Oktacron - Cyber Security RSS Feeds History

A brief guide to fintech security

kaspersky Nov 30, 2020 Business

In 2019, the global stock market grew by $17 trillion, and despite world markets being battered — to put it mildly — by the pandemic, interest in investment has not gone away. Since the beginning of 2020, the number of trading app users has only risen. On the downside, the assets and personal data of e-traders are show more ...

attractive prey for cybercriminals, and in the event of an incident, it is trading platform operators that have to deal with the consequences. In this post, we talk about the main threats companies face and how to defeat them. App vulnerabilities Like any software, trading platforms have vulnerabilities. In 2018, cybersecurity expert Alejandro Hernandez found holes in 79 such apps including not using encryption to store or transmit data (anyone could see or change it) and not logging out users after a period of inactivity. Design-level flaws included permitting weak passwords. A year later, analysts at ImmuniWeb carried out similar research and reached an equally negative conclusion: Out of the 100 fintech developments they tested, all were vulnerable to some extent. Issues were found in both Web and mobile apps, with many bugs inherited from third-party developments and tools used by the programmers. For some of the vulnerabilities, patches had long existed but hadn’t been applied. One such patch was released back in 2012, but the authors of the fintech app never got around to installing it. As sure as night follows day, if a product has security issues, they will make themselves known, potentially harming companies’ reputations and scaring away customers. And if, as a result of a bug in an app, users suffer a data leak or financial loss, the developer could face a big fine or be forced to pay damages. Sometimes, a platform’s creator is the only victim. For example, the authors of the Robinhood trading app failed to spot a bug that allowed premium users to borrow unlimited funds from the platform to trade securities — and one user borrowed a million dollars against a deposit of just $4,000. Traders dubbed it the “infinite money cheat code.” To avoid losses associated with bugs and vulnerabilities, trading platform coders need to consider security in the development stage, thinking in advance about such things as automatic user logout, encryption, and a ban on weak passwords. They should also regularly review the code for errors and fix them promptly. Supply-chain attacks To save time and money, most companies not only write their own code, but also employ third-party developments, frameworks, and services. If a provider’s infrastructure is compromised, the companies that use it can also suffer. That’s what happened to currency broker Pepperstone, for example. In August 2020, cybercriminals infected the computers of a company contractor, gaining access to its account in Pepperstone’s CRM system. Although the break-in was quickly neutralized, the attackers still managed to steal some client data. The broker says its financial and trading systems were not affected. All the same, recall that data leaks can be very costly for companies even if third-party code is to blame. To avoid potential burns, always choose reliable, security-minded partners, and never rely on their protection mechanisms alone. Any company in the field of finance should adopt a stringent security policy. Spear-phishing The human factor is often the cause of cyberincidents. That’s why attackers use company employees to infiltrate corporate infrastructures. In that context, in July of this year, cybersecurity researchers connected a series of attacks on fintech institutions in the EU, the UK, Canada, and Australia to the APT group Evilnum. The cybercriminals sent e-mails to company employees with a link to a ZIP archive hosted in a legitimate cloud service. The messages were disguised as business correspondence, and the archive contents as documents or images. Although the promised document or image appeared on the screen, opening it set the infection chain in motion. Sometimes attackers break into corporate e-mail accounts, which makes their phishing even more convincing. In August of this year, such an attack hit trading company Virtu. According to company reps, cybercriminals got into the mailbox of a top manager and spent the next two weeks sending e-mails to the accounting department with instructions to transfer large sums of money to China. Blind trust cost the company close to $11 million. To repel such attacks, cybersecurity staff needs proper training. Compile a list of phishing red flags in e-mails and use it to engineer a course of action in the event that a colleague, partner, or client asks you (or seems to be asking you) to send a couple of million — or even a bit less than that — to Jane Doe. Client problems Sometimes users lose money through no fault of your company or app — by downloading malware, entering passwords on phishing sites, or otherwise acting irresponsibly. Here too, alas, they may make claims against the trading platform. In some countries, companies are legally bound at least to figure out what happened, so it is worth warning traders from time to time about potential dangers and urging them to protect themselves (and, by extension, you). It is also a good idea to periodically remind clients that any third-party software, especially if pirated or obtained from dubious sources, can pose a threat. For example, it might steal passwords, including ones for trading accounts. Warn clients that cybercriminals might pose as your service to extract their credentials. Advise them to pay close attention to e-mails about problems with the service, and to carefully check the sender’s address and the message for typos and bad grammar. Recommend they manually enter the URL in a browser, open the app, or call client support in case of any doubt. How to protect your money and reputation Handling money comes with great responsibility, and neglecting security can cost fintech companies a lot. Therefore: Monitor the security of your apps and programs. Scan them for vulnerabilities and show zero tolerance for bugs and errors. Install a reliable security solution on work devices, ideally one that is cloud-based and managed through a single control panel. Train employees in the fundamentals of cybersecurity, so they won’t make mistakes that cost you and your clients money and stress. Use the strictest practicable security policy for employees and third-party suppliers. Remind clients that their money’s security depends largely on them. Recommend they install a security solution on the device they use for trading, and keep it junk-free. Implement security mechanisms in your developments from day 1. That means starting with a ban on weak passwords, encryption, and automatic logout of inactive users as a bare minimum.

Containers Complicate Compliance (And What To Do About It)

securityledger Nov 30, 2020 container

If you work within the security industry, compliance is seen almost as a dirty word. You have likely run into situations like that which @Nemesis09 describes below. Here, we see it’s all too common for organizations to treat testing compliance as a checkbox exercise and to thereby view compliance in a way that goes show more ...

against its entire purpose....Read the whole entry... » Related StoriesEpisode 191: Shifting Compliance Left with Galen Emery of ChefReport: Critical Infrastructure Cyber Attacks A Global CrisisPodcast Episode 189: AppSec for Pandemic Times, A Conversation with GitLab Security VP Jonathan Hunt

Update: Pennsylvania county pays 500K ransom to DoppelPaymer ransomware

cyware Nov 30, 2020 Breaches and Incidents

Delaware County has paid a $500,000 ransom after their systems were hit by the DoppelPaymer ransomware last weekend, after which the County had taken portions of their computer network offline.

HD-PLC Alliance to create the IEEE P1901b standard for using HD-PLC in smart grids and factories

cyware Nov 30, 2020 Govt., Critical Infrastructure

High Definition Power Line Communication (HD-PLC) technology has already been standardized as IEEE 1901 (Broadband over Power Line Networks for MAC and PHY) by the IEEE Standards Association.

Consumption of public cloud is way ahead of the ability to secure it

cyware Nov 30, 2020 Expert Blogs and Opinion

As companies need to build applications to cater for distributed workforces, the use of public cloud is a no-brainer, but as the leaks of S3 buckets show, cloud customers are failing to secure it.

A critical flaw in industrial automation systems opens to remote hack

cyware Nov 30, 2020 Malware and Vulnerabilities

Tracked as CVE-2020-25159, the flaw is rated 9.8 out of 10 on the CVSS score and impacts all versions of EtherNet/IP Adapter Source Code Stack prior to 2.28, which was released on November 21, 2012.

What if there were a vaccine for OT ransomware?

cyware Nov 30, 2020 Expert Blogs and Opinion

The pandemic has digital consequences as well, for both enterprise networks and OT networks. Not only has it brought us more online and forced us into remote work, macro trends continue as well.

Cybercriminals Target Italian Banks with Black Box Attacks

cyware Nov 30, 2020 Breaches and Incidents

The Carabinieri of Monza dismantled the gang. The Italian law enforcement agency confirmed that the cybercrime organization stole about $950,000 in just 7 months using ATM Black Box attack.

The Show Must Go On for State-Sponsored APT Groups

cyware Nov 30, 2020 Trends, Reports, Analysis

Between the second half of 2019 and the first half of 2020, Group-IB researchers have uncovered dozens of attack campaigns carried out by state-sponsored APT groups across different countries.

Industrial IoT Chip Maker AdvanTech Hit by Conti Ransomware Attack

cyware Nov 30, 2020 Breaches and Incidents

The Conti operators hit the systems of industrial automation and IoT chip maker Advantech and is now demanding a $14 million ransom to decrypt affected systems and to stop leaking stolen company data.

CursedGrabber Malware Campaign Leveraging Open-Source Ecosystems

cyware Nov 30, 2020 Malware and Vulnerabilities

The new malware campaign uses npm registry for distribution and steals Discord app tokens, personal information such as payment information, and web browser files of the users.

Office 365 phishing abuses Oracle and Amazon cloud services

cyware Nov 30, 2020 Identity Theft, Fraud, Scams

A complex phishing scheme for stealing Office 365 credentials from small and medium-sized businesses in the U.S. and Australia combines cloud services from Oracle and Amazon into its infrastructure.

Unofficial Patch Released for Windows 7 Zero-Day Vulnerability

cyware Nov 30, 2020 Malware and Vulnerabilities

An unofficial patch is now available through ACROS Security’s 0patch service for a zero-day vulnerability identified earlier this month in Windows 7 and Windows Server 2008 R2.

Australia's Department of Home Affairs wants to expand telco security reform notification requirements

cyware Nov 30, 2020 Laws, Policy, Regulations

In its submission to the PJCIS, Home Affairs suggested additional types of notices "with more nuanced language" to reflect various levels and types of risk and the urgency of adopting further mitigations.

It's hard to keep a big botnet down: TrickBot sputters back toward full health

cyware Nov 30, 2020 Malware and Vulnerabilities

Mounting evidence suggests that TrickBot, the vast botnet that both U.S. Cyber Command and a Microsoft-led coalition sought to disable around the 2020 elections, is on the mend and evolving.

Researchers Discover Biohacking Technique That Can be Used to Create Dangerous Viruses and Toxins

cyware Nov 30, 2020 Malware and Vulnerabilities

Academics from the Ben-Gurion University of the Negev described how "unwitting" biologists and scientists could become victims of cyberattacks designed to take biological warfare to another level.

Notorious Ransomware Gang Hits Producers Of Big Brother, Master Chef And The Voice

cyware Nov 30, 2020 Breaches and Incidents

The cybercriminals behind the DoppelPaymer ransomware have taken credit for the attack. Like many other ransomware crews, the group has taken to publicly identifying its victims on a ‘leak’ site.

Update: University of Vermont Medical Center has yet to fully recover from October cyber attack

cyware Nov 30, 2020 Breaches and Incidents

The ransomware attack has caused variable impacts at each of its affiliates. The hospital announced that only on Tuesday it had restored access to its main electronic records system at the hospital.

UK-based Glasswall raises $24 million to help companies eliminate file-based cyber threats

cyware Nov 30, 2020 Companies to Watch

The round was led by IPGL, and several other high net worth investors including, Lord Rose, Chairman of Ocado, Lance Uggla, Chairman and CEO of IHS Markit, and Andy Bell, founder, and CEO of AJ Bell.

Back-to-Work Phishing Campaign Targeting Corporate Email Accounts

cyware Nov 30, 2020 Identity Theft, Fraud, Scams

Abnormal Security detected one of the campaign’s attack emails that masqueraded as an internal notification from the recipient’s company by using spoofing techniques to disguise the sender address.

Vietnam-Linked Cyberspies Use New macOS Backdoor in Attacks

cyware Nov 30, 2020 Malware and Vulnerabilities

The observed sample masquerades as a Word document but it is an app bundled in a ZIP archive, which features special characters in its name, in an attempt to evade detection.

Ransomware Halts Classes For 115,000 Baltimore Pupils

packetstormsecurity Nov 30, 2020 headline,government,malware,usa,cryptogr

WarGames For Real: How One 1983 Exercise Nearly Triggered WWIII

packetstormsecurity Nov 30, 2020 headline,government,usa,russia,cyberwar,

Hackers Are Targeting MacOS Users With Updated Malware

packetstormsecurity Nov 30, 2020 headline,hacker,malware,apple