Tag: Cybersecurity

Banks face tough new security standards in the EU — their tech suppliers are under scrutiny, too

Traffic_analyzer | Digitalvision Vectors | Getty Images

Financial services companies and their digital technology suppliers are under intense pressure to achieve compliance with strict new rules from the EU that require them to boost their cyber resilience.

By the start of next year, financial services firms and their technology suppliers will have to make sure that they’re in compliance with a new incoming law from the European Union known as DORA, or the Digital Operational Resilience Act.

CNBC runs through what you need to know about DORA — including what it is, why it matters, and what banks are doing to make sure they’re prepared for it.

What is DORA?

DORA requires banks, insurance companies and investment to strengthen their IT security. The EU regulation also seeks to ensure the financial services industry is resilient in the event of a severe disruption to operations.

Such disruptions could include a ransomware attack that causes a financial company’s computers to shut down, or a DDOS (distributed denial of service) attack that forces a firm’s website to go offline.

The regulation also seeks to help firms avoid major outage events, such as the historic IT meltdown last month caused by cyber firm CrowdStrike when a simple software update issued by the company forced Microsoft’s Windows operating system to crash.

Multiple banks, payment firms and investment companies — from JPMorgan Chase and Santander, to Visa and Charles Schwab — were unable to provide service due to the outage. It took these firms several hours to restore service to consumers.

In the future, such an event would fall under the type of service disruption that would face scrutiny under the EU’s incoming rules.

Mike Sleightholme, president of fintech firm Broadridge International, notes that a standout factor of DORA is that it doesn’t just focus on what banks do to ensure resiliency — it also takes a close look at firms’ tech suppliers.

Under DORA, banks will be required to undertake rigorous IT risk management, incident management, classification and reporting, digital operational resilience testing, information and intelligence sharing in relation to cyber threats and vulnerabilities, and measures to manage third-party risks.

Firms will be required to conduct assessments of “concentration risk” related to the outsourcing of critical or important operational functions to external companies.

These IT providers often deliver “critical digital services to customers,” said Joe Vaccaro, general manager of Cisco-owned internet quality monitoring firm ThousandEyes.

“These third-party providers must now be part of the testing and reporting process, meaning financial services companies need to adopt solutions that help them uncover and map these sometimes hidden dependencies with providers,” he told CNBC.

Banks will also have to “expand their ability to assure the delivery and performance of digital experiences across not just the infrastructure they own, but also the one they don’t,” Vaccaro added.

When does the law apply?

DORA entered into force on Jan. 16, 2023, but the rules won’t be enforced by EU member states until Jan. 17, 2025.

The EU has prioritised these reforms because of how the financial sector is increasingly dependent on technology and tech companies to deliver vital services. This has made banks and other financial services providers more vulnerable to cyberattacks and other incidents.

“There’s a lot of focus on third-party risk management” now, Sleightholme told CNBC. “Banks use third-party service providers for important parts of their technology infrastructure.”

“Enhanced recovery time objectives is an important part of it. It really is about security around technology, with a particular focus on cybersecurity recoveries from cyber events,” he added.

Many EU digital policy reforms from the last few years tend to focus on the obligations of companies themselves to make sure their systems and frameworks are robust enough to protect against damaging events like the loss of data to hackers or unauthorized individuals and entities.

The EU’s General Data Protection Regulation, or GDPR, for example, requires companies to ensure the way they process personally identifiable information is done with consent, and that it’s handled with sufficient protections to minimize the potential of such data being exposed in a breach or leak.

DORA will focus more on banks’ digital supply chain — which represents a new, potentially less comfortable legal dynamic for financial firms.

What if a firm fails to comply?

For financial firms that fall foul of the new rules, EU authorities will have the power to levy fines of up to 2% of their annual global revenues.

Individual managers can also be held responsible for breaches. Sanctions on individuals within financial entities could come in as high a 1 million euros ($1.1 million).

For IT providers, regulators can levy fines of as high as 1% of average daily global revenues in the previous business year. Firms can also be fined every day for up to six months until they achieve compliance.

Third-party IT firms deemed “critical” by EU regulators could face fines of up to 5 million euros — or, in the case of an individual manager, a maximum of 500,000 euros.

That’s slightly less severe than a law such as GDPR, under which firms can be fined up to 10 million euros ($10.9 million), or 4% of their annual global revenues — whichever is the higher amount.

Carl Leonard, EMEA cybersecurity strategist at security software firm Proofpoint, stresses that criminal sanctions may vary from member state to member state depending on how each EU country applies the rules in their respective markets.

DORA also calls for a “principle of proportionality” when it comes to penalties in response to breaches of the legislation, Leonard added.

That means any response to legal failings would have to balance the time, effort and money firms spend on enhancing their internal processes and security technologies against how critical the service they’re offering is and what data they’re trying to protect.

Are banks and their suppliers ready?

Stephen McDermid, EMEA chief security officer for cybersecurity firm Okta, told CNBC that many financial services firms have prioritized using existing internal operational resilience and third-party risk programs to get into compliance with DORA and “identify any gaps they may have.”

“This is the intention of DORA, to create alignment of many existing governance programs under a single supervisory authority and harmonise them across the EU,” he added.

Fredrik Forslund vice president and general manager of international at data sanitization firm Blancco, warned that though banks and tech vendors have been making progress toward compliance with DORA, there’s still “work to be done.”

On a scale from one to 10 — with a value of one representing noncompliance and 10 representing full compliance — Forslund said, “We’re at 6 and we’re scrambling to get to 7.”

“We know that we have to be at a 10 by January,” he said, adding that “not everyone will be there by January.”

[ad_2]
Source link

August 7, 2024
Inside the Dark World of Doxing for Profit

Since the early 1990s, people have used doxing as a toxic way to strike digital revenge—stripping away someone’s anonymity by unmasking their identity online. But in recent years, the poisonous practice has taken on new life, with people being doxed and extorted for cryptocurrency and, in the most extreme cases, potentially facing physical violence.

For the past year, security researcher Jacob Larsen—who was a victim of doxing around a decade ago when someone tried to extort him for a gaming account—has been monitoring doxing groups, observing the techniques used to unmask people, and interviewing prominent members of the doxing community. Doxing actions have led to incomes of “well over six figures annually,” and methods include making fake law enforcement requests to get people’s data, according to Larsen’s interviews.

“The primary target of doxing, particularly when it involves a physical extortion component, is for finance,” says Larsen, who leads an offensive security team at cybersecurity company CyberCX but conducted the doxing research in a personal capacity with the support of the company.

Over several online chat sessions last August and September, Larsen interviewed two members of the doxing community: “Ego” and “Reiko.” While neither of their offline identities is publicly known, Ego is believed to have been a member of the five-person doxing group known as ViLe, and Reiko last year acted as an administrator of the biggest public doxing website, Doxbin, as well as being involved in other groups. (Two other ViLe members pleaded guilty to hacking and identity theft in June.) Larsen says both Ego and Reiko deleted their social media accounts since speaking with him, making it impossible for WIRED to speak with them independently.

People can be doxed for a full range of reasons—from harassment in online gaming, to inciting political violence. Doxing can “humiliate, harm, and reduce the informational autonomy” of targeted individuals, says Bree Anderson, a digital criminologist at Deakin University in Australia who has researched the subject with colleagues. There are direct “first-order” harms, such as risks to personal safety, and longer-term “second-order harms,” including anxiety around future disclosures of information, Anderson says.

Larsen’s research mostly focused on those doxing for profit. Doxbin is central to many doxing efforts, with the website hosting more than 176,000 public and private doxes, which can contain names, social media details, Social Security numbers, home addresses, places of work, and similar details belonging to people’s family members. Larsen says he believes most of the doxing on Doxbin is driven by extortion activities, although there can be other motivations and doxing for notoriety. Once information is uploaded, Doxbin will not remove it unless it breaks the website’s terms of service.

“It is your responsibility to uphold your privacy on the internet,” Reiko said in one of the conversations with Larsen, who has published the transcripts. Ego added: “It’s on the users to keep their online security tight, but let’s be real, no matter how careful you are, someone might still track you down.”

Impersonating Police, Violence as a Service

Being entirely anonymous online is almost impossible—and many people don’t try, often using their real names and personal details in online accounts and sharing information on social media. Doxing tactics to gather people’s details, some of which were detailed in charges against ViLe members, can include reusing common passwords to access accounts, accessing public and private databases, and social engineering to launch SIM swapping attacks. There are also more nefarious methods.

Emergency data requests (EDR) can also be abused, Larsen says. EDRs allow law enforcement officials to ask tech companies for people’s names and contact details without any court orders as they believe there may be danger or risks to people’s lives. These requests are made directly to tech platforms, often through specific online portals, and broadly need to come from official law enforcement or government email addresses.

Matt Burgess

Source link

August 7, 2024
A Flaw in Windows Update Opens the Door to Zombie Exploits

New research being presented at the Black Hat security conference in Las Vegas today shows that a vulnerability in Windows Update could be exploited to downgrade Windows to older versions, exposing a slew of historical vulnerabilities that then can be exploited to gain full control of a system. Microsoft says that it is working on a complex process to carefully patch the issue, dubbed “Downdate.”

Alon Leviev, the SafeBreach Labs researcher who discovered the flaw, says he started looking for possible downgrade attack methods after seeing that a startling hacking campaign from last year was using a type of malware (known as the “BlackLotus UEFI bootkit”) that relied on downgrading the Windows boot manager to an old, vulnerable version. After probing the Windows Update flow, Leviev discovered a path to strategically downgrading Windows—either the entire operating system or just specifically chosen components. From there, he developed a proof-of-concept attack that utilized this access to disable the Windows protection known as Virtualization-Based Security (VBS) and ultimately target highly privileged code running in the computer’s core “kernel.”

“I found a downgrade exploit that is fully undetectable because it is performed by using Windows Update itself,” which the system trusts, Leviev told WIRED ahead of his conference talk. “In terms of invisibility, I didn’t uninstall any update—I basically updated the system even though under the hood it was downgraded. So the system is not aware of the downgrade and still appears up-to-date.”

Leviev’s downgrade capability comes from a flaw in the components of the Windows Update process. To perform an upgrade, your PC places what is essentially a request to update in a special update folder. It then presents this folder to the Microsoft update server, which checks and confirms its integrity. Next, the server creates an additional update folder for you that only it can control, where it places and finalizes the update and also stores an action list—called “pending.xml”—that includes the steps of the update plan, such as which files will be updated and where the new code will be stored on your computer. When you reboot your PC, it takes the actions from the list and updates the software.

The idea is that even if your computer, including your update folder, is compromised, a bad actor can’t hijack the update process because the crucial parts of it happen in the server-controlled update folder. Leviev looked closely at the different files in both the user’s update folder and the server’s update folder, though, and he eventually found that while he couldn’t modify the action list in the server’s update folder directly, one of the keys controlling it—called “PoqexecCmdline”—was not locked. This gave Leviev a way to manipulate the action list, and with it the entire update process, without the system realizing that anything was amiss.

With this control, Leviev then found strategies to downgrade multiple key components of Windows, including drivers, which coordinate with hardware peripherals; dynamic link libraries, which contain system programs and data; and, crucially, the NT kernel, which contains the most core instructions for a computer to run. All of these could be downgraded to older versions that contain known, patched vulnerabilities. And Leviev even cast a wider net from there, to find strategies for downgrading Windows security components including the Windows Secure Kernel; the Windows password and storage component Credential Guard; the hypervisor, which creates and oversees virtual machines on a system; and VBS, the Windows virtualization security mechanism.

The technique does not include a way to first gain remote access to a victim device, but for an attacker who already has initial access, it could enable a true rampage, because Windows Update is such a trusted mechanism and can reintroduce a vast array of dangerous vulnerabilities that have been fixed by Microsoft over the years. Microsoft says that it has not seen any attempts to exploit the technique.

“We are actively developing mitigations to protect against these risks while following an extensive process involving a thorough investigation, update development across all affected versions, and compatibility testing, to ensure maximized customer protection with minimized operational disruption,” a Microsoft spokesperson told WIRED in a statement.

Part of the company’s fix involves revoking vulnerable VBS system files, which must be done carefully and gradually, because it could cause integration issues or reintroduce other, unrelated problems that were previously addressed by those same system files.

Leviev emphasizes that downgrade attacks are an important threat for the developer community to consider as hackers endlessly seek paths into target systems that are stealthy and difficult to detect.

Lily Hay Newman

Source link

August 7, 2024
CrowdStrike Faces a Potential Tsunami of Lawsuits. Only the Fine Print Can Save It, Experts Say

On July 19, Jonathan Cardi and his family watched as the departures board at Raleigh-Durham International Airport in North Carolina, turned from green to a sea of red. “Oh my gosh, it was insane,” says Cardi. “Delayed, delayed, delayed, delayed.”

Cardi, a law professor at Wake Forest University and a member of the American Law Institute, was due to fly with Delta Airlines to a conference in Fort Lauderdale, Florida. With thousands of other travelers, he spent the day lining up as staff kept telling people that flights “would be taking off any minute,” he recalls. But when it became clear that planes were going nowhere, he made the 11-hour journey by rental car instead. Others heading to the conference slept at the airport, Cardi later found out.

The chaos was the result of a software update released by cybersecurity company CrowdStrike, which contained a defect that crashed millions of Microsoft Windows computers. The IT outage, which disrupted airlines, financial services, and various other industries, is estimated to have caused more than $5 billion in financial losses. “Because there was so much money lost, there is going to be legal action,” says Cardi, who specializes in the field of law concerned with civil liability for losses or harm.

That legal wrangling is already beginning.

On July 29, Delta informed CrowdStrike and Microsoft of its intent to sue over the $500 million it claims to have lost as a result of the outage. A class action lawsuit has been filed by law firm Labaton Keller Sucharow on behalf of CrowdStrike shareholders, claiming they were misled over the company’s software testing practices. Another law firm, Gibbs Law Group, has announced it is looking into bringing a class action on behalf of small businesses affected by the outage.

In response to WIRED’s inquiry about the shareholder class action, CrowdStrike says, “We believe this case lacks merit, and we will vigorously defend the company.” In a letter to Delta’s legal counsel seen by WIRED, a legal representative for CrowdStrike said that the company “strongly rejects any allegation that it was grossly negligent or committed willful misconduct.” Microsoft declined to comment. Delta’s legal counsel declined an interview request.

Those hoping to recover financial losses will need to find creative ways to frame their cases against CrowdStrike, which is insulated to a great extent by clauses typical of software contracts that limit its liability, Cardi says. Though it may seem intuitive that CrowdStrike be on the hook for its mistake, the company is likely to be “pretty well-guarded” by the fine print, he adds.

Limitation Clause

Despite CrowdStrike conceding responsibility for the outage, neither direct customers nor businesses disrupted by proximity—i.e., the customers of CrowdStrike customers—will find it easy to recover their losses. The first question will be: What specifically would they be suing CrowdStrike for? There are a handful of theoretical options—breach of contract, negligence, or fraud—but none of them are straightforward.

Although customers may argue that CrowdStrike breached its contract in some way, “the amount of money they could recover is likely to be severely limited by the limitation clause,” says Paul MacMahon, associate professor of law at the London School of Economics and Political Science. The purpose of any such clause is to act as a sort of get-out-of-jail-free card, limiting the amount of money a software vendor has to pay out. The specific contents of the contracts entered into by CrowdStrike and its customers will differ from case to case, but the general terms and conditions limit CrowdStrike’s liability to only the amount its customers pay for its services.

Joel Khalili

Source link

August 7, 2024
A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

“It’s not just that the water goes out, it’s that when the sole wastewater facility in your community is down really bad things start to happen. For example, no water means no hospital,” he says. “I really encountered a lot of this during my leadership of the Covid Task Force. There is such interdependence across the basic functions of society.”

UnDisruptable27 will focus on interacting with communities who aren’t reached by Washington DC-based policy discussions or Information Sharing and Analysis Centers (ISACs), which are meant to represent each infrastructure sector of the US. The project aims to communicate directly with people who actually work on the ground in US critical infrastructure, and grapple together with the reality that cybersecurity-related disasters could impact their daily work.

“There’s a data breach, you get whatever services like identity protection for some period of time, and life carries on, and people think that there’s no long-term impact,” says Megan Stifel, IST’s chief strategy officer. “There’s this expectation that it’s fine, things will just continue. So we’re very interested in getting after this issue and thinking about how do we tackle critical infrastructure security with perhaps a new approach.”

Corman notes that even though cybersecurity incidents have become a well-known fact of life, business owners and infrastructure operators are often shaken and caught off guard when a cybersecurity incident actually affects them. Meanwhile, when government entities try to impose cybersecurity standards or become a partner on defense initiatives, communities often balk at the intrusion and perceived overreach. Last year, for example, the US Environmental Protection Agency was forced to rescind new cybersecurity guidelines for water systems after water companies and Republicans in Congress filed a lawsuit over the initiative.

“Time and time again, trade associations or lobbyists or owners and operators have an allergic reaction to oversight and say, ‘We prefer voluntary, we’re doing fine on our own,’ ” Corman says. “And they really are trying to do the right thing. But then also time and time again, people are just shocked that disruption could happen and feel very blindsided. So you can only conclude that the people who feel the pain of our failures are not included in the conversation. They deserve to understand the risks inherent in this level of connectivity. We’ve tried a lot of things, but we have not tried just leveling with people.”

UnDisruptable27 is launching this week for visibility among attendees at BSides as well as the other conferences, Black Hat and Defcon, that will run through Sunday in Las Vegas. Corman says that the goal is to combine the hacker mentality and, essentially, a call for volunteers with plans to work with creative collaborators on producing engaging content to fuel discourse and understanding. Information campaigns using memes and social media posts or moonshots like narrative podcasts and even reality TV are all on the table.

“We must prioritize the security, safety, and resilience of critical infrastructure — including water, health care facilities, and utilities,” Craig Newmark, the Craigslist founder whose philanthropy is funding UnDisruptable27, told WIRED. “The urgency of this issue requires affecting human behavior through storytelling.”

Lily Hay Newman

Source link

August 6, 2024
Master Microsoft Technologies for Your Business with This Training Bundle | Entrepreneur

Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

Running a small business often comes with the challenge of managing IT infrastructure, ensuring robust security, and keeping costs under control. The Complete 2024 Microsoft Tech Certification Training Super Bundle, priced at $59.97 (down from $429), is designed to help you tackle these issues head-on.

This extensive training package has 11 courses totaling 264 hours of instruction on essentials like Microsoft technologies, focusing on cloud computing, security, and endpoint management.

Key areas covered in this bundle include mastery of the super-popular Microsoft 365. You’ll learn how to manage user identities, services, and Microsoft Teams to boost productivity and streamline communication within your business.

Develop a thorough understanding of Azure administration, infrastructure, development, and security. Utilize cloud services to optimize data management and enhance operational efficiency. You can also expect to get hands-on experience with modern desktop management and Windows client administration. This can help you ensure your systems are running smoothly and efficiently.

You can also use this bundle to focus on security operations and Azure security technologies. Protect your business from cyber threats with advanced security strategies found here.

Small businesses often struggle with the high costs of outsourcing IT support. This training bundle equips you and your team with the necessary skills to handle IT issues internally, significantly reducing these expenses. Learn to efficiently manage your IT environment with courses such as Microsoft 365 Identity and Services and Windows Client.

Robust cybersecurity is essential in today’s digital world. The training bundle emphasizes security operations and Azure security technologies, ensuring you can safeguard sensitive data against potential threats. Courses like Azure Security Technologies help you implement strong security measures to protect your business.

Lifetime access to this bundle is an invaluable resource for entrepreneurs aiming to enhance their IT capabilities, reduce costs, and secure their businesses.

For a limited time, the Complete 2024 Microsoft Tech Certification Training Super Bundle is on sale for $59.97 (reg. $429).

StackSocial prices subject to change.

StackCommerce

Source link

August 3, 2024
Sensitive Illinois Voter Data Exposed by Contractor’s Unsecured Databases

Databases containing sensitive voter information from multiple counties in Illinois were openly accessible on the internet, revealing 4.6 million records that included driver’s license numbers as well as full and partial Social Security Numbers and documents like death certificates. Longtime security researcher Jeremiah Fowler stumbled upon one of the databases that appeared to contain information from DeKalb County, Illinois and subsequently discovered another 12 exposed databases. None were password protected nor required any type of authentication to access.

As criminal and state-backed hacking becomes ever more sophisticated and aggressive, threats to critical infrastructure loom. But often, the biggest vulnerabilities come not from esoteric software issues, but from gaping errors that leave the safe door open and the crown jewels exposed. After years of efforts to shore up election security across the United States, state and local awareness about cybersecurity issues has improved significantly. But as this year’s US election quickly approaches, the findings reflect the reality that there are always more oversights to catch.

“I’ve found voter databases in the past, so I kind of know if it’s a low-level marketing outreach database that someone has purchased,” Fowler tells WIRED. “ But here I saw voter applications— there were actually scans of documents, and then screenshots of online applications. I saw voter rolls for active voters, absentee voters with email addresses, some of them military email addresses. And when I saw Social Security numbers and driver’s license numbers and death certificates I was like, ‘OK, those shouldn’t be there.’”

Through public records, Fowler determined that all of the counties appear to contract with an Illinois-based election management service called Platinum Technology Resource, which provides voter registration software and other digital tools along with services like ballot printing. Many counties in Illinois use Platinum Technology Resource as an election services provider, including DeKalb, which confirmed its relationship with Platinum to WIRED.

Fowler reported the unprotected databases to Platinum on July 18, but he says he didn’t receive a response and the databases remained exposed. As Fowler dug deeper into public records, he realized that Platinum works with the Illinois-based managed services provider Magenium, so he sent a disclosure to this company as well on July 19. Again, he says he did not receive a response, but shortly after the databases were secured, pulling them from public view. Platinum and Magenium did not return WIRED’s multiple requests for comment.

Platinum began distributing a notification, viewed by WIRED, to impacted counties on Friday. “We have evidence of a claim the file storage containing voter registration documents may have been scanned,” Platinum wrote, adding that the exposed databases do not indicate a deeper compromise of its systems. “There was a thorough investigation executed. The findings support our ongoing belief there is no evidence of voter registration forms being leaked or stolen. … We used this opportunity to deploy new and additional safeguards around voter registration documents.”

Illinois’s data breach notification law requires notification to the state within 45 days of an incident. A standard version of a Champaign County contract for technology services posted publicly through a Freedom of Information Act request requires a contractor to notify the impacted county within 15 minutes of identifying a data breach.

Fowler points out that while the exposed information would potentially make impacted individuals more susceptible to identity theft and other scams, it could also be abused to submit multiple absentee ballot requests or to conduct other suspicious activity that could call a voter’s legitimate vote into question and take time to reconcile. But he adds that the death certificates and other documentation contained in the trove reflects the work election officials do all over the country to manage voter registrations and ensure that everyone’s vote is accurately counted.

“There’s definitely progress on basic data security, and I don’t see stuff like this very often anymore,” Fowler says. “But I used the open and public internet and no specialized tools to find this. And at the end of the day, this is critical infrastructure that was exposed.”

Lily Hay Newman

Source link

August 2, 2024
A Senate Bill Would Radically Improve Voting Machine Security

Congress is moving closer to putting US election technology under a stricter cybersecurity microscope.

Embedded inside this year’s Intelligence Authorization Act, which funds intelligence agencies like the CIA, is the Strengthening Election Cybersecurity to Uphold Respect for Elections through Independent Testing (SECURE IT) Act, which would require penetration testing of federally certified voting machines and ballot scanners, and create a pilot program exploring the feasibility of letting independent researchers probe all manner of election systems for flaws.

The SECURE IT Act—originally introduced by US senators Mark Warner, a Virginia Democrat, and Susan Collins, a Maine Republican—could significantly improve the security of key election technology in an era when foreign adversaries remain intent on undermining US democracy.

“This legislation will empower our researchers to think the way our adversaries do, and expose hidden vulnerabilities by attempting to penetrate our systems with the same tools and methods used by bad actors,” says Warner, who chairs the Senate Intelligence Committee.

The new push for these programs highlights the fact that even as election security concerns have shifted to more visceral dangers such as death threats against county clerks, polling-place violence, and AI-fueled disinformation, lawmakers remain worried about the possibility of hackers infiltrating voting systems, which are considered critical infrastructure but are lightly regulated compared to other vital industries.

Russia’s interference in the 2016 election shined a spotlight on threats to voting machines, and despite major improvements, even modern machines can be flawed. Experts have consistently pushed for tighter federal standards and more independent security audits. The new bill attempts to address those concerns in two ways.

The first provision would codify the US Election Assistance Commission’s recent addition of penetration testing to its certification process. (The EAC recently overhauled its certification standards, which cover voting machines and ballot scanners and which many states require their vendors to meet.)

While previous testing simply verified whether machines contained particular defensive measures—such as antivirus software and data encryption—penetration testing will simulate real-world attacks meant to find and exploit the machines’ weaknesses, potentially yielding new information about serious software flaws.

“People have been calling for mandatory [penetration] testing for years for election equipment,” says Edgardo Cortés, a former Virginia elections commissioner and an adviser to the election security team at New York University’s Brennan Center for Justice.

The bill’s second provision would require the EAC to experiment with a vulnerability disclosure program for election technology—including systems that are not subject to federal testing, such as voter registration databases and election results websites.

Vulnerability disclosure programs are essentially treasure hunts for civic-minded cyber experts. Vetted participants, operating under clear rules about which of the organizer’s computer systems are fair game, attempt to hack those systems by finding flaws in how they are designed or configured. They then report any flaws they discover to the organizer, sometimes for a reward.

By allowing a diverse group of experts to hunt for bugs in a wide range of election systems, the Warner–Collins bill could dramatically expand scrutiny of the machinery of US democracy.

Eric Geller

Source link

July 30, 2024
How Infostealers Pillaged the World’s Passwords

These platforms take cues in how they are designed and marketed from legitimate information and ecommerce services. Many markets and forums charge a subscription fee to access the platform and then have different pricing structures for data depending on how valuable it might be. Currently, Gray says, Russian Market has so much stolen data available from infostealers that it has been charging a low flat rate, typically no more than $10, for any subset of data users want to download.

“Organizations have become very good with their security, and people have also gotten more savvy, so they’re not the best targets now,” for traditional tailored attacks, Gray says. “So attackers need something that’s less targeted and more based on what they can make use of. Infostealers are modular and often sold on a subscription basis, and that evolution probably aligns with the rise of modern subscription services like video streaming.”

Infostealers have been especially effective with the rise of remote work and hybrid work, as companies adapt to allowing employees to access work services from personal devices and personal accounts from work devices. This creates opportunities for infostealers to randomly compromise individuals on, say, their home computers but still end up with corporate access credentials because the person was logged into some of their work systems as well. It also makes it easier for infostealing malware to get around corporate protections, even on enterprise devices, if employees are able to have their personal email or social media accounts open.

“I started paying attention to this once it became an enterprise problem,” Mandiant’s Carmakal says. “And particularly around 2020, because I started seeing more intrusions of enterprises first starting from compromises of home computers—through phishing of people’s Yahoo accounts, Gmail accounts, and Hotmail accounts that were totally unrelated to any enterprise targeting, but to me look very opportunistic.”

Victoria Kivilevich, director of threat research at security firm KELA, says that in some instances criminals can use cybercrime markets to search for the domain of potential targets and see if any credentials are available. Kivilevich says the sale of infostealer data can be considered as the “supply chain” for various types of cyberattacks, including ransomware operators looking for the details of potential victims, those involved in business email compromise, and even initial access brokers who can sell the details along again to other cybercriminals.

On various cybercrime marketplaces and Telegram, Kivilevich says, there have been more than 7,000 compromised credentials linked to Snowflake accounts being shared. In one instance, a criminal has been touting access to 41 companies from the education sector; another cybercriminal claims to be selling access to US companies with revenues between $50 million and $8 billion, according to Kivilevich’s analysis.

“I don’t think there was one company that came to us and had zero accounts compromised by infostealer malware,” Kivilevich says of the threat that infostealer logs provide to businesses, with KELA saying infostealer-related activity jumped in 2023. Irina Nesterovsky, KELA’s chief research officer, says millions of credentials have been collected by infostealing malware in recent years. “This is a real threat,” Nesterovsky says.

Carmakal says there are multiple steps companies and individuals can take to protect themselves from the threat of infostealers and their aftereffects, including using antivirus or EDR products to detect malicious activity. Companies should be strict on enforcing multifactor authentication across their users, he says. “We try to encourage people to not synchronize passwords on their corporate devices with their personal devices,” Carmakal adds.

The use of infostealers has been working so well that it is all but inevitable that cybercriminals will look to replicate the success of compromise sprees like Snowflake and get creative about other enterprise software services that they can use as entry points for access to an array of different customer companies. Carmakal warns that he expects to see this result in more breaches in the coming months. “There’s no ambiguity about this,” he says. “Threat actors will start hunting for infostealer logs, and looking for other SaaS providers, similar to Snowflake, where they log in and steal data, and then extort those companies.”

Lily Hay Newman, Matt Burgess

Source link

July 29, 2024
Stop X’s Grok AI From Training on Your Tweets

The fallout from CrowdStrike’s deleterious software update came into full view this week as system administrators and IT staffers scrambled to get digital systems back online and return operations to normal. Elsewhere, the Olympics began this week, and Paris is ready with a controversial new surveillance system that hints at a future of ubiquitous CCTV camera coverage. And researchers revealed new findings this week about the innovative malware Russia used in January to sabotage a heating utility in Lviv and cut heat to 600 Ukrainian buildings at the coldest point in the year.

The US Department of Defense has a $141 billion idea to modernize US intercontinental ballistic missiles and their silos around the country. Meanwhile, the European Commission is allocating €7.3 billion for defense research—from drones and tanks to battleships and space intelligence—over the next seven years. And hackers have established a “ghost” network to quietly spread malware on the Microsoft-owned developer platform GitHub.

In more encouraging news, a former Google engineer has built a prototype search engine, dubbed webXray, meant to allow users to find specific privacy violations online, determine which sites are tracking you, and see where all that data goes.

And there’s more. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

Leaked files obtained by The Guardian reveal that the Israeli government took extraordinary measures to prevent information about the Pegasus spyware system from falling into the hands of US courts, including seizing files directly from the company to prevent legal disclosure. The spyware is the product of the Israel-based NSO Group. It allows users to infect smartphones, extract messages and photos, record calls, and secretly activate microphones. NSO Group faces legal action in the US brought by WhatsApp, which claims the company engineered Pegasus to target users of its messaging software. According to WhatsApp, more than 1,400 of its users were targeted. NSO, whose software has been allegedly tied to the harassment and murder of journalist Jamal Khashoggi, has denied any wrongdoing.

In an effort to thwart BIOS-based threats, prompted in part by the rollout of a powerful rootkit designed by a Chinese researcher in 2007, Secure Boot became a widely adopted tool. Unfortunately, researchers at the security firm Binarly have revealed that Secure Boot is now “completely compromised” on more than 200 device models, affecting major hardware manufacturers like Dell, Acer, and Intel. The incident was the result of a weak cryptographic key used to establish trust between hardware and firmware systems. AMI, the key’s owner, says it was meant to be used for testing and should never have made its way into production.

Following in Meta’s footsteps, Elon Musk’s X quietly adjusted its settings this week to give the company’s AI system—known as Grok—access to all of its users’ posts. There is a way to prevent Grok from ingesting your posts; however, you cannot perform this action from the mobile app. You’ll need to access X’s Settings using a desktop computer; select Privacy and Safety, then select Grok, and then uncheck the box. Or just head straight here to go directly to the right settings page. (You can also delete your conversation history with Grok, if you have one, by clicking Delete conversation history.)

Dell Cameron, Lily Hay Newman

Source link

July 27, 2024
Cyber Attacks Are Inevitable — So Stop Preparing For If One Happens and Start Preparing For When One Will | Entrepreneur
Opinions expressed by Entrepreneur contributors are their own.
In 2024, organizations faced an average of 1,308 cyber attacks per week in Q1, a 28% rise from the previous quarter and 5% year-over-year. And what’s even worrisome is that cybercrime losses reached $12.8 billion in 2023 and are expected to hit $23.84 trillion by 2027.

Undoubtedly, securing your business in today’s digital business landscape isn’t just about protecting against cyber threats — it’s about resilience.

You can always fall for the latest threats since cybercriminals are becoming increasingly sophisticated while sneaking into business networks. Hence, you need a more robust cybersecurity plan backed by cyber resilience that goes beyond conventional cybersecurity strategy.

Cyber resilience isn’t a buzzword; it’s a necessity and a proactive approach that goes beyond conventional security. It ensures your organization withstands and recovers from potential threats without much impact on your business.

In a nutshell, cyber resilience is about building walls of protection and having the resilience to bounce back stronger.

Let’s discover why embracing resilience should be a top priority for businesses to ensure continuity and future success in the ever-expanding cybersecurity landscape.

Related: There’s No Margin for Error in Cybersecurity — Here’s How to Build a Strong Online Defense through Everyday Habits

Why your business needs cyber resilience

Cyber resilience is your organization’s ability to prevent, withstand and smoothly recover from various cybersecurity incidents. Cyber resilience isn’t about preventing cyberattacks — it’s about ensuring your organization can swiftly recover and continue to operate after an incident.

Nobody can predict the next threat to your organization and customers, especially in an era where machine learning and artificial intelligence have broadened the horizons and increased threat vectors.

Hence, a robust incident response plan is undeniably the need of the hour for businesses that are about to reinvent their cybersecurity posture.

Remember, a cybersecurity strategy lacking a robust incident response plan is good for nothing since cybercriminals are already exploring new ways to target end users and customers to exploit their personal information and gain access to sensitive business details.

On the other hand, cyber resilience not only ensures stringent cybersecurity against immediate threats but eventually mitigates long-term costs. Hence, investing in cyber resilience would surely safeguard your business from financial devastation and ensure smooth continuity.

Now that we’ve learned about cyber resilience and its importance, let’s emphasize how you can incorporate it into your business.

Related: 3 Reasons to Increase Your Cybersecurity Protocols in 2024

Is your organization truly protected?

Most businesses mistake cyber resilience for cybersecurity. However, they are pretty different and hold their own importance at different levels.

Securing your organization against modern threats is crucial, but it’s also important to prepare for the worst. For example, you must have a plan to deal with a data or privacy breach.

If you wish to protect your organization from the latest threats, your cybersecurity must include a comprehensive cyber resilience checklist.

Whether it is regular audits, employee training, or advanced threat detection through technology, you must always be geared up to handle any cyber incident.

Your cybersecurity checklist to supercharge your cyber resilience

1. Regular security audits

Scheduled audits are crucial to uncover potential threats and vulnerabilities before cybercriminals can exploit them. Addressing the issues well in advance can help you prepare a solid plan for the worst-case scenario and bounce back stronger.

Here’s what you can do:
- Look for outdated software: It’s crucial to check and update your defense software and firewalls since outdated software is more susceptible to ransomware attacks and other threats.
- Incidence response drill: Organizing an incident response drill will help identify gaps in your communication protocol and eventually help you overcome the delayed response time during a cyberattack. Hence, scheduling quarterly incident response drills is crucial once you’ve completed the security audit.
- Engage third-party experts: Involving third-party cybersecurity experts can provide an unbiased evaluation of your security measures and help create a robust cyber resilience program. Experts can uncover vulnerabilities your internal teams might overlook and help prepare an action response plan accordingly.
2. Strengthening your human firewall through employee training and awareness programs

Human error leads to cybersecurity breaches. Ensuring your employees are well-trained to handle any vulnerability is critical to building cyber resilience.
- Regular training sessions: Regular training and updating your employees on the latest threat vectors and best practices are essential. Using real-world scenarios to illustrate various threats and their corresponding responses would shield your organization from potential threats and minimize losses during an unforeseen event.
- Phishing simulations: Implementing phishing simulations to test your employees’ ability to recognize and respond to phishing attacks is crucial for safeguarding sensitive information. Using the results to identify improvement areas will help tailor training to minimize human error.
- Clear policies and procedures: Establishing clear cybersecurity procedures and policies within your organization is crucial to building resilience. Ensure the policies are easily accessible and understood by everyone in the organization.
3. Building a robust incident response team is your frontline defense

A dedicated incident response team is all you need for swift and effective action during a cybersecurity incident. This will help minimize the impact, leading to fewer financial and reputational losses.
- Define roles and responsibilities: You must clearly define roles and responsibilities for every team member regardless of their job title and experience. It’s crucial to ensure that everyone knows their duties and responsibilities promptly during an incident and the situation.
- Invoke the potential of modern tools and technologies: Using threat intelligence tools, data encryption, multi-factor authentication (MFA), and Zero Trust architecture can reinforce your overall cybersecurity resilience program.
- Continuous improvement: Conducting a thorough review to identify areas for improvement after every drill and incident. This will help you continuously update your incident response plan based on the recent findings.
Final thoughts

In this modern digital business landscape, the increasing cyber threats and sophistication of cybercriminals demand next-level security — cyber resilience.

Cyber resilience is a vital strategy for businesses to ensure they stay up and running even in the event of a cyber incident and can quickly contain a breach without financial and reputational losses.

Hence, embracing cyber resilience shouldn’t be a luxury; it must be an essential pillar of your cybersecurity foundation.
Rakesh Soni

Source link
July 26, 2024
A North Korean Hacker Tricked a US Security Vendor Into Hiring Him—and Immediately Tried to Hack Them

KnowBe4, a US-based security vendor, revealed that it unwittingly hired a North Korean hacker who attempted to load malware into the company’s network. KnowBe4 CEO and founder Stu Sjouwerman described the incident in a blog post this week, calling it a cautionary tale that was fortunately detected before causing any major problems.

“First of all: No illegal access was gained, and no data was lost, compromised, or exfiltrated on any KnowBe4 systems,” Sjouwerman wrote. “This is not a data breach notification, there was none. See it as an organizational learning moment I am sharing with you. If it can happen to us, it can happen to almost anyone. Don’t let it happen to you.”

KnowBe4 said it was looking for a software engineer for its internal IT AI team. The firm hired a person who, it turns out, was from North Korea and was “using a valid but stolen US-based identity” and a photo that was “enhanced” by artificial intelligence. There is now an active FBI investigation amid suspicion that the worker is what KnowBe4’s blog post called “an Insider Threat/Nation State Actor.”

KnowBe4 operates in 11 countries and is headquartered in Florida. It provides security awareness training, including phishing security tests, to corporate customers. If you occasionally receive a fake phishing email from your employer, you might be working for a company that uses the KnowBe4 service to test its employees’ ability to spot scams.

Person Passed Background Check and Video Interviews

KnowBe4 hired the North Korean hacker through its usual process. “We posted the job, received résumés, conducted interviews, performed background checks, verified references, and hired the person. We sent them their Mac workstation, and the moment it was received, it immediately started to load malware,” the company said.

Even though the photo provided to HR was fake, the person who was interviewed for the job apparently looked enough like it to pass. KnowBe4’s HR team “conducted four video conference based interviews on separate occasions, confirming the individual matched the photo provided on their application,” the post said. “Additionally, a background check and all other standard pre-hiring checks were performed and came back clear due to the stolen identity being used. This was a real person using a valid but stolen US-based identity. The picture was AI ‘enhanced.'”

The two images at the top of this story are a stock photo and what KnowBe4 says is the AI fake based on the stock photo. The stock photo is on the left, and the AI fake is on the right.

The employee, referred to as “XXXX” in the blog post, was hired as a principal software engineer. The new hire’s suspicious activities were flagged by security software, leading KnowBe4’s Security Operations Center (SOC) to investigate:

On July 15, 2024, a series of suspicious activities were detected on the user beginning at 9:55 pm EST. When these alerts came in KnowBe4’s SOC team reached out to the user to inquire about the anomalous activity and possible cause. XXXX responded to SOC that he was following steps on his router guide to troubleshoot a speed issue and that it may have caused a compromise.

The attacker performed various actions to manipulate session history files, transfer potentially harmful files, and execute unauthorized software. He used a Raspberry Pi to download the malware. SOC attempted to get more details from XXXX including getting him on a call. XXXX stated he was unavailable for a call and later became unresponsive. At around 10:20 pm EST SOC contained XXXX’s device.

“Fake IT Worker From North Korea”

The SOC analysis indicated that the loading of malware “may have been intentional by the user,” and the group “suspected he may be an Insider Threat/Nation State Actor,” the blog post said.

“We shared the collected data with our friends at Mandiant, a leading global cybersecurity expert, and the FBI, to corroborate our initial findings. It turns out this was a fake IT worker from North Korea,” Sjouwerman wrote.

KnowBe4 said it can’t provide much detail because of the active FBI investigation. But the person hired for the job may have logged into the company computer remotely from North Korea, Sjouwerman explained:

How this works is that the fake worker asks to get their workstation sent to an address that is basically an “IT mule laptop farm.” They then VPN in from where they really physically are (North Korea or over the border in China) and work the night shift so that they seem to be working in US daytime. The scam is that they are actually doing the work, getting paid well, and give a large amount to North Korea to fund their illegal programs. I don’t have to tell you about the severe risk of this. It’s good we have new employees in a highly restricted area when they start, and have no access to production systems. Our controls caught it, but that was sure a learning moment that I am happy to share with everyone.

This story originally appeared on Ars Technica.

Jon Brodkin, Ars Technica

Source link

July 26, 2024
How to avoid another CrowdStrike-type outage | Bank Automation News

CrowdStrike continues to manage the fallout from its IT outage July 19 as it works on remediation plans with the banks, airlines and stock exchanges that were brought to a halt by the tech meltdown. The cybersecurity firm last Friday released a patch, or a software update that addresses security vulnerabilities, on its Falcon […]

Whitney McDonald

Source link

July 22, 2024
Bank of America, JPM, TD and Visa affected by global CrowdStrike outages | Bank Automation News

Banks, airlines and other organizations using Microsoft have reported down systems across the globe as cybersecurity firm CrowdStrike is suffering from the biggest IT outage in history. “CrowdStrike has identified a cybersecurity issue related to a recent update that has impacted Windows systems globally,” Gokul Mahendran, digital marketing lead at industrial automation company, Barani Generic […]

Vaidik Trivedi

Source link

July 19, 2024
Huge Microsoft Outage Linked to CrowdStrike Takes Down Computers Around the World

Banks, airports, TV stations, hotels, and countless other businesses are all facing widespread IT outages, leaving flights grounded and causing widespread disruption, after Windows machines have displayed errors worldwide.

In the early hours of Friday, companies in Australia running Microsoft’s Windows operating system started reporting devices showing Blue Screens of Death (BSODs). Shortly after, reports of disruptions started flooding in from around the world, including from the UK, the Netherlands, and the US: TV station Sky News went offline, and US airlines United, Delta, and American Airlines issued a “global ground stop” on all flights.

The widespread Windows outages have been linked to a software update from cybersecurity giant Crowdstrike. It is not believed the issues are linked to a malicious cyberattack. Engineers from the company posted to the company’s Reddit forum that it has seen “widespread reports of BSODs on Windows hosts” occurring across its software, is working on the problem, and has advised a workaround for impacted systems.

The incident, so far, appears to only be impacting devices running Windows and not other operating systems. It is unclear exactly how widespread the issues are and how long they will take to resolve. Microsoft and Crowdstrike did not immediately respond to WIRED’s requests for comment on the outage.

However, the incident could result in “millions” being lost by organizations impacted who have had to halt their operations or stop business, says Lukasz Olejnik, an independent cybersecurity consultant, who says the Crowdstrike update appears to be linked to its Falcon Sensor product. The Falcon system is part of Crowdstrike’s security tools and can block attacks on systems, according to the company.

“It reminds us about our dependence on IT and software,” Olejnik says. “When a system has several software systems maintained by various vendors, this is equivalent to placing trust on them. They may be a single point of failure—like here, when various firms feel the impact.”

This is a developing story and is being updated with new information.

Matt Burgess

Source link

July 19, 2024
Russian duo confess to cyber heist that forced $500 million in ransom payments

Two Russian nationals pleaded guilty to their roles in ransomware attacks in the U.S., Asia, Europe and Africa for a notorious hacking gang known as LockBit.

Ruslan Magomedovich Astamirov and Mikhail Vasiliev admitted they helped to deploy the ransomware variant, which first appeared in 2020. It soon became one of the most destructive in the world, leading to attacks against more than 2,500 victims and ransom payments of at least $500 million, according to the Justice Department.

The men pleaded guilty Thursday in federal court in Newark, New Jersey, where six people have been charged over LockBit attacks, including Dimitry Yuryevich Khoroshev, described by the US as the creator, developer and administrator of the group. US authorities are offering a reward of up to $10 million for his arrest.

Astamirov, 21, of the Chechen Republic, and Vasiliev, 34, of Bradford, Ontario, pleaded guilty to charges including conspiracy to commit computer fraud and abuse.

LockBit is the name of a ransomware variant, a type of malicious code that locks up computers before hackers demand a ransom to unlock them. Hacking gangs are often known by the name of their ransomware variant. LockBit successfully deployed a ransomware-as-a-service model, in which “affiliates” lease the malicious code and do the actual hacking, in exchange for paying the the gang’s leaders a cut of their illegal proceeds. Astamirov and Vasiliev were affiliates, according to the Justice Department.

In recent years, the US and its allies have aggressively tried to curb ransomware attacks by sanctioning hackers or entities associated with them or disrupting the online infrastructure of cybercriminal gangs. But many hackers are located in places such as Russia, which provide them safe haven, making it difficult for Western law enforcement to arrest them.

In February, US and UK authorities announced they disrupted LockBit operations, arresting alleged members, seizing servers and cryptocurrency accounts, and recovering decryption keys to unlock hijacked data.

“We’ve dealt significant blows to destructive ransomware groups like LockBit, as we did earlier this year, seizing control of LockBit infrastructure and distributing decryption keys to their victims,” said Deputy Attorney General Lisa Monaco, in a statement.

Vasiliev deployed LockBit against at least 12 victims, including an educational facility in the UK and a school in Switzerland, the US said. He was arrested by Canadian authorities in November 2022 and extradited to the US in June.

Astamirov was arrested by the FBI last year. In May 2023, he agreed to an interview with FBI agents in Arizona, where they seized his electronic devices. He initially denied having anything to do with an email account through a Russian-based provider, but agents later found records related to it on his devices, according to the arrest complaint. Records showed that Astamirov used the email to “create multiple online accounts under names either fully or nearly identical to his own name,” the complaint said.

After August 2020, Astamirov executed cyberattacks on at least five victims, according to the FBI complaint. They included: businesses in France and West Palm Beach, Florida; a Tokyo firm, which refused to pay a ransom, leading the group to post stolen data on a “leak site” of extortion victims; a Virginia company that stopped an attack after 24,000 documents were stolen; and a Kenyan business that agreed to pay ransom after some of its stolen data was posted to the LockBit website.

Both are scheduled to be sentenced on Jan. 8, 2025.

Recommended Newsletter:

CEO Daily provides key context for the news leaders need to know from across the world of business. Every weekday morning, more than 125,000 readers trust CEO Daily for insights about–and from inside–the C-suite. Subscribe Now.

David Voreacos, Bloomberg

Source link

July 18, 2024
The US Supreme Court Kneecapped US Cyber Strategy

The Commerce Department could hit a legal snag with its proposal to require cloud companies to verify their customers’ identities and report on their activities. The pending rule, part of an effort to clamp down on hackers’ misuse of cloud services, has drawn industry criticism for alleged overreach. A major tech trade group warned Commerce that its “proposed regulations risk exceeding the rulemaking authority granted by Congress.” (Commerce declined to comment.)

Lawsuits could also target other regulations—including data breach reporting requirements from the Federal Trade Commission, the Federal Communications Commission, and financial regulators—that rely on laws written long before policymakers were thinking about cybersecurity.

“A lot of the challenges where the agencies are going to be most nervous [are] when they’ve been interpreting something for 20 years or they newly have interpreted something that’s 30 years old,” says the cyber attorney.

The White House has already faced one major setback. Last October, the Environmental Protection Agency withdrew cyber requirements for water systems that industry groups and Republican-led states had challenged in court. Opponents said the EPA had exceeded its authority in interpreting a 1974 law to require states to add cybersecurity to their water-facility inspections, a strategy that a top White House cyber official had previously praised as “a creative approach.”

All Eyes on Congress

The government’s cyber regulation push is likely to run headlong into a judicial morass.

Federal judges could reach different conclusions about the same regulations, setting up appeals to regional circuit courts that have very different track records. “The judiciary itself is not a monolith,” says Geiger, of the Center for Cybersecurity Policy and Law. In addition, agencies understand cutting-edge tech issues much better than judges, who may struggle to parse the intricacies of cyber regulations.

There is only one real solution to this problem, according to experts: If Congress wants agencies to be able to mandate cyber improvements, it will have to pass new laws empowering them to do so.

“There is greater onus now on Congress to act decisively to help ensure protection of the critical services on which society relies,” Geiger says.

Clarity will be key, says Jamil Jaffer, the executive director of George Mason University’s National Security Institute and a former clerk to Supreme Court Justice Neil Gorsuch. “The more specific Congress gets, the more likely I think a court is to see it the same way an agency does.”

Congress rarely passes major legislation, especially with new regulatory powers, but cybersecurity has consistently been an exception.

“Congress moves very, very slowly, but it’s not completely passive [on] this front,” Lilley says. “There’s a possibility that you will see meaningful cyber legislation in particular sectors if regulators are not able to move forward.”

One major question is whether this progress will continue if Republicans seize unified control of the government in November’s elections. Lilley is optimistic, pointing to the GOP platform’s invocation of securing critical infrastructure with heightened standards as “a national priority.”

“There’s a sense across both sides of the aisle at this point that, certainly in some of the sectors, there has been some measure of market failure,” Lilley says, “and that some measure of government action will be appropriate.”

Regardless of who controls Capitol Hill next January, the Supreme Court just handed lawmakers a massive amount of responsibility in the fight against hackers.

“It’s not going to be easy,” Geiger says, “but it’s time for Congress to act.”

Eric Geller

Source link

July 17, 2024
Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages

A group calling itself “NullBulge” published a 1.1-TB trove of data late last week that it claims is a dump of Disney’s internal Slack archive. The data allegedly includes every message and file from nearly 10,000 channels, including unreleased projects, code, images, login credentials, and links to internal websites and APIs.

The hackers claim they got access to the data from a Disney insider and named the alleged collaborator. A person with that name who lists Disney as their current employer did not return WIRED’s request for comment. Whether the hackers actually had inside help remains unconfirmed; they could also have plausibly used info-stealing malware to compromise an employee’s account. Disney did not confirm the breach or return multiple requests for comment about the legitimacy of the stolen data. A Disney spokesperson told the Wall Street Journal that the company “is investigating this matter.”

The data, which appears to have been first published on Thursday, was posted on BreachForums and later taken down, but it is still live on mirror sites.

Roei Sherman, field CTO at Mitiga Security, says he isn’t surprised that a giant like Disney could have a breach of this scale and significance. “Companies are getting breached all the time, especially data theft from the cloud and software-as-a-service platforms,” he says. “It is just easier for attackers and holds bigger rewards.”

Sherman, who reviewed the data in the leak, added that “all of it looks legit—a lot of URLs, conversations of employees, some credentials, and other content.”

The NullBulge site says that it is a “hacktivist group protecting artists’ rights and ensuring fair compensation for their work.” The group claims it hacks only targets that violate one of three “sins.” First: “We do not condone any form of promoting crypto currencies or crypto related products/services.” Second: “We believe AI-generated artwork harms the creative industry and should be discouraged.” And third: “Any theft from Patreons, other supportive artist platforms, or artists in general.”

The group’s “wall of knowledge,” where it lists its data dumps, summarizes the philosophy: “What better way to punish someone than getting them in trouble eh?” Previously, the group targeted the Indian content creator Chief Shifter with a “first shaming.” Then in May, NullBulge posted a “second punch” and teased the Disney breach. “Here is one I never thought I would get this quickly … Disney. Yes, that Disney,” NullBuldge wrote, suggesting that the group may be a single person. “The attack has only just started, but we have some good shit. To show we are serious, here is 2 files from inside.”

In addition to the alleged Slack data, NullBulge posted what appears to be detailed information about the individual whom they claim provided the insider access and data. The leak includes medical records and other personally identifying information, plus the alleged contents of the alleged Disney employee’s 1Password password manager. NullBulge claims to have doxxed the individual in retaliation for cutting off communication and access, although whether the employee actually collaborated with the group in the first place remains unconfirmed.

Security researchers have long warned about corporate Slack accounts as a treasure trove for attackers if compromised. The popular team communication platform is owned by Salesforce and is used by an array of prominent organizations, including IBM, Capital One, Uber, and Disney rival Paramount.

“Disney will probably be targeted a lot more now by opportunistic threat actors,” Sherman warns.

Lily Hay Newman

Source link

July 15, 2024
AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records

Despite the payment and deletion, some AT&T customers and those who communicated with them may still be at risk, given that others may have samples of the data that were not deleted.

The hacker who spoke with WIRED obtained payment from AT&T instead of Binns because, he says, in an odd twist to the case, Binns was arrested in Turkey in May for an unrelated breach dating back to 2021. That one involved a massive theft of data from T-Mobile. AT&T said in its SEC filing that it believed “at least one person” associated with the breach had already been apprehended, but didn’t identify him. 404 Media was first to report on Friday that Binns is allegedly that person.

Binns was indicted in 2022 on 12 counts related to the 2021 hack of T-Mobile “and theft and sale of sensitive files and information” that involved data on more than 40 million people. Binns, however, had moved from the US to Turkey in 2018 with his Turkish mother, according to an interview he gave three years ago to The Wall Street Journal. The indictment remained sealed until this year. Last September, the US learned he could possibly be arrested in Turkey and extradited to the US because he didn’t have Turkish citizenship. Prosecutors in Seattle, near where T-Mobile is based, asked a US court in December to unseal parts of the indictment so they could give it and an arrest warrant to Turkish authorities who were making the final decision on whether Binns could be extradited legally under Turkish law. The court granted the request to unseal in January.

The hacker who received payment from AT&T tells WIRED he believes Binns was arrested in Turkey around May 5, since Binns hasn’t responded to any attempts by him and others to contact him. WIRED contacted the Seattle public defender representing Binns in the T-Mobile case but did not receive a reply.

Binns has had contact with US authorities on a number of occasions and has accused the CIA and other agencies of wild conspiracies to harm and entrap him. As part of a 2020 FOIA lawsuit against the FBI, CIA, and US Special Operations Command to obtain records he claimed they held about him, Binns claimed that CIA contractors spied on him, experimented on him, harassed him, and that one of them pointed a “psychotronic weapon” at his head and used a microwave oven to shock him, among other allegations. He later filed a motion to dismiss his FOIA case, claiming he had filed some documents while “experiencing a psychological episode brought on by intoxication.”

Last October, in the T-Mobile case, Binns wrote to the US District Court in Seattle and said he believed his actions were affected by a chip that had been implanted in his brain when he was an infant. In a certified letter sent to the court and viewed by WIRED, Binns told the judge that he believed a “wireless brain (basal gangliea) stimulation implant or device implanted” shortly after he was born was responsible for “erratic behavior to include irresistible impulses, artificial neurological problems, and the possible commission of crimes.”

The timeline suggests that if Binns is responsible for the AT&T breach, he allegedly did it when he was likely already aware that he was under indictment for the T-Mobile hack and could face arrest for it.

Kim Zetter

Source link

July 14, 2024
The Sweeping Danger of the AT&T Phone Records Breach

From targeted wiretaps to bulk surveillance dragnets, phone companies have been at the center of privacy concerns for decades—and their time in the limelight isn’t over yet. On Friday, telecom giant AT&T announced that it recently suffered a data breach impacting call and text messaging records of “nearly all” its customers. The company is in the process of notifying about 110 million people that they were affected.

AT&T said in a US Securities and Exchange Commission filing that it learned about the data breach on April 19. Attackers exfiltrated data between April 14 and April 25. The company said in its SEC submission that the US Justice Department authorized delayed disclosure of the breach on May 9 and again on June 5, pending investigation. AT&T added that it is “working with law enforcement in its efforts to arrest those involved in the incident.” So far, “at least one person has been apprehended.”

“Yeah, this is really bad,” says Jake Williams, vice president of research and development at the cybersecurity consultancy Hunter Strategy. “What the threat actors stole here are essentially call data records. These are a gold mine in intelligence analysis because they allow someone to understand networks—who is talking to whom and when. And threat actors have data from previous compromises to map phone numbers to identities. But even without identifying data for a phone number, closed networks—where numbers only communicate with others in the same network—are almost always interesting.”

The incident is significant not only because of its sheer scale and reach but because AT&T says it is the latest in a staggering spate of data thefts that resulted from attackers compromising organizations’ Snowflake cloud accounts. Snowflake is a data warehousing platform, and attackers collected its customers’ account credentials in recent months to steal hundreds of millions of records from about 165 Snowflake clients, including Ticketmaster, Santander bank, and LendingTree’s QuoteWizard.

The AT&T data is from both landline and cellular accounts and spans May 1, 2022, to October 31, 2022. A smaller, undisclosed number of people also had records from January 2, 2023, stolen in the breach. The company said on Friday that the data trove “does not contain the content of calls or texts” and does not include the date and time of communications. But attackers did make off with phone numbers and a massive amount of so-called “metadata” about calls and texts, including who contacted whom, call durations, and tallies of a customer’s total calls and texts. The trove also includes some cell site identification numbers—essentially cell tower data that can be used to approximate a cellphone’s location when it made or received a call or text.

The data includes some records of people who are customers of phone carriers—known as “mobile virtual network operators”—that contract with AT&T to use the larger company’s networks and infrastructure for their service. And, crucially, the stolen trove exposes people who have no relationship with AT&T when they communicated with an AT&T customer during the relevant time spans.

Lily Hay Newman

Source link

July 12, 2024