ReportWire

Tag: Cybercrime

  • The French government says it’s being targeted by unusual intense cyberattacks

    The French government says it’s being targeted by unusual intense cyberattacks

    [ad_1]

    FILE – French Prime Minister Gabriel Attal gestures as he speaks during the first session of questions to the new government at the National Assembly in Paris, Tuesday, Jan. 16, 2024. The French government said Monday, March 11, 2024 that several of its services are being targeted by cyberattacks of ‘’unprecedented intensity,’’ and a special crisis center was activated to restore online services. In a statement, Prime Minister Gabriel Attal’s office said the attacks started Sunday night and hit multiple government ministries, without providing details. (AP Photo/Michel Euler, File)

    [ad_2]

    Source link

  • Cyberattack on UnitedHealth still impacting prescription access:

    Cyberattack on UnitedHealth still impacting prescription access:

    [ad_1]

    Washington — A cyberattack on the health technology provider Change Healthcare is wreaking havoc nationwide, as some hospitals and pharmacies cannot get paid, and many patients are unable to get prescriptions.

    Change Healthcare is a subsidiary of the UnitedHealth Group, one of the nation’s largest healthcare companies. In a federal filing this week, UnitedHealth said that Change Healthcare first discovered the hack on Feb. 21, disconnecting impacted systems “immediately.”

    “So I mean we’ve seen a lot of claims coming through as a rejected claim, where obviously the insurance provider are not able to pay because of this attack,” said Amrish Patel, a pharmacist in Dallas, Texas. “Elderly patients that have a fixed income, and they’re trying to get their medicine…unfortunately there’s no way around it at this point.”

    Change Healthcare says it processes 15 billion transactions annually, touching one in three U.S. patient records.

    “I can tell you that this cyberattack has affected every hospital in the country one way or another,” said John Riggi, national advisor for cybersecurity and risk at the American Hospital Association.

    “It’s not a data crime, it’s not a white-collar crime, these are threats to life,” Riggi added.
     
    In a since-deleted post on the dark web, a Russian-speaking ransomware group known as Blackcat claimed responsibility, alleging they stole more than six terabytes of data, including “sensitive” medical records.

    “Change Healthcare can confirm we are experiencing a cybersecurity issue perpetrated by a cybercrime threat actor who has represented itself to us as ALPHV/Blackcat,” UnitedHealth told CBS News in a statement Thursday of Blackcat’s claim. “Our experts are working to address the matter and we are working closely with law enforcement and leading third-party consultants, Mandiant and Palo Alto Network, on this attack against Change Healthcare’s systems.” 

    UnitedHealth added that its investigation has so far provided “no indication” that the systems of its other subsidiaries — Optum, UnitedHealthcare and UnitedHealth Group — “have been affected by this issue.” 
     
    Change Healthcare says it has established workarounds for payment, but more than one week after the hack was first detected, systems remain down, creating billing headaches for hospitals and pharmacies. Smaller hospitals are particularly vulnerable.

    “The smaller, less resourced hospitals, our safety net critical access rural hospitals, certainly do not operate with months of cash reserves,” Riggi said. “Could be just a matter of days, or a couple of weeks.”

    In a previous statement Wednesday, UnitedHealth estimated that more than 90% of the nation’s pharmacies “have modified electronic claim processing to mitigate impacts” of the cyberattack, and “the remainder have offline processing workarounds.”

    UnitedHealth has not provided an estimate on when it believes its systems will return to normal. The FBI is also investigating. 

    Nicole Sganga

    CBS News reporter covering homeland security and justice.

    [ad_2]

    Source link

  • Why are ransomware gangs making so much money? | TechCrunch

    Why are ransomware gangs making so much money? | TechCrunch

    [ad_1]

    For many organizations and startups, 2023 was a rough year financially, with companies struggling to raise money and others making cuts to survive. Ransomware and extortion gangs, on the other hand, had a record-breaking year in earnings, if recent reports are anything to go by.

    It’s hardly surprising when you look at the state of the ransomware landscape. Last year saw hackers continue to evolve their tactics to become scrappier and more extreme in efforts to pressure victims into paying their increasingly exorbitant ransom demands. This escalation in tactics, along with the fact that governments have stopped short of banning ransom payments, led to 2023 becoming the most lucrative year yet for ransomware gangs.

    The billion-dollar cybercrime business

    According to new data from crypto forensics startup Chainalysis, known ransomware payments almost doubled in 2023 to surpass the $1 billion mark, calling the year a “major comeback for ransomware.”

    That’s the highest figure ever observed, and almost double the amount of known ransom payments tracked in 2022. But Chainalysis said the actual figure is likely far higher than the $1.1 billion in ransom payments it has witnessed so far.

    There’s a glimmer of good news, though. While 2023 was overall a bumper year for ransomware gangs, other hacker-watchers observed a drop in payments toward the end of the year.

    This drop is a result of improved cyber defenses and resiliency, along with the growing sentiment that most victim organizations don’t trust hackers to keep their promises or delete any stolen data as they claim. “This has led to better guidance to victims and fewer payments for intangible assurances,” according to ransomware remediation company Coveware.

    Record-breaking ransoms

    While more ransomware victims are refusing to line the pockets of hackers, ransomware gangs are compensating for this drop in earnings by increasing the number of victims they target.

    Take the MOVEit campaign. This huge hack saw the prolific Russia-linked Clop ransomware gang mass-exploit a never-before-seen vulnerability in the widely used MOVEit Transfer software to steal data from the systems of more than 2,700 victim organizations. Many of the victims are known to have paid the hacking group in efforts to prevent the publication of sensitive data.

    While it’s impossible to know exactly how much money the mass-hack made for the ransomware group, Chainalysis said in its report that Clop’s MOVEit campaign amassed over $100 million in ransom payments, and accounted for almost half of all ransomware value received in June and July 2023 during the height of this mass-hack.

    MOVEit was by no means the only money-making campaign of 2023.

    In September, casino and entertainment giant Caesars paid roughly $15 million to hackers to prevent the disclosure of customer data stolen during an August cyberattack.

    This multimillion-dollar payment perhaps illustrates why ransomware actors continue to make so much money: the Caesars attack barely made it into the news, while a subsequent attack on hotel giant MGM Resorts — which has so far cost the company $100 million to recover from — dominated headlines for weeks. MGM’s refusal to pay the ransom led to the hackers’ release of sensitive MGM customer data, including names, Social Security numbers and passport details. Caesars — outwardly at least — appeared largely unscathed, even if by its own admission could not guarantee that the ransomware gang would delete the company’s stolen data.

    Escalating threats

    For many organizations, like Caesars, paying the ransom demand seems like the easiest option to avoid a public relations nightmare. But as the ransom money dries up, ransomware and extortion gangs are upping the ante and resorting to escalating tactics and extreme threats.

    In December, for example, hackers reportedly tried to pressure a cancer hospital into paying a ransom demand by threatening to “swat” its patients. Swatting incidents rely on malicious callers falsely claiming a fake real-world threat to life, prompting the response of armed police officers.

    We also saw the notorious Alphv (known as BlackCat) ransomware gang weaponize the U.S. government’s new data breach disclosure rules against MeridianLink, one of the gang’s many victims. Alphv accused MeridianLink of allegedly failing to publicly disclose what the gang called “a significant breach compromising customer data and operational information,” for which the gang took credit.

    No ban on ransom payments

    Another reason ransomware continues to be lucrative for hackers is that while not advised, there’s nothing stopping organizations paying up — unless, of course, the hackers have been sanctioned.

    To pay or not to pay the ransom is a controversial subject. Ransomware remediator Coveware suggests that if a ransom payment ban was imposed in the U.S. or any other highly victimized country, companies would likely stop reporting these incidents to the authorities, reversing past cooperation between victims and law enforcement agencies. The company also predicts that a ransom payments ban would lead to the overnight creation of a large illegal market for facilitating ransomware payments.

    Others, however, believe a blanket ban is the only way to ensure ransomware hackers can’t continue to line their pockets — at least in the short term.

    Allan Liska, a threat intelligence analyst at Recorded Future, has long opposed banning ransom payments — but now believes that for as long as ransom payments remain lawful, cybercriminals will do whatever it takes to collect them.

    “I’ve resisted the idea of blanket bans on ransom payments for years, but I think that has to change,” Liska told TechCrunch. “Ransomware is getting worse, not just in the number of attacks but in the aggressive nature of the attacks and the groups behind them.”

    “A ban on ransom payments will be painful and, if history is any guide, will likely lead to a short-term increase in ransomware attacks, but it seems like this is the only solution that has a chance of long-term success at this point,” said Liska.

    While more victims are realizing that paying the hackers cannot guarantee the safety of their data, it’s clear that these financially motivated cybercriminals aren’t giving up their lavish lifestyles anytime soon. Until then, ransomware attacks will remain a major money-making exercise for the hackers behind them.

    Read more on TechCrunch:

    [ad_2]

    Carly Page

    Source link

  • 2/12: Prime Time with John Dickerson

    2/12: Prime Time with John Dickerson

    [ad_1]

    2/12: Prime Time with John Dickerson – CBS News


    Watch CBS News



    John Dickerson reports on a push from President Biden to protect civilian lives in Gaza, Donald Trump’s comments on NATO, and how Chinese hackers are getting into U.S. infrastructure.

    Be the first to know

    Get browser notifications for breaking news, live events, and exclusive reporting.


    [ad_2]

    Source link

  • Did a Hacker Gang Create a Botnet Out of 3 Million Electric Toothbrushes?

    Did a Hacker Gang Create a Botnet Out of 3 Million Electric Toothbrushes?

    [ad_1]

    The answer is: No, but you’d be forgiven for having believed that was the case since a viral news story made the rounds earlier this week claiming it was so.

    The Animal Kingdom Imagines a World of Humans Turning Into Animals

    The story in question was published by a Swiss newspaper, Aargauer Zeitung, and claimed that three million electric toothbrushes had been tied into a botnet, which was then used by cybercriminals to carry out a financially damaging DDoS attack on a Swiss company’s website. The source of the story were researchers from Fortinet, a well-known security company based in California.

    This story, which sounded just crazy enough to be true, was subsequently recycled by numerous English-speaking outlets, including Tom’s Hardware, ZDNet, and others. There was a certain logic to it. Cybercriminals can be very creative when it comes to using smart hardware to build malicious networks; the Mirai cybercriminals notably used over 100,000 smart devices to build one of the most notorious botnets ever. Why not use a smart toothbrush or two?

    The problem, however, is that not all smart devices are built alike. The toothbrush story unraveled after security experts on X began chiming in about the ridiculousness of this scenario. Some said that it was basically impossible, given that smart toothbrushes connect to Bluetooth, not the internet. A story from 404 Media cited skeptical security experts, who called into question the validity of the narrative.

    Now, the story has been officially deemed false. According to Fortinet, the Swiss journalists who initially spread the story misinterpreted their researchers during an interview, which then caused U.S. outlets to uncritically pick up the false narrative and further circulate it. In a statement shared with ZDNet, Fortinet clarified that the toothbrush incident had not actually happened, and was more of a thought experiment than anything:

    “To clarify, the topic of toothbrushes being used for DDoS attacks was presented during an interview as an illustration of a given type of attack, and it is not based on research from Fortinet or FortiGuard Labs. It appears that due to translations the narrative on this topic has been stretched to the point where hypothetical and actual scenarios are blurred.

    Covering cybersecurity as a journalist can be tricky. Many stories are pitched as research by security companies, and those companies are incentivized to elaborate a bit in their research findings to get more attention for their business. Indeed, the Swiss newspaper at the center of the toothbrush drama has now come out and blamed Fortinet for falsely claiming that the story was real. The paper claims, in a statement posted to its website, that the excuse of a “translation error” is, itself, made up:

    [Translated from German by Google Translate] What the Fortinet headquarters in California is now calling a “translation problem” sounded completely different during the research: Swiss Fortinet representatives described the toothbrush case as a real DDoS at a meeting that discussed current threats…

    Fortinet provided specific details: information about how long the attack took down a Swiss company’s website; an order of magnitude of how great the damage was. Fortinet did not want to reveal which company it was out of consideration for its customers.

    The text was submitted to Fortinet for verification before publication. The statement that this was a real case that really happened was not objected to.

    Gizmodo reached out to Fortinet for more information on how this tall tale got so much circulation and will update our story if it responds.



    [ad_2]

    Lucas Ropek

    Source link

  • EU capitals fear Russian retaliation and cyberattacks after asset freezes

    EU capitals fear Russian retaliation and cyberattacks after asset freezes

    [ad_1]

    The EU’s unrelated effort to funnel cash to Ukraine from its central budget faced serious political resistance, prompting governments to look at alternative sources of money. It took weeks of diplomatic backchanneling before leaders convinced Hungary on Feb. 1 to lift its veto over the EU’s €50 billion cash pot for Ukraine.

    Financial stability

    The assets confiscation plan could generate over €200 billion to support Ukraine’s postwar reconstruction, according to backers of the proposal. G7 countries are aiming to come up with a coordinated roadmap amid growing pressure from the United States, which, along with the United Kingdom and Canada, has fewer qualms than EU countries such as Germany, France and Italy.

    In Europe, there are fears Moscow might retaliate by lodging a flurry of appeals against Euroclear, a Belgium-based financial depository that holds the vast majority of Russian reserves in Europe.

    “An institution like Euroclear is a very systemic financial institution,” Belgian Finance Minister Vincent Van Peteghem said | Nicolas Maeterlinck/Belga/AFP via Getty Images

    “An institution like Euroclear is a very systemic financial institution,” Belgian Finance Minister Vincent Van Peteghem told reporters at the end of January. “We should … try to avoid an impact [of Russian asset confiscation] on financial stability.”

    In a sign of the sort of retaliation countries fear might come, Russian entities have already filed 94 lawsuits in Russia demanding payback to Euroclear, which operates under Belgian law, after their investments and their profits in Europe were frozen, according to a Belgian official with knowledge of the proceedings.

    Top Russian lenders, including Rosbank, Sinara Bank and Rosselkhozbank, filed legal claims against Euroclear worth hundreds of millions of rubles.



    [ad_2]

    Gregorio Sorgi

    Source link

  • Journalists, lawyers and activists hacked with Pegasus spyware in Jordan, forensic probe finds

    Journalists, lawyers and activists hacked with Pegasus spyware in Jordan, forensic probe finds

    [ad_1]

    Israeli-made Pegasus spyware was used in Jordan to hack the cellphones of at least 30 people, including journalists, lawyers, human rights and political activists, the digital rights group Access Now said Thursday.

    The hacking with spyware made by Israel’s NSO Group occurred from 2019 until last September, Access Now said in its report. It did not accuse Jordan’s government of the hacking.

    One of the targets was Human Rights Watch’s deputy director for the region, Adam Coogle, who said in an interview that it was difficult to imagine who other than Jordan’s government would be interested in hacking those who were targeted.

    The Jordanian government had no immediate comment on Thursday’s report.

    In a 2022 report detailing a much smaller group of Pegasus victims in Jordan, digital sleuths at the University of Toronto’s Citizen Lab identified two operators of the spyware it said may have been agents of the Jordanian government. A year earlier, Axios reported on negotiations between Jordan’s government and NSO Group.

    “We believe this is just the tip of the iceberg when it comes to the use of Pegasus spyware in Jordan, and that the true number of victims is likely much higher,” Access Now said. Its Middle East and North Africa director, Marwa Fatafta, said at least 30 of 35 known targeted individuals were successfully hacked.

    Citizen Lab confirmed all but five of the infections, with 21 victims asking to remain anonymous, citing the risk of reprisal. The rest were identified by Human Rights Watch, Amnesty International’s Security Lab, and the Organized Crime and Corruption Reporting Project.

    NSO Group says it only sells to vetted intelligence and law enforcement agencies — and only for use against terrorists and serious criminals. But cybersecurity researchers who have tracked the spyware’s use in 45 countries have documented dozens of cases of politically motivated abuse of the spyware — from Mexico and Thailand to Poland and Saudi Arabia.

    An NSO Group spokesperson said the company would not confirm or deny its clients’ identities. NSO Group says it vets customers and investigates any report its spyware has been abused.

    The U.S. government was unpersuaded and blacklisted the NSO Group in November 2021, when iPhone maker Apple Inc. sued it, calling its employees “amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse.”

    Those targeted in Jordan include Human Rights Watch’s senior researcher for Jordan and Syria, Hiba Zayadin. Both she and Coogle had received threat notifications from Apple on Aug. 29 that state-sponsored attackers had attempted to compromise their iPhones.

    Coogle’s local, personal iPhone was successfully hacked in October 2022, he said, just two weeks after the human rights group published a report documenting the persecution and harassment of citizens organizing peaceful political dissent.

    After that, Coogle activated “Lockdown Mode,” on the iPhone, which Apple recommends for users at high risk.

    Human Rights Watch said in a statement Thursday that it had contacted NSO Group about the attacks and specifically asked it to investigate the hack of Coogle’s device “but has received no substantive response to these inquiries.”

    Jordanian human rights lawyer Hala Ahed — known for defending women’s and workers rights and prisoners of conscience — was also targeted at least twice by Pegasus, successfully in March 2021 then unsuccessfully in February 2023, Access Now said.

    About half of those found to have been targeted by Pegasus in Jordan — 16 in all — were journalists or media workers, the report said.

    One veteran Palestinian-American journalist and columnist, Dauod Kuttab, was hacked with Pegasus three times between February 2022 and September 2023.

    Along the way, he said, he’s learned important lessons about not clicking on links in messages purporting to be from legitimate contacts, which is how one of the Pegasus hacks snared him.

    Kuttab refused to speculate about who might have targeted him.

    “I always assume that somebody is listening to my conversations,” he said, as getting surveilled “comes with the territory” when you are journalist in the Middle East.

    But Kuttab does worry about his sources being compromised by hacks — and the violation of his privacy.

    “Regardless of who did it, it’s not right to intervene into my personal, family privacy and my professional privacy.”

    ___

    This story has been corrected to say that Access Now says the hacking occurred from 2019 until last September, not from early 2020 until last November.

    [ad_2]

    Source link

  • Tech leaders to testify on social media safety for kids

    Tech leaders to testify on social media safety for kids

    [ad_1]

    Tech leaders to testify on social media safety for kids – CBS News


    Watch CBS News



    CEOs from five of the biggest tech companies are set to testify on what they’re doing to protect children who use their social media platforms. Jo Ling Kent speaks to a woman whose daughter died by suicide following sexual exploitation by online predators.

    Be the first to know

    Get browser notifications for breaking news, live events, and exclusive reporting.


    [ad_2]

    Source link

  • Russian hacking group accessed Microsoft executive emails, company says

    Russian hacking group accessed Microsoft executive emails, company says

    [ad_1]

    Microsoft Corp. said Friday a Russian hacking group illegally gained access to some of its top executives’ email accounts.

    In a regulatory filing, the software giant
    MSFT,
    +1.22%
    said a group called Nobelium was responsible for the attack.

    In late November, the group accessed “a legacy non-production test tenant account and [gained] a foothold, and then used the account’s permissions to access a very small percentage of Microsoft corporate email accounts, including members of our senior leadership team and employees in our cybersecurity, legal, and other functions, and exfiltrated some emails and attached documents,” Microsoft’s Security Response Center wrote in a blog post.

    Microsoft’s senior leadership team, which includes Chief Financial Officer Amy Hood and President Brad Smith, routinely meets with Chief Executive Satya Nadella.

    The company reported that there were no signs Nobelium had obtained customer data, production systems or proprietary source code.

    A Microsoft spokesperson provided this comment late Friday: “Our security team recently detected an attack on our corporate systems attributed to the Russian state-sponsored actor Midnight Blizzard. We immediately activated our response process to investigate, disrupt malicious activity, mitigate the attack, and deny the threat actor further access. The attack was not the result of a vulnerability in Microsoft products or services. To date, there is no evidence that the threat actor had any access to customer environments, production systems, source code, or AI systems. More information is available in our blog.”

    Nobelium, also known as APT29 or Cozy Bear, is a shadowy hacking group that attempted to crack the systems of the U.S. Defense Department and did breach the Democratic National Committee’s systems in 2016.

    Netskope Threat Labs, which tracks Nobelium, said the hacking group uses a variety of techniques to compromise accounts, including compromised Azure AD accounts to collect victim emails. “This hack underscores the importance of securing corporate email accounts, even those in non-production and test environments,” a Netskope spokesperson said. “Even if the email account isn’t regularly used or doesn’t contain anything sensitive, it can still be used to launch additional attacks.”

    Microsoft’s disclosure comes amid new U.S. requirements to report cybersecurity incidents.

    [ad_2]

    Source link

  • 1/17: CBS Evening News

    1/17: CBS Evening News

    [ad_1]

    1/17: CBS Evening News – CBS News


    Watch CBS News



    Dangerous cold snap continues to grip U.S.; Family of teen who died by suicide warns of dangers of financial sextortion

    Be the first to know

    Get browser notifications for breaking news, live events, and exclusive reporting.


    [ad_2]

    Source link

  • GTA Hacker Gets Life Sentence for Stealing $10 Million Data | Entrepreneur

    GTA Hacker Gets Life Sentence for Stealing $10 Million Data | Entrepreneur

    [ad_1]

    Arion Kurtaj’s joyride as a Grand Theft Auto (GTA) criminal appears to have crashed and burned.

    The 18-year-old hacker from Oxfordshire, UK, played a crucial role in the Lapsus$ group — an international cybercrime syndicate that inflicted nearly $10 million in damages to several high-profile tech companies, including Uber, Nvidia, and Rockstar Games (the company that makes GTA), according to the BBC.

    Kurtaj’s most infamous crime was breaching Rockstar while in police custody and releasing 90 clips of unreleased Grand Theft Auto 6 footage.

    Despite being on bail for hacking Nvidia and having his laptop confiscated, Kurtaj still managed to break into Rockstar’s servers from a Travelodge motel, using an Amazon Firestick, the hotel TV, and a mobile phone.

    He then broke into the company’s internal Slack with a warning, “If Rockstar does not contact me on Telegram within 24 hours, I will start releasing the source code.”

    Related: Cyber Attacks Are On the Rise — Here’s How Your Business Can Continuously Prepare for Threats

    Autism cited

    Kurtaj has severe autism and was reportedly quite violent in custody, injuring people and damaging property. The severity of his disorder led to the court’s decision to confine him to a secure medical facility indefinitely.

    According to a mental health assessment, he “continued to express the intent to return to cyber-crime as soon as possible. He is highly motivated.”

    In contrast, a 17-year-old Lapsus$ member, whose identity remains protected, was issued an 18-month Youth Rehabilitation Order. Both youths stand as the first convicted members of the Lapsus$ gang. Other suspects remain at large.

    Kurtaj’s defense team argued that the success of the recently released GTA 6 trailer, with over 128 million views in just four days, signaled minimal harm to Rockstar Games.

    But Judge Patricia Lees said extensive damage was done to the actual victims of the group’s numerous cyber attacks. In addition to Rockstar Games having to pay Lapsus$ $5 million to recover its data, other hacks by Lapsus$ involved threatening communications sent to thousands of cell phone customers and stealing money from cryptocurrency wallets.

    “This case serves as an example of the dangers that young people can be drawn towards whilst online and the serious consequences it can have for someone’s broader future,” said Detective Chief Superintendent Amanda Horsburgh from the City of London Police.

    Related: Comcast Xfinity Hackers Stole Personal Information From More Than 35 Million Customers, the Company Says

    [ad_2]

    Jonathan Small

    Source link

  • A suspected cyberattack paralyzes the majority of gas stations across Iran

    A suspected cyberattack paralyzes the majority of gas stations across Iran

    [ad_1]

    TEHRAN, Iran — Nearly 70% of Iran’s gas stations went out of service on Monday following possible sabotage — a reference to cyberattacks, Iranian state TV reported.

    The report said a “software problem” caused the irregularity in the gas stations. It urged people not to rush to the stations that were still operational.

    Israeli media, including the Times of Israel, blamed the problem on an attack by a hacker group dubbed “Gonjeshke Darande” or predatory sparrow.

    State TV quoted a statement by the Oil Ministry as saying more than 30% of gas stations remain in service. The country has some 33,000 gas stations.

    In recent years, Iran has seen a series of cyberattacks on its filling stations, railway system and industries. Surveillance cameras in government buildings, including prisons, have also been hacked in the past.

    In 2022, the Gonjeshke Darande group hacked a major steel company in the southwest of the country. A cyberattack on Iran’s fuel distribution system in 2021 paralyzed gas stations across the country, leading to long lines of angry motorists. The hacking group claimed responsibility for the attack on fuel pumps.

    The country disconnected much of its government infrastructure from the internet after the Stuxnet computer virus — widely believed to be a joint U.S.-Israeli creation — disrupted thousands of Iranian centrifuges in the country’s nuclear sites in the late 2000s.

    Iran, long sanctioned by the West, faces difficulties in getting up-to-date hardware and software, often relying on Chinese-manufactured electronics or older systems no longer being patched by manufacturers. That would make it easier for a potential hacker to target. Pirated versions of Windows and other software are common across Iran.

    [ad_2]

    Source link

  • Kansas courts' computer systems are starting to come back online, 2 months after cyberattack

    Kansas courts' computer systems are starting to come back online, 2 months after cyberattack

    [ad_1]

    TOPEKA, Kan. — The court system in Kansas has started bringing its computer system for managing cases back online, two months after a foreign cyberattack forced officials to shut it down along with public access to documents and other systems, the judicial branch announced Thursday.

    The case management systems for district courts in 28 of the state’s 105 counties are expected to be back online by Monday, with others following by the end of the week. Online access to documents for the public will be restored after that, though counties that go back online will be able to offer access through terminals at their courthouses, the judicial branch said.

    The courts also have restored systems that allow people to apply for marriage licenses online and file electronic requests for orders to protect them from abuse, stalking and human trafficking.

    The Kansas Supreme Court’s seven justices, who oversee administration of the state courts, said last month that the judicial branch was the victim of a “sophisticated foreign cyberattack.” Criminals stole data and threatened to post it on a dark website “if their demands were not met,” the justices said.

    However, judicial branch officials have not publicly disclosed the hackers’ demands, whether a ransom was paid or how much the state has spent in restoring judicial branch systems. Asked about a ransom Thursday, judicial branch spokesperson Lisa Taylor referred to last month’s statement.

    “Restoring our district court case management system is a much-anticipated milestone in our recovery plan, but we still have a lot of work to do,” Supreme Court Chief Justice Marla Luckert said in a statement Thursday.

    The outages affected the courts in 104 counties — all but the state’s most populous one, Johnson County in the Kansas City area. Johnson County has its own systems and isn’t scheduled to join the state’s systems until next year.

    The judicial branch initially described the attack as a “security incident,” but cybersecurity experts said that it had the hallmarks of a ransomware attack — including in how court officials gave few details about what happened.

    The long outage has forced courts in the affected counties to return to having documents filed on paper. Judicial branch officials acknowledged that it could take weeks for the courts to electronically log all of the filings since the Oct. 12 shutdown.

    The electronic filing and case management systems for the state Court of Appeals and Supreme Court will come back online after the district courts are done.

    A risk assessment of the state’s court system, issued in February 2022, is kept “permanently confidential” under state law, as is one issued in June 2020.

    Last month, state Rep. Kyle Hoffman, the chair of the Legislature’s information technology committee, told reporters after a meeting that the results of the 2020 audit were terrible, but he provided no details. He said the 2022 audit showed a lot of improvement, again without disclosing any details.

    Two recent audits of other state agencies identified cybersecurity weaknesses. The most recent one, released in July, said “agency leaders don’t know or sufficiently prioritize their IT security responsibilities.”

    [ad_2]

    Source link

  • Inside the police force scouring the internet to save abused children

    Inside the police force scouring the internet to save abused children

    [ad_1]

    EUROPOL HEADQUARTERS, THE HAGUE — “Please knock. Do not enter,” said the sign on the door of Europe’s heavily-secured law enforcement headquarters in the Netherlands.

    Inside, detectives were staring at their computers, examining a video of a newborn girl being molested. 

    A group of international detectives was trying to identify details — a toy, a clothing label, a sound — that would allow them to rescue the girl and arrest those who sexually abused her, recorded it and then shared it on the internet.

    Even a tiny hint could help track down the country where the baby girl was assaulted, allowing the case to be transferred to the right police authority for further investigation. Such details matter when police are trying to tackle crimes carried out behind closed doors but disseminated online across the world.

    Finding and stopping child sex offenders is gruesome and frustrating most of the time — yet hugely rewarding sometimes — police officers part of the international task force at the EU agency Europol told POLITICO. 

    Offenders are getting better at covering their digital tracks and law enforcement officials say they don’t have the tools they need to keep up. The increasing use of encrypted communication online makes investigators’ work harder, especially as a pandemic that kept people at home and online ramped up a flood of abuse images and videos.

    In 2022, social media giant Meta Platforms found and reported 26 million images on Facebook and Instagram. Teenagers’ favorite apps Snapchat and TikTok respectively filed over 550,000 and nearly 290,000 reports to the U.S. National Center for Missing and Exploited Children, an organization acting as a clearing house under U.S. law for child sexual abuse material (CSAM) content that technology firms detect and spot.

    The European Commission in December also ordered Meta to explain what it was doing to fight the spread of illegal sexual images taken by minors themselves and shared through Instagram, under the EU’s new content-moderation rulebook, the Digital Services Act (DSA).

    Politicians across the world are keen to act. In the European Union and the United Kingdom, legislators have drafted laws to dig up more illegal content and extend law enforcement’s powers to crack down on child sexual abuse material.

    But those efforts have ignited a fierce public debate on what takes precedence: granting police new abilities to go after offenders or preserving privacy and protections against states’ and digital platforms’ mass online surveillance.

    The scale of the problem

    The Europol task force has met twice a year since 2014 to accelerate investigations to identify victims, most recently in November. It has almost tripled in size to 33 investigators representing 26 countries including Germany, Australia and the United States. 

    “You might recognize things that are in the images or you might recognize the sounds in the background or the voices. If you do that together with multiple nationalities in one room, it can be really effective,” said Marijn Schuurbiers, head of operations at Europol’s European Cybercrime Centre (EC3).

    Still, too often detectives feel like they’re swimming against the tide, as the amount of child sexual abuse material circulating online surges.

    Europol created a database in 2016 and this system now holds 85 million unique photos and videos of children, many found on pedophile forums on the “dark web” — the part of the internet that isn’t publicly searchable and requires special software to browse.

    “We can work hours and hours on end and we’re still scratching the surface. It’s terrifying,” said Mary, a national police officer from a non-EU country with 17 years of experience. She requested not to use her last name to protect her identity while doing investigative work. 

    The task force in November went through 432 files, each containing tens of thousands of images, and found the most likely country for 285 of the children abused in the images. Police believe it likely identified 74 of the victims, three of whom were rescued by the time of publication. Two offenders were arrested. 

    “We have some successes. But all I can see is those we can’t help,” Mary said. 

    Many Western agencies outside of the U.S. are restricted by privacy provisions in the software they use like facial recognition tools. They often have to make do with a mix of manual analysis and freely accessible tools they can get from the internet.

    “If you have like thousands or hundreds of thousands or even millions of pictures, it’s basically impossible to go manually through them, one by one,” said Schuurbiers. 

    Since 2017, the agency has regularly been asking for public help to identify objects in images like plastic bags and a logo on a school uniform. Europol said it has gotten 27,000 tips from internet sleuths including investigative outlet Bellingcat, some of which led to 23 kids being identified and five offenders being prosecuted.  

    Groups on the “dark web” remain the principal place where offenders share illegal content, according to Europol. 

    But police and child protection hotlines are seeing a growing number of images cropping up on popular and accessible platforms like Facebook, Instagram, Snapchat and Instagram. The pandemic made this worse as more children and teenagers also joined social media and gaming websites where offenders got better at grooming victims and blackmailing them into making sexual content.

    Law enforcement agencies around the world have also sounded the alarm that offenders are also connecting with minors and exchanging illegal content on encrypted messaging apps like WhatsApp, Signal and iMessage, making it extremely challenging to find the content. WhatsApp, for instance, scans the photos and descriptions users but is unable to monitor their highly secure messages.

    Finding more child sexual abuse material

    The crisis of child sexual abuse material proliferating online has got governments pushing through sweeping new legislation to make it possible for law enforcement to investigate more online material and use artificial intelligence tools to help them. 

    The European Commission has proposed a law that could force tech companies like Meta, Apple and Google to scan messages and content stored in the cloud for images of abuse — and even for conversations of offenders seeking to manipulate minors upon a judge’s order. The companies would have to report the content, so it could end up with Europol or other national investigators, and then remove it.

    The United Kingdom recently passed the Online Safety Act, which some legal experts say would allow the country’s platform regulator Ofcom to force companies to break encryption to find sexual abuse. Government and Ofcom officials have said companies would not currently be forced to monitor content because tools to bypass encryption and also preserve privacy do not exist at the moment.

    Both plans have sparked widespread backlash among digital rights activists, tech experts and some lawyers. They fear the laws effectively force tech firms to ditch encryption, and that indiscriminate scanning will lead to mass surveillance.

    Negotiations on the EU draft law remain on thin ice, with politicians and member countries clashing over how far to go in hunting down potential illegal child abuse. And Brussels also finalized in December a new law, the Artificial Intelligence Act, governing how law enforcement will be able to use AI tools like facial recognition software to go through footage and images. 

    Still, EU lawmakers have already significantly expanded Europol’s powers to build new artificial intelligence tools and handle more data. Under the Digital Services Act, Europol and national police will also be able to swiftly compel tech companies to remove publicly accessible illegal content and hand over information about users posting such images.

    Anne, a Europol investigator, said she doesn’t keep count of the number of kids she’s identified in her 12 years working in the field — but she remembers them. She requested not to use her last name to protect her investigative work.

    “The thing that I will always remember from my cases is the images,” she said. “They stay in my head.”

    [ad_2]

    Clothilde Goujard

    Source link

  • Top White House cyber aide says recent Iran hack on water system is call to tighten cybersecurity

    Top White House cyber aide says recent Iran hack on water system is call to tighten cybersecurity

    [ad_1]

    WASHINGTON — A top White House national security official said recent cyber attacks by Iranian hackers on U.S. water authorities — as well as a separate spate of ransomware attacks on the health care industry — should be seen as a call to action by utilities and industry to tighten cybersecurity.

    Deputy national security adviser Anne Neuberger said in an interview on Friday that recent attacks on multiple American organizations by the Iranian hacker group “Cyber Av3ngers” were “unsophisticated” and had “minimal impact” on operations. But the attacks, Neuberger said, offered a fresh warning that American companies and operators of critical infrastructure “are facing persistent and capable cyber attacks from hostile countries and criminals” that are not going away.

    “Some pretty basic practices would have made a big difference there,” said Neuberger, who serves as a top adviser to President Joe Biden on cyber and emerging technology issues. “We need to be locking our digital doors. There are significant criminal threats, as well as capable countries — but particularly criminal threats — that are costing our economy a lot.”

    The hackers, who U.S. and Israeli officials said are tied to Tehran’s Islamic Revolutionary Guard Corps, breached multiple organizations in several states including a small municipal water authority in the western Pennsylvania town of Aliquippa. The hackers said they were specifically targeting organizations that used programmable logic controllers made by the Israeli company Unitronics, commonly used by water and water treatment utilities.

    Matthew Mottes, the chairman of the Municipal Water Authority of Aliquippa, which discovered it had been hacked on Nov. 25, said that federal officials had told him the same group also breached four other utilities and an aquarium.

    The Aliquippa hack prompted workers to temporarily halt pumping in a remote station that regulates water pressure for two nearby towns, leading crews to switch to manual operation.

    The hacks, which authorities said began on Nov. 22, come as already fraught tensions between the U.S. and Iran have been heightened by the two-month-old Israel-Hamas war. The White House said that Tehran has supported Houthi rebels in Yemen who have carried out attacks on commercial vessels and have threatened U.S. warships in the Red Sea.

    Iran is the chief sponsor of both Hamas, the militant group which controls Gaza, as well as the Houthi rebels in Yemen.

    The U.S. has said they have uncovered no information that Iran was directly involved in Hamas’ Oct. 7 attack on Israel that triggered the massive retaliatory operation by Israeli Defense Forces in Gaza. But the Biden administration is increasingly voicing concern about Iran attempting to broaden the Israeli-Hamas conflict through proxy groups and publicly warned Tehran about the Houthi rebels’ attacks.

    “They’re the ones with their finger on the trigger,” White House national security adviser Jake Sullivan told reporters earlier this week. “But that gun — the weapons here are being supplied by Iran. And Iran, we believe, is the ultimate party responsible for this.”

    Neuberger declined to comment on whether the recent cyber attack by the Iranian hacker group could portend more hacks by Tehran on U.S. infrastructure and companies. Still, she said the moment underscored the need to step up cybersecurity efforts.

    The Iranian “Cyber Av3ngers” attack came after a federal appeals court decision in October prompted the EPA to rescind a rule that would have obliged U.S public water systems to include cybersecurity testing in their regular federally mandated audits. The rollback was triggered by a federal appeals court decision in a case brought by Missouri, Arkansas and Iowa, and joined by a water utility trade group.

    Neuberger said that measures spelled out in the scrapped rule to beef up cybersecurity for water systems could have “identified vulnerabilities that were targeted in recent weeks.”

    The administration, earlier this year, unveiled a wide-ranging cybersecurity plan that called for bolstering protections on critical sectors and making software companies legally liable when their products don’t meet basic standards.

    Neuberger also noted recent criminal ransomware attacks that have devastated health care systems, arguing those attacks spotlight the need for government and industry to take steps to tighten cyber security.

    A recent attack targeting Ardent Health Services prompted the health care chain that operates 30 hospitals in six states to divert patients from some of its emergency rooms to other hospitals while postponing certain elective procedures. Ardent said it was forced to take its network offline after the Nov. 23 cyberattack.

    A recent global study by the cybersecurity firm Sophos found nearly two-thirds of health care organizations were hit by ransomware attacks in the year ending in March, double the rate from two years earlier but dipping slightly from 2022.

    “The president’s made it a priority. We’re pushing out actionable information. We’re pushing out advice,” Neuberger said. “And we really need the partnership of state and local governments and of companies who are operating critical services to take and implement that advice quickly.”

    —

    Associated Press writers Frank Bajak in Boston and Marc Levy in Harrisburg, Pa., contributed reporting.

    [ad_2]

    Source link

  • Cybersecurity Attacks Are On the Rise — Is Your Business Prepared? | Entrepreneur

    Cybersecurity Attacks Are On the Rise — Is Your Business Prepared? | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    In the ever-evolving landscape of cybersecurity threats, the traditional castle-and-moat approach is proving increasingly inadequate. The global average data breach cost in 2023 was $4.45 million. Compared with 2020, this is a 15% increase. Organizations must fortify their defenses with proactive and comprehensive strategies as cyber adversaries grow more sophisticated. In this era of uncertainty, the key to resilience lies in continuous monitoring.

    Related: The World is Doubling Down on Cybersecurity — Here’s What Business Leaders Should Know

    Understanding the value of continuous monitoring

    At its core, continuous monitoring is not just a tool but a mindset — a proactive and comprehensive approach to cybersecurity. It transcends the reactive measures of the past, emphasizing continuous data collection, analysis and correlation. It is also not a one-time event but a perpetual vigilance system that allows organizations to stay one step ahead of cyber adversaries.

    The primary benefit, of course, is identifying threats early on. Furthermore, employing advanced analytics and machine learning helps go beyond signature-based detection and recognize anomalies that may indicate potential threats. This proactive stance is crucial in the dynamic landscape of cyber threats, where speed is often the differentiator between containment and catastrophe.

    When breaches occur, and they inevitably will, the monitoring system plays a pivotal role in isolating compromised systems and containing malware. This containment strategy limits the blast radius of an attack, preventing the spread of malicious entities within the network. In the aftermath of a breach, the ability to swiftly and effectively mitigate the impact is a testament to the resilience afforded by continuous monitoring.

    Related: 4 Ways Continuous Learning Will Make You and Your Business Unstoppable

    Knowing is half the battle, especially in the realm of cybersecurity. Continuous monitoring gives organizations valuable insights into attacker tactics, techniques and procedures (TTPs). Organizations can strengthen their security controls and create an adaptive defense architecture by understanding how adversaries operate.

    Beyond resilience, in an era of stringent regulations and compliance standards, monitoring is crucial in demonstrating adherence to industry guidelines. By providing continuous visibility into security postures and monitoring activities, organizations can proactively address compliance requirements, avoiding the pitfalls of non-compliance.

    Finally, the financial burden of cyberattacks extends far beyond immediate remediation costs. Minimizing the impact of breaches and optimizing incident response significantly reduces the overall economic toll of cyber incidents. It transforms cybersecurity from a necessary expense into a strategic investment that safeguards data and the bottom line.

    Executing continuous monitoring in your organization

    To offer complete visibility, a comprehensive monitoring plan should consider every endpoint, network, and software your company utilizes. As such, the first step is assessing every asset within the corporate network. However, not all assets are equal. Prioritizing monitoring efforts is essential to protect the most valuable information. Allowing organizations to focus their resources where they matter most helps create a targeted defense that fortifies the digital crown jewels.

    A monitoring architecture should also include an incident response plan. Due to its ability to allow organizations to record, respond, and learn from cyberattacks, incident reporting is essential. Facilitating the development of well-defined incident response procedures ensures that organizations can react swiftly and decisively to mitigate potential damage when a threat is detected.

    Selecting the most suitable technology and monitoring tools is a crucial choice. To have complete visibility, the monitoring architecture established must account for every attack vector that can be used to launch a cyberattack. Considering the expanding nature of today’s attack surface, choosing the right tools is paramount.

    For instance, most enterprises start with a Security Information and Event Monitoring Tool (SIEM), followed by Endpoint Detection and Response (EDR) and a Unified Endpoint Management (UEM) solution. SIEM searches for patterns that make it easier for security teams to recognize attacks, breaches, and technical problems. An EDR, on the other hand, collects data from each endpoint and uses AI to determine threats.

    While on the outside, both SIEM and EDR offer visibility, EDRs focus on endpoints, and SIEM covers the entire network. However, EDR offers deeper capabilities regarding incident response, allowing security teams to fight back. UEMs, on the other hand, utilize their remote capabilities to keep track of device compliance. Furthermore, non-compliant devices, once identified, can be flagged and managed remotely. With new national and international regulations emerging, the consequences of non-compliance are grave indeed.

    The chosen tools must seamlessly integrate into the existing cybersecurity ecosystem, whether it’s network monitoring, endpoint monitoring or threat intelligence platforms. For example, selecting a SIEM with data loss prevention or a UEM with patch management capabilities saves IT teams from managing multiple platforms.

    Finally, let’s say you have implemented a reliable architecture. This, however, is not the end. There are always fresh risks to be aware of in the evolving field of cybersecurity. To respond to changing threats, continual improvement and refining are necessary. Regular reviews and updates ensure that the watchtower remains vigilant and resilient in the ever-changing cyber threat landscape.

    Last but not least — your employees. An issue with complex tools like SIEMs is that they require skilled security professionals to manage. Beyond security professionals, each employee must be updated on the latest cyber threats and attack vectors through regular workshops and training sessions. Knowing how criminals breach security will help them notice the minute details and signs that could help them identify a breach. Moreover, it also impacts how well they respond to a cybersecurity dilemma.

    Going forward

    As cyber threats become more sophisticated, the significance of continuous security monitoring continues to grow. It is not an exaggeration to portray it as a vital tool for businesses looking to safeguard their assets and ensure business continuity — in fact, doing so is a strategic requirement. The agility and responsiveness afforded by continuous monitoring are the building blocks of a resilient cybersecurity strategy in an age where digital disruption is the norm.

    [ad_2]

    Apu Pavithran

    Source link

  • Deepfakes are Lurking in 2024 — Here's How to Unmask Them | Entrepreneur

    Deepfakes are Lurking in 2024 — Here's How to Unmask Them | Entrepreneur

    [ad_1]

    Opinions expressed by Entrepreneur contributors are their own.

    As artificial intelligence (AI) takes the world by storm, one particular facet of this technology has left people in both awe and apprehension. Deepfakes, which are synthetic media created using artificial intelligence, have come a long way since their inception. According to a survey by iProov, 43% of global respondents admit that they would not be able to tell the difference between a real video and a deepfake.

    As we navigate the threat landscape in 2024, it becomes increasingly vital to understand the implications of this technology and the measures to counter its potential misuse.

    Related: Deepfakes Are on the Rise — Will They Change How Businesses Verify Their Users?

    The evolution of deepfake technology

    The trajectory of deepfake technology has been nothing short of a technological marvel. Deepfakes were characterized by relatively crude manipulations in their infancy, often discernible due to subtle imperfections. These early iterations, though intriguing, lacked the finesse that would later become synonymous with the term “deepfake.”

    As we navigate the technological landscape of 2024, the progression of deepfake sophistication is evident. This evolution is intricately tied to the rapid advancements in machine learning. The algorithms powering deepfakes have become more adept at analyzing and replicating intricate human expressions, nuances, and mannerisms. The result is a generation of synthetic media that, at first glance, can be indistinguishable from authentic content.

    Related: ‘Biggest Risk of Artificial Intelligence’: Microsoft’s President Says Deepfakes Are AI’s Biggest Problem

    The threat of deepfakes

    This heightened realism in deepfake videos is causing a ripple of concern throughout society. The ability to create hyper-realistic videos that convincingly depict individuals saying or doing things they never did has raised ethical, social, and political questions. The potential for these synthetic videos to deceive, manipulate, and mislead is a cause for genuine apprehension.

    Earlier this year, Google CEO Sundar Pichai warned people about the dangers of AI content, saying, “It will be possible with AI to create, you know, a video easily. Where it could be Scott saying something or me saying something, and we never said that. And it could look accurate. But you know, on a societal scale, you know, it can cause a lot of harm.”

    As we delve deeper into 2024, the realism achieved by deepfake videos is pushing the boundaries of what was once thought possible. Faces can be seamlessly superimposed onto different bodies, and voices can be cloned with uncanny accuracy. This not only challenges our ability to discern fact from fiction but also poses a threat to the very foundations of trust in the information we consume. A report by Sensity shows that the number of deepfakes created has been doubling every six months.

    The impact of hyper-realistic, deepfake videos extends beyond entertainment and can potentially disrupt various facets of society. From impersonating public figures to fabricating evidence, the consequences of this technology can be far-reaching. The notion of “seeing is believing” becomes increasingly tenuous, prompting a critical examination of our reliance on visual and auditory cues as markers of truth.

    In this era of heightened digital manipulation, it becomes imperative for individuals, institutions, and technology developers to stay ahead of the curve. As we grapple with these advancements’ ethical implications and societal consequences, the need for robust countermeasures, ethical guidelines, and a vigilant public becomes more apparent than ever.

    Related: Deepfakes Are on the Rise — Will They Change How Businesses Verify Their Users?

    Countermeasures and prevention strategies

    Governments and industries globally are not mere spectators in the face of the deepfake menace; they have stepped onto the battlefield with a recognition of the urgency that the situation demands. According to reports, the Pentagon, through the Defense Advanced Research Projects Agency (DARPA), is working with several of the country’s biggest research institutions to get ahead of deepfakes. Initiatives aimed at curbing the malicious use of deepfake technology are currently in progress, and they span a spectrum of strategies.

    One front in this battle involves the development of anti-deepfake tools and technologies. Recognizing the potential havoc that hyper-realistic synthetic media can wreak, researchers and engineers are tirelessly working on innovative solutions. These tools often leverage advanced machine learning algorithms themselves, seeking to outsmart and identify deepfakes in the ever-evolving landscape of synthetic media. A great example of this is Microsoft offering US politicians and campaign groups an anti-deepfake tool ahead of the 2024 elections. This tool will allow them to authenticate their photos and videos with watermarks.

    Apart from that, industry leaders are also investing significant resources in research and development. The goal is not only to create more robust detection tools but also to explore technologies that can prevent the creation of convincing deepfakes in the first place. Recently, TikTok has banned any deepfakes of nonpublic figures on the app.

    However, it’s essential to recognize that the battle against deepfakes isn’t solely technological. As technology evolves, so do the strategies employed by those with malicious intent. Therefore, to complement the development of sophisticated tools, there is a need for public education and awareness programs.

    Public understanding of the existence and potential dangers of deepfakes is a powerful weapon in this fight. Education empowers individuals to critically evaluate the information they encounter, fostering a society less susceptible to manipulation. Awareness campaigns can highlight the risks associated with deepfakes, encouraging responsible sharing and consumption of media. Such initiatives not only equip individuals with the knowledge to identify potential deepfakes but also create a collective ethos that values media literacy.

    Related: ‘We Were Sucked In’: How to Protect Yourself from Deepfake Phone Scams.

    Navigating the deepfake threat landscape in 2024

    As we stand at the crossroads of technological innovation and potential threats, unmasking deepfakes requires a concerted effort. It necessitates the development of advanced detection technologies and a commitment to education and awareness. In the ever-evolving landscape of synthetic media, staying vigilant and proactive is our best defense against the growing threat of deepfakes in 2024 and beyond.

    [ad_2]

    Asim Rais Siddiqui

    Source link

  • 23andMe says hackers accessed 'significant number' of files about users' ancestry | TechCrunch

    23andMe says hackers accessed 'significant number' of files about users' ancestry | TechCrunch

    [ad_1]

    Genetic testing company 23andMe announced on Friday that hackers accessed around 14,000 customer accounts in the company’s recent data breach.

    In a new filing with the U.S. Securities and Exchange Commission published Friday, the company said that, based on its investigation into the incident, it had determined that hackers had accessed 0.1% of its customer base. According to the company’s most recent annual earnings report, 23andMe has “more than 14 million customers worldwide,” which means 0.1% is around 14,000.

    But the company also said that by accessing those accounts, the hackers were also able to access “a significant number of files containing profile information about other users’ ancestry that such users chose to share when opting in to 23andMe’s DNA Relatives feature.”

    The company did not specify what that “significant number” of files is, nor how many of these “other users” were impacted.

    23andMe did not immediately respond to a request for comment, which included questions on those numbers.

    In early October, 23andMe disclosed an incident in which hackers had stolen some users’ data using a common technique known as “credential stuffing,” whereby cybercriminals hack into a victim’s account by using a known password, perhaps leaked due to a data breach on another service.

    The damage, however, did not stop with the customers who had their accounts accessed. 23andMe allows users to opt into a feature called DNA Relatives. If a user opts-in to that feature, 23andMe shares some of that user’s information with others. That means that by accessing one victim’s account, hackers were also able to see the personal data of people connected to that initial victim.

    23andMe said in the filing that for the initial 14,000 users, the stolen data “generally included ancestry information, and, for a subset of those accounts, health-related information based upon the user’s genetics.” For the other subset of users, 23andMe only said that the hackers stole “profile information” and then posted unspecified “certain information” online.

    TechCrunch analyzed the published sets of stolen data by comparing it to known public genealogy records, including websites published by hobbyists and genealogists. Although the sets of data were formatted differently, they contained some of the same unique user and genetic information that matched genealogy records published online years earlier.

    The owner of one genealogy website, for which some of their relatives’ information was exposed in 23andMe’s data breach, told TechCrunch that they have about 5,000 relatives discovered through 23andMe, and said our “correlations might take that into account.”

    News of the data breach surfaced online in October when hackers advertised the alleged data of one million users of Jewish Ashkenazi descent and 100,000 Chinese users on a well-known hacking forum. Roughly two weeks later, the same hacker who advertised the initial stolen user data advertised the alleged records of four million more people. The hacker was trying to sell the data of individual victims for $1 to $10.

    TechCrunch found that another hacker on a different hacking forum had advertised even more allegedly stolen user data two months before the advertisement that was initially reported by news outlets in October. In that first advertisement, the hacker claimed to have 300 terabytes of stolen 23andMe user data, and asked for $50 million to sell the whole database, or between $1,000 and $10,000 for a subset of the data.

    In response to the data breach, on October 10, 23andMe forced users to reset and change their passwords and encouraged them to turn on multi-factor authentication. And on November 6, the company required all users to use two-step verification, according to the new filing.

    After the 23andMe breach, other DNA testing companies Ancestry and MyHeritage started mandating two-factor authentication.

    [ad_2]

    Lorenzo Franceschi-Bicchierai

    Source link

  • Bahrain government websites briefly inaccessible after cyberattack over Israel-Hamas war

    Bahrain government websites briefly inaccessible after cyberattack over Israel-Hamas war

    [ad_1]

    The websites of two government ministries in Bahrain have briefly became inaccessible after a cyberattack took them down, purportedly over the island kingdom’s stance on the ongoing Israel-Hamas war

    ByJON GAMBRELL Associated Press

    November 21, 2023, 10:39 AM

    This is a locator map for the Gulf Cooperation Council member states: Saudi Arabia, Bahrain, Qatar, Oman, Kuwait and United Arab Emirates. (AP Photo)

    The Associated Press

    DUBAI, United Arab Emirates — The websites of two government ministries in Bahrain briefly became inaccessible Tuesday night after a cyberattack took them down, purportedly over the island kingdom’s stance on the ongoing Israel-Hamas war.

    A statement posted online by a self-described group calling itself Al-Toufan, or “The Flood” in Arabic, claimed hacking the Foreign Ministry and the Information Affairs Ministry’s websites. Both later became accessible.

    Another statement included scans of passports for American citizens and a top Russian diplomat in Bahrain that allegedly came from the hack.

    The statement said the hacks came in retaliation for “the abnormal statements issued” by the island’s Al Khalifa ruling family, without elaborating. Bahrain’s Crown Prince Salman bin Hamad Al Khalifa opened a summit last week in the kingdom with a call for a swap between Hamas and Israel for the hostages and a halt in the bloodshed.

    A Bahrain government statement sent later Tuesday night to The Associated Press acknowledged that “a number of government agency websites have today been the target of malicious cyberattacks.”

    “The government of Bahrain has implemented a comprehensive cybersecurity strategy and framework to address such threats,” the statement said. “Government operations were unaffected by the attacks, and work is ongoing to restore access to the targeted websites.”

    In February, the self-described group issued a claim that it had taken down the websites of Bahrain’s international airport, state news agency and chamber of commerce to mark the 12-year anniversary of an Arab Spring uprising in the small Gulf country. The same shadowy self-described group targeted government websites during elections held last year that were boycotted by a banned Shiite opposition group and others.

    Bahrain reached a diplomatic recognition deal with Israel in 2020 alongside the United Arab Emirates. The island kingdom, home to the U.S. Navy’s 5th Fleet, has drawn repeated criticism from Iran, its regional arch rival, over that.

    ___

    Follow AP’s coverage at https://apnews.com/hub/israel-hamas-war

    [ad_2]

    Source link

  • How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

    How ransomware attack on ICBC rattled the Treasury market and shook up a 30-year bond auction

    [ad_1]

    It was a trading day unlike any other for traders in the $25 trillion Treasury market, with a 30-year bond auction seen as having been partially undermined by a cyberattack on the U.S. unit of a Chinese bank.

    In recapping Treasury’s poorly received $24 billion bond auction on Thursday, traders said the weaker-than-expected results likely had at least something to do with this week’s ransomware hit on the American arm of Industrial & Commercial Bank of China, known as ICBC. That attack reportedly caused disruptions across the market and had some impact on liquidity, with the Financial Times citing unnamed sources as saying hedge funds and asset managers were forced to reroute trades.

    Traders were grappling on Friday to answer the question of what created the sudden lack of interest at the auction, which went so badly that it also shook up U.S. stock investors. Thursday’s sale was the worst since November 2021, based on the extent to which primary dealers were forced to step in and pick up the slack in demand, one trader said. And it reinforced a recent pattern of weak auctions for the 30-year bond that may not bode well for future sales of that long-dated maturity.

    It’s possible that bonds simply “look much less attractive” following a recent “explosive rally” since late October, according to Charlie McElligott, a cross-asset macro strategist at Nomura Securities in New York. However, “this might be the case of ‘more than meets the eye’ to this ‘ugly auction evidencing low demand for duration’ story,” he wrote in a note.

    “One dynamic that makes yesterday’s ugly auction results murky was the ICBC cyberattack described across various financial media, which gunked-up anybody who clears UST trades through them, and made it so that many dealers were then likely unable to trade with those clients until resolved, on account of unsettled trades which weren’t able to be matched,” McElligott said.

    Adding to Thursday’s uncertainty was another random event. Federal Reserve Chairman Jerome Powell appeared on stage in an International Monetary Fund panel, was interrupted by a climate protester, and then uttered a seven-letter expletive that could be heard on the event’s livestream.

    Powell’s policy-related remarks, which indicated the central bank might take further action to control inflation, “didn’t help things and kind of spooked people again,” said John Farawell, head of municipal trading at New York bond underwriter Roosevelt & Cross.

    Read: Fed’s Powell Made Cryptic Comments. How He’s Guiding the Market.

    On Friday, the Treasury market found stabilization as buyers returned to segments of government debt in a sign that calm was being restored. A rush of buying was seen on the 30-year bond
    BX:TMUBMUSD30Y,
    sending its yield down to 4.733% and to a third straight weekly decline.

    Meanwhile, Bloomberg News reported that the repercussions of the ICBC cyberattack included an inability to deliver U.S. debt that was being pledged as collateral. ICBC’s U.S. unit was forced to rely on a messenger carrying a USB stick across Manhattan to complete disrupted trades, according to the news service, which also described Thursday’s $24 billion 30-year bond auction as one of the worst in a decade.

    The ICBC attack “might have had a dramatic impact on the auction. I don’t know how much, but I also can’t imagine it didn’t,” said Tom di Galoma, co-head of global rates trading for BTIG in New York. “When people see that there are trade-settlement issues, there’s a willingness to back off and that’s exactly what happened yesterday. Institutional accounts were saying, ‘We don’t know who is settling this trade.’ If the cyberattack hadn’t happened, I think the auction would have gone a lot better.”

    Ben Emons, a senior portfolio manager and head of fixed income for NewEdge Wealth in New York, said that once the Treasury market got upended by the ICBC cyberattack, the bad auction, and the interruption during Powell’s appearance, liquidity on U.S. government debt “was, for a moment, a dark matter.”

    [ad_2]

    Source link