Oktacron - Cyber Security RSS Feeds History

Transatlantic Cable podcast, episode 168

kaspersky Oct 28, 2020 News

In the latest episode of the Kaspersky podcast, we look into recent news about Donald Trump’s campaign website being hacked — briefly — to promote a cryptocurrency scam. It was only a single page, but the hack comes at a critical time in the US election cycle. From there, we move on to a story about a show more ...

psychotherapy clinic in Finland that was hacked. Patients are now finding their details on the dark web, and some have been contacted by an elusive individual called “The Ransom Guy.” To wrap up, we look at a case of fake news in the retail sector. Anyone familiar with the dearly departed Woolworths chain knows it went under in 2008 — but that didn’t stop somebody from creating a (now deleted) UK Woolworths Twitter account and claiming physical stores would be opening “to save 2020.” The story even reached the press, but it was all a hoax. If you liked the podcast, please consider subscribing and sharing with your friends. For more information on the stories we covered, please visit the links below: Trump campaign website briefly defaced in cyber attack Therapy patients blackmailed for cash after clinic data breach Fort Bragg says its Twitter account was “hacked” Woolworths High Street “relaunch” proves a hoax

Security Blueprints of Many Companies Leaked in Hack of Swedish Firm Gunnebo

krebsonsecurity Oct 28, 2020 Data Breaches

In March 2020, KrebsOnSecurity alerted Swedish security giant Gunnebo Group that hackers had broken into its network and sold the access to a criminal group which specializes in deploying ransomware. In August, Gunnebo said it had successfully thwarted a ransomware attack, but this week it emerged that the intruders show more ...

stole and published online tens of thousands of sensitive documents — including schematics of client bank vaults and surveillance systems. The Gunnebo Group is a Swedish multinational company that provides physical security to a variety of customers globally, including banks, government agencies, airports, casinos, jewelry stores, tax agencies and even nuclear power plants. The company has operations in 25 countries, more than 4,000 employees, and billions in revenue annually. Acting on a tip from Milwaukee, Wis.-based cyber intelligence firm Hold Security, KrebsOnSecurity in March told Gunnebo about a financial transaction between a malicious hacker and a cybercriminal group which specializes in deploying ransomware. That transaction included credentials to a Remote Desktop Protocol (RDP) account apparently set up by a Gunnebo Group employee who wished to access the company’s internal network remotely. Five months later, Gunnebo disclosed it had suffered a cyber attack targeting its IT systems that forced the shutdown of internal servers. Nevertheless, the company said its quick reaction prevented the intruders from spreading the ransomware throughout its systems, and that the overall lasting impact from the incident was minimal. Earlier this week, Swedish news agency Dagens Nyheter confirmed that hackers recently published online at least 38,000 documents stolen from Gunnebo’s network. Linus Larsson, the journalist who broke the story, says the hacked material was uploaded to a public server during the second half of September, and it is not known how many people may have gained access to it. Larsson quotes Gunnebo CEO Stefan Syrén saying the company never considered paying the ransom the attackers demanded in exchange for not publishing its internal documents. What’s more, Syrén seemed to downplay the severity of the exposure. “I understand that you can see drawings as sensitive, but we do not consider them as sensitive automatically,” the CEO reportedly said. “When it comes to cameras in a public environment, for example, half the point is that they should be visible, therefore a drawing with camera placements in itself is not very sensitive.” It remains unclear whether the stolen RDP credentials were a factor in this incident. But the password to the Gunnebo RDP account — “password01” — suggests the security of its IT systems may have been lacking in other areas as well. After this author posted a request for contact from Gunnebo on Twitter, KrebsOnSecurity heard from Rasmus Jansson, an account manager at Gunnebo who specializes in protecting client systems from electromagnetic pulse (EMP) attacks or disruption, short bursts of energy that can damage electrical equipment. Jansson said he relayed the stolen credentials to the company’s IT specialists, but that he does not know what actions the company took in response. Reached by phone today, Jansson said he quit the company in August, right around the time Gunnebo disclosed the thwarted ransomware attack. He declined to comment on the particulars of the extortion incident. Ransomware attackers often spend weeks or months inside of a target’s network before attempting to deploy malware across the network that encrypts servers and desktop systems unless and until a ransom demand is met. That’s because gaining the initial foothold is rarely the difficult part of the attack. In fact, many ransomware groups now have such an embarrassment of riches in this regard that they’ve taken to hiring external penetration testers to carry out the grunt work of escalating that initial foothold into complete control over the victim’s network and any data backup systems — a process that can be hugely time consuming. But prior to launching their ransomware, it has become common practice for these extortionists to offload as much sensitive and proprietary data as possible. In some cases, this allows the intruders to profit even if their malware somehow fails to do its job. In other instances, victims are asked to pay two extortion demands: One for a digital key to unlock encrypted systems, and another in exchange for a promise not to publish, auction or otherwise trade any stolen data. While it may seem ironic when a physical security firm ends up having all of its secrets published online, the reality is that some of the biggest targets of ransomware groups continue to be companies which may not consider cybersecurity or information systems as their primary concern or business — regardless of how much may be riding on that technology. Indeed, companies that persist in viewing cyber and physical security as somehow separate seem to be among the favorite targets of ransomware actors. Last week, a Russian journalist published a video on Youtube claiming to be an interview with the cybercriminals behind the REvil/Sodinokibi ransomware strain, which is the handiwork of a particularly aggressive criminal group that’s been behind some of the biggest and most costly ransom attacks in recent years. In the video, the REvil representative stated that the most desirable targets for the group were agriculture companies, manufacturers, insurance firms, and law firms. The REvil actor claimed that on average roughly one in three of its victims agrees to pay an extortion fee. Mark Arena, CEO of cybersecurity threat intelligence firm Intel 471, said while it might be tempting to believe that firms which specialize in information security typically have better cybersecurity practices than physical security firms, few organizations have a deep understanding of their adversaries. Arena said this is a particularly acute shortcoming with many managed service providers (MSPs), companies that provide outsourced security services to hundreds or thousands of clients who might not otherwise be able to afford to hire cybersecurity professionals. “The harsh and unfortunate reality is the security of a number of security companies is shit,” Arena said. “Most companies tend to have a lack of ongoing and up to date understanding of the threat actors they face.”

Episode 192: It’s Showtime! Are Local Governments Ready To Turn Back Election Hacks?

securityledger Oct 28, 2020 Business

Election day is almost here. After years of warnings, are state and local governments ready for what Russia, Iran or any number of ransomware gangs have in store for them? The post Episode 192: It’s Showtime! Are Local Governments Ready To Turn Back Election Hacks? appeared first on The Security Ledger. Related show more ...

StoriesSpotlight Podcast: Taking a Risk-Based Approach to Election SecurityPublic Sector Mega-Vendor Tyler Technologies Says It Was HackedSpotlight Podcast: CTO Zulfikar Ramzan on RSA’s Next Act: Security Start-Up

The lowly DDoS attack is still a viable threat for undermining elections

cyware Oct 28, 2020 Expert Blogs and Opinion

Though DDoS attacks are not the most significant threat, a suspected 2018 DDoS attack in Knox County, Tennessee during its mayoral primary likewise turned out to be a red herring, NBC News reported.

Flaws in Winston Privacy Devices Can Expose Networks to Remote Attacks

cyware Oct 28, 2020 Malware and Vulnerabilities

A consultant at offensive security testing company Bishop Fox and an independent researcher discovered a total of 9 vulnerabilities in the device provided by Winston Privacy to customers.

Israeli cyber firm Toka raises $25 mln in private funding

cyware Oct 28, 2020 Companies to Watch

Toka said the funds will be used to further its efforts to develop intelligence-gathering platforms and products and advise governments on building an integrated cyber defense.

Attacks on IoT devices continue to escalate

cyware Oct 28, 2020 Trends, Reports, Analysis

Attacks on IoT devices continue to rise at an alarming rate due to poor security protections and cybercriminals use of automated tools to exploit these vulnerabilities, according to Nokia.

Some Ballot Requests May Be Affected by County Cyber Attack

cyware Oct 28, 2020 Govt., Critical Infrastructure

The cyberattack on October 18 encrypted about 200 computers operated by Chenango County and hackers demanded a ransom of $450 per computer to unlock the files, the county’s IT director said.

DOD, FBI, DHS warn of active North Korean government-linked hacking operation

cyware Oct 28, 2020 Threat Actors

The FBI, DoD, and DHS issued a joint alert Tuesday warning the private sector about what they say is a global hacking operation run by North Korean state-sponsored hackers.

Chinese Attackers' Favorite Flaws Prove Global Threats, Research Shows

cyware Oct 28, 2020 Trends, Reports, Analysis

The 25 vulnerabilities most commonly scanned for and targeted by Chinese nation-state attackers were exploited seven times more often than other flaws in the past six months, researchers reported.

Trump’s campaign website hacked by cryptocurrency scammers

cyware Oct 28, 2020 Breaches and Incidents

President Trump’s campaign website was briefly and partially hacked Tuesday afternoon as unknown adversaries took over parts of the page, replacing them with what appeared to be a cryptocurrency scam.

PE Firm to Acquire Forcepoint From Raytheon

cyware Oct 28, 2020 Companies to Watch

ForcePoint was created in 2015 and unveiled as a new brand in 2016 after Raytheon and Websense inked a $1.9 billion deal with Vista Equity Partners to combine Websense with Raytheon Cyber Products.

Multinational Energy Firm Enel Group Suffers Second Ransomware Attack This Year

cyware Oct 28, 2020 Breaches and Incidents

Netwalker ransomware gang is asking a $14 million ransom, while claiming to have stolen several terabytes from the company and threatens to leak them if the ransom will be not paid.

Ruckus IoT controllers vulnerable to remote takeover via ‘trivial’ chained exploit

cyware Oct 28, 2020 Malware and Vulnerabilities

Two security vulnerabilities in a smart device controller made by Ruckus, which aids the integration of IoT devices, could be chained to achieve unauthenticated remote code execution.

Eagle Eye Networks raises $40M to accelerate growth and AI investment for its Cloud VMS

cyware Oct 28, 2020 Companies to Watch

Eagle Eye Networks has raised $40 million of Series E funding from venture capital firm Accel (Facebook, Spotify, DocuSign) to continue its growth and expand its technology leadership.

TrickBot Malware Variants Discovered in the Wild Despite Recent Takedown

cyware Oct 28, 2020 Malware and Vulnerabilities

According to new findings shared by cybersecurity firm Netscout, TrickBot's authors have moved portions of their code to Linux in an attempt to widen the scope of victims that could be targeted.

Zoom finally adds end-to-end encryption for all, for free – though there are caveats

cyware Oct 28, 2020 Security Products & Services

Zoom has finally added the long-awaited end-to-end encryption to its video conferencing service at no additional cost for all users, whether they are paying subscribers or not.

Furniture Giant Steelcase Struck by Potential Ransomware Attack

cyware Oct 28, 2020 Breaches and Incidents

A multibillion-dollar furniture maker has become the latest major firm hit by a major ransomware attack. Steelcase, the world’s largest maker of office furniture, revealed the attack in an SEC filing.

Employees Aware of Emailed Threats Open Suspicious Messages

cyware Oct 28, 2020 Trends, Reports, Analysis

A survey by Mimecast found 73% of respondents "extensively use" corporate devices for personal tasks such as personal email (47%), financial transactions (38%), and online shopping (35%).

Cyber Espionage Detection Firm Strider Technologies Raises $10 Million

cyware Oct 28, 2020 Companies to Watch

Strider, which claims it has seen rapid growth in demand for its platform, plans to invest the new funds in product research and development, looking to add new modules to its Intelligence Platform.

LinkedIn, Instagram Vulnerable to Preview-Link RCE Security Woes

cyware Oct 28, 2020 Malware and Vulnerabilities

Link previews in popular chat apps such as Facebook Messenger, LINE, Slack, Twitter DMs, Zoom, and others on iOS and Android are a firehose of security and privacy issues, researchers have found.

StackHawk Raises $10M Series A to Put Application Security in the Hands of Developers

cyware Oct 28, 2020 Companies to Watch

The pre-emptive, oversubscribed round was led by Sapphire Ventures and included return seed backers Foundry Group, Costanoa Ventures, Flybridge Capital, and Matchstick Ventures.

Munich Security Conference attendees targeted with Iran-linked spearphishing, Microsoft says

cyware Oct 28, 2020 Threat Actors

Phosphorous, the Iranian hacker group, has disguised as conference organizers and sent fake invitations containing PDF documents with malicious links to over 100 possible invitees of the conferences.

Top 5 industries that fall victim to phishing scams

cyware Oct 28, 2020 Trends, Reports, Analysis

1 in 3 employees are likely to click the links in phishing emails, and 1 in 8 employees are likely to share information requested in a phishing email, a recent study by Keepnet Labs has shown.

How botnets are evolving: from IoT botnets to Hivenets

cyware Oct 28, 2020 Trends, Reports, Analysis

Botnets will recruit new types of connected devices, especially consumer IoT products, such as mobile or wearable devices and other classes of IoT belonging to the industrial device category.

Medical Records of 3.5 Million U.S. Patients Exposed Online via Thousands of Servers

cyware Oct 28, 2020 Breaches and Incidents

The results of 13 million medical examinations relating to around 3.5 million U.S. patients are unprotected and available to anyone on the internet, SecurityWeek has learned.

Experts Weigh in on E-Commerce Security Amid Snowballing Threats

cyware Oct 28, 2020 Expert Blogs and Opinion

The new socially distanced reality is colliding with the crush of an upcoming holiday shopping season, creating an unprecedented opportunity for cybercriminals to capitalize.

Healthcare network security is slowly improving

cyware Oct 28, 2020 Trends, Reports, Analysis

The percentage of devices running Windows unsupported operating systems fell from 71% in 2019 to 32% in 2020 and there have been improvements when it comes to timely patching and network segmentation.

Ransomware attack hits Indian IT managers' confidence too: Survey

cyware Oct 28, 2020 Trends, Reports, Analysis

According to a new Sophos survey, Indian IT managers spent 42 percent of their time focusing on threat prevention and confessed that 27 percent of their time is focused on responding to cyber threats.

FBI: Hackers stole government source code via SonarQube instances

cyware Oct 28, 2020 Threat Intel & Info Sharing

The FBI issued a flash alert warning of hackers stealing data from U.S. government agencies and enterprise organizations via internet-exposed and insecure SonarQube instances.

Akamai Acquires Asavie for Its Mobility, IoT Services

cyware Oct 28, 2020 Companies to Watch

Akamai says the acquisition is part of its strategy to advance 5G security, and it hopes to expand its ability to secure mobile and other cellular devices in distributed enterprise environments.

Global Credential Harvesting Campaign Discovered Using FiercePhish Open Source Framework

cyware Oct 28, 2020 Identity Theft, Fraud, Scams

The campaign, which is hosted on Russian domain infrastructure but does not target Russian users, is globally harvesting credentials from a variety of organizations in the public and private sectors.

FTC receives almost 2 million robocall complaints in nine months

cyware Oct 28, 2020 Trends, Reports, Analysis

According to FTC data, the exact number of received "Do Not Call" complaints since the start of 2020 is 2,814,851, with 1,988,489 of them being related to robocalls and only 624,634 to live callers.

Hacks for sale: inside the Buer Loader malware-as-a-service

cyware Oct 28, 2020 Malware and Vulnerabilities

Buer was first advertised in a forum post on August 20, 2019, under the title “Modular Buer Loader”, described as a new modular bot written in pure C with C&C server code in .NET Core MVC.

Facebook “copyright violation” tries to get past 2FA – don’t fall for it!

cyware Oct 28, 2020 Identity Theft, Fraud, Scams

Ignoring copyright complaints is not really an option, given that social media sites may decide to remove the offending material unilaterally, or even to lock you out of your account temporarily.

Russian Espionage Group Updates Custom Malware Suite

cyware Oct 28, 2020 Threat Actors

The Turla APT is targeting government organizations using custom malware, including an updated trio of implants that give the group persistence through overlapping backdoor access.

Coronavirus-Related Cyberattacks Still A Major Threat

cyware Oct 28, 2020 Trends, Reports, Analysis

Malicious actors, often state-backed, continue to harass people and organizations sensing an opportunity in the COVID-19 situation. The global healthcare system has borne the brunt of increased cyberattacks.

The Increasing Extent of Damage Caused by Botnets

cyware Oct 28, 2020 Malware and Vulnerabilities

The KashmirBlack botnet has already successfully infected thousands of websites running popular CMS frameworks, including Joomla, WordPress, Drupal, and Magneto.

Payment and Data Security Firm Bluefin Raises $25 Million

cyware Oct 28, 2020 Companies to Watch

The funding round was led by Macquarie Capital Principal Finance, a division of Macquarie Group Limited. Bluefin’s current investors are Napier Park Global Capital and Camden Partners.

German infectious disease agency hit by hackers days before arson attack: Spiegel

cyware Oct 28, 2020 Breaches and Incidents

Germany’s Robert Koch Institute for infectious disease control was hit by a cyberattack days before its headquarters was the target of an arson attempt, Der Spiegel reported on Wednesday.

DDoS attacks in Q3 2020

cyware Oct 28, 2020 Trends, Reports, Analysis

The most newsworthy incidents in Q3 were extortion attacks allegedly carried out by actors known for hiding behind variously named APT groups: FancyBear, Armada Collective, Lazarus, and others.

Microsoft Introduces New Password Spray Detection for Azure

cyware Oct 28, 2020 Security Products & Services

With one or two attempts per day, which fall within normal login patterns, such attacks typically go undetected and traditional protections such as password lockout and IP blocking are bypassed too.

Trump Campaign Website Defaced In Apparent Hack

packetstormsecurity Oct 28, 2020 headline,hacker,government,usa

Experian Told To Stop Sharing Data Without Consent

packetstormsecurity Oct 28, 2020 headline,privacy,cybercrime,data loss,fr

ICE, IRS Explored Using Hacking Tools, New Documents Show

packetstormsecurity Oct 28, 2020 headline,hacker,government,privacy,usa,s