ReportWire

Tag: Cybercrime

  • Are Your Business Partners Exposing You to Cyber Threats?

    Are Your Business Partners Exposing You to Cyber Threats?

    Opinions expressed by Entrepreneur contributors are their own.

    The cybersecurity business has become everyone’s business. It only takes one viral data breach to destroy a company’s social proof and send its clients running to rival organizations in search of safer conditions. IBM estimates that the average data breach this year costs affected businesses $4.35 million, a near 13% increase since 2020. That figure doesn’t include the sometimes irreversible harm to a company’s reputation.

    Headline-grabbing data leaks aren’t limited to credit card or identity information, however. These incidents encompass anything and everything having to do with private and personal details. If you submit a car loan application, you trust the prospective lender to be a good steward of your information. When your business does business with another company, you similarly expect the same level of security.

    Related: 3 Reasons Why Privacy Matters to Your Business, Your Brand and Your Future

    In the financial services world, we’re held to high standards of security where even the smallest misstep must be reported to several entities. Ours certainly isn’t the only industry facing tremendous expectations when it comes to prioritizing the importance of cybersecurity in business, either. It’s become mission-critical across the board.

    There can be a surprising upside to so much rigidity and concern, though. If you’re doing a great job and implementing the strongest, most reliable cybersecurity solutions for businesses, you have the opportunity to make your protocols a differentiator. When customers see “social proof” of something, they tend to trust what they see. Yet, you can’t tap into this social proof if you don’t control all your cybersecurity business elements, and that includes how proactive and protective your partners act with your shared data.

    Lowering risk exposure starts from the inside

    As mentioned above, we’re in the financial services world. To maintain our license, we must use advanced data encryption tools and technologies. Encryption is essential during the process of buying currency online because so much personal information moves back and forth, including a high degree of money-related data like bank routing numbers.

    We also must follow BSA/AML compliance guidelines to the letter, just like any financial institution. Therefore, we have a BSA compliance officer who handles all compliance coordination, monitoring and oversight. The BSA compliance officer serves as a critical player in assuring regulatory entities, board members, customers and the public that we’re doing what needs to be done when it comes to lowering our risk exposure.

    Opening a money service business like ours is difficult. After taking so many steps and performing intense due diligence, we’re understandably careful about the partners we choose. You should be, too, as one bad apple can ruin the entire bunch.

    Related: Five Ways to Protect Your Company Against Cyber Attacks

    Know exactly who you’re doing business with

    All companies — especially MSBs, or money service businesses — need to be vigilant and put strategies in play to reduce the chances of a breach. A lot goes into building such a comprehensive, cohesive protection plan. Running online business transactions on a private server and implementing data encryption processes are the minimum requirements to get off the ground, but that’s just the start.

    Beyond those necessary action items, companies of all sizes should consider leveraging the following methods to make certain that anyone with access to even a sliver of your data believes in safety as strongly as you do:

    1. Vet each partner on basic compliance

    Foundational elements to review thoroughly include having up-to-date security certificates, performing detailed security audits, using a VPN to fully protect browsing data and getting federal agency approval when necessary. If a potential partner is cutting compliance corners — intentionally or otherwise — you’d be better off continuing the search until all of your concerns are alleviated. Don’t settle for less than the best.

    It’s important to treat each potential partner with the same level of due diligence, as threats and attacks can come from small startups and big corporations alike. The Verizon Business 2022 Data Breach Investigations Report found that 62% of “system intrusion” incidents originated with an organization’s partner. And the Ponemon Institute reported that 54% of organizations were “not monitoring the security and privacy practices of third parties that they share sensitive or confidential information with on an ongoing basis.”

    That’s hugely concerning. Opportunistic cybercriminals are always looking for the weakest link in the supply chain, after all.

    2. Check for third-party verification

    In the complicated digital reality we all live in, honesty can be at a premium. This can be especially true when verifying the real identity of a person — or the motives of a potential vendor. Enter third-party providers who use a variety of tactics to drill down to the actual, accurate identities of customers who might attempt to make a financial transaction or businesses that want to join forces. These third-party testers do the thankless work of monitoring platform security and infiltration.

    My company, Xchange of America, uses a third-party verification service to authenticate customer identities by specific inputs. A series of four random verification questions that only the true person would know are asked, such as the make and model of previous vehicle(s) owned, street names where the customer previously lived and previous employer(s). Confirming these unique details keeps nefarious actors at bay and prevents sales fraud.

    Different industries will perform third-party verifications differently than ours, but the importance is the same for every company. Do your partners employ thorough third-party verification tactics? Stipulate that they do.

    Related: Authentication Technology is Shaping Vendor Partner Verification and Onboarding

    3. Demand full transparency

    What happens if you start to ask questions of your partners and run into brick walls? This may be an indication that they’re not being forthright. You want partners who welcome questions because they have nothing to hide. For example, all money service businesses like ours must be registered and licensed in the states we operate in. If a potential partner is required to have certain registrations, licenses or permits and doesn’t, that’s a major red flag.

    Be persistent when it comes to getting the compliance answers you seek. Don’t be hesitant to ask pointed follow-up questions, such as how data encryption works at a partner’s company. Data breaches can be thwarted if information is always encrypted, whether it’s in motion or in storage.

    Dropbox is an example of a company that takes data encryption (and protection) seriously. According to Dropbox’s help center, files at rest are encrypted using 256-bit Advanced Encryption Standard (AES). The company also uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS) to protect data in transit between Dropbox apps and its servers, among many other layers of protection.

    Related: Cybersecurity Trends and Drivers in 2022

    You deserve to know the level of data encryption of any associated organization, not just that they have “some kind of encryption.” Dropbox’s transparency in that regard should serve as the rule, not the exception.

    As long as cybercriminals are willing to hack into systems, corporate leaders and their teams must find and remove their cybersecurity vulnerabilities. Just make sure that you’re not just looking at ways to improve your own cybersecurity. Insist that all companies you do business with also treat it as a pressing priority.

    Robert Hoffman

    Source link

  • Consumer and Expert Survey Reveals: No Country is Good at Fighting Online Scams

    Consumer and Expert Survey Reveals: No Country is Good at Fighting Online Scams

    Press Release
    –

    Dec 8, 2022 14:00 CET


    AMSTERDAM, December 8, 2022 (Newswire.com)
    –
    The Global Anti Scam Alliance and ScamAdviser.com interviewed both 200 cybercrime experts as well as 4,430 consumers to determine which country is the best at fighting online scams. In short: it seems no country really deserves to be called “Best Scam Fighting Country of the World”. 

    The 200 experts, in general, believe their country is doing nothing (35%) or only a bit (48%). Only 7% consider their nation the best at fighting scams.  

    The 4,430 consumers likewise rated the performance of their country poorly. Remarkably, the top three best-performing countries are all developing nations: Indonesia, Bangladesh, and the Philippines. Consumers from Indonesia were the only ones who gave their country a “sufficient” 6.1 out of 10. The United Kingdom is listed in fifth place, followed by Canada and the USA falls in eleventh place. 

    Consumers could also rate their country on different aspects of scam fighting, including: 

    • Awareness building
    • Offering tools to identify scams
    • Ease of scam reporting
    • Enforcement of scammers

    The scoring differs little per category. Indonesia, Bangladesh, and the Philippines are listed each time in the top three. Australia was given a 5.9 for ‘Ease of scam reporting’, owning second place in this category with Indonesia rated as #1 and Bangladesh and the Philippines sharing third place. 

    The survey participants listed several reasons for the general poor scoring of their countries. When asked how their country can improve, five main areas for improvement were named.

    The first focuses on building more scam awareness, especially via mass media such as TV and radio. Consumers especially want to see more concrete examples of the latest kinds of scams. 

    A second improvement often named is offering consumers more tools to identify or block scams, be it via phone (especially robocalls), email or websites. While in some countries commercial tools are being offered, not all participants stated having the financial resources to buy these or they believe that these should be offered by the government to protect all citizens. 

    Easier and more centralized reporting of scams is likewise often named. Several respondents stated that reporting of scams cannot be done online in their country. They feel that the police focus on protecting businesses and rich citizens. Some report being laughed at by the police or being told that it is their own fault.  

    The fourth action named is more strict, international legislation. Many participants call for a global dedicated police force combating online scams, especially regarding cryptocurrency schemes.  

    Finally, consumers state that social media should be held more accountable for advertisements of scammers. The same applies to banks. Finally, hosting companies and registrars should be named and shamed more publicly for supporting and even protecting scam sites, or be forced to apply to Know Your Customer (KYC) processes. 

    The full report can be found on GASA and ScamAdviser.

    Source: Global Anti Scam Alliance

    Source link

  • Ransomware group Vice Society targeted dozens of schools in 2022, new report finds

    Ransomware group Vice Society targeted dozens of schools in 2022, new report finds

    More than 40 educational organizations, including 15 in the United States, suffered ransomware attacks launched by the cybercriminal group known as Vice Society, researchers at cybersecurity firm Palo Alto Networks revealed in a report published Tuesday and obtained by CBS News.

    Researchers from Palo Alto Network’s threat research team, Unit 42, found that hackers targeted the United States in the largest numbers – followed by the United Kingdom, Spain, France, Brazil, Germany and then Italy.

    The report tracked how the group, which first surfaced in the summer of 2021, uses a double-extortion playbook. Not only does the consortium of cybercriminals hold data hostage for a hefty fee, but it also threatens to leak the data online.

    “Education is so vulnerable to this type of attack because oftentimes organizations don’t have the best cybersecurity in place and the best funding for it,” said Ryan Olson, vice president of threat intelligence at Palo Alto Networks. “Schools can’t compete with a bank or a tech company as far as what they can buy and deploy, and that means that a threat actor who gets into that network is facing a lot less, a lot fewer barriers to go in and launch their attack.

    The threat actors have been on the radar of federal law enforcement for months.

    Earlier this year, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint bulletin warning that “the education sector, especially kindergarten through twelfth grade (K-12) institutions, have been a frequent target of ransomware attacks” in recent years.

    “Impacts from these attacks have ranged from restricted access to networks and data, delayed exams, canceled school days, and unauthorized access to and theft of personal information regarding students and staff.”

    The intelligence memo singled out Vice Society for “disproportionately targeting the education sector with ransomware attacks.”

    And while comprehensive ransomware data proves hard to come by, cybersecurity researchers warn that schools – particularly K-12 institutions – continue to attract the attention of ransomware gangs.

    Most schools are not required by law to report cyberattacks to the public, but researchers at K-12 Security Information Exchange say that more than 1,200 cybersecurity incidents have occurred since 2016 at public school districts, nationwide. Earlier this year, the Virginia-based nonprofit published a report accounting for at least 209 ransomware attacks against K-12 institutions from 2016-2021.

    The new findings by Palo Alto Networks revealed “noticeable spikes” in attacks perpetrated by Vice Society during the spring and fall months, an indication the group may be “timing campaigns to coincide with this sector’s unique calendar year.”

    “You could guess attackers just happened to hit in the fall, but it’s much more likely they were thoughtful about making an impact as the schools are beginning,” said Olson.

    Vice Society operates unlike other notorious ransomware groups, opting out of the ransomware-as-a-service (RaaS) model, in which criminal gangs sell or rent their hacking software or services to the highest bidder, according to researchers. Instead, the group utilizes pre-existing ransomware – including well-known variants HelloKitty and Zeppelin – to extort victims.

    Researchers at Palo Alto Networks have not tied the group’s members to a specific geographic location, though posts and communications from the cybercriminal gang have appeared on the dark web in both English and Russian.

    Researchers estimate the threat actors “have impacted more than 100 organizations in total,” including 40 cases impacting educational organizations, 13 targeting health care and 12 targeting state and local governments.

    According to Palo Alto Networks’ analysis, of the schools and education organizations targeted by the cybercriminal group, 15 are based in the U.S., with 10 located in the United Kingdom. Other incidents are sprinkled across Colombia, Brazil, France, Malaysia, Austria, Canada and Ukraine.

    The report noted, “the group appears to be targeting more educational organizations based in California.”

    Earlier this year, a ransomware attack targeted Los Angeles Unified School District, the second largest school district in the U.S. Although school administrators have not confirmed the actors behind the incident, Vice Society has publicly claimed credit for the Labor Day weekend breach.

    The district characterized the cyberattack as a “significant disruption to our system’s infrastructure,” with 500 gigabytes of data stolen. Still, classes continued.

    “If you hit a company and shut down their financial payment system, that’s going to be frustrating for that company,” Olson said. “But if a school starts to shut down in an area, it is going to impact all of the students, teachers, their parents. It’s absolutely going to be news. That’s going to put a lot of pressure on administrators to get things working again. Ransomware actors want people in a position where they need to get operations going again quickly, because that’s what’s going to make them pay.”

    After LAUSD administrators refused to pay a ransom, cybercriminals posted more than 250,000 files and images on the dark web, including potentially sensitive information, according to the cybersecurity firm Checkpoint Research.

    “Vice Society and its consistent targeting of the education industry vertical, particularly around the September time frame, serves as a warning that this group has shaped their campaigns to take advantage of the school year in the U.S.,” Palo Alto Networks said in its report. “It’s likely they’ll maintain use of the tactics to impact the cyberthreat landscape moving forward, as long as their activities continue to be lucrative for them.”  

    Earlier this year, CISA previewed a plan to enhance cybersecurity protections in local communities, with a focus on the particularly vulnerable: K-12 schools, hospitals and water treatment facilities. CISA Director Jen Easterly noted in October that not all organizations are “investing millions and billions of dollars like some in the finance and energy [sectors] are.”

    Homeland Security Secretary Alejandro Mayorkas said Monday at a Center for Strategic and International Studies event in Washington, D.C., “Even the smallest organizations stand on the frontlines defending against the most sophisticated nation states and non-nation state threats.” 

    The cabinet secretary warned that cyberattacks continue to “[grow] in number and gravity,” allowing U.S. adversaries to launch “a new kind of warfare” with a single keystroke.

    For their part, Olson said researchers at Palo Alto Networks are currently developing better cybersecurity tools to help preempt attacks launched by Vice Society. “One of the things we looked at is, how long were threat actors inside the network before they actually launched an attack?” Olson said. His team identified an average “dwell time” of six days.

    “Tracking all of this information is what allows us to respond more quickly and more effectively to incident response cases,” Olsen said.

    Nicole Sganga

    CBS News reporter covering homeland security and justice.

    Source link

  • Teenagers led a group of hackers who breached some of the world’s biggest tech companies. The government wants to know how they did it.

    Teenagers led a group of hackers who breached some of the world’s biggest tech companies. The government wants to know how they did it.

    The Biden administration announced Friday the U.S. would investigate recent hacks linked to a teenage cybercriminal group that focused on extortion.

    The U.S. Cyber Safety Review Board, a 15-member panel of experts from across government and private sector, will probe a series of high-profile hacks by the group, known as Lapsus$.  

    Homeland Security Secretary Alejandro Mayorkas said its goal is to “evaluate how this group has allegedly impacted some of the biggest companies in the world, in some cases, with relatively unsophisticated techniques, and determine how people can build resilience against innovative social engineering tactics and address international partnership in combatting criminal cyber actors.” 

    The board did not list which hacks it would probe, but high-profile victims of Lapsus$ include Uber, Microsoft, Okta and Samsung, according to previous releases by the companies.  

    Like many cybercriminal gangs, Lapsus$ is an evolving group of cyber hackers that maintains an anonymous online presence. Earlier this year, London Police arrested seven individuals – ages 16 to 21 – believed to be tied to the hacking gang. Security experts and government officials believe the group still poses a threat.  

    The group has routinely relied on stolen login credentials to pilfer company data – demanding high extortion checks from victims to stop any leak of stolen information. 

    For instance, during its breach of Uber, the company said Lapsus$ posted messages to the company’s internal slack message board, including a “graphic image.” 

    But the intrusions have also gone after proprietary information. According to Microsoft, the hacking group has left a few breadcrumbs. “Unlike most activity groups that stay under the radar, DEV-0537 doesn’t seem to cover its tracks,” the company wrote in a March blog post. “They go as far as announcing their attacks on social media or advertising their intent to buy credentials from employees of target organizations.” 

    In a briefing Friday, Mayorkas called the cyber threat facing the U.S.”as diverse and severe as its ever been” and went on to say that “nation-states like China, Russia, Iran and North Korea, as well as non-state criminal cyber gangs continue to conduct espionage, steal intellectual property and mine scores of Americans’ personal data.” 

    DHS’ relatively new cyber board, which draws its authority from an executive order signed by President Joe Biden last year, lacks regulatory authority and indicated its work will not be punitive — it won’t fine any companies involved.  

    Modeled after the National Transportation Safety Board, the panel investigates high-profile cyber intrusions and publishes security recommendations. In July, the cyber board published its inaugural investigation, determining that the Log4j bug poses a persistent vulnerability, but did not lead to any “significant” attacks on critical infrastructure.  

    Friday’s announcement marks a pivot for the board, which will shift investigatory efforts from a specific vulnerability to a prolific hacking group. 

    Led by Chair Rob Silvers, the undersecretary for policy at the Department of Homeland Security, and Vice Chair Heather Adkins, senior director of security engineering at Google, the new group promised it would “move quickly” on its next investigation and work with government partners including the Department of Justice, but did not offer a timeline.  

    Adkins said the group aimed to “go deeper” to “provide the kind of advice that creates new foundations for cybersecurity in the ecosystem.” 

    Nicole Sganga

    CBS News reporter covering homeland security and justice.

    Source link

  • Greek police nab German suspect sought on 4 arrest warrants

    Greek police nab German suspect sought on 4 arrest warrants

    THESSALONIKI, Greece — Greek police say that they have arrested a 35-year-old German citizen who has four outstanding arrest warrants on him for fraud and cybercrime, three from Germany and one international.

    The Thessaloniki police’s organized crime and human trafficking division announced Saturday they had found over 1,000 photos and videos of child pornography in the suspect’s cellphone when he was arrested Thursday.

    The man, who had settled in Greece since 2019, was jailed pending review of the extradition requests. He also faces a Greek prosecutor next week on charges of impersonating both a German and a Greek police officer.

    The suspect, whose mother was Greek, had been showing what proved to be a fake German police officer’s ID on across northern Greece, claiming he was a part of a special unit investigating networks of pedophiles. He also impersonated a Greek policeman, recently checking into a hospital wearing a police uniform, which was found in his home.

    Police say they also found in the suspect’s car and home two license plates purporting to be from German state vehicles, at least one of which was fake, as well as fake salary payment statements from German state authorities.

    Source link

  • New Survey Reveals 73% of Internet Users Are Targeted by Scammers

    New Survey Reveals 73% of Internet Users Are Targeted by Scammers

    Though 48% of the respondents admit to have fallen for a scam; 74% of consumers still think they can recognize scams before it is too late.

    Press Release
    –

    Oct 27, 2022 13:30 CEST


    AMSTERDAM, October 27, 2022 (Newswire.com)
    –
    According to research conducted by The Global Anti Scam Alliance and ScamAdviser of 3,500+ internet users, 73% of respondents are either sure or think that they have been exposed to a scam last year.

    74% believe they can recognize scams; 48% fell for them

    Similarly, this year’s survey has found a small increase of 3 percent, from 71% to 74%, of respondents that claim they can confidently identify a scam. In spite of this, however, 48% of respondents still fell for a scam. It is worth noting that this figure also bodes well for internet users given that in the previous year the reported figure was 67%, thereby illustrating a 19% improvement in victimization from the previous year.

    Investment & Crypto Scams are the most reported

    The types of scams that internet users were confronted with in the past year have notably changed, with cryptocurrency (28%) being the most popular, followed by unexpected promises of money (22%) and phishing (22%). In terms of the frequency of exposure, the results from the two surveys were notably similar with reported figures of 43% and 42% respectively in 2022 and 2021.

    Consumers still rely on outdated methods to check for scams

    In terms of how internet users check the safety of websites, unsafe methods such as “checking for an SSL certificate” have increased from 5% to 12% whilst checking for reviews has declined from 41% to 26%. This might serve as an indicator that internet users are putting less faith in online reviews given the increasing problem of fake reviews. 

    Consumers report scams less; especially to the police

    In terms of where internet users report their negative online experiences there has been a drop in the use of review websites from 21% to 15% and reporting to the national police remains the least popular option at 6%. 

    Furthermore, 46% of respondents choose not to report scams with the most popular reason being that they do not know who to report to (25%), that the process seems too complicated (17%), and general apathy in terms of their opinion that reporting victimization would not in their eyes make a difference (14%).

    Lastly, one of our most significant findings is that the respondents still rate police and government efforts in combatting scams as poor. In fact, this figure has increased from 64% in 2021 to 72% in 2022. 

    On the 9th and 10th of November, GASA will organize the Global Anti Scam Summit to identify new solutions to fight the rise of scams. 

    The report Why do Consumers get Scammed can be downloaded here. 

    Contact: jorij.abraham@gasa.org 

    Source: Global Anti Scam Alliance

    Source link

  • Former Uber security chief guilty of data breach coverup

    Former Uber security chief guilty of data breach coverup

    SAN FRANCISCO — The former chief security officer for Uber was convicted Wednesday of trying to cover up a 2016 data breach in which hackers accessed tens of millions of customer records from the ride-hailing service.

    A federal jury in San Francisco convicted Joseph Sullivan of obstructing justice and concealing knowledge that a federal felony had been committed, federal prosecutors said.

    Sullivan remains free on bond pending sentencing and could face a total of eight years in prison on the two charges when he is sentenced, prosecutors said.

    “Technology companies in the Northern District of California collect and store vast amounts of data from users,” U.S. Attorney Stephanie M. Hinds said in a statement. “We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users.”

    It was believed to be the first criminal prosecution of a company executive over a data breach.

    A lawyer for Sullivan, David Angeli, took issue with the verdict.

    “Mr. Sullivan’s sole focus — in this incident and throughout his distinguished career — has been ensuring the safety of people’s personal data on the internet,” Angeli told the New York Times.

    An email to Uber seeking comment on the conviction wasn’t immediately returned.

    Sullivan was hired as Uber’s chief security officer in 2015. In November 2016, Sullivan was emailed by hackers, and employees quickly confirmed that they had stolen records on about 57 million users and also 600,000 driver’s license numbers, prosecutors said.

    After learning of the breach, Sullivan began a scheme to hide it from the public and the Federal Trade Commission, which had been investigating a smaller 2014 hack, authorities said.

    According to the U.S. attorney’s office, Sullivan told subordinates that “the story outside of the security group was to be that ‘this investigation does not exist,’” and arranged to pay the hackers $100,000 in bitcoin in exchange for them signing non-disclosure agreements promising not to reveal the hack. He also never mentioned the breach to Uber lawyers who were involved with the FTC’s inquiry, prosecutors said.

    “Sullivan orchestrated these acts despite knowing that the hackers were hacking and extorting other companies as well as Uber,” the U.S. attorney’s office said.

    Uber’s new management began investigating the breach in the fall of 2017. Despite Sullivan lying to the new chief executive officer and others, the truth was uncovered and the breach was made public, prosecutors said.

    Sullivan was fired along with Craig Clark, an Uber lawyer he had told about the breach. Clark was given immunity by prosecutors and testified against Sullivan.

    No other Uber executives were charged in the case.

    The hackers pleaded guilty in 2019 to computer fraud conspiracy charges and are awaiting sentencing.

    Sullivan was convicted of of obstruction of proceedings of the Federal Trade Commission and misprision of felony, meaning concealing knowledge of a felony from authorities.

    Meanwhile, some experts have questioned how much cybersecurity has improved at Uber since the breach.

    The company announced last month that all its services were operational following what security professionals called a major data breach, claiming there was no evidence the hacker got access to sensitive user data.

    The lone hacker apparently gained access posing as a colleague, tricking an Uber employee into surrendering their credentials. Screenshots the hacker shared with security researchers indicate they obtained full access to the cloud-based systems where Uber stores sensitive customer and financial data.

    It is not known how much data the hacker stole or how long they were inside Uber’s network. There was no indication they destroyed data.

    Source link

  • Former Uber security chief guilty of data breach coverup

    Former Uber security chief guilty of data breach coverup

    SAN FRANCISCO — The former chief security officer for Uber was convicted Wednesday of trying to cover up a 2016 data breach in which hackers accessed tens of millions of customer records from the ride-hailing service.

    A federal jury in San Francisco convicted Joseph Sullivan of obstructing justice and concealing knowledge that a federal felony had been committed, federal prosecutors said.

    Sullivan remains free on bond pending sentencing and could face a total of eight years in prison on the two charges when he is sentenced, prosecutors said.

    “Technology companies in the Northern District of California collect and store vast amounts of data from users,” U.S. Attorney Stephanie M. Hinds said in a statement. “We will not tolerate concealment of important information from the public by corporate executives more interested in protecting their reputation and that of their employers than in protecting users.”

    Sullivan was hired as Uber’s chief security officer in 2015. In November 2016, Sullivan was emailed by hackers, and employees quickly confirmed that they had stolen records on about 57 million users and also 600,000 driver’s license numbers, prosecutors said.

    After learning of the breach, Sullivan began a scheme to hide it from the public and the Federal Trade Commission, which had been investigating a smaller 2014 hack, authorities said.

    According to the U.S. attorney’s office, Sullivan told subordinates that “the story outside of the security group was to be that ‘this investigation does not exist,’” and arranged to pay the hackers $100,000 in bitcoin in exchange for them signing non-disclosure agreements promising not to reveal the hack. He also never mentioned the breach to Uber lawyers who were involved with the FTC’s inquiry, prosecutors said.

    “Sullivan orchestrated these acts despite knowing that the hackers were hacking and extorting other companies as well as Uber,” the U.S. attorney’s office said.

    Uber’s new management began investigating the breach in the fall of 2017. Despite Sullivan lying to the chief executive officer and others, the truth was uncovered and the breach was made public, prosecutors said.

    Sullivan was fired. The hackers pleaded guilty in 2019 to computer fraud conspiracy charges and are awaiting sentencing.

    An email to Uber seeking comment on the conviction wasn’t immediately returned.

    Some experts have questioned how much cybersecurity has improved at Uber since the breach.

    The company announced last month that all its services were operational following what security professionals called a major data breach, claiming there was no evidence the hacker got access to sensitive user data.

    The lone hacker apparently gained access posing as a colleague, tricking an Uber employee into surrendering their credentials. Screenshots the hacker shared with security researchers indicate they obtained full access to the cloud-based systems where Uber stores sensitive customer and financial data.

    It is not known how much data the hacker stole or how long they were inside Uber’s network. There was no indication they destroyed data.

    Source link

  • New Bedford fire lieutenant uses himself as human shield against flames

    New Bedford fire lieutenant uses himself as human shield against flames

    Fire Lt. uses himself as shield against flames

    Source link

  • Phishing Attacks Rose 61% in 2022, New Study Finds

    Phishing Attacks Rose 61% in 2022, New Study Finds

    Interisle’s annual study finds the cybercrime technique expanding to more brands and surging in the cryptocurrency field.

    Press Release
    –

    Jul 26, 2022


    NEW YORK, July 26, 2022 (Newswire.com)
    –
    The cybercrime commonly called “phishing” soared 61% in the past year to more than 1 million attacks and continues to pose a significant threat to most Internet users, according to an annual study from Interisle Consulting Group, specialists in business and technology strategy and authors of a long-running series of reports on phishing activity.

    Phishing attacks lure victims, typically via email or text message, to a fraudulent website that appears to be run by a trusted entity, often a bank or retailer. The site is designed to persuade a victim to provide sensitive information like a bank account number.

    For its study, entitled Phishing Landscape 2022: An Annual Study of the Scope and Distribution of Phishing, Interisle assembled and analyzed a deep and reliable dataset by collecting more than three million phishing reports from 1 May 2021 through 30 April 2022 from four respected threat intelligence providers: the AntiPhishing Working Group (APWG), OpenPhish, PhishTank, and Spamhaus, and examined data from 2020 for a longer-term examination of certain issues. The report also includes Interisle’s recommendations on measures to stop the practice.

    Interisle’s study has drawn praise from experts on the topic. “This thoroughly researched report is essential reading for anyone concerned about the growing threat of online phishing,” said John Levine, president of the Coalition Against Unsolicited Commercial Email (CAUCE). “It has detailed analyses and advice on what and where the threats are, and how we can and must deal with them.”

    Interisle’s study found the 3 million reports represented 1,122,579 unique phishing attacks during that time frame, with 853,987 domain names reported for phishing, a 72% increase over the previous year’s study.

    One notable finding: Phishing attempts related to cryptocurrency increased 257% year to year. Nearly 80% of the generic top-level domains (gTLD) reported for phishing were maliciously registered, and crypto wallets were the most targeted brands.

    “Cryptocurrency phishing has skyrocketed, especially attacks involving wallets and exchanges,” said Interisle partner and co-author Dave Piscitello. “Phishers are applying attack techniques that they’ve used against other financials to virtual currencies with great effect.”

    In other findings:  

    • The number of monthly attacks has doubled in two years, from about 40,000 in May 2020 to more than 100,000 in April 2022.
       
    • Phishers targeted over 2,000 businesses and organizations during the 1 May 2021 to 30 April 2022 period. The majority of phishing attacks targeted just 10 brands.
       
    • A small number of registrars dominate malicious domain registration in some TLDs (top-level domains). In four TLDs, more than 80% of the malicious domains were registered through just one registrar.
       
    • Phishing attacks are disproportionately concentrated in new gTLDs. While the new TLDs’ market share decreased during the yearly reporting period, phishing among the new TLDs has increased.
       
    • Phishers deliberately registered 69% of all domains—and 92% of new gTLD domains—on which phishing occurred.
       
    • Phishers have begun targeting more brands, including Amazon, Apple, Meta (Facebook, WhatsApp) and Microsoft (Outlook).

    Interisle’s report also includes observations and recommendations to counter phishing attempts, including: 

    • The naming, addressing, and hosting ecosystem exploited by phishers (and cyberattackers generally) is encumbered by vertically isolated (“siloed”) policy and mitigation regimes.
       
    • Registries and registrars should identify, “lock”, and suspend domains reported for phishing, and hosting and cloud service providers should remove phishing content or shut down accounts where phishing occurs, and all parties should be more responsive to abuse complaints, especially for cybercrimes such as phishing, and they must begin to do so in a more coordinated and determined manner.
       
    • Changes to or introduction of policy or regulation may be necessary to effectively mitigate phishing. Obliging operators to validate the identity of users and customers, coupled with agreement on a common definition of lawful access that acknowledges the role that the private sector plays in combating cybercrime, could reduce both the incidence of phishing and the difficulty of responding to it.

    For more about Interisle, please visit: https://www.interisle.net.

    About Interisle
    Interisle’s principal consultants are experienced practitioners with extensive track records in industry and academia and world-class expertise in business and technology strategy, Internet technologies and governance, financial industry applications, and software design. Every Interisle client benefits from the direct hands-on management of this core team, augmented by the specialized expertise of an extensive network of associates—a coherent, team approach with the low overhead of a lean, virtual organization.

    Contact Information
    Dave Piscitello
    dave@interisle.net

    Source: Interisle Consulting Group

    Source link