Home Blog Page 273

Hacker Offers US$ 100K in BTC to Hack Corporate Companies

Horangi Raises US$20 Million in Funding to Strengthen Cybersecurity in Southeast Asia

Phineas Fisher, a popular vigilante hacker recently announced a new kind of bug bounty program “Hacktivist Bug Hunting Program” to reward hackers who do public interest hacks and data leaks.

In his new manifesto, the hacker stated that he will offer US$ 100,000 bounty in Bitcoin as a reward for hacktivists who attack Banks and Oil Companies, the Vice.com reported.

Phineas Fisher said the main intention of the program is to encourage other hackers who carry out politically motivated hacks against companies that could lead to the disclosure of documents in the public interest.

“Hacking to obtain and leak documents with public interest is one of the best ways for hackers to use their abilities to benefit society,” Phineas Fisher wrote in his manifesto. “I’m not trying to make anyone rich. I’m just trying to provide enough funds so that hackers can make a decent living doing a good job.”

While mentioning the targets, Phineas Fisher cited oil services giant Halliburton, mining companies in South Africa, and an Israeli spyware vendor NSO Group as potential targets. The hacker also claimed that he recently hacked an offshore bank and called on other hacktivists to join in his works.

Most companies and software developers often launch Bug Bounty Programs, rewarding ethical hackers for discovering potential vulnerabilities in their systems. This helps the companies to bolster their cybersecurity capabilities to sustain cyber-attacks.

Recently, around 81 ethical hackers from the U.S., India, Ukraine, Turkey, and Canada participated in a bug bounty program organized by the U.S. Department of Defense (DoD) with the participation from bug bounty platform HackerOne.

The bounty program, named Hack the Proxy with HackerOne, was sponsored by the U.S. Cyber Command with a focus on content intermediaries, like proxies, VPNs, and virtual desktops. “Hack the Proxy program was the first initiative that’s focused on securing content intermediaries for publicly accessible proxy servers owned by the government,” DoD said in a statement.

The Department of Defense stated that security researchers around the world submitted 31 valid vulnerabilities from September 3, 2019, to September 18, 2019. The hackers are rewarded US$ 33,750 for their findings.

URL Hijacking on the Sprawl, Holiday Shoppers Beware

Yahoo

Holidays are near and we don’t have time to buy gifts. What do we do? Shop online. Unfortunately, as online shopping continues to grow, so does typosquatting/URL Hijacking and targeting users through malicious fake domains. Venafi, a cybersecurity software that secures and protects cryptographic keys and digital certificates, says it has uncovered nearly 100,000 typosquatted/fake domains with valid TLS certificates impersonating as major retailers.

What is Typosquatting/URL Hijacking?

Typosquatting/URL Hijacking is a phenomenon where an attacker creates another domain name that is spelled like the targeted domain name. For better understanding, consider a scenario where instead of entering the URL “www.yahoo.com”, you mistakenly entered “www.tahoo.com” or “www.yahooo.com”. It’s a common mistake that sometimes we enter a similar wrong URL having just one or two additional or mismatched letters. When such typographical errors are made by Internet users, they may be redirected to an alternate malicious website that is better known as a hijacked website.

Venafi’s Analysis

Venafi that 109,045 fake domains using valid TLS certificates were discovered which are targeting top 20 online retailers. Of the 109,000 typosquatted domains, nearly 84,000 target retailers in the U.S., including almost 50,000 domains that imitate one of the country’s top retailers. Similarly, in the U.K., nearly 14,000 certificates have been issued for targeting fake retailer domains, 7,000 certificates targeting retailers in Germany, 3,500 for domains targeting Australian retailers, and 1,500 targeting French retailers.

Jing Xie, senior threat intelligence researcher at Venafi, told SecurityWeek, “Some of these URLs probably serve a legitimate purpose, but many may be used by attackers for fraudulent purposes. We think the sheer volume of these sites is a strong indication that many of them are being used for malicious purposes, especially since we are so close to the holiday shopping season”.

Venafi, also found that an overall 60 percent of the hijacked domains had a valid TLS certificate obtained for free from Let’s Encrypt. Let’s encrypt is a free online TLS certificate provider whose services are often abused by hackers.

Causes of URL Hijacking

  • Typing a misspelled domain name into the browser.
  • Specifying a wrong domain extension (such as .com instead of .org).
  • Forgetting to include a hyphen in the domain name.
  • Spelling differently due to Language differences, such as colour (U.K. English) instead of color (U.S. English).

Threats of URL Hijacking

  • Leads to phishing.
  • Installation of a malware/ransomware.
  • Identity theft, etc.

Mitigation Steps

  • Most importantly, be very careful while typing the domain name of a website.
  • Instead of entering the domain name every time in the URL field, bookmark the websites that are frequently visited.
  • Perform web searches and then click on the intended site from the web search results.
  • Do not click on links from unknown senders.
  • Domain owners should try and register typo versions of their original domain name to avoid URL hijacking.

RAT Attack: Double Whammy

A new malware recently surfaced with a very low detection rate and capability of delivering multiple Trojans to infect computers. The researchers from Fortinet found a sample file of a dropper that was flagged suspicious. Upon research, it was found that the new malware has the capability to drop both RevengeRAT and WSHRAT on systems running Windows.

This is double trouble in every sense. The dropper gets in action with a JavaScript code which contained a URL-encoded data, which the researchers later uncovered as VBScript code. According to Fortinet, “The author of this malware used simple character replacement when calling the “Chr()” function in an attempt to hide the actual strings (“shell.application” and “cmd /c cd %temp%”, respectively.”

According to the researchers, the objectives of the VBScript code are:

  1. Create a new Shell.Application object
  2. Call the ShellExecute() function, which eventually generates a new file with the hardcoded filename of “A6p.vbs”
  3. Execute the newly-created script file “A6p.vbs”
  4. Pause the CMD command execution for 13 seconds (by calling the timeout.exe program)
  5. Delete the script file “A6p.vbs”
  6. Execute the downloaded script file “Microsoft.vbs”
  7. Close the current/active window

The VBScript code then summons a Shell.Application which generates a new script file, which then fetches another payload (VBScript code) from an external source. The new string pulls a script Microsoft.vbs from a remote server and saves itself in the temp folder. The code is composed of the main class called “th3m41n” using three methods “dugh41r,” “t01l3t,” and “b3st1n”.

“Once the aforementioned code is executed, it creates a new WScript.Shell object and collects OS environment and hardcoded data, which will eventually end in running the newly created script (GXxdZDvzyH.vbs) by calling the VBScript interpreter with the “//B” parameter. This enables “batch-mode” and disables any potential warnings or alerts that can occur during execution,” researchers wrote. As the code is executed, a new key is added which is called Microsoft which stores the malformed base64-encoded data.

With the new key into the registry, commands are executed to bypass execution policies and the RAT payload is then deployed. Following the RevengeRAT attack IP addresses, usernames, machine data, CPU data, webcam access, information on firewall installations and antivirus are stolen. RevengeRAT is infamous and has been earlier deployed to steal data from financial firms, governments, and IT companies. But the buck doesn’t stop there.

The dropper also deploys another payload, a WSHRAT on the same script with a few changes. The second attack is the double whammy. The second payload which is the newest version of the WSHRAT, an infamous phishing tool, is capable of stealing information stored in browsers. It is also capable of remotely installing and uninstalling programs and several other methods of keylogging.

 

Symantec Fixes Code Execution Vulnerability

Symantec

A recent research conducted by Peleg Hadar, a Security Researcher at SafeBreach Labs, exposed a local code execution vulnerability in Symantec’s Endpoint Protection service. As per Hadar, this vulnerability allowed an attacker “to bypass Symantec’s self-defense mechanism and perform defense evasion, persistence and privilege escalation by loading an arbitrary unsigned DLL into a process that is signed by Symantec and that runs as NT AUTHORITY\SYSTEM.”

Symantec Endpoint Protection has a host of security software solutions on offer as per various business needs. At present, it has the largest market-share for any endpoint security product. Thus, to avoid vulnerability exploitation and subsequent monetary losses, Symantec was quick to fix this issue.

The vulnerability can now be tracked as CVE-2019-12758. It requires an attacker to have Administrator rights to successfully exploit the issue reported. The overall severity of these type of issues is generally set from medium to high. Symantec has ranked it as a medium severity problem with a CVSS base score of 3.4. In its description of this vulnerability, Symantec also said that failed attempts to execute this arbitrary code may lead to denial-of-service conditions. As a source of information to all its customers, Symantec listed the technologies affected by this vulnerability. Following is the complete list issued:

  • Symantec Endpoint Protection 11.0
  • Symantec Endpoint Protection 12.0
  • Symantec Endpoint Protection 12.1
  • Symantec Endpoint Protection 12.1.1
  • Symantec Endpoint Protection 12.1.2
  • Symantec Endpoint Protection 12.1.3
  • Symantec Endpoint Protection 12.1.4
  • Symantec Endpoint Protection 12.1.5
  • Symantec Endpoint Protection 12.1.6
  • Symantec Endpoint Protection 14.0
  • Symantec Endpoint Protection 14.2
  • Symantec Endpoint Protection 14.2 RU1

To remediate this issue, it has recommended all its customers to upgrade to Symantec Endpoint Protection 14.2 RU2. Symantec also issued a list of other precautionary measures to avoid attacks.

  • Restrict administrative access to authorized/privileged users.
  • Restrict remote access to trusted/authorized systems only.
  • Run under the principle of least privilege, wherever possible, limit the access privileges.
  • Keep all operating systems and applications updates with latest vendor patches.
  • Follow a multi-layered approach to security. At a minimum, run both firewall and anti-malware applications to provide multiple points of detection and protection for both inbound and outbound threats.
  • Deploy network and host-based intrusion detection systems (IDS) to monitor network traffic for signs of anomalous or suspicious activity. This may aid in the detection of attacks or malicious activity related to the exploitation of latent vulnerabilities.

“Observe the trinity of cybersecurity crisis communications: Forensics, Legal, Communications”

Michael Estevez, Executive Vice President, Managing Director and Cybersecurity Crisis Team Lead, BCW

In his role as an executive vice president/managing director in BCW’s New York Public Affairs & Crisis practice, Michael Estevez advises clients on crisis communications, issues management, litigation communications, and cybersecurity. Michael’s cybersecurity and privacy communications experience includes engagements on behalf of corporations, a U.S. defense contractor, an ivy league university, and government entities. He has advised organizations on matters related to cybersecurity crisis communications including media relations, employee communications, customer and stakeholder engagement, and public affairs.

Michael helps clients navigate complex crisis communications situations, enabling them to regain trust, repair stakeholder relationships and return focus to their core organizational mission. Drawing upon his experience in traditional public relations, political communications and digital media, he has extensive experience in helping clients to develop their reputational risk profile, anticipate crisis and risk scenarios, proactively stake out positions on critical issues and respond to crises. Michael has counseled corporate clients on CEO transitions, workplace health and safety issues, international intellectual property litigation, high-profile workplace violence incidents, unionization campaigns, and activist campaigns. His clients have included financial institutions, private equity firms, energy firms, pharmaceutical companies, medical device manufacturers, quick-serve restaurants, and consumer package goods companies.

Before joining BCW, Michael held a succession of positions with a specialization in public affairs and crisis communications. He was most recently with a boutique public affairs firm based in New Jersey, where he was Executive Vice President in charge of the firm’s operations. Prior to this, Michael held successive positions with firms based in New York City, where managed multinational crisis and issues management engagements for organizations including Samsung Electronics, Starbucks, PepsiCo, General Electric, Unilever, Yale University, Western Union and others.

In an email interview with Brian Pereira of CISO MAG Michael talks about strategies for managing cybersecurity reputation risk and communications best practices for handling breaches. He outlines what organizations need to do to be cybersecurity resilient. He also talks about BCW CyberTREE, a crisis communications and reputation management framework.

Cybersecurity threats continue to grow in volume and sophistication. However, managing cybersecurity reputation risk has not kept pace with the evolution of threats. What are you observing?

Nearly every relevant industry has rapidly evolved to meet the challenges of cybersecurity risk. In addition to information technology, insurance and law have most notably adopted industry best practices and standards.

We developed BCW CyberTREE because we saw a need for a crisis communications and reputation management framework that can align with any company’s incident response plan. It’s based on a careful review and analysis of our own cybersecurity crisis engagements with clients, as well as studying a cohort of high-profile cyber events.

The focus is to be an effective communications partner with the full CSIRT, especially forensics, legal and a company’s executive leadership team.

This is important because stakeholder opinions about how well a company managed a cyber event can be critical to resilience and recovery. This can include whether customers choose to continue doing business with you, how investment analysts view your ability to manage risk and whether prospective employees pursue career opportunities with you or a competitor.

What are the mistakes that most breached organizations are making? What are the gaps in communication and how does BCW CyberTREE help?

BCW CyberTREE is based upon three core principles that directly address the main gaps we’ve seen:

First, corporate reputation is essential to cybersecurity resilience. This means perceptions about how well a company responds to an incident can be as important as the technical response itself. It’s not enough to only restore your network’s integrity. You need to maintain – or rebuild – stakeholder trust. A client CEO once told me, ‘My network has no value if I lose all my customers.’

Second, cybersecurity crisis communications is a cross-functional CSIRT responsibility. Communications do its job effectively without cooperation from the CSIRT, and everyone – not only communications – should be focused on maintaining stakeholder trust and confidence throughout the incident.

And third, cybersecurity crisis communications strategy must account for facts and speculation. While the CSIRT is mainly focused on resilience and recovery, the communications team needs to focus on that as well as myriad hypothetical potential scenarios that may emerge.

What are the top 3 or 5 things that a breached organization should immediately do?

The cybersecurity crisis situations that I’ve seen end with the best outcomes have all been guided by a written plan that had been practiced by the full CSIRT using an interactive simulation platform like BCW PressurePoint.

Most plans have similar initial steps: (1) Send an internal alert from legal notifying CSIRT members that a legally privileged investigation is being initiated – this is also a signal to avoid using specific terms like “breach” that can have legal, and ultimately reputational, implications. (2) Call your cyber insurer. (3) Retain outside cybersecurity legal counsel. (4) Retain an independent forensic consultant. (5) Retain cyber crisis communications counsel.

The first things your cyber crisis communications consultant will do are to begin monitoring news and social media for chatter or potential leaks; prepare initial statements for news media in case of any inquiries and adapt them for social media in case of questions or comments; and, in the case of BCW, we will begin assessing the situation based on the 25+ specific considerations that span the four domains of BCW CyberTREE: Threat, Response, Expectations and Engagement and build out a full crisis communications strategy.

Most countries have laws and regulations that make it mandatory to report cybersecurity incidents— especially in regulated industries such as banking and finance. For instance, Canada has PIEPDA. But are there any provisions/clauses for crisis communications?

There are no specific provisions for crisis communications and reputation management. The laws and regulations you mention require certain details in reporting and notifications, and they can provide essential information that’s needed for effective crisis communications. But they don’t take into account the importance of communications to rebuild or maintain trust among customers/clients/patients/ investors/employees and other stakeholders. This is the critical gap BCW CyberTREE was created to fill.

What best practices and strategies do you recommend for handling the crisis communications in the wake of a cybersecurity incident?

The most important best practice is to observe “the trinity of cybersecurity crisis communications”: Forensics, Legal, Communications.

Forensic consultants need time to complete their analysis. Legal provides advice and counsel based on that analysis and communications provides an integrated communications strategy based on the forensics and legal guidance. The communications strategy should include news and social media engagement as well as employee communications, investor relations and communications with key customers and other stakeholders.

Can you elaborate on BCW CyberTREE, your strategic communications model for cybersecurity crisis communications response and planning?

The foundation of BCW CyberTREE is a set of more than 25 strategic considerations that, when fully, create a crisis communications roadmap for managing a cybersecurity incident.

For example, the first consideration is, “Who is the threat actor?” A threat actor can be a nation-state, an organized criminal network, a “lone wolf” (external), or an insider (or, there can be no threat actor).

Nation-states are often clandestine about their activities, whereas some organized networks may use social media to exert pressure on an organization to comply with ransom demands. Organized networks oftentimes have a pattern of behavior, while a “lone wolf” can be entirely unpredictable. So you can see, based on this single decision point, how your communications strategy would have to shift dramatically.

There are currently 28 additional considerations inside of CyberTREE which we will continually update and evolve as the threat landscape evolves.

Brian Pereira is the Principal Editor of CISO MAG. Apart from his editorial responsibilities, he enjoys writing features, interviews and technical articles.

LA Attorney Urges People to Avoid Public Charging Stations

USB charging stations

The Los Angeles District Attorney urged travelers to avoid public USB power charging stations in hotels, airports, and other public locations. In a security alert published recently, the attorney stated that public charging points may contain dangerous malware that might bring threats to mobile devices.

The LA officials stated that USB connections are designed to work as both data and power transfer mediums without a strong barrier between the two. They also highlighted that attacks can abuse USB connections to hide and deliver secret data payloads, which is referred to as “Juice Jacking” attack.

The Attorney’s warning described many attack vectors that cybercriminals use to abuse USB wall chargers. And the most common way is via “pluggable” USB wall chargers that can be plugged into an AC socket by attackers to leave malware at public charging stations.

The officials also recommended a few security tips for travelers to follow, which include:

  • Use an AC power outlet, not a USB charging station
  • Take AC and car chargers for your devices when traveling
  • Consider buying a portable charger for emergencies

In a similar research, cybersecurity experts stated that using someone else charging cable might bring threats to mobile devices. Attackers could exploit charging cables/cords to access sensitive information from the victim’s mobile.

Hackers could implant Malware into charging cords or cables to hack mobile devices. The USB chargers can be turned into potential hacking devices by inserting a malicious chip that allegedly allows attackers to access a mobile’s data over open Wi-Fi networks. The surprising part here is that the person who’s lending the charger might not be aware that his/her charger is infected.

In-Built Design Flaw Makes Bluetooth Devices Vulnerable

BrakTooth Flaws

A recent discovery revealed that mobile applications that work with Bluetooth devices have a built-in design flaw that makes them vulnerable to hacks.

According to the academic researcher Zhiqiang Lin from the Ohio State University, the vulnerability lies in the way Bluetooth Low Energy devices, a type of Bluetooth used in modern gadgets, communicate with mobile apps.

It’s said that wearable devices like smart speakers, health and fitness trackers or smart home assistants communicate with the apps on mobile devices by broadcasting UUID (Universally Unique Identifier), which allows the mobile apps to recognize the Bluetooth device.

The researcher stated that UUIDs in mobile apps make the devices vulnerable to a fingerprinting attack.

Presenting his findings recently at the Association for Computing Machinery’s Conference on Computer and Communications Security (ACM CCS 2019), Lin said, “There is a fundamental flaw that leaves these devices vulnerable – first when they are initially paired to a mobile app, and then again when they are operating. And while the magnitude of that vulnerability varies, we found it to be a consistent problem among Bluetooth low energy devices when communicating with mobile apps.”

“At a minimum, a hacker could determine whether you have a particular Bluetooth device, such as a smart speaker, at your home, by identifying whether or not your smart device is broadcasting the particular UUIDs identified from the corresponding mobile apps. But in some cases, in which no encryption is involved, or encryption is used improperly between mobile apps and devices, the attacker would be able to ‘listen in’ on your conversation and collect that data,” Lin added.

As part of their research, Lin and his team built a “sniffer”, a hacking device that can identify Bluetooth devices based on the broadcasting messages sent by the devices. After testing the device, the team found more than 5,800 Bluetooth Low Energy devices, in which 5,500 were able to be “fingerprinted” (or identified) by an attack. The team has identified 1,434 vulnerable mobile apps in Google Play that allowed unauthorized access.

Zhiqiang Lin and his research team reported their findings to developers of vulnerable apps and to the Bluetooth Special Interest Group. “It was in the initial app-level authentication, the initial pairing of the phone app with the device, where that vulnerability existed. If app developers tightened defenses in that initial authentication, he said, the problem could be resolved,” Lin concluded.

You will be breached! [INFOGRAPHIC]

(It’s only a matter of time.)

84% of CISOs in North America believe cybersecurity breaches are inevitable. And when you do get breached it will result in severe financial losses, loss of customers, and loss of reputation.

Identity theft is the biggest concern for customers, in the aftermath of a breach. It impacts your customers’ mental health and wellbeing, financial situation, and even their personal relationships.

So how do organizations become resilient after a breach? How can they reduce the impact of a breach?

According to the Ponemon 2018 ‘Cost of Data Breach’ study, organizations that offer data breach victims identity protection in the aftermath are more successful in reducing churn.

To do this you need to add ID theft monitoring to your breach readiness plan.

You need an early warning system that alerts your customers to signs of trouble.

A solution like ID Assist will help your customers limit the fallout of identity theft and financial fraud and restore their identity to a pre-breach state.

 

Intel Fixes 77 Vulnerabilities in Patch Tuesday, Announces New Appointment to Top Suite

intel

Intel has stated that it fixed 77 vulnerabilities in its recently released November Patch Tuesday. It also said that, “67 of the 77 vulnerabilities we are addressing were internally found”. The company maintained that even though the internally found vulnerabilities could have been handled without going public, but Intel believes in transparency. It has also assigned CVE IDs to all internally found vulnerabilities which will help customers assess risks involved, prioritize, and deploy updates.

Intel gave the news via a new security blog which intends to serve as a resource for security updates, bug bounty topics, and latest security research among the cybersecurity community. The blog contains a detailed list of 18 security advisories. All the affected Intel products and corresponding remedial recommendations are mentioned at the end of every advisory. In the following table, updates are ordered from highest to lowest severity rating:

Advisory ID

 Title Internally Found CVSS Range

INTEL-SA-00241

 Intel® CSME, Intel® SPS, Intel® TXE, Intel® AMT, Intel® PTT and Intel® DAL Advisory

22 of 24

2.3 – 9.6
INTEL-SA-00313 Intel® BMC Advisory

12 of 12

3.7 – 9.0
INTEL-SA-00255 Intel® Ethernet 700 Series Controllers Advisory

10 of 11

 5.6 – 8.8

INTEL-SA-00242

 Intel® Graphics Driver for Windows* Advisory

5 of 8

 4.0 – 8.8

INTEL-SA-00287

 Intel® WIFI Drivers and Intel® PROSet/Wireless WiFi Software extension DLL Advisory

3 of 3

8.2 – 8.7
INTEL-SA-00288 Intel® PROSet/Wireless WiFi Software Security Advisory

3 of 3

5.3 – 8.5
INTEL-SA-00220 Intel® SGX and TXT Advisory

2 of 2

 8.2 – 8.2

INTEL-SA-00240

 Intel® CPU Security Advisory

2 of 2

7.5 – 8.2
INTEL-SA-00293 Intel® SGX Advisory

1 of 2

7.0 – 7.8
INTEL-SA-00280 IPU UEFI Advisory

1 of 2

7.5 – 7.5
INTEL-SA-00309 Nuvoton* CIR Driver for Windows® 8 for Intel® NUC Advisory

0 of 1

6.7
INTEL-SA-00210 Intel® Processor Machine Check Error Advisory

1 of 1

6.5
INTEL-SA-00260 Intel® Processor Graphics Update Advisory

1 of 1

6.5
INTEL-SA-00270 TSX Transaction Asynchronous Abort Advisory

0 of 1

6.5
INTEL-SA-00164 Intel® TXT Advisory

1 of 1

6
INTEL-SA-00219 Intel® SGX with Intel® Processor Graphics Update Advisory

1 of 1

6
INTEL-SA-00254 Intel® SMM Advisory

1 of 1

6
INTEL-SA-00271 Intel® Xeon® Scalable Processors Voltage Setting Modulation Advisory

1 of 1

5.8

(Above list of advisories is as per the original list published in Intel’s Security Blog and not an independent research of CISO MAG)

James J Goetz joins Intel’s Board of Directors

Intel also announced the onboarding of James (Jim) J. Goetz to its Board of Directors’ list. The company in a recent release stated that it is “very happy to have Goetz on the board,” who has served as a partner of Sequoia Capital since 2004. He comes in with a vast knowledge of working in technology and innovation domain and currently serves on the boards of several privately held companies including Palo Alto Networks Inc.

“Jim has a keen understanding of how technology is evolving and a strong track record helping technology companies capitalize on disruptive innovation,” said Intel Chairman Andy Bryant. “Jim has helped create and grow a number of technology companies and product lines to market-leading positions, both as an entrepreneur and as an investor. Jim’s technical insight, substantial operating experience, growth mindset, and deep private and public company board experience, all will further strengthen Intel’s board.”

Hacker Group “Lizard Squad” Claim Responsibility for Attack on Labour Party

Lizard Squad

An infamous hacking group “Lizard Squad” claimed responsibility for the recent cyber-attack on the Labour Party. The hackers also warned that they are planning to launch a slew of such attacks, the Independent reported.

Lizard Squad stated that it has used a Distributed Denial of Service (DDoS) tool to take down the party’s digital platforms.

“Today’s DDoS attack on the Labour Party is to show that no terrorist-supporting government should allow to rule a country. Our botnet is connected to millions of devices around the world to enable more power to process such attacks,” Lizard Group said in a Twitter post.

The hackers also threatened that they will take down the Leader of the Labour Party Jeremy Bernard Corbyn’s and his family’s accounts. “Jeremy Corbyn’s family members’ personal accounts have been compromised and their home internet is under a DDoS attack as we speak,” the hackers said.

On November 12, 2019, the officials of the Labour Party stated that it sustained a cyber-attack that targeted its digital platforms. Describing it as a “sophisticated and large-scale cyber-attack,” the party officials stated the attack affected the party’s website and online campaigning tools temporarily.

The Party clarified that no data breach had occurred as they’re maintaining a strong security system. It’s believed that the attacks came from computers linked to Russia and Brazil.

“Yesterday afternoon our security systems identified that, in a very short period of time, there were large-scale and sophisticated attacks on Labour Party platforms, which had the intention of taking our systems entirely offline,” said Niall Sookoo, the party’s executive director of elections and campaigns.

“The integrity of all our platforms was maintained and we are confident that no data breach occurred,” Our security procedures have slowed down some of our campaign activities, but these were restored this morning and we are back up to full speed,” Sookoo added.

The party officials stated that they’ve notified the incident to the National Cyber Security Centre for further investigation. The attack comes ahead of the General Election campaign, with the UK set to go to the polls on December 12, 2019.

Election campaigns have always been a primary target for cybercriminals. The attackers try to steal sensitive information and even manipulate election advertisements online.

1...272273274...409Page 273 of 409