Home Blog Page 282

“Cozy Bear” Strikes Again! Targets Foreign Ministries in Europe

Cybercrimes in COVID-19 Pandemic

Security experts revealed that the Russian-based hacking group “Cozy Bear”, the group behind the 2016 U.S. Presidential election hack, has been working under the radar to attack the Foreign Ministries in Europe.

Cozy Bear, also known as APT29, is believed to be linked to the Russian intelligence service and Russian military hacking group Fancy Bear, which was involved in high profile attacks between 2014 and 2017.

According to cybersecurity analysts from IT security firm ESET, the hacking group, which ESET refer to as Dukes, have continued their campaign “Operation Ghost” from 2013 to 2019.

The researchers stated the group continued their malicious activities while staying under the radar. Cozy Bear recently targeted ministries of foreign affairs of three different countries in Europe, as well as the U.S. embassy of a European Union country in Washington DC.

“The Dukes (aka APT29 and Cozy Bear) have been in the spotlight after their suspected involvement in the breach of the Democratic National Committee in the run-up to the 2016 U.S. elections. Since then, except for a one-off, suspected comeback on November 2018, with a phishing campaign targeting several US-based organizations, no activity has been confidently attributed to the Dukes. This left us thinking that the group had stopped its activities,” ESET said in a statement.

“This held true until recent months when we uncovered three new malware families that we attribute to the Dukes – PolyglotDuke, RegDuke, and FatDuke. These new implants were used until very recently, with the latest observed sample being deployed in June 2019. This means the Dukes have been quite active since 2016, developing new implants and compromising high-value targets. We call these newly uncovered Dukes activities, collectively, Operation Ghost,” the statement added.

Attackers from Russia were involved in a series of espionage activities across various sectors over the years. A recent threat report from cybersecurity firm CrowdStrike revealed that hackers tied to Russian intelligence agencies are eight times faster than North Koreans, Chinese, and Iranians in hacking.

In its report titled Global Threat Report 2019: Adversary Tradecraft and the Importance of Speed,  CrowdStrike stated the Russians are the most sophisticated among the many nation-state adversaries that are regularly hacking government and private computers in the United States.

Canadian Legislation Lacks Cybersecurity Awareness: Survey

Canadians Refuse to Divulge Personal Data for Free Online Services: Survey

Cybersecurity experts have opined the Canadian government isn’t doing enough to protect businesses and consumers from data breaches.

A recent survey from Keyfactor, a provider of secure digital identity management solutions, revealed that 87 percent of surveyed cybersecurity pros think that more privacy and security legislation is required to better protect Canada’s businesses and consumers. Keyfactor provides secure digital identity management solutions that enable organizations to confirm authenticity.

According to the survey, 58 percent of respondents think regulators and the Canadian officials are not trying to regulate the security guidance on measures like data encryption. The survey also highlighted that 50 percent of respondents stated that manual and complex processes as their greatest challenge in managing Public Key Infrastructure (PKI) while 43 percent of respondents were concerned about their ability to securely adopt DevOps, cloud, and IoT.

“While the federal government continues to introduce cybersecurity consortiums and guidance, professionals on the front lines know that consortiums do little to protect their business and consumers from attacks and data loss,” said Chris Hickman, the chief security officer at Keyfactor. “The resource divide that exists across small and large enterprise, combined with standards inconsistencies, make us vulnerable to attacks.”

“As the federal election looms, Canadians should closely evaluate each party’s cybersecurity pledge and what it means to their own digital security as an online consumer. Broadly, whether large or small, Canadian businesses are struggling with IT and security resourcing. Without stronger government standardization and actionable support, businesses and consumers downstream face rising security risks,” Hickman added.

The comments come after the recent cyber-attack that impacted 201 online campus stores in Canada. A hacker group named Magecart was responsible for the recent data breach. According to Trend Micro, the attackers used a skimming script, a malicious code, designed to steal the data from 201 online stores that were catering to 176 colleges and universities in Canada. Hackers used a skimming script to compromise the card information and personal details entered on the payment page by users. Trend Micro also stated that attackers also compromised PrismWeb, an e-commerce platform designed for college stores by PrismRBS.

The Krack on Amazon’s Kindle and Echo

From creepy laughs to spy bugs, Amazon’s Echo devices have been in the limelight for more than a dozen or two reasons, and it seems like Alexa is going to hog maybe a bit more of your attention due to a “Krack” on the wall.

Reports have emerged stating that the millions of first-generation Amazon Echo devices and even the eighth generation Kindle are susceptible to a Krack WiFi vulnerability. The vulnerability allows hackers to execute a man-in-the-middle attack against a WPA2 protected the network.

Krack, a jazzy abbreviation of Key Reinstallation Attack was first revealed by researchers Mathy Vanhoef and Frank Piessens in 2017. The vulnerability existed in the four-way handshake of the WPA2 protocol, which secured almost all modern Wi-Fi networks at that time.

According to researchers, attackers could have easily exploited the vulnerability by using key reinstallation attack if the victim was within the network. The attack would enable access to details like passwords, email, photos, and even financial data like credit card numbers were among several other personal and sensitive data that was vulnerable.

After the vulnerability was discovered, Amazon had released a patch for affected devices early this year after researchers from ESET informed the Amazon about the vulnerability. But “Krack” has cracked its way open to the surface, and researchers from ESET have discovered and again confirmed that the first-generation Amazon Echo and the eighth generation of Kindle are still affected by “Krack” vulnerability.

“The Echo 1st  generation and Amazon Kindle 8th generation devices were found to be vulnerable to two KRACK vulnerabilities”, ESET researchers stated in their report. “Using Vanhoef’s scripts, we were able to replicate the reinstallation of the pairwise encryption key (PTK-TK) in the four-way handshake (CVE-2017-13077) and reinstallation of the group key (GTK) in the four-way handshake (CVE-2017-13078).”

Even though Amazon had patched the vulnerability, the reason why Krack still looms in the air is that several users may not have updated their devices and ESET has urged users to go to the setting of these devices to make sure they are running the latest firmware.

Vulnerabilities in Amazon Echo devices are not a new thing and it has echoed even before. In the last edition of DEFCON security conference researchers Wu HuiYu and Qian Wenxiang gave a live demonstration on how to hack a smart speaker. The team used Amazon Echo smart speakers to present their attack program.

The researchers hacked the speaker by adding a malicious device embedded with an attack program.  “After several months of research, we successfully break the Amazon Echo by using multiple vulnerabilities in the Amazon Echo system, and achieve remote eavesdropping,” the researchers said in a media report. “When the attack succeeds, we can control Amazon Echo for eavesdropping and send the voice data through a network to the attacker.”

Recruitment Sites Exposes 250,000 Resumes Online

recruitment sites data leak

Around 250,000 American and British-based job seekers’ personal information has been exposed after two recruiting sites misconfigured their databases. The exposed information included candidates’ names, addresses, contact information, and work experience.

The data leak occurred when recruitment sites Authentic Jobs and Sonic Jobs failed to set their cloud storage as private. The companies stored the candidates’ profiles in cloud storage folders known as buckets, which were provided by Amazon Web Services (AWS).

Both companies set their privacy settings options to public instead of private, which allowed the users to view the details of someone who applied for a job and also downloaded by anyone who knew the location of the buckets.

The data breach was discovered by security researcher Gareth Llewellyn and reported to Sky News in the U.K.

“By finding and closing these buckets we can protect people who placed their trust in these businesses and, hopefully, start drawing attention to the dangers of storing personal data in a woefully insecure manner,” Gareth Llewellyn said. “Just because they leveraged a service like AWS, or even outsourced to a third-party entirely, doesn’t preclude them from ensuring the data entrusted to them is safe.”

According to the official reports, the U.S.-based job portal Authentic Jobs, whose client list includes EY and The New York Times, exposed over 221,130 resumes online. A further 29,202 resumes were exposed by the UK-based retail and restaurant jobs app Sonic Jobs, which is used by the Marriott and InterContinental hotel chains for recruitment.

After being warned of the exposure, the companies restored their databases and changed their bucket settings to private. “We take security and privacy very seriously and are looking into how this happened,” Authentic Jobs said in a statement.

“With limited resources, as a small business, we are confident that we take reasonable and proportionate measures to protect the confidentiality, integrity, and availability of our business data and the personal data we hold,” Sonic Jobs said.

In a similar data breach incident, an unprotected MongoDB server exposed a database that contains resumes of 202 million Chinese people online.

Security researcher Bob Diachenko discovered that the unsecured server was left visible online without a password, thus exposing the resumes that contained personal details such as mobile phone number, email, marital status, driver license, literacy level, salary expectations, skills, and work experience. The leaky server was secured soon after Diachenko publicized the issue via a Twitter post.

Samsung Admits Galaxy S10 Fingerprint Reader Vulnerability, says “Will Fix it Soon”

Galaxy S10 fingerprint reader vulnerability

Samsung, a premium smartphone manufacturer, in a statement given to the press, has admitted to being “aware of the case of S10’s malfunctioning fingerprint recognition and will soon issue a software patch.” This statement comes soon after a British user reported an issue with her Samsung Galaxy S10 fingerprint reader.

According to her story, she bought a new $3.50 screen protector for her Galaxy S10 device and then registered her fingerprint for its on-screen fingerprint recognition security feature. Her excitement about the device’s fingerprint recognition feature was cut short when surprisingly, her husband was able to unlock her phone even without registering his fingerprint with the mobile phone’s fingerprint reader. To double-check this flaw she asked her sister to unlock the phone using her fingerprint and to her surprise, this worked as well.

Samsung reportedly uses the same fingerprint reader in its recently launched model, Samsung Galaxy Note 10. Since the Galaxy S10 news surfaced, one of the twitter users shared a video on the social media handle exposing the same vulnerability on the Galaxy Note 10 smartphone.

It is a known fact that smartphone biometric security features are not as secure as they claim to be, but fooling the Samsung Galaxy S10 device with a mere $3.50 screen protector is difficult to digest. This is not the first time that Samsung has faced issues with its biometric security features. Previously, Samsung’s other flagship smartphone, the Galaxy S8, was laced with facial and iris recognition biometric security feature issues.

In a separate comment given to TechCrunch by Samsung related to fingerprint reader vulnerability, it stated, “We are investigating this issue and will be deploying a software patch soon. We encourage any customers with questions or those who need support downloading the latest software to contact us directly at 1-800-SAMSUNG.”

Attackers used “Cutlet Maker” Malware in Jackpotting Attacks on ATMs in Germany

BotenaGo, malware over encrypted connections

Cybersecurity experts found a new trace of an ATM Jackpotting Attack via infamous ATM malware named Cutlet Maker. The researchers opined that the usage of this malware by attackers is now rapidly growing across the globe.

Cutlet Maker malware was designed in 2017 to spit the cash from ATMs in Germany. In ATM jackpotting, attackers use malware like Cutlet Maker to trick the ATM, by exploiting its vulnerability, to eject the cash.

A joint investigation by Motherboard and the German broadcaster Bayerischer Rundfunk revealed some new details about a series of Jackpotting Attacks. The malware was used to attack multiple ATMs in Germany to steal around US$ 1.5 million during 2017. It’s said that a total of 10 different jackpotting incidents had taken place between February and November 2017, involving Cutlet Maker malware.

According to the investigation findings, the attacked regions include the U.S., Latin America, and Southeast Asia. The Spanish Commercial Bank Santander is one of the highly impacted banks in the 2017 attacks, as it used outdated Windows systems.

“Protecting our customers’ information and the integrity of our physical network is at the core of what we do. Our experts are involved in every stage of product development and operations to protect customers and the bank from fraud and cyber-threats. This focus on protecting our data and operations prevents us from commenting on specific security issues,” a Santander spokesperson said in a statement.

In January 2018, National Cash Register (NCR) Corporation and Diebold Nixdorf, two leading financial self-service providers in the United States, issued warnings against Jackpotting Attacks that make ATMs gush out cash incessantly. The self-service kiosk makers accepted to have informed their clients about the vulnerability. Although there is no available data on the losses due to these incidents, the ATM manufacturers have admitted to the rising cases of jackpotting across the world.

These ATM cyberattacks took off in 2015 in Asia, Europe and Mexico, however, now their new target is the U.S, raising concerns for the U.S. Secret Service, which has advised financial institutions to be cautious. “This should be treated by all ATM deployers as a call to action to take appropriate steps to protect their ATMs against these forms of attack,” NCR cautioned.

Gigamon ThreatINSIGHT’s “Time is Everything” Mantra for Network Detection and Threat Response

Evil Internet Minute: 1.5 cyberattacks on Computers with an Internet Connection

Gigamon a leader in network detection and response (NDR) solutions, recently announced the latest version of ThreatINSIGHT, a widely used and trusted product for network detection and response. This enhanced version has placed ThreatINSIGHT in the forefront of the cloud-native network detection and response solution providers race.

Speaking about the latest developments, Josh Carlson, Vice President and INSIGHT General Manager, Gigamon said, “Time is everything for threat response and responders. With that principle in mind, we have enhanced ThreatINSIGHT with a series of detection and management features that takes an organization’s security posture to a new level, allowing our customers to focus on threat hunting and resolution, not maintaining their threat-hunting infrastructure.”

The new features of ThreatINSIGHT, which take it ahead in the market include:

  • Machine Learning (ML) combined with Applied Threat Research (ATR) provides faster network detection and response.
  • Enables responders to quickly identify potential network threats by curating clusters of network events simultaneously
  • OmniSearch provides contextual correlation of events that accelerates investigation time.
  • Power to leverage the Gigamon INSIGHT Cloud Data Warehouse which delivers access to all current and historical network activity metadata needed for comprehensive forensics and investigative efforts.

According to an earlier research report “Managed Detection and Response Market by Security Type (Endpoint, Network, Application, Cloud), Deployment (On-Premises, Hosted), Organization Size (SMEs, and Large Enterprises), Industry Vertical, and Region – Global Forecast to 2022”, published by MarketsandMarkets, the market size is expected to grow from US$419.7 million in 2017 to US$1,658.0 million by 2022, at a Compound Annual Growth Rate (CAGR) of 31.6 percent during the forecast period.

MyGate Secures US$ 56 Million to Enhance Security in Gated Communities

Firedome Funding

MyGate, a security solutions provider for gated premises, recently raised US$ 56 million in a Series B funding round led by Chinese internet giant Tencent Holdings, US-based JS Capital LLC, and Tiger Global Management along with the participation from the existing investor Prime Venture Partners. The India-based startup stated the investment will help accelerate the business growth and expansion.

Founded in 2016, MyGate is a technology-forward app that helps people simplify their daily lives. MyGate provides comprehensive security solutions for gated communities to manage their operations digitally. With MyGate technology, the authentication procedures are performed digitally, with the implementation of artificial intelligence.

MyGate also offers other innovative services like e-intercom (automatic visitor authentication), child safety alerts, infrastructure-free vehicle management, staff management, touchless resident identification, clubhouse access management, and admin dashboards. The startup claims that its software platform is operating over a million homes in 11 cities across the country and planning to expand its services to other cities.

Speaking on the new investment, Vijay Arisetty, the CEO & Co-founder of MyGate, said, “We started MyGate to solve for the real problem of security and inconvenience faced by households every day. We are thankful to our customers and investors who believed in our solution, gave feedback and guided us in our journey. Our mission of simplifying urban living has just started and we’re delighted to welcome marquee investors and business partners in Tencent, Tiger, and JSoros to be part of our journey.”

“Right from the first time I experienced MyGate as a customer just two years ago, it’s been great to see a fledgling startup execute consistently and holistically, and grow into a category-creating market-leader. We’re delighted by the progress of MyGate and welcome these marquee investors, as the company prepares for the next wave of growth,” said Sanjay Swamy, Managing Partner, Prime Venture Partners.

Around 26 Million Stolen Cards Rescued from “BriansClub” Hack

one million card data exposed

BriansClub, a black-market website for buying stolen credit card data, has been hacked by unknown intruders and extracted around 26 million credit and debit card records. According to cybersecurity journalist Brian Krebs, the website sold more than 9.1 million stolen card data and earned over US$ 126 million.

According to a report published on the site KrebsOnSecurity.com, the exposed information included credit card data uploaded from 2015 to 2019. It’s found that BriansClub added 1.7 million card records for sale in 2015, and 2.89 million in 2016.. In 2019 (between January and August), BriansClub added nearly 7.6 million cards.

Brian Krebs complained that the BriansClub site is using his name and his image on their ads to carry their activities.

“Last month, KrebsOnSecurity was contacted by a source who shared a plain text file containing what was claimed to be the full database of cards for sale, both currently and historically, through BriansClub[.]at, a thriving fraud bazaar named after this author. Imitating my site, likeness, and namesake, BriansClub even dubiously claims copyright with a reference at the bottom of each page: “© 2019 Crabs on Security,” said Brian Krebs.

“The stolen card data from BriansClub was shared across multiple sources who work with financial institutions to identify and monitor or reissue cards that show up for sale in the cybercrime underground. An extensive analysis of the database indicates BriansClub holds approximately $414 million worth of stolen credit cards for sale, based on the pricing tiers listed on the site,” Krebs added.

Brian Krebs helped several organizations by reporting potential vulnerabilities to them. In August 2019, Krebs reported about a state-sponsored phishing attack launched against the Indian IT outsourcing and consulting giant Wipro. He stated the company was dealing with a multi-month intrusion from an assumed state-sponsored attacker.

According to reports from Krebs On Security, “One source familiar with the forensic investigation at a Wipro customer said it appears at least 11 other companies were attacked, as evidenced from file folders found on the intruders’ back-end infrastructure that were named after various Wipro clients.”

Cookery Writer Jack Monroe Loses £5,000 in SIM-Swap Attack

SIM Swapping

Jack Monroe, a popular food blogger and activist, recently revealed that she lost about £5,000 (around US$ 6,395) from her bank account after being hit by a SIM-Swapping attack. The British-based writer stated that her phone number was seized and re-activated on another SIM card, despite using two-factor authentication (2FA).

Monroe stated the attackers were able to receive her two-factor authentication messages and access her bank and payment accounts.

“It seems my card details and PayPal info were lifted from an online transaction. The phone number was ported to a new SIM, meaning crims access/bypass authentication and authorize payments. I’m an autistic, methodical, ruthless investigator, and I have a LOT of info to go on,” Jack Monroe tweeted.

“The money stolen has run into thousands of pounds–I’m a self-employed freelancer and I have to absolutely hustle for every single pound I earn. And someone has just HELPED THEMSELVES to around five thousand of them. The total figure not in yet. I’m so white-hot angry,” Monroe added.

SIM Swapping fraud is one of the simplest ways for cybercriminals to bypass users’ 2FA protection. Recently, unknown hackers used SIM Swapping Attack technique to take over Jack Dorsey’s, Twitter’s CEO & Co-founder, Twitter account by exploiting the cell carrier vulnerability, which enabled them to post anti-Semitic comments in his account feed.

According to an official report, Dorsey’s account was compromised by a hacking group named Chuckle Squad. However, Twitter officials clarified that Jack’s account is now fixed and there is no sign that Twitter’s systems have been hacked.

Describing how the account got hacked, Twitter said, “The phone number associated with the account was compromised due to a security oversight by the mobile provider. This allowed an unauthorized person to compose and send tweets via text message from the phone number. That issue is now resolved.”

1...281282283...410Page 282 of 410