ReportWire

Tag: cyberattacks

  • Attackers Caused So Much Havoc Inside Rainbow Six Siege, Ubisoft Shut Down the Whole Game

    [ad_1]

    Over the weekend, Ubisoft apparently lost control of one of its biggest video games, Rainbow Six Siege, as attackers appeared to infiltrate it and seize control of a number of core functions. The new bizarro game operators created a chaotic free-for-all that Ubisoft apparently couldn’t put to rest while keeping the game online.

    So the game, a team-oriented tactical first-person shooter sort of like Counter-Strike but with an emphasis on destructible environments, was taken down intentionally on Saturday. As of this writing on Sunday, it still wasn’t back up. There’s no campaign mode for the game, so there’s nothing to play with the servers down.

    There’s no official statement on the identity of the alleged perpetrators.

     

    Rather ominously, the X account of the malware code and information repository VX-Underground claims that the Rainbow Six Siege attack coincided with several wider, and potentially more damaging infiltrations at Ubisoft, rumored to include the theft of proprietary code and possibly even private user data, though none of this has been confirmed. 

    According to Bleeping Computer, there has not yet been a public release of information about the nature of the Rainbow Six Siege attack, and that publication’s reporting has been drawn from reports posted online by players.

    How much havoc was it? Well, according to one X user, the attackers turned the ban announcement pop-ups into a sort of meme ticker, making them drip out the lyrics to “It Wasn’t Me” by Shaggy.

     

    More substantively, Bleeping Computer says the attackers took control of player bans and ban reversal, and distributed 2 billion credits in the game’s in-game currency, along with an equally economy-destroying amount of “renoun,” in-game clout points that also function as a sort of currency. All skins and cosmetic items were opened to all players as well.

    Credits are sold for actual fiat currency, so, by Bleeping Computer’s math, two billion credits translates to roughly $13.33 million—though it’s doubtful anyone was able to convert that into an actual, real-world fortune.

    With their game effectively an asylum run by overtly hostile inmates, Ubisoft took the servers for Rainbow Six Siege, and the accompanying game marketplace, offline while engineers set about putting everything back together. Ubisoft posted on X that players would not be punished for spending the credits the attackers had given them.

    The bad news for players, however, is that as of Sunday, engineers were in the process of rolling back all those purchases as part of the repair effort. 

    The latest X post from Rainbow Six Siege as of this writing says “The team is focused on getting players back into the game as quickly as possible,” and that the “matter is being handled with extreme care and therefore, timing cannot be guaranteed.”

    Gizmodo reached out to Ubisoft for information on whether the attack is really more expansive than just Rainbow Six Siege, whether data was stolen from Ubisoft, and whether there is any information yet about the nature of the attack and what vulnerability was exploited. We will update if we hear back.

    [ad_2]

    Mike Pearl

    Source link

  • A Cyberattack on Jaguar Land Rover Is Causing a Supply Chain Disaster

    [ad_1]

    Almost immediately after the cyberattack, a group on Telegram called Scattered Lapsus$ Hunters, claimed responsibility for the hack. The group name implies a potential collaboration between three loose hacking collectives— Scattered Spider, Lapsus$, and Shiny Hunters—that have been behind some of the most high-profile cyberattacks in recent years. They are often made up of young, English-speaking, cybercriminals who target major businesses.

    Building vehicles is a hugely complex process. Hundreds of different companies provide parts, materials, electronics, and more to vehicle manufacturers, and these expansive supply chain networks often rely upon “just-in-time” manufacturing. That means they order parts and services to be delivered in the specific quantities that are needed and exactly when they need them—large stockpiles of parts are unlikely to be held by auto makers.

    “The supplier networks that are supplying into these manufacturing plants, they’re all set up for efficiency—economic efficiency, and also logistic efficiency,” says Siraj Ahmed Shaikh, a professor in systems security at Swansea University. “There’s a very carefully orchestrated supply chain,” Shaikh adds, speaking about automotive manufacturing generally. “There’s a critical dependency for those suppliers supplying into this kind of an operation. As soon as there is a disruption at this kind of facility, then all the suppliers get affected.”

    One company that makes glass sun roofs has started laying off workers, according to a report in the Telegraph. Meanwhile, another firm told the BBC it has laid off around 40 people so far. French automotive company OPmobility, which employs 38,000 people across 150 sites, told WIRED it is making some changes and monitoring the events. “OPmobility is reconfiguring its production at certain sites as a consequence of the shutdown of its production by one of its customers based in the United Kingdom and depending on the evolution of the situation,” a spokesperson for the firm says.

    While it is unclear which specific JLR systems have been impacted by the hackers and what systems JLR took offline proactively, many were likely taken offline to stop the attack from getting worse. “It’s very challenging to ensure containment while you still have connections between various systems,” says Orla Cox, head of EMEA cybersecurity communications at FTI Consulting, which responds to cyberattacks and works on investigations. “Oftentimes as well, there will be dependencies on different systems: You take one down, then it means that it has a knock on effect on another.”

    Whenever there’s a hack in any part of a supply chain—whether that is a manufacturer at the top of the pyramid or a firm further down the pipeline—digital connections between companies may be severed to stop attackers from spreading from one network to the next. Connections via VPNs or APIs may be stopped, Cox says. “Some may even take stronger measures such as blocking domains and IP addresses. Then things like email are no longer usable between the two organizations.”

    The complexity of digital and physical supply chains, spanning across dozens of businesses and just-in-time production systems, means it is likely that bringing everything back online and up to full-working speed may take time. MacColl, the RUSI researcher, says cybersecurity issues often fail to be debated at the highest level of British politics—but adds this time could be different due to the scale of the disruption. “This incident has the potential to cut through because of the job losses and the fact that MPs in constituencies affected by this will be getting calls,” he says. That breakthrough has already begun.

    [ad_2]

    Matt Burgess

    Source link

  • Russia’s Most Notorious Special Forces Unit Now Has Its Own Cyber Warfare Team

    Russia’s Most Notorious Special Forces Unit Now Has Its Own Cyber Warfare Team

    [ad_1]

    Russia’s military intelligence agency, the GRU, has long had a reputation as one of the world’s most aggressive practitioners of sabotage, assassination, and cyber warfare, with hackers who take pride in working under the same banner as violent special forces operators. But one new group within that agency shows how the GRU may be intertwining physical and digital tactics more tightly than ever before: a hacking team, which has emerged from the same unit responsible for Russia’s most notorious physical tactics, including poisonings, attempted coups, and bombings inside Western countries.

    A broad group of Western government agencies from countries including the US, the UK, Ukraine, Australia, Canada, and five European countries on Thursday revealed that a hacker group known as Cadet Blizzard, Bleeding Bear, or Greyscale—one that has launched multiple hacking operations targeting Ukraine, the US, and other countries in Europe, Asia, and Latin America—is in fact part of the GRU’s Unit 29155, the division of the spy agency known for its brazen acts of physical sabotage and politically motivated murder. That unit has been tied in the past, for instance, to the attempted poisoning of GRU defector Sergei Skripal with the Novichok nerve agent in the UK, which led to the death of two bystanders, as well as another assassination plot in Bulgaria, the explosion of an arms depot in the Czech Republic, and a failed coup attempt in Montenegro.

    Now that infamous section of the GRU appears to have developed its own active team of cyber warfare operators—distinct from those within other GRU units such as Unit 26165, broadly known as Fancy Bear or APT28, and Unit 74455, the cyberattack-focused team known as Sandworm. Since 2022, GRU Unit 29155’s more recently recruited hackers have taken the lead on cyber operations, including with the data-destroying wiper malware known as Whispergate, which hit at least two dozen Ukrainian organizations on the eve of Russia’s February 2022 invasion, as well as the defacement of Ukrainian government websites and the theft and leak of information from them under a fake “hacktivist” persona known as Free Civilian.

    Cadet Blizzard’s identification as a part of GRU Unit 29155 shows how the agency is further blurring the line between physical and cyber tactics in its approach to hybrid warfare, according to one of multiple Western intelligence agency officials whom WIRED interviewed on condition of anonymity because they weren’t authorized to speak using their names. “Special forces don’t normally set up a cyber unit that mirrors their physical activities,” one official says. “This is a heavily physical operating unit, tasked with the more gruesome acts that the GRU is involved in. I find it very surprising that this unit that does very hands-on stuff is now doing cyber things from behind a keyboard.”

    In addition to the joint public statement revealing Cadet Blizzard’s link to the GRU’s unit 29155, the US Cybersecurity and Infrastructure Security Agency published an advisory detailing the group’s hacking methods and ways to spot and mitigate them. The US Department of Justice indicted five members of the group by name, all in absentia, in addition to a sixth who had been previously charged earlier in the summer without any public mention of Unit 29155.

    “The GRU’s WhisperGate campaign, including targeting Ukrainian critical infrastructure and government systems of no military value, is emblematic of Russia’s abhorrent disregard for innocent civilians as it wages its unjust invasion,” the US Justice Department’s assistant attorney general Matthew G. Olsen wrote in a statement. “Today’s indictment underscores that the Justice Department will use every available tool to disrupt this kind of malicious cyber activity and hold perpetrators accountable for indiscriminate and destructive targeting of the United States and our allies.”

    [ad_2]

    Andy Greenberg

    Source link

  • A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

    A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

    [ad_1]

    “It’s not just that the water goes out, it’s that when the sole wastewater facility in your community is down really bad things start to happen. For example, no water means no hospital,” he says. “I really encountered a lot of this during my leadership of the Covid Task Force. There is such interdependence across the basic functions of society.”

    UnDisruptable27 will focus on interacting with communities who aren’t reached by Washington DC-based policy discussions or Information Sharing and Analysis Centers (ISACs), which are meant to represent each infrastructure sector of the US. The project aims to communicate directly with people who actually work on the ground in US critical infrastructure, and grapple together with the reality that cybersecurity-related disasters could impact their daily work.

    “There’s a data breach, you get whatever services like identity protection for some period of time, and life carries on, and people think that there’s no long-term impact,” says Megan Stifel, IST’s chief strategy officer. “There’s this expectation that it’s fine, things will just continue. So we’re very interested in getting after this issue and thinking about how do we tackle critical infrastructure security with perhaps a new approach.”

    Corman notes that even though cybersecurity incidents have become a well-known fact of life, business owners and infrastructure operators are often shaken and caught off guard when a cybersecurity incident actually affects them. Meanwhile, when government entities try to impose cybersecurity standards or become a partner on defense initiatives, communities often balk at the intrusion and perceived overreach. Last year, for example, the US Environmental Protection Agency was forced to rescind new cybersecurity guidelines for water systems after water companies and Republicans in Congress filed a lawsuit over the initiative.

    “Time and time again, trade associations or lobbyists or owners and operators have an allergic reaction to oversight and say, ‘We prefer voluntary, we’re doing fine on our own,’ ” Corman says. “And they really are trying to do the right thing. But then also time and time again, people are just shocked that disruption could happen and feel very blindsided. So you can only conclude that the people who feel the pain of our failures are not included in the conversation. They deserve to understand the risks inherent in this level of connectivity. We’ve tried a lot of things, but we have not tried just leveling with people.”

    UnDisruptable27 is launching this week for visibility among attendees at BSides as well as the other conferences, Black Hat and Defcon, that will run through Sunday in Las Vegas. Corman says that the goal is to combine the hacker mentality and, essentially, a call for volunteers with plans to work with creative collaborators on producing engaging content to fuel discourse and understanding. Information campaigns using memes and social media posts or moonshots like narrative podcasts and even reality TV are all on the table.

    “We must prioritize the security, safety, and resilience of critical infrastructure — including water, health care facilities, and utilities,” Craig Newmark, the Craigslist founder whose philanthropy is funding UnDisruptable27, told WIRED. “The urgency of this issue requires affecting human behavior through storytelling.”

    [ad_2]

    Lily Hay Newman

    Source link

  • The US Supreme Court Kneecapped US Cyber Strategy

    The US Supreme Court Kneecapped US Cyber Strategy

    [ad_1]

    The Commerce Department could hit a legal snag with its proposal to require cloud companies to verify their customers’ identities and report on their activities. The pending rule, part of an effort to clamp down on hackers’ misuse of cloud services, has drawn industry criticism for alleged overreach. A major tech trade group warned Commerce that its “proposed regulations risk exceeding the rulemaking authority granted by Congress.” (Commerce declined to comment.)

    Lawsuits could also target other regulations—including data breach reporting requirements from the Federal Trade Commission, the Federal Communications Commission, and financial regulators—that rely on laws written long before policymakers were thinking about cybersecurity.

    “A lot of the challenges where the agencies are going to be most nervous [are] when they’ve been interpreting something for 20 years or they newly have interpreted something that’s 30 years old,” says the cyber attorney.

    The White House has already faced one major setback. Last October, the Environmental Protection Agency withdrew cyber requirements for water systems that industry groups and Republican-led states had challenged in court. Opponents said the EPA had exceeded its authority in interpreting a 1974 law to require states to add cybersecurity to their water-facility inspections, a strategy that a top White House cyber official had previously praised as “a creative approach.”

    All Eyes on Congress

    The government’s cyber regulation push is likely to run headlong into a judicial morass.

    Federal judges could reach different conclusions about the same regulations, setting up appeals to regional circuit courts that have very different track records. “The judiciary itself is not a monolith,” says Geiger, of the Center for Cybersecurity Policy and Law. In addition, agencies understand cutting-edge tech issues much better than judges, who may struggle to parse the intricacies of cyber regulations.

    There is only one real solution to this problem, according to experts: If Congress wants agencies to be able to mandate cyber improvements, it will have to pass new laws empowering them to do so.

    “There is greater onus now on Congress to act decisively to help ensure protection of the critical services on which society relies,” Geiger says.

    Clarity will be key, says Jamil Jaffer, the executive director of George Mason University’s National Security Institute and a former clerk to Supreme Court Justice Neil Gorsuch. “The more specific Congress gets, the more likely I think a court is to see it the same way an agency does.”

    Congress rarely passes major legislation, especially with new regulatory powers, but cybersecurity has consistently been an exception.

    “Congress moves very, very slowly, but it’s not completely passive [on] this front,” Lilley says. “There’s a possibility that you will see meaningful cyber legislation in particular sectors if regulators are not able to move forward.”

    One major question is whether this progress will continue if Republicans seize unified control of the government in November’s elections. Lilley is optimistic, pointing to the GOP platform’s invocation of securing critical infrastructure with heightened standards as “a national priority.”

    “There’s a sense across both sides of the aisle at this point that, certainly in some of the sectors, there has been some measure of market failure,” Lilley says, “and that some measure of government action will be appropriate.”

    Regardless of who controls Capitol Hill next January, the Supreme Court just handed lawmakers a massive amount of responsibility in the fight against hackers.

    “It’s not going to be easy,” Geiger says, “but it’s time for Congress to act.”

    [ad_2]

    Eric Geller

    Source link

  • The US Wants to Integrate the Commercial Space Industry With Its Military to Prevent Cyber Attacks

    The US Wants to Integrate the Commercial Space Industry With Its Military to Prevent Cyber Attacks

    [ad_1]

    THIS ARTICLE IS republished from The Conversation under a Creative Commons license.

    The US military recently launched a groundbreaking initiative to strengthen ties with the commercial space industry. The aim is to integrate commercial equipment into military space operations, including satellites and other hardware. This would enhance cybersecurity for military satellites.

    As space becomes more important to the world’s critical infrastructure, the risk increases that hostile nation-states will deploy cyberattacks on important satellites and other space infrastructure. Targets would include not just spy satellites or military communications satellites, but commercial spacecraft too.

    The US Department of Defense believes its new partnership, called Commercial Augmentation Space Reserve (CASR), would enhance US national security and the country’s competitive advantage in space. It would go some way beyond the relationship between government and private contractor that already exists.

    In some cases, the commercial sector has advanced rapidly beyond government capabilities. This situation exists in numerous countries with a space capability and may apply in certain areas in the US too.

    The governments of some nation-states are therefore confronted with a choice. They could utilize bespoke systems for protecting their satellites, even though these may be outdated, or they could use other commercial—and potentially more advanced—“off-the-shelf” components. However, the commercial hardware may be less well understood in terms of its vulnerabilities to cyberattacks.

    Nevertheless, the US military believes that CASR will give it advanced strategic capabilities, and that potential risks can be minimized by actively avoiding overreliance on any single commercial entity.

    The supply chain aims to transition the US military from a restricted pool of commercial suppliers to a broader spectrum of partners. However, there are risks with a bigger pool of commercial suppliers too. Some might be unable to meet the demands of military contracts, could run into financial instability, or encounter other pressures that hinder their ability to supply critical components.

    New Priorities

    In 2022 there was a cyberattack on the KA-Sat consumer satellite broadband service. It targeted the satellites delivering the broadband and disrupted the service.

    There are many ways to attack another state’s satellites, such as anti-satellite (ASAT) weapons, which are often designed to physically destroy or disable the spacecraft. However, compared to ASATs, cyberattacks can be carried out in ways that are cheaper, quicker, and more difficult to trace.

    Part of the critical need to prioritize cybersecurity as a result of this strategy is that the US is an attractive market for global players in space. This strategic shift by the US Department of Defense is therefore likely to encourage more global companies to participate.

    Resilience to cyberattacks in the space industry has not always been a top priority. It is likely to take time for this to enter the thinking of major players in the space sector.

    This historical lack of emphasis on cybersecurity in space highlights an obvious need. There are also inconsistencies and gaps regarding the basic cyber requirements for government and industry, which vary depending on the stance of each nation-state.

    [ad_2]

    Sharon Lemac-Vincere

    Source link

  • Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

    Hackers Detail How They Allegedly Stole Ticketmaster Data From Snowflake

    [ad_1]

    It’s possible the ShinyHunter hackers did not directly hack the EPAM worker, and simply gained access to the Snowflake accounts using usernames and passwords they obtained from old repositories of credentials stolen by info stealers. But, as Reddington points out, this means that anyone else can sift through those repositories for these and other credentials stolen from EPAM accounts. Reddington says they found data online that was used by nine different infostealers to harvest data from the machines of EPAM workers. This raises potential concerns about the security of data belonging to other EPAM customers.

    EPAM has customers across various critical industries, including banks and other financial services, health care, broadcast networks, pharmaceutical, energy and other utilities, insurance, and software and hi-tech—the latter customers include Microsoft, Google, Adobe, and Amazon Web Services. It’s not clear, however, if any of these companies have Snowflake accounts to which EPAM workers have access. WIRED also wasn’t able to confirm whether Ticketmaster, Santander, Lending Tree, or Advance AutoParts are EPAM customers.

    The Snowflake campaign also highlights the growing security risks from third-party companies in general and from infostealers. In its blog post this week, Mandiant suggested that multiple contractors were breached to gain access to Snowflake accounts, noting that contractors—often known as business process outsourcing (BPO) companies—are a potential gold mine for hackers, because compromising the machine of a contractor that has access to the accounts of multiple customers can give them direct access to many customer accounts.

    “Contractors that customers engage to assist with their use of Snowflake may utilize personal and/or non-monitored laptops that exacerbate this initial entry vector,” wrote Mandiant in its blog post. “These devices, often used to access the systems of multiple organizations, present a significant risk. If compromised by infostealer malware, a single contractor’s laptop can facilitate threat actor access across multiple organizations, often with IT and administrator-level privileges.”

    The company also highlighted the growing risk from infostealers, noting that the majority of the credentials the hackers used in the Snowflake campaign came from repositories of data previously stolen by various infostealer campaigns, some of which dated as far back as 2020. “Mandiant identified hundreds of customer Snowflake credentials exposed via infostealers since 2020,” the company noted.

    This, accompanied by the fact that the targeted Snowflake accounts didn’t use MFA to further protect them, made the breaches in this campaign possible, Mandiant notes.

    Snowflake’s CISO, Brad Jones, acknowledged last week that the lack of multifactor authentication enabled the breaches. In a phone call this week, Jones told WIRED that Snowflake is working on giving its customers the ability to mandate that users of their accounts employ multifactor authentication going forward, “and then we’ll be looking in the future to [make the] default MFA,” he says.

    [ad_2]

    Kim Zetter

    Source link

  • TikTok Hack Targets ‘High-Profile’ Users via DMs

    TikTok Hack Targets ‘High-Profile’ Users via DMs

    [ad_1]

    TikTok says it’s currently taking steps to mitigate a cyberattack that’s targeting a number of high-profile users through direct messages, in an attempt to hijack their accounts.

    “We have taken measures to stop this attack and prevent it from happening in the future. We’re working directly with affected account owners to restore access, if needed,” says Jason Grosse, a spokesperson for TikTok’s privacy and security team.

    Grosse says TikTok is still investigating the attack and could not comment at this time about its scale or sophistication, describing the threat as merely a “potential exploit.”

    TikTok’s acknowledgment followed a report on Tuesday claiming CNN’s account had been temporarily breached last week. Citing an anonymous source at the news organization, Semifor reports that the breach did “not appear to be the result of someone gaining access from CNN’s end.” CNN did not immediately respond to WIRED’s request to comment.

    Concerns over hacking attempts targeting news organizations in the US are particularly high given the impending presidential election this fall.

    Forbes reported earlier in the day that the account of hotel heiress Paris Hilton was similarly affected, citing sources within the company. A source at TikTok tells WIRED that Hilton’s account was targeted but had not been compromised.

    Security and privacy concerns around TikTok expand beyond cyberattacks by malicious actors. The company itself is fighting to remain available in the United States after US president Joe Biden signed a law in April that forces its parent company, China-based ByteDance, to sell TikTok or face a ban. TikTok and several users have sued the US government, claiming the law is unconstitutional on First Amendment grounds.

    This is a developing story. Check back for updates.

    [ad_2]

    Dell Cameron

    Source link

  • Cops Are Just Trolling Cybercriminals Now

    Cops Are Just Trolling Cybercriminals Now

    [ad_1]

    Russian cybercriminals are almost untouchable. For years, hackers based in the country have launched devastating ransomware attacks against hospitals, critical infrastructure, and businesses, causing billions in losses. But they’re out of reach of Western law enforcement and largely ignored by the Russian authorities. When police do take the criminals’ servers and websites offline, they’re often back hacking within weeks.

    Now investigators are increasingly adding a new dimension to their disruption playbook: messing with cybercriminals’ minds. To put it bluntly, they’re trolling the hackers.

    In recent months, Western law enforcement officials have turned to psychological measures as an added way to slow down Russian hackers and cut to the heart of the sweeping cybercrime ecosystem. These nascent psyops include efforts to erode the limited trust the criminals have in each other, driving subtle wedges between fragile hacker egos, and sending offenders personalized messages showing they’re being watched.

    “We’re never going to get to the kernel of these organized criminal gangs, but if we can minimize the impact they have by reducing their ability to scale, then that’s a good thing,” says Don Smith, vice president of threat research at security firm Secureworks. “All of these little things, which in themselves may not be a killer blow, they all add friction,” he says. “You can look for cracks, amplify them, and create further discord and mistrust so it slows down what the bad guys are doing.”

    Take Operation Cronos. In February, a global law enforcement operation, led by the UK’s National Crime Agency (NCA), infiltrated the LockBit ransomware group, which authorities say has extorted more than $500 million from victims, and took its systems offline. Investigators at the NCA redesigned LockBit’s leak website, where it published its victims’ stolen data, and used the site to publish LockBit’s inner workings.

    Demonstrating the control and data they had, law enforcement published images of LockBit’s administration system and internal conversations. Investigators also published the usernames and login details of 194 LockBit “affiliate” members. This was expanded in May to include the members’ surnames.

    The policing operation also teased the unveiling of “LockBitSupp,” the mastermind behind the group, and said they had been “engaging” with law enforcement. Russian national Dmitry Yuryevich Khoroshev was charged with running LockBit in May, following a multiday countdown clock being published on the seized LockBit website and bold graphics naming him as the group’s organizer.

    “LockBit prided itself on its brand and anonymity, valuing these things above anything else,” says Paul Foster, director of threat leadership at the NCA. “Our operation has shattered that anonymity and completely undermined the brand, driving cybercriminals away from using their services.” The NCA says it carefully considered the operation, with its efforts to rebuild LockBit’s site leading to the group being widely mocked online and making its brand “toxic” to cybercriminals who had worked with it.

    “We recognized that a technical disruption in isolation wouldn’t necessarily destroy LockBit, therefore our additional infiltration and control, alongside arrests and sanctions in partnership with our international partners, has enhanced our impact on LockBit and created a platform for more law enforcement action in the future,” Foster says.

    [ad_2]

    Matt Burgess

    Source link

  • Teslas Can Still Be Stolen With a Cheap Radio Hack—Despite New Keyless Tech

    Teslas Can Still Be Stolen With a Cheap Radio Hack—Despite New Keyless Tech

    [ad_1]

    In 2020, Tesla even wrote in a filing to the US Federal Communications Commission that it would be implementing ultra-wideband in its keyless entry systems, and that the ability to far more precisely measure the distance of a key fob or smartphone from a car would—or at least could—prevent its vehicles from being stolen via relay attacks. “The distance estimate is based on a Time of Flight measurement, which is immune to relay attacks,” Tesla’s filing read. That document, first turned up by the Verge, led to widespread reports and social media comments suggesting that the upcoming ultra-wideband version of Tesla’s keyless entry system would spell the end of relay attacks against its vehicles.

    Yet the GoGoByte researchers found they were able to carry out their relay attack against the latest Tesla Model 3 over Bluetooth, just as they had with earlier models, from a distance as far as 15 feet between their device and the owner’s key or phone. While the cars do appear to use ultra-wideband communications, they don’t apparently use them for a distance check to prevent keyless entry theft.

    Tesla has not yet responded to WIRED’s requests for comment.

    When the GoGoByte researchers shared their findings with Tesla earlier this month, the company’s product security team immediately responded in an email dispelling any rumor that ultra-wideband, or “UWB,” was even intended to prevent theft. “This behavior is expected, as we are currently working on improving the reliability of UWB,” read Tesla’s email in response to GoGoByte’s description of its relay attack. “UWB ranging will be enforced when reliability improvements are complete.”

    That answer shouldn’t necessarily come as a surprise, says Josep Rodriguez, a researcher for security firm IOActive who has previously demonstrated relay attacks against Tesla vehicles. Tesla never explicitly said it had started using the ultra-wideband feature for security, after all—instead, the company has touted ultra-wideband features like detecting that someone’s phone is next to the trunk to open it hands-free—and using it as a security check may still produce too many false positives.

    “My understanding is that it can take engineering teams time to find a sweet spot where relay attacks can be prevented but also not affect the user experience,” Rodriguez wrote in an email to WIRED. “I wasn’t expecting that the first implementation of UWB in vehicles would solve the relay attacks.”

    Automakers’ slow adoption of ultra-wideband security features isn’t just limited to Tesla, the GoGoByte researchers note. They found that two other carmakers whose keys support ultra-wideband communications are also still vulnerable to relay attacks. In one case, the company hadn’t even written any software to implement ultra-wideband communications in its cars’ locking systems, despite upgrading to hardware that supports it. (The researchers aren’t yet naming those other carmakers since they’re still working through the vulnerability disclosure process with them.)

    Despite Teslas’ high price tag and continuing vulnerability to relay attacks, some studies have found that the cars are far less likely to be stolen than other cars due to their default GPS tracking—though some car theft rings have targeted them anyway using relay attacks to sell the vehicles for parts.

    GoGoByte notes that Tesla, unlike many other carmakers, does have the ability to push out over-the-air updates to its cars and might still use that feature to implement a relay attack fix via ultra-wideband communications. Until then, though, the GoGoByte researchers say they want Tesla owners to understand they’re far from immune. “I think Tesla will be able to fix this because they have the hardware in place,” says Li. “But I think the public should be notified of this issue before they release the secure version.”

    Until then, in other words, keep your Tesla’s PIN-to-drive protection in place. Better that than keeping your keys and smartphone in the freezer—or waking up to find a vacant driveway and your car sold for parts.

    [ad_2]

    Andy Greenberg

    Source link

  • The Dangerous Rise of GPS Attacks

    The Dangerous Rise of GPS Attacks

    [ad_1]

    The disruption to GPS services started getting worse on Christmas Day. Planes and ships moving around southern Sweden and Poland lost connectivity as their radio signals were interfered with. Since then, the region around the Baltic Sea—including neighboring Germany, Finland, Estonia, Latvia, and Lithuania—has faced persistent attacks against GPS systems.

    Tens of thousands of planes flying in the region have reported problems with their navigation systems in recent months amid widespread jamming attacks, which can make GPS inoperable. As the attacks have grown, Russia has increasingly been blamed, with open source researchers tracking the source to Russian regions such as Kaliningrad. In one instance, signals were disrupted for 47 hours continuously. On Monday, marking one of the most serious incidents yet, airline Finnair canceled its flights to Tartu, Estonia, for a month, after GPS interference forced two of its planes to abort landings at the airport and turn around.

    The jamming in the Baltic region, which was first spotted in early 2022, is just the tip of the iceberg. In recent years, there has been a rapid uptick in attacks against GPS signals and wider satellite navigation systems, known as GNSS, including those of Europe, China, and Russia. The attacks can jam signals, essentially forcing them offline, or spoof the signals, making aircraft and ships appear at false locations on maps. Beyond the Baltics, war zone areas around Ukraine and the Middle East have also seen sharp rises in GPS disruptions, including signal blocking meant to disrupt airborne attacks.

    Now, governments and telecom and airline safety experts are increasingly sounding the alarm about the disruptions and the potential for major disasters. Foreign ministers in Estonia, Latvia, and Lithuania have all blamed Russia for GPS issues in the Baltics this week and said the threat should be taken seriously.

    “It cannot be ruled out that this jamming is a form of hybrid warfare with the aim of creating uncertainty and unrest,” Jimmie Adamsson, the chief of public affairs for the Swedish Navy, tells WIRED. “Of course, there are concerns, mostly for civilian shipping and aviation, that an accident will occur creating an environmental disaster. There is also a risk that ships and aircraft will stop traffic to this area and therefore global trade will be affected.”

    “A growing threat situation must be expected in connection with GPS jamming,” Joe Wagner, a spokesperson from Germany’s Federal Office for Information Security, tells WIRED, saying there are technical ways to reduce its impact. Officials in Finland say they have also seen an increase in airline disruptions in and around the country. And a spokesperson for the International Telecommunication Union, a United Nations agency, tells WIRED that the number of jamming and spoofing incidents have “increased significantly” over the past four years, and interfering with radio signals is prohibited under the ITU’s rules.

    On the Upswing

    Attacks against GPS, and the wider GNSS category, come in two forms. First, GPS jamming looks to overwhelm the radio signals that make up GPS and make the systems unusable. Second, spoofing attacks can replace the original signal with a new location—spoofed ships can, for example, appear on maps as if they’re at inland airports.

    Both types of interference are up in frequency. The disruptions—at least at this stage—mostly impact planes flying at high altitudes and ships that can be in open water, not people’s individual phones or other systems that rely on GPS.

    [ad_2]

    Matt Burgess

    Source link

  • The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

    The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind

    [ad_1]

    Ultimately, Scott argues that those three years of code changes and polite emails were likely not spent sabotaging multiple software projects, but rather building up a history of credibility in preparation for the sabotage of XZ Utils specifically—and potentially other projects in the future. “He just never got to that step because we got lucky and found his stuff,” says Scott. “So that’s burned now, and he’s gonna have to go back to square one.”

    Technical Ticks and Time Zones

    Despite Jia Tan’s persona as a single individual, their yearslong preparation is a hallmark of a well-organized state-sponsored hacker group, argues Raiu, the former Kaspersky lead researcher. So too are the technical hallmarks of the XZ Utils malicious code that Jia Tan added. Raiu notes that, at a glance, the code truly looks like a compression tool. “It’s written in a very subversive manner,” he says. It’s also a “passive” backdoor, Raiu says, so it wouldn’t reach out to a command-and-control server that might help identify the backdoor’s operator. Instead, it waits for the operator to connect to the target machine via SSH and authenticate with a private key—one generated with a particularly strong cryptographic function known as ED448.

    The backdoor’s careful design could be the work of US hackers, Raiu notes, but he suggests that’s unlikely, since the US wouldn’t typically sabotage open source projects—and if it did, the National Security Agency would probably use a quantum-resistant cryptographic function, which ED448 is not. That leaves non-US groups with a history of supply chain attacks, Raiu suggests, like China’s APT41, North Korea’s Lazarus Group, and Russia’s APT29.

    At a glance, Jia Tan certainly looks East Asian—or is meant to. The time zone of Jia Tan’s commits are UTC+8: That’s China’s time zone, and only an hour off from North Korea’s. However, an analysis by two researchers, Rhea Karty and Simon Henniger, suggests that Jia Tan may have simply changed the time zone of their computer to UTC+8 before every commit. In fact, several commits were made with a computer set to an Eastern European or Middle Eastern time zone instead, perhaps when Jia Tan forgot to make the change.

    “Another indication that they are not from China is the fact that they worked on notable Chinese holidays,” say Karty and Henniger, students at Dartmouth College and the Technical University of Munich, respectively. They note that Jia Tan also didn’t submit new code on Christmas or New Year’s. Boehs, the developer, adds that much of the work starts at 9 am and ends at 5 pm for Eastern European or Middle Eastern time zones. “The time range of commits suggests this was not some project that they did outside of work,” Boehs says.

    Though that leaves countries like Iran and Israel as possibilities, the majority of clues lead back to Russia, and specifically Russia’s APT29 hacking group, argues Dave Aitel, a former NSA hacker and founder of the cybersecurity firm Immunity. Aitel points out that APT29—widely believed to work for Russia’s foreign intelligence agency, known as the SVR—has a reputation for technical care of a kind that few other hacker groups show. APT29 also carried out the Solar Winds compromise, perhaps the most deftly coordinated and effective software supply chain attack in history. That operation matches the style of the XZ Utils backdoor far more than the cruder supply chain attacks of APT41 or Lazarus, by comparison.

    “It could very well be someone else,” says Aitel. “But I mean, if you’re looking for the most sophisticated supply chain attacks on the planet, that’s going to be our dear friends at the SVR.”

    Security researchers agree, at least, that it’s unlikely that Jia Tan is a real person, or even one person working alone. Instead, it seems clear that the persona was the online embodiment of a new tactic from a new, well-organized organization—a tactic that nearly worked. That means we should expect to see Jia Tan return by other names: seemingly polite and enthusiastic contributors to open source projects, hiding a government’s secret intentions in their code commits.

    Updated 4/3/2024 at 12:30 pm ET to note the possibility of Israeli or Iranian involvement.

    [ad_2]

    Andy Greenberg, Matt Burgess

    Source link

  • ‘Malicious Activity’ Hits the University of Cambridge’s Medical School

    ‘Malicious Activity’ Hits the University of Cambridge’s Medical School

    [ad_1]

    The University of Cambridge is constantly ranked among the world’s top universities, with its medical school and vast research facilities among the very best. But for the past month, staff at the prestigious medical school have had work hampered following “malicious activity” on its computer network.

    An emailed “staff notice” seen by WIRED, believed to have been sent at the end of February, alerted staff to the disruption and said the university was working to get systems back online as soon as possible. However, weeks later, the incident is still ongoing, and little information has been made public about the nature of the incident.

    “IT services provided by the Clinical School Computing Service (CSCS) have been disrupted by malicious activity,” the email reviewed by WIRED says. “We appreciate that some staff and students are experiencing significant disruption to their work and studies, and we are grateful for their patience and understanding.”

    The University has confirmed to WIRED that its systems have been impacted, that some services have been voluntarily taken offline, and that while it has “contained” the incident, the disruption is ongoing and its investigations will likely take some time to complete. No data has been taken, it says. The UK’s national cybersecurity body and the country’s data regulator are also looking into the events.

    The email message sent to staff last month said a “Critical Incident Management Team” has been set up to handle the response. At the time the message was sent, the email said, there was no access to the local IT network and Wi-Fi, and wired internet access had been turned off in impacted buildings, with the Wi-Fi set to be turned on again that same day.

    The CSCS provides IT support to staff and researchers in the university’s School of Clinical Medicine. An archived version of its website says there are more than 5,800 devices on its network, and the team provides computers and servers to staff. The email seen by WIRED says that the CSCS also serves the Department of Zoology, Sainsbury Laboratory, which researches plant life; the Stem Cell Institute; and Milner Institute of the School of Biological Sciences, which researches emerging therapies. All have been impacted.

    A University of Cambridge spokesperson confirmed the incident to WIRED, saying that “malicious activity” was found on the Clinical School Computing Service last month. “We took immediate action to contain the incident including voluntarily taking some systems offline,” the spokesperson said in a statement. “As a result, there is ongoing interruption to some services.”

    It is not clear what the “malicious activity” entails or whether the activity is an attack by criminal hackers or an incident of a different nature. Multiple staff members at university departments did not respond to questions sent by WIRED about whether their work or research had been disrupted, or they directed questions to the press office as they are not authorized to speak about the incident.

    The university spokesperson did not describe the nature of the problem; however, they said a business continuity plan has been implemented to minimize disruption, and all of the other university and college IT systems are working as normal and are not impacted. “This will likely take some time to complete,” the spokesperson said of its ongoing investigation. “Investigations have found no evidence that data has been taken or transferred without authorization. We have also received third-party assurance that the incident is contained.” They say the situation has moved on since the email seen by WIRED was sent, and it is not possible to characterize the level of disruption across all departments.

    [ad_2]

    Matt Burgess

    Source link

  • Chinese Hackers Charged in Decade-Long Global Spying Rampage

    Chinese Hackers Charged in Decade-Long Global Spying Rampage

    [ad_1]

    For years, China’s state-backed hackers have stolen huge troves of company secrets, political intelligence, and the personal information of millions of people. On Monday, officials in the United States and United Kingdom expanded the long list of hacking allegations, claiming China is responsible for breaching the UK’s elections watchdog and accessing 40 million people’s data. The countries also issued a raft of criminal charges and sanctions against a separate Chinese group following a multiyear hacking rampage.

    In August last year, the UK’s Electoral Commission revealed “hostile actors” had infiltrated its systems in August 2021 and could potentially access sensitive data for 14 months until they were booted out in October 2022. The deputy prime minister, Oliver Dowden, told lawmakers on Monday that a China state-backed actor was responsible for the attack. In addition, Dowden said, the UK’s intelligence services have determined that Chinese hacking group APT31 targeted the email accounts of politicians in 2021.

    “This is the latest in a clear pattern of malicious cyber activity by Chinese state-affiliated organizations and individuals targeting democratic institutions and parliamentarians in the UK and beyond,” Dowden said in the UK’s House of Commons. The revelations were accompanied by the UK sanctioning two individuals and one company linked to APT31.

    Alongside the UK’s announcement on Monday, the US Department of Justice and Department of the Treasury’s Office of Foreign Assets Control unveiled further action against APT31, also known as Violet Typhoon, Bronze Vinewood, and Judgement Panda, including charging seven Chinese nationals with the conspiracy to commit computer intrusions and wire fraud.

    The DOJ claims the hacking group, which has been linked back to China’s Ministry of State Security (MSS) spy agency, has spent 14 years targeting thousands of critics, businesses, and political entities around the world in widespread espionage campaigns. This includes posing as journalists to send more than 10,000 malicious emails that tracked recipients, compromising email accounts, cloud storage accounts, telephone call records, home routers, and more. The spouses of one high-ranking White House official and those of multiple US senators were also targeted, the DOJ says.

    “These allegations pull back the curtain on China’s vast illegal hacking operation that targeted sensitive data from US elected and government officials, journalists and academics; valuable information from American companies; and political dissidents in America and abroad,” Breon Peace, a US attorney for the Eastern District of New York, said in a statement. “Their sinister scheme victimized thousands of people and entities across the world, and lasted for well over a decade.”

    The moves come as countries increasingly warn of an increase in China-linked espionage, during a year when more than 100 countries will host major elections. Statements from officials focus on the impact of the hacking activity on democratic processes, including the targeting of elected officials around the world and the compromising of pro-democracy activists and lawmakers in Hong Kong. However, the disclosures also coincide with continued jostling from Western politicians over pro- or anti-China stances, including the proposed sale of TikTok to a US company, which could result in a ban on the popular app if the sale fails to go through.

    [ad_2]

    Matt Burgess

    Source link

  • Here Come the AI Worms

    Here Come the AI Worms

    [ad_1]

    As generative AI systems like OpenAI’s ChatGPT and Google’s Gemini become more advanced, they are increasingly being put to work. Startups and tech companies are building AI agents and ecosystems on top of the systems that can complete boring chores for you: think automatically making calendar bookings and potentially buying products. But as the tools are given more freedom, it also increases the potential ways they can be attacked.

    Now, in a demonstration of the risks of connected, autonomous AI ecosystems, a group of researchers have created one of what they claim are the first generative AI worms—which can spread from one system to another, potentially stealing data or deploying malware in the process. “It basically means that now you have the ability to conduct or to perform a new kind of cyberattack that hasn’t been seen before,” says Ben Nassi, a Cornell Tech researcher behind the research.

    Nassi, along with fellow researchers Stav Cohen and Ron Bitton, created the worm, dubbed Morris II, as a nod to the original Morris computer worm that caused chaos across the internet in 1988. In a research paper and website shared exclusively with WIRED, the researchers show how the AI worm can attack a generative AI email assistant to steal data from emails and send spam messages—breaking some security protections in ChatGPT and Gemini in the process.

    The research, which was undertaken in test environments and not against a publicly available email assistant, comes as large language models (LLMs) are increasingly becoming multimodal, being able to generate images and video as well as text. While generative AI worms haven’t been spotted in the wild yet, multiple researchers say they are a security risk that startups, developers, and tech companies should be concerned about.

    Most generative AI systems work by being fed prompts—text instructions that tell the tools to answer a question or create an image. However, these prompts can also be weaponized against the system. Jailbreaks can make a system disregard its safety rules and spew out toxic or hateful content, while prompt injection attacks can give a chatbot secret instructions. For example, an attacker may hide text on a webpage telling an LLM to act as a scammer and ask for your bank details.

    To create the generative AI worm, the researchers turned to a so-called “adversarial self-replicating prompt.” This is a prompt that triggers the generative AI model to output, in its response, another prompt, the researchers say. In short, the AI system is told to produce a set of further instructions in its replies. This is broadly similar to traditional SQL injection and buffer overflow attacks, the researchers say.

    To show how the worm can work, the researchers created an email system that could send and receive messages using generative AI, plugging into ChatGPT, Gemini, and open source LLM, LLaVA. They then found two ways to exploit the system—by using a text-based self-replicating prompt and by embedding a self-replicating prompt within an image file.

    [ad_2]

    Matt Burgess

    Source link

  • 2024 CrowdStrike Global Threat Report: From breakout to breach in under three minutes; cloud infrastructure under attack

    2024 CrowdStrike Global Threat Report: From breakout to breach in under three minutes; cloud infrastructure under attack

    [ad_1]

    The findings of the 2024 CrowdStrike Global Threat Report highlight a surge in adversaries leveraging stolen identity credentials to exploit gaps in cloud environments and maximize the stealth, speed, and impact of cyberattacks. The report also details the biggest threats on the horizon for 2024, including the disruption of global elections and the exploitation of generative AI  to lower the barrier of entry and launch more sophisticated attacks. 

    In the 10th annual edition of the cybersecurity leader’s seminal report, CrowdStrike highlights activity from some of the 230+ prolific threat groups it tracks today. Key findings in the 2024  report include:  

    ● Dramatic Increase in Attack Velocity

    The speed of cyberattacks continues to accelerate at an alarming rate. The report indicates that the average breakout time is down to only 62 minutes from 84 in the previous year (with the fastest recorded attack coming in at 2 minutes and 7 seconds). Once initial access was obtained, it took only 31  seconds for an adversary to drop initial discovery tools to compromise victims.  

    ● Stealthy Attacks Spike as Adversaries Compromise Credentials

    The report notes a sharp increase in interactive intrusions and hands-on-keyboard activity (60%) as adversaries increasingly exploit stolen credentials to gain initial access to targeted organizations.  

    ● Adversaries Follow as Business Moves to the Cloud

    Adversaries turned their sights to the cloud through valid credentials – creating a challenge for defenders looking to differentiate between normal and malicious user behavior. The report shows cloud intrusions increased by 75% overall with cloud-conscious cases amplifying by 110% year-over-year. 

    ● The Exploitation of Generative AI on the Horizon

    In 2023, CrowdStrike observed nation-state actors and hacktivists experimenting with and seeking to abuse generative  AI to democratize attacks and lower the barrier of entry for more sophisticated operations. The report highlights how generative AI will likely be used for cyber activities in 2024 as the technology continues to gain popularity. 

    ● Disrupting Democracy by Targeting Global Elections

    With more than 40 democratic elections scheduled in 2024, nation-state and eCrime adversaries will have numerous opportunities to disrupt the electoral process or sway voter opinion. Nation-state actors from China, Russia, and Iran are highly likely to conduct mis-or disinformation operations to sow disruption against the backdrop of geoconflicts and global elections.

    “Over the course of 2023, CrowdStrike observed unprecedented stealthy operations from brazen eCrime groups, sophisticated nation-state actors, and hacktivists targeting businesses in every sector spanning the globe. Rapidly evolving adversary tradecraft honed in on both cloud and identity with unheard-of speed, while threat groups continued to experiment with new technologies, like GenAI, to increase the success and tempo of their malicious operations,” said  Adam Meyers, head of Counter Adversary Operations, CrowdStrike. “To defeat relentless  adversaries, organizations must embrace a platform approach, fueled by threat intelligence and  hunting, to protect identity, prioritize cloud protection, and give comprehensive visibility into  areas of enterprise risk.” 

    As the cybersecurity consolidator in the AI era, CrowdStrike pioneered the adversary-focused approach to cybersecurity and provided customers with adversary-driven intelligence, human-led analysis, and the groundbreaking technology required to stay ahead of threats. This unique approach combines the unparalleled power of CrowdStrike Falcon Intelligence with  CrowdStrike Falcon OverWatch’s elite team of threat hunters to fuel the AI-native CrowdStrike  XDR Falcon platform to accelerate investigations, remediate threats, and ultimately stop breaches.  

    [ad_2]

    Gadgets Magazine 17

    Source link

  • How to Not Get Scammed Out of $50,000

    How to Not Get Scammed Out of $50,000

    [ad_1]

    Plus: State-backed hackers test out generative AI, the US takes down a major Russian military botnet, and 100 hospitals in Romania go offline amid a major ransomware attack.

    [ad_2]

    Andrew Couts

    Source link

  • What Bank of America is doing for customers after data breach | Bank Automation News

    What Bank of America is doing for customers after data breach | Bank Automation News

    [ad_1]

    Bank of America is working to control the fallout following an October data breach at third-party vendor Infosys McCamish Solutions.  The bank is offering the more than 57,000 affected clients a free, two-year membership to IdentityWorks, an identity protection product from Experian, according to an Infosys McCamish Solutions filing with the state of Maine. “If […]

    [ad_2]

    Whitney McDonald

    Source link

  • ATO losses may exceed $635B in 2023 | Bank Automation News

    ATO losses may exceed $635B in 2023 | Bank Automation News

    [ad_1]

    Anti-fraud and anti-money laundering companies are looking to AI to increase the efficiency of their detection models as digital fraud becomes more pervasive.  Account takeovers using stolen credentials and related financial crime increased by 354% year over year in the second quarter, according to the September “Q3 2023 digital trust and safety index” report by […]

    [ad_2]

    Vaidik Trivedi

    Source link

  • 7 Next-Gen Security Recommendations to Safeguard Your Data | Entrepreneur

    7 Next-Gen Security Recommendations to Safeguard Your Data | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    The threat landscape is growing, and professional cybercriminals are increasingly becoming more dangerous as their methods develop in complexity and sophistication.

    Although threat actors leverage different techniques, they all have a common goal: to find a single exploitable security weakness and rapidly take advantage of the situation. Developing a tactical response plan is essential; however, the best defense is strengthening security to prevent attacks from occurring in the first place.

    Most of us are familiar with common security recommendations: 2FA, software updates, data encryption, using secure networks, VPNs, proxy servers and more. While these recommendations should always remain part of your security toolkit, others have emerged to help you adapt to the rapidly evolving threat landscape.

    Related: Data Security: How To Protect Your Most Sensitive Asset

    1. Avoid inputting sensitive information into generative AI applications

    Generative AI leverages machine learning and deep learning algorithms to autonomously generate content based on complex data patterns. These systems are trained on datasets containing text from the internet, books, articles and other public sources; however, they can also “learn” from user interactions by collecting data from conversations.

    Recently, enterprise-grade versions of ChatGPT and GitHub Copilot have been introduced, claiming that these models do not use business and conversation data for training purposes. To safeguard sensitive data, at Oxylabs, we actively encourage our employees to use business accounts.

    Nevertheless, it is less clear how popular generative AI tools use customer data if customers interact with free versions. Therefore, users should still exercise caution by avoiding the input of sensitive or confidential company data into generative AI applications if free accounts are being used. Further, data should be completely anonymized and stripped of personally identifiable information to maintain privacy and security.

    2. Go beyond standard security protocols for remote teams with encrypted, containerized workspaces

    Hybrid teams went mainstream in 2020 and are likely here to stay. While working remotely benefits both employers and employees in many ways, the use of mobile teams continues to challenge organizations from a security perspective.

    We’re all familiar with conventional protocols such as using trusted Wi-Fi networks, VPNs, Multi-Factor Authentication (MFA) and data encryption. Due to the increasing use of cloud-based services, companies must also ensure each vendor has robust security practices in place and maintains compliance with the latest security regulations.

    Another emerging recommendation is deploying encrypted, containerized workspaces on company-owned and personal employee devices. The use of such systems ensures data is secured in a container even if device safety is compromised. For example, if malware infects a containerized browser, it won’t be able to spread anywhere beyond it.

    3. Secure supply chains with a risk-mitigation strategy

    Supply chains are growing in size and complexity, requiring a comprehensive risk management strategy that includes compliance with regulations and robust safety protocols.

    Risks include phishing attacks, ransomware, software vulnerabilities, man-in-the-middle attacks and more. It is recommended to implement standard security measures such as firewalls, intrusion detection systems and advanced security monitoring. Further, it’s essential to integrate specialized security standards and practices, such as the Cybersecurity Framework developed by the U.S. Institute of Standards and Technology (NIST).

    Related: How to Mitigate Cybersecurity Risks Associated With Supply Chain Partners and Vendors

    4. Swap traditional encryption methods with quantum-resistant encryption algorithms

    Quantum computers beat traditional computers by leveraging quantum mechanics to solve complex problems faster; however, their use poses a challenge to commonly used encryption methods.

    Encryption typically converts plaintext (unencrypted data) into ciphertext (encrypted data) using a cryptographic algorithm that requires a key to “unlock” the data. Quantum computing potentially weakens or breaks commonly used encryption techniques, such as Grover’s algorithm, Shor’s algorithm and quantum key distribution.

    To address the threat, researchers are exploring post-quantum cryptographic techniques and algorithms designed to withstand attacks from quantum computers. These include code-based cryptography, hash-based cryptography, lattice-based cryptography and more. In the meantime, organizations must maintain a robust security posture and stay informed of quantum-resistant encryption methods as they become available.

    5. Safeguard Cyber-Physical Systems (CPS)

    Cyber-Physical Systems (CPS) communicate with the world around us through a network of computational and physical components. These include electrical power distribution systems or smart grids, smart traffic management systems, autonomous vehicles, remote healthcare monitoring, smart buildings and more.

    The concept has been around for decades; however, the emergence of Internet of Things (IoT) devices, connected appliances and sensor technology has increased CPS prevalence substantially since 2010. Data generation has grown concurrently, attracting cybercriminals in the process.

    Access control, authentication, software updates, monitoring and regulatory compliance are well-known protocols to secure CPS. Emerging recommendations also include:

    • Network segmentation to isolate critical CPS components and less crucial systems to limit access in the event of an attack;

    • Designing CPS systems with redundancy and fail-safe mechanisms to ensure systems keep operating if an attack or system failure takes place;

    • Regular penetration testing or simulated cyber attacks to identify vulnerabilities.

    6. Boost your Identity and Access Management (IAM) strategy with three-factor authentication (3FA) and passkeys

    We’re all familiar with two-factor authentication (2FA), where two steps or “factors” are required to access a system, including a password or PIN and a mobile phone or device that generates a one-time password (OTP).

    3FA takes security up a level by requiring authentication comprised of some type of biometric data, such as a fingerprint, face scan, iris recognition, vein recognition, voice recognition or other piece of highly individual data. However, even 3FA might soon be overthrown by passkeys, a technology already used by Google. Resistant to phishing, passkeys utilize fingerprints, face scans or pins to unlock a device or program without using passwords.

    Related: Cybersecurity for Small and Medium-Sized Businesses — How to Conduct a Comprehensive Risk Assessment

    7. Protect assets with cyber insurance

    Last but not least is cyber insurance. It’s not the most innovative or exciting recommendation on this list, but insurance has existed for hundreds of years because it adds value to any security strategy.

    Cyber insurance can protect your organization from liabilities associated with sensitive data breaches, such as credit/debit card details, health records and social security information. While it may be cost-intensive in some cases, it does have the potential to save your organization millions of dollars in the event of a security breach.

    Cybercriminals continuously enhance their techniques. That’s why it’s imperative to stay a step ahead with a robust data security strategy that fuses next-generation practices that go beyond familiar safety protocols. Integrating these recommendations protects your organization’s digital assets on the ever-evolving threat landscape to ensure long-term business viability and success.

    [ad_2]

    Julius Černiauskas

    Source link