds of Users Impacted in Twitter and Facebook Data Breach

blockchain-based social media, Parental Consent for Minors, Iranian Facebook accounts

Facebook and Twitter admitted that hundreds of users inadvertently gave access to their personal data through third-party apps. The companies stated the affected users have been using their social media accounts to log in to certain Android applications.

The social media giants were notified about the issue by third-party security researchers, who discovered that One Audience and Mobiburn software development kits (SDK) provided access to users’ sensitive data. The exposed information included usernames, email addresses, recent tweets and posts on both the platforms.

“We recently received a report about a malicious mobile software development kit (SDK) maintained by One Audience.  We are informing you about this today because we believe we have a responsibility to inform you of incidents that may impact the safety of your personal data or Twitter account,” Twitter said in a post.

It’s said that the breach reportedly affected Android users who accessed the Giant Square and Photofy apps using their Facebook or Twitter accounts. However, there are no reports that i0S users have been impacted by the incident.

Twitter and Facebook stated that they will notify the affected users. Twitter said that it has also informed Google, Apple, and other industry partners about the malicious SDK to take further action if needed.

“We will be directly notifying people who use Twitter for Android, who may have been impacted by this issue. There is nothing for you to do at this time, but if you think you may have downloaded a malicious application from a third-party app store, we recommend you delete it immediately,” Twitter added.

In a similar security incident, Twitter exposed phone numbers and email addresses of its users who opted for two-factor authentication (2FA) protection. The company stated that user contacts had been used for targeted advertising purposes. Twitter stated that an error in its “Tailored Audiences and Partner Audiences advertising system” unintentionally used the information, provided by users, to run targeted ads.

Also, Facebook admitted a data breach involving roughly 100 third-party app developers who had improper data access. In a blog post, Facebook’s Konstantinos Papamiltiadis, Director of Platform Partnerships revealed that app developers had access to user data such as group member names and profile pictures through the Group API.

1...269270271...410Page 270 of 410