Oktacron - Cyber Security RSS Feeds History

What are the Risks in Cybersecurity, and How To Prevent Them?

cyberexpress Mar 22, 2024 What is

The digital world we live in brings endless opportunities for learning, connecting with others, and advancing our careers. However, with these benefits come real risks that too often go overlooked. Each time we access the internet, use an app or send an email, we potentially expose ourselves and our most sensitive show more ...

information to bad actors seeking to do us harm. Cybersecurity threats are growing more advanced and pervasive with each passing day. According to the FBI's IC3 report, cybercrime cost Americans more than $4.2 billion in 2019 alone. Yet many of us don't stop to consider what data of ours is circulating in the dark corners of the web or how a simple phishing email or weak password might give a hacker the key to our digital lives. In this blog post, we will discuss what are risks in cybersecurity and how to prevent them! Table of Contents What are the Risks in Cybersecurity? Why Cyber Risk Management is Essential Common Cybersecurity Risks Common Key Performance Indicators (KPIs) for Assessing Cyber Risk Challenges in Traditional Cybersecurity Risk Measurement Importance of Measuring Financial Costs of Cyber Risk How to Perform A Cybersecurity Risk Assessment The Bottom Line! Key Highlights FAQ's What are Risks in Cybersecurity? Cybersecurity risk refers to the possibility of exposure or harm resulting from cyberattacks or data breaches within an organization. It involves the identification of possible threats and vulnerabilities within digital systems and networks. The risk encompasses not only the likelihood of a cyberattack but also its potential outcomes, such as financial loss, damage to reputation, or disruption of operations. Examples of cybersecurity risks include various malicious activities such as ransomware attacks, where critical data is encrypted and a ransom is demanded for its release, malware that infiltrates systems to steal or corrupt data, and insider threats involving the misuse of access rights by employees. Additionally, phishing attacks, where attackers deceive employees into revealing sensitive information, and poor compliance management, which can lead to vulnerabilities and legal consequences, are prevalent risks. Given these risks, it is imperative for organizations across all industries to prioritize cybersecurity. This entails continually assessing and updating their cybersecurity risk management strategies to address evolving threats. By doing so, organizations can safeguard their assets, uphold customer trust, and mitigate potentially severe financial and reputational repercussions. Proactive measures include ongoing employee training to identify and respond to threats like phishing, stringent compliance protocols, and robust systems for detecting and mitigating malware and ransomware. Why is Cyber Risk Management Essential? In today's technology-driven landscape, businesses rely heavily on IT systems for their day-to-day operations and critical processes. However, as these systems grow in complexity, so does the potential for cyber threats. Factors like the proliferation of cloud services, the shift to remote work, and increased reliance on third-party IT service providers have expanded the attack surface for organizations. Cyber risk management plays a crucial role in helping companies navigate and mitigate these evolving risks, thereby enhancing their overall security posture. 1) Constant Evolution of Threat Landscape The threat landscape is constantly evolving, with thousands of new vulnerabilities and malware variants emerging each month. Managing and mitigating every single vulnerability or threat is neither practical nor financially feasible for organizations. Cyber risk management provides a pragmatic approach by prioritizing security efforts based on the threats and vulnerabilities most likely to impact the organization. This assures that resources are allocated effectively, focusing on high-value assets and critical systems. 2) Compliance with Regulations Cyber risk management initiatives also play a vital role in ensuring compliance with regulatory requirements like the General Data Protection Regulation (GDPR), HIPAA, & Payment Card Industry Data Security Standard (PCI DSS). By incorporating these standards into their security programs, businesses can demonstrate their commitment to protecting sensitive data. The documentation and reports generated during the risk management process can serve as evidence of compliance during audits and investigations. 3) Adherence to Risk Management Frameworks Certain industries and organizations may be required to adhere to specific risk management frameworks, such as the NIST Risk Management Framework (RMF) and the NIST Cybersecurity Framework (CSF). Federal agencies in the US, for example, are mandated to follow these frameworks, and federal contractors often need to comply with them as well, as government contracts typically incorporate NIST standards for cybersecurity requirements. Implementing these frameworks ensures a structured and systematic approach to managing cyber risks. Common Cybersecurity Risks Here are the most common cybersecurity risks: 1) Malware: Malware is a persistent security threat, characterized by the installation of unwanted software on a system, leading to various disruptive behaviors such as program denial, file deletion, data theft, and propagation to other systems. Prevention: Employ up-to-date anti-malware software to proactively defend against malware attacks. Exercise caution when encountering suspicious links, files, or websites to mitigate malware infiltration. Combining vigilance with robust antivirus solutions offers effective protection against malware threats. 2) Password Theft: Password theft involves unauthorized access to accounts through the theft or guessing of passwords, resulting in compromised data and security breaches. Prevention: Implement two-factor authentication to bolster security measures by requiring additional verification for login attempts. Utilize complex passwords to deter brute-force attacks and enhance password security. 3) Traffic Interception: Traffic interception, or eavesdropping, occurs when a third party intercepts communication between a user and host, potentially compromising sensitive information. Prevention: Safeguard against compromised websites by avoiding those lacking proper security measures, such as those not utilizing HTML5. Enhance security by encrypting network traffic, such as through the use of a Virtual Private Network (VPN). 4) Phishing Attacks: Phishing attacks uses social engineering tactics to deceive users into divulging sensitive information, often through fraudulent emails or messages impersonating legitimate entities. Prevention: Exercise caution and skepticism when encountering suspicious emails or messages, particularly those requesting personal information. Be wary of phishing indicators such as spelling and grammar errors, and avoid responding to requests for sensitive data from unverified sources. 5) DDoS (Distributed Denial of Service) Attack: DDoS attacks involve malicious actors overwhelming servers with excessive user traffic, leading to server shutdowns or significantly slowed performance, rendering websites inaccessible. Prevention: Mitigating DDoS attacks requires the identification and blocking of malicious traffic, which can necessitate taking servers offline for maintenance. 6) Cross-Site Scripting (XSS) Attack: XSS attacks target vulnerable websites by injecting malicious code, which is then delivered to unsuspecting users' systems or browsers, potentially causing disruptions or compromising user data. Prevention: Hosts should implement encryption measures to secure websites and offer options to disable page scripts, while users can install script-blocking browser add-ons for additional protection. 7) Zero-Day Exploits: Zero-day exploits exploit undiscovered vulnerabilities in systems, networks, or software, aiming to cause damage, disrupt services, or steal sensitive information. Prevention: Mitigating zero-day exploits relies on prompt vendor detection and release of patches to address vulnerabilities, emphasizing the importance of maintaining vigilant security practices until fixes are available. 8) SQL Injection Attack: SQL injection attacks manipulate SQL queries to access unauthorized information, posing a threat to data security and integrity. Prevention: Employing application firewalls can detect and filter out malicious SQL queries, while developing code with input validation mechanisms helps prevent unauthorized data access. 9) Social Engineering: Social engineering tactics deceive users into divulging sensitive information, leveraging psychological manipulation to exploit human vulnerabilities. Prevention: Users should exercise caution and skepticism towards unsolicited messages, emails, or requests for personal information from unknown sources, remaining vigilant against potential social engineering attempts. 10) Man-in-the-Middle (MitM) Attack: A MitM attack occurs when a third-party intercepts communication between a client and host, often using a spoofed IP address to impersonate one of the parties. This enables the attacker to eavesdrop on sensitive information exchanged between them, such as login credentials during a banking session. Prevention: Utilize encryption protocols and ensure the use of HTML5 to enhance security against MitM attacks. 11) Ransomware: Ransomware is kind of malicious software that encrypts a user's data or restricts access to their system until a ransom is paid to the attacker, posing a significant threat to data security and operational continuity. Prevention: Maintain up-to-date antivirus software, exercise caution when clicking on suspicious links, and regularly back up data to mitigate the impact of ransomware attacks. 12) Cryptojacking: Cryptojacking involves the unauthorized use of a victim's computing resources to mine cryptocurrency, often resulting in performance degradation and increased energy consumption. Prevention: Keep security software and firmware updated, and remain vigilant against potential cryptojacking attempts on unprotected systems. 13) Water Hole Attack: Water hole attacks target organizations by infecting websites frequented by their employees or members, aiming to distribute malicious payloads and compromise their systems. Prevention: Employ proactive measures such as antivirus software to detect and neutralize threats from infected websites. 14) Drive-By Attack: In a drive-by attack, malicious code is automatically downloaded onto a user's system when they visit a compromised website, without requiring any action from the user. Prevention: Be cautious when you are browsing the internet and avoid visiting suspicious websites flagged by search engines or antivirus programs. 15) Trojan Virus: Trojan malware finds itself as legitimate software to deceive users into downloading and executing it, often leading to unauthorized access to their systems or the installation of additional malware. Prevention: Avoid downloading software from untrusted sources and remain vigilant against deceptive tactics used by Trojan viruses to infiltrate systems. Common Key Performance Indicators (KPIs) for Assessing Cyber Risk Here are the common KPI to assess cyber risk: Time to Assess Cyber Risk: The duration it takes for an organization to evaluate and analyze potential cyber risks to its systems and networks. Time to Remediate Cyber Risk: The timeframe required for addressing and resolving identified cyber risks, including implementing necessary security measures and fixes. Identification of OT and IoT Assets Vulnerable to Cyber Risk: The ability to identify operational technology (OT) and Internet of Things (IoT) assets within the organization's infrastructure that are susceptible to cyber threats. Effectiveness in Prioritizing Cyber Risks: The organization's capability to prioritize cyber risks based on their severity, potential impact, and likelihood of occurrence to allocate resources efficiently for risk mitigation. Loss of Revenue: The financial impact resulting from a disruption in business operations or loss of customers due to cyber incidents. Loss of Productivity: The decrease in productivity caused by cyberattacks or security breaches, leading to downtime, delays, or inefficiencies in business processes. Drop in Stock Price: The decline in the organization's stock value attributed to cyber incidents or breaches, affecting investor confidence and market perception. Challenges in Traditional Cybersecurity Risk Measurement Overemphasis on Technical Aspects: Traditional approaches to cyber risk measurement often focus solely on technical aspects without considering broader business and financial impacts. Lack of Strategic KPIs: Many KPIs used for assessing cyber risk are tactical rather than strategic, hindering the ability to prioritize risks effectively for remediation and reduction. Inability to Correlate KPIs with Risk Mitigation: A significant percentage of organizations struggle to correlate KPIs with their effectiveness in mitigating cyber risks, indicating a disconnect between measurement and action. Importance of Measuring Financial Costs of Cyber Risk Executive Understanding and Support: Quantifying the financial costs associated with cyber risks helps executives and key stakeholders comprehend the significance and value of cybersecurity and risk management initiatives. Business Decision-Making: Understanding the financial implications of cyber risks enables leaders to make informed decisions regarding resource allocation, program support, and strategic planning to enhance operational resilience. Building a Strong Use Case: By aligning cyber risk measurements with business goals and objectives, organizations can build a compelling use case for investing in cybersecurity measures that directly contribute to organizational resilience and continuity. How to Perform A Cybersecurity Risk Assessment In today's digital age, cybersecurity is paramount for organizations of all sizes. A risk assessment is an important step in identifying, evaluating, and mitigating potential threats to your organization's digital assets and infrastructure. Here is a step-by-step guide to perform a comprehensive cybersecurity risk assessment: Identify Assets: Begin by identifying all the digital assets within your organization, including hardware, software, data, networks, and personnel. Assess Threats: Identify and assess potential threats that could compromise the confidentiality, integrity, or availability of your assets. This may include external threats like cyberattacks from hackers, as well as internal threats such as accidental data breaches or malicious insider activities. Evaluate Vulnerabilities: Identify vulnerabilities within your organization's systems and networks that could be exploited by threats. This may include outdated software, weak passwords, unpatched systems, or misconfigured security settings. Determine Potential Impact: Assess the potential impact of cybersecurity incidents on your organization, including financial losses, reputational damage, legal liabilities, and operational disruptions. This will help prioritize risk mitigation efforts. Calculate Risk Likelihood and Severity: Determine the likelihood of each identified threat exploiting vulnerabilities and the severity of the potential impact.This will assist in prioritize risks based on their level of risk exposure. Develop Risk Mitigation Strategies: Develop and implement risk mitigation strategies to address identified vulnerabilities and reduce the likelihood and impact of cybersecurity incidents. This may include implementing security controls, conducting employee training, updating software and systems, and establishing incident response plans. Monitor and Review: Continuously monitor and check your organization's cybersecurity posture to identify new threats, vulnerabilities, and risks. Regularly update your risk assessment and mitigation strategies to adapt to the changing cybersecurity landscape. Document and Report: Document all findings, assessments, and mitigation strategies in a comprehensive cybersecurity risk assessment report. Share the report with key stakeholders, including senior management, IT personnel, and relevant departments, to ensure transparency and accountability. By following these steps, organizations can effectively identify, evaluate, and mitigate cybersecurity risks, thereby enhancing their overall security posture and protecting their digital assets and infrastructure from potential threats. The Bottom Line! Cybersecurity risks are a serious and growing concern in our modern digital world. From financial loss to reputational damage, the consequences of cyber attacks can be devastating for businesses and individuals alike. However, as technology continues to advance, some steps can be taken to prevent these risks and protect ourselves against potential threats. Firstly, organizations must prioritize cybersecurity and invest in robust protection measures. This includes regularly updating software, implementing strong passwords and encryption methods, conducting regular employee training on cybersecurity best practices, and having a contingency plan in case of an attack. Additionally, individuals must also take responsibility for their own online security. This means being cautious about what information is shared online, using secure networks when accessing sensitive data or making transactions, and being vigilant against phishing scams or suspicious emails. Key Highlights Cybersecurity risks encompass a range of threats, including malware, phishing attacks, data breaches, and ransomware. Prevention strategies involve implementing robust security measures such as firewalls, antivirus software, and encryption protocols. Employee training and awareness programs play an important role in mitigating risks by educating staff about potential threats and how to avoid them. Regular security assessments, updates, and audits are essential for identifying vulnerabilities and ensuring that preventive measures remain effective. FAQ's Q1: What are the common risks in cybersecurity? A: Common risks in cybersecurity include malware infections, phishing attacks, data breaches, ransomware, DDoS attacks, and insider threats. Q2: How can I prevent malware infections? A: To prevent malware infections, ensure that your antivirus software is up to date, avoid clicking on fraud links or downloading attachments from unknown sources, and regularly review your system for malware. Q3: What steps can I take to protect against phishing attacks? A: Protect yourself against phishing attacks by being cautious of unprotected emails or messages, verifying the sender's identity before hitting on any links or providing sensitive information, and educating yourself and your employees about common phishing tactics. Q4: How can I secure my data to prevent breaches? A: To secure your data and prevent breaches, implement encryption protocols to protect sensitive information, regularly back up your data to an offsite location, and restrict access to confidential data only to authorized personnel. Q5: What measures can I take to defend against ransomware attacks? A: Defend against ransomware attacks by regularly update your operating system and software, by using strong and unique passwords for all accounts, and deploying security solutions like endpoint protection and intrusion detection systems.

Don’t Let Your Data Leak! Understand What is Spillage in Cybersecurity!

cyberexpress Mar 22, 2024 What is

Imagine accidentally sending a confidential email with your boss' salary to the entire company. Think of a disgruntled employee leaking your latest product design to your biggest competitor. These scenarios are data spillage - the uncontrolled leak of sensitive information. It's not a malicious hacker show more ...

breaching your system but a simple human error or system lapse that exposes sensitive information. Believe it or not, data spillage is way more common than breaches. In fact, 68 records are lost or stolen every second! This can have devastating consequences, costing companies millions and tarnishing reputations. However, there are ways you can take to prevent this from happening in the first place. In this article, we’ll talk about what is spillage in cyber security, its types, how it happens, and what steps you can take to prevent it. What Is Spillage in Cyber Security? Spillage in cybersecurity refers to the uncontrolled or unauthorized movement of sensitive or classified information from a secure system or network to an unapproved location. This can encompass a wide range of scenarios, from accidental human error to intentional leaks. Data spillage can have severe consequences for organizations, leading to financial losses, reputational damage, legal repercussions, and even physical harm, depending on the nature of the exposed information. Types of Data Spillage in Cyber Security Data spillage can manifest in various ways, each with its own potential for harm. Here's a breakdown of some common types: Accidental Spillage: This is the most frequent form of spillage, often caused by human error. Examples include sending an email with sensitive information to the wrong recipient, attaching the wrong file to a document, or losing a device containing confidential data. Negligent Spillage: This occurs when individuals fail to follow established security protocols or display a lack of awareness regarding data sensitivity. Sharing passwords, leaving documents unattended, or using unencrypted storage mediums are examples of negligent spillage. Intentional Spillage: This is the deliberate leak of sensitive information, often by disgruntled employees, contractors, or even insiders with malicious intent. Motivations for intentional spillage can range from personal gain to revenge or activism. System Spillage: System vulnerabilities can also lead to spillage. Unpatched software, weak encryption protocols, or misconfigured systems can create pathways for unauthorized access and data exfiltration. How Does a Spillage in Cyber Security Happen? Data spillage incidents can occur through a multitude of pathways, often exploiting a combination of human vulnerabilities and technological weaknesses. Here's a deeper dive into some common causes: Human Error: As highlighted earlier, human error is the leading culprit behind data spillage. Let's explore some specific ways human mistakes can lead to spillage: Misconfigured Email Addresses: A seemingly simple typo in an email address can lead to sensitive information being sent to the wrong recipient. Accidental File Sharing: Attaching the wrong file to an email or uploading confidential documents to a public cloud storage platform can result in unintended data exposure. Lost or Stolen Devices: Losing a laptop, smartphone, or USB drive containing unencrypted sensitive data creates a significant spillage risk. Weak Password Management: Reusing passwords across different accounts or using easily guessable passwords makes it easier for attackers to gain unauthorized access and potentially steal or leak data. Mishandling of Paper Documents: Improper disposal of confidential documents, such as leaving them in unsecured trash bins, can lead to data breaches if accessed by unauthorized individuals. Phishing Attacks: Phishing emails are meticulously crafted attempts to trick users into revealing sensitive information or clicking on malicious links. These links can download malware that steals data or redirect users to fake login pages that capture their credentials. Once attackers gain access to user accounts or systems, they can potentially steal or leak sensitive data, leading to spillage. Malware Infection: Malicious software (malware) like viruses, worms, and ransomware pose a significant threat to data security. These programs can exploit system vulnerabilities to steal data, encrypt files for ransom, or compromise systems, creating avenues for data spillage. Here's a breakdown of how different types of malware can lead to spillage: Keyloggers: These programs track and record every keystroke made on a user's device, potentially capturing sensitive information like passwords and credit card details that can be used for malicious purposes. Data Stealing Malware: These malicious programs are specifically designed to steal data from infected devices, possibly including confidential files, customer records, or intellectual property. Ransomware: While ransomware primarily encrypts files to extort money from victims, some variants can also steal data before encrypting it, potentially leading to data spillage if the stolen information falls into the wrong hands. Weak Access Controls: Inadequate access controls create a significant risk for data spillage. Here are some ways weak access controls can contribute to spillage incidents: Unrestricted Access to Sensitive Data: Granting access to sensitive data to individuals who don't have a legitimate need to know increases the risk of accidental or intentional spillage. Insufficient User Authentication: Relying on weak authentication methods like single-factor authentication (e.g., only username and password) makes it easier for attackers to bypass security measures and access sensitive data, potentially leading to spillage. Privileged Account Abuse: Disgruntled employees or attackers who gain access to privileged accounts with elevated permissions can potentially steal or leak large volumes of sensitive data. Physical Security Lapses: Physical security breaches can also lead to data spillage. Here are some examples: Lost or Stolen Devices: As mentioned earlier, losing a device containing sensitive data creates a spillage risk. Unattended Workstations: Leaving workstations unlocked and unattended while logged into accounts containing sensitive data can allow unauthorized individuals to access and potentially leak information. Unauthorized Access to Data Centers: Inadequate physical security measures in data centers, such as weak access control systems or lax surveillance procedures, can allow unauthorized individuals to gain access to servers and steal data, leading to spillage. Misconfigured Systems: System misconfigurations can create vulnerabilities that attackers can exploit to steal data or compromise systems. Here are some ways misconfigurations can lead to spillage: Unpatched Software: Failure to install security patches promptly leaves systems vulnerable to known exploits that attackers can leverage to gain unauthorized access and potentially steal data. Open Network Shares: Leaving network shares publicly accessible without proper access controls can expose sensitive data to anyone who can access the network. Cloud Storage Misconfigurations: Incorrectly configuring cloud storage settings can lead to unintended data exposure, making it accessible to unauthorized individuals or applications. How Do Data Leaks Affect a Company? A data spillage incident can have a cascading effect on a company, impacting its financial well-being, reputation, competitive edge, and even legal standing. Let's delve deeper into the potential consequences of data leaks: Financial Losses: Fines and Penalties: Data leaks can violate various data privacy regulations, such as GDPR (General Data Protection Regulation) or CCPA (California Consumer Privacy Act). These regulations impose significant fines for non-compliance, leading to substantial financial penalties. Lawsuits and Legal Costs: Customers and partners whose data is exposed in a leak may file lawsuits against the affected company. Legal fees, settlements, and potential judgments can add up to a significant financial burden. Cost of Remediation: Responding to a data leak involves a series of actions to contain the damage, recover lost data, and improve security posture. These activities, including forensic investigations, credit monitoring services for affected individuals, and public relations campaigns, can be quite costly. Loss of Business: News of a data leak can damage a company's reputation and erode customer trust. Customers may choose to take their business elsewhere, leading to a decline in sales and revenue. Reputational Damage: Loss of Customer Trust: Consumers place a high value on data privacy. When a data leak occurs, customers feel their personal information has been compromised, leading to a loss of trust in the company's ability to safeguard their data. Negative Media Coverage: Data leaks often garner significant media attention, portraying the affected company in a negative light. Negative press coverage can damage the company's brand image and erode public confidence. Difficulty Attracting Talent: News of a data leak can damage a company's reputation as a secure and responsible employer. This can make it difficult to attract and retain top talent, hindering the company's growth and innovation. Loss of Competitive Advantage: Exposure of Intellectual Property: Data leaks can expose a company's intellectual property, including trade secrets, product roadmaps, or marketing strategies. Competitors can exploit this information to gain an unfair advantage in the marketplace. Erosion of Customer Loyalty: Customers who have had their data exposed may be hesitant to continue doing business with the company. This can lead to a loss of customer loyalty and a decline in market share. Reduced Investment Opportunities: Investors may be wary of companies with a history of data leaks, hindering the ability to secure funding for future growth initiatives. Legal and Regulatory Issues: Regulatory Investigations: Data leaks can trigger investigations by data protection authorities. Failure to comply with regulations can result in hefty fines, additional sanctions, and even criminal charges in severe cases. Increased Scrutiny: Companies that have experienced a data leak may face increased scrutiny from regulators in the future. This can lead to more stringent compliance requirements and a higher burden of proof regarding data security practices. Employee Impact: Loss of Morale: Employees may feel embarrassed or ashamed if a data leak exposes sensitive customer information entrusted to them. This can lead to a decline in employee morale and a decrease in productivity. Legal Issues for Employees: In some cases, employees may be held personally liable for data leaks caused by negligence or intentional actions. What's the Difference Between Data Breach and Data Spillage? The terms "data breach" and "data spillage" are often used interchangeably, but there's a subtle difference. A data breach refers to a security incident where unauthorized access to data occurs. Hackers might actively exploit system vulnerabilities or social engineering tactics to steal data. On the other hand, data spillage focuses on the uncontrolled movement of data, regardless of whether it's intentional or accidental. The data may not necessarily be stolen, but it ends up in an unauthorized location due to human error, negligence, or system vulnerabilities. While data breaches often lead to spillage, spillage can also occur without a breach. For instance, accidentally sending sensitive data to the wrong recipient would be considered spillage, not a breach. How to Prevent Data Spillage in Cyber Security? Fortunately, there are several measures organizations can implement to significantly reduce the risk of data spillage. Here are some key strategies: Data Classification and Access Control: Classify Data: The first step is to identify and classify sensitive data according to its level of confidentiality. This helps prioritize security measures and restrict access based on the sensitivity of the information. Implement Access Controls: Define clear access control policies that dictate who can access specific data types. Enforce strong authentication protocols like multi-factor authentication to prevent unauthorized access. Minimize Privileges: Follow the principle of least privilege, granting users only the minimum level of access required for their job function. This limits the potential damage if credentials are compromised. Employee Training and Awareness: Security Awareness Programs: Regularly train employees on data security best practices. Educate them on common spillage risks, phishing scams, and how to handle sensitive data responsibly. Phishing Simulations: Conduct simulated phishing attacks to test employee alertness and preparedness. This helps identify knowledge gaps and improve overall awareness. Encourage Reporting: Create a culture where employees feel comfortable reporting suspected spillage incidents without fear of reprisal. Technical Safeguards: Data Loss Prevention (DLP): Implement DLP solutions that monitor and filter data movement across the network. DLP systems can identify and prevent sensitive data from being accidentally transmitted outside authorized channels. Encryption: Encrypt sensitive data at rest and in transit. Encryption renders data unreadable even if intercepted, significantly reducing the risk of exploitation in case of spillage. Regular Patch Management: Maintain a rigorous patch management process to address software vulnerabilities promptly. Outdated software poses a significant security risk and can create pathways for unauthorized access and data spillage. Physical Security Measures: Secure Workstations: Implement physical security measures to protect data on workstations. This could include locking down unused devices, requiring strong passwords, and implementing data encryption on laptops and mobile devices. Data Center Security: Secure data centers with access control systems, video surveillance, and environmental controls to prevent unauthorized physical access and data theft. Incident Response Plan: Develop a Plan: Create a comprehensive incident response plan outlining the steps to take in case of a data spillage incident. This plan should define roles and responsibilities, communication protocols, and data recovery procedures. Regular Testing: Regularly test and update the incident response plan to ensure its effectiveness. Conduct simulation exercises to identify gaps and ensure smooth execution during an actual event. Third-Party Risk Management: Vetting Vendors: Thoroughly vet third-party vendors before granting them access to sensitive data. Ensure they have robust security policies and practices in place to mitigate spillage risks. Contractual Obligations: Include data security clauses in contracts with third-party vendors. These clauses should outline data handling procedures, breach notification requirements, and potential penalties for data spillage. Key Takeaways Data spillage is the uncontrolled movement of sensitive data. It can have serious consequences for businesses, including financial losses, reputational damage, and regulatory violations. While human error is a leading cause of spillage, data breaches, system vulnerabilities, and physical security lapses can also contribute to the problem. Organizations can significantly reduce the risk of spillage by implementing a layered approach that includes data classification, access controls, employee training, technical safeguards, and a robust incident response plan. Prioritizing data security, fostering employee awareness, and constantly adapting to evolving threats are crucial for building a strong defense against data spillage. FAQs 1. What is a cyber spillage? A cyber spillage refers to the unauthorized release, transfer, or exposure of classified or sensitive information onto a system, network, or environment where such information is not authorized to reside. 2. How can cyber security prevent spillage? Cyber security can prevent spillage through various measures such as implementing access controls, encryption, data loss prevention (DLP) solutions, network segmentation, and conducting regular security audits and training. 3. What is an example of a spillage? An example of a spillage could be an employee accidentally sending an email containing sensitive customer information to an incorrect recipient outside the organization, thereby exposing the information to unauthorized individuals. 4. Who is responsible for spillage? The responsibility for spillage often lies with the individual or entity that owns or manages the information or system where the spillage occurred. This could be an employee, a contractor, or the organization itself. 5. What do you do if spillage occurs? If spillage occurs, immediate steps should be taken to contain and mitigate the impact. This may include isolating affected systems, notifying relevant parties, conducting a thorough investigation to determine the cause, and implementing measures to prevent future occurrences.

Petersen Health Care Plunges into Bankruptcy Amid Cyberattack Fallout

cyberexpress Mar 22, 2024 Data Breach News

Petersen Health Care files bankruptcy following a cyberattack on its systems and defaults on government-backed loans. The Illinois-based company, known for its extensive network of nursing homes across the United States, sought refuge under Chapter 11 protection in a Delaware bankruptcy court, burdened by a staggering show more ...

$295 million in debt. Among this debt was a substantial $45 million owed under healthcare facility loans insured by the U.S. Department of Housing and Urban Development. The Petersen Health Care cyberattack was claimed by the Cactus ransomware gang. This cyberattack not only compromised the company’s digital infrastructure but also led to the exposure of sensitive information. Documents, including passports, were leaked as proof of claims by the attackers. While the nature of these documents wasn't explicitly stated, concerns were raised regarding potential breaches of employee data. Fortunately, there was no indication of patient or medical records being compromised, although the extent of file encryption remained unclear. Petersen Health Care Files Bankruptcy Following Financial Troubles Prior to the Petersen Health Care cyberattack and loan defaults, the healthcare facility provider operated various types of facilities, including independent living, memory care, rehabilitation services, skilled nursing, supportive living, and assisted living facilities. With locations spanning across Illinois, Missouri, and Iowa, the company provided vital care services to thousands of individuals. The inability to fulfill payments under the HUD-insured loans prompted Petersen's lenders to take action, resulting in the placement of some properties into receivership. This further disrupted the company’s operations, compounding its financial woes as depicted in court documents, reported 25News. Despite the challenges, Petersen Health Care stated that it remained committed to its mission of providing quality care. The company assured continuity of operations during the bankruptcy proceedings while expressing its intent to restructure debts for a more sustainable future. David Campbell, the chief restructuring officer, articulated the company's determination to emerge from restructuring as a resilient entity, better positioned to serve both its residents and employees. "We will emerge from restructuring as a stronger company with a more flexible capital structure. This will enable us to continue as a first-choice care provider and a reliable employer for our staff", said David Campbell as reported by Reuters. Petersen Health Care Cyberattack Recovery Plans [caption id="attachment_60173" align="alignnone" width="361"] Source: Dark Web[/caption] Petersen Health Care boasted an extensive footprint, operating over 90 nursing homes with nearly 4,000 employees and a capacity to accommodate 6,796 residents. Its services encompassed a wide spectrum of elderly care, ranging from assisted living to hospice care, highlighting its significance within the healthcare domain. The challenges faced by Petersen Health Care were not solely attributed to cyberattacks and loan defaults. Pre-existing factors such as declining demand for nursing homes in rural areas, staffing shortages exacerbated by the COVID-19 pandemic, and unresolved Medicaid reimbursement issues in Illinois had already strained the company’s operations. In response to the financial strain exacerbated by cyberattacks, Petersen missed payments on its HUD loans, resulting in lenders placing 19 locations into receivership. Efforts were made to transition these properties under the receiver’s control, albeit with notable difficulties in meeting demands while addressing larger debt obligations. The Cyber Express also reached out to Petersen Health Care to learn more about the bankruptcy and the mitigation strategies. However, at the time of writing this, no official statement or response has been received. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

CISA Issues Advisory on WebAccess/SCADA Vulnerability: SQL Injection Threatens Industrial Control Systems

cyberexpress Mar 22, 2024 Firewall Daily

The Cybersecurity and Infrastructure Security Agency (CISA) has recently released an essential advisory on Industrial Control Systems (ICS). The CISA One Industrial Control Systems Advisory, marked by CVSS v4 7.1, highlights concerns regarding the WebAccess/SCADA system, manufactured by Advantech. The identified show more ...

vulnerability pertains to SQL Injection, a popular cyberattack attack technique that exploits vulnerabilities in databases by injecting malicious SQL code. Through SQL Injection, attackers manipulate input fields or parameters to execute unauthorized SQL commands, potentially gaining access to sensitive data, modifying records, or taking control of the database server. The One Industrial Control Systems Advisory serves as crucial updates on prevailing security issues, vulnerabilities, and potential exploits affecting ICS systems, offering timely insights for concerned parties and stakeholders. Decoding CISA's One Industrial Control Systems Advisory The identified WebAccess/SCADA vulnerability, if successfully exploited, could grant an authenticated attacker the ability to read or modify a remote database, posing substantial risks to system integrity and data confidentiality. The affected product, Advantech's WebAccess/SCADA, particularly version 9.1.5U, is a browser-based SCADA software widely utilized in critical infrastructure sectors such as manufacturing, energy, and water management systems. The vulnerability stems from CWE-89, involving improper neutralization of special elements used in an SQL command, commonly known as SQL Injection. This flaw enables malicious actors to manipulate SQL commands through user-controllable inputs, potentially bypassing security measures or executing unauthorized commands on the backend database, posing a severe threat to system security. The affected product is deployed extensively across various regions, including East Asia, Europe, and the United States, with its headquarters situated in Taiwan. CISA's discovery of a public Proof of Concept (PoC), authored by Prześlij Komentarz, highlights the urgency of addressing this vulnerability promptly. Background and Researcher Insights In response to the identified WebAccess/SCADA vulnerability, Advantech recommends updating WebAccess/SCADA to version 9.1.6 or higher, emphasizing the criticality of applying patches promptly to mitigate potential risks. CISA emphasizes the importance of implementing defensive measures to minimize the risk of exploitation in industrial control systems. These measures include restricting network exposure for control devices, ensuring they are not accessible from the internet, as well as employing robust network segmentation through firewalls to isolate control system networks from other business networks. Additionally, CISA recommends utilizing secure remote access methods such as Virtual Private Networks (VPNs) and keeping VPN software updated regularly. Before implementing defensive measures, CISA highlights the necessity of conducting comprehensive impact analyses and risk assessments to ensure their effectiveness. Furthermore, CISA provides additional resources and best practices on its website, including technical papers and guidance documents, aimed at fortifying industrial control system assets against cyber threats. Organizations encountering suspicious activities or potential cybersecurity incidents are encouraged to report them to CISA, fostering collaboration and a collective response to online threats. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Apple M-Series Chip Vulnerability Puts Encryption Keys at Risk

cyberexpress Mar 22, 2024 Firewall Daily

An unpatchable vulnerability in Apple's M-series chips has been reported. The Apple M-series chip vulnerability could potentially leak secret encryption keys. This flaw, embedded deep within the architecture of the chips, poses a challenge for the tech giant in terms of addressing security concerns without show more ...

sacrificing performance. The Apple chip vulnerability, discovered by academic researchers and disclosed in a paper published on Thursday, highlights a critical flaw in the M-series chips utilized in Mac devices. It revolves around a side channel that enables attackers to extract confidential keys when the chips execute various cryptographic operations. The Cyber Express has reached out to Apple to learn more about this M-series chip vulnerability and any mitigation strategies to counter cyberattacks on encryption keys. However, at the time of writing this, no official statement or response has been shared. Decoding the Apple M-Series Chip Vulnerability Unlike conventional software vulnerabilities that can be remedied through patches, this issue stems from the inherent design of the silicon itself, rendering direct fixes unfeasible. Foresight News reported that the vulnerability poses a serious risk of leakage of wallet keys, The flaw operates as a side channel, facilitating the extraction of end-to-end keys during encrypted transactions. However, due to its origin in the microarchitecture of the chip, conventional patching methods are ineffective. Instead, addressing this Apple M-Series Chip vulnerability necessitates implementing defensive measures within third-party encryption software. Regrettably, these measures come at a cost, significantly impairing the performance of the affected M-series chips, particularly those belonging to the early M1 and M2 iterations. The vulnerability manifests when targeted encryption operations coincide with the execution of malicious applications possessing standard user system permissions within the same CPU cluster. This intersection creates a loophole that malicious actors can exploit to compromise the integrity of encrypted data. The Role of Data Memory-Dependent Prefetchers Central to this Apple M-Series Chip vulnerability is the chips' data memory-dependent prefetcher (DMP), a hardware optimization designed to enhance system performance by predicting memory addresses likely to be accessed imminently. By proactively loading data into the CPU cache before actual retrieval, the DMP minimizes latency, thereby optimizing computational efficiency. However, this optimization inadvertently introduces a vulnerability, as it opens a side channel through which attackers can extract sensitive information, reported Ars Technica. Security experts have long recognized the risks associated with prefetchers, as they create predictable access patterns that malicious processes can exploit to glean secret key material from cryptographic operations. The unique aspect of this vulnerability lies in the behavior of Apple's DMPs, which occasionally misinterpret data contents as memory addresses, leading to inadvertent leakage of confidential information. This deviation from the constant-time paradigm, a programming approach aimed at ensuring uniform operation durations irrespective of input, underscores the severity of the vulnerability. Exploiting the Vulnerability: The GoFetch Attack Researchers have also revealed a novel attack, dubbed GoFetch, which capitalizes on this Apple M-Series chip vulnerability to extract sensitive cryptographic keys from Apple's M-Series chips. Remarkably, this attack does not necessitate root access but can be executed using standard user privileges, mirroring the permissions granted to typical third-party applications on macOS systems. GoFetch operates by infiltrating the same CPU cluster as the targeted cryptographic application, enabling it to intercept and extract sensitive data during encrypted transactions. This attack methodology has proven effective against both classical encryption algorithms and newer, quantum-resistant encryption protocols, undermining the security posture of affected systems. As a precautionary measure, end users are urged to remain vigilant and stay abreast of updates and mitigation strategies provided by Apple and third-party software vendors. While the immediate focus may be on addressing the specific vulnerabilities disclosed in this research, the broader challenge lies in fortifying the hardware-software ecosystem to withstand future threats effectively. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

Ways to detect and curb Living off the Land (LotL) attacks | Kaspersky official blog

kaspersky Mar 22, 2024 Business

Should serious-minded attackers choose namely your company to target, theyd certainly be looking to gain a long-term, persistent presence in your infrastructure. Some would deploy high-end malware to achieve this – but others prefer not to. Many, in fact, prefer to attack companies by exploiting vulnerabilities, show more ...

stolen credential, and legitimate programs that are already in the system. This technique – known as Living off the Land (LotL) – has many advantages from an attackers point of view: Malicious activity blends in with everyday network and administrative activities. Tools already installed on computers are less likely to trigger endpoint protection (EPP). Theres no need to spend time and resources on developing ones own malicious tools. Such activity doesnt produce obvious indicators of compromise (IoC), making it hard to trace malicious activity and compare attacks across organizations. Many companies fail to collect and store information about network monitoring and day-to-day network activity in sufficient detail, so its impossible to track the evolution of an attack in real time – much less historically. This makes preventing attacks and mitigating their consequences extremely tricky. LotL tactics are used by various groups: spy groups (see here and here), money-minded cybercriminals, and ransomware gangs. Environments prone to LotL attacks LotL attacks can be carried out in any environment: cloud, on-premises, hybrid; on Windows, Linux, and macOS platforms. Incidentally, attacks on macOS are sometimes known as Living off the Orchard – a reference to, yes, apples. In each of these environments, attackers have a variety of tools and techniques at their disposal: Tools useful to attackers are usually called LOLBins (LOL binaries) or LOLBAS (LOL binaries and scripts). We analyzed the most popular LOLBins; a more complete list of all Windows tools seen in attacks can be found in this GitHub repository. To escalate privileges and disable defenses, threat actors can exploit legitimate software drivers, a list of which is available at loldrivers.io. Unix/Linux. An extensive list of tools exploited by attackers can be found in the gtfobins repository on GitHub. macOS. Orchard tools used in attacks are available at io. It should be reiterated here that all the files listed in the links above are legitimate tools. They arent vulnerable per se, but can be used by an attacker whos penetrated a system and gained sufficient privileges. Whats stopping you from detecting LotL? Even if an organization has a high level of information security maturity – with an expert team and advanced protective tools – in practice, defenders may be hampered in detecting LotL attacks due to the following reasons: Non-adapted settings. Even advanced security tools need to be adapted to the specifics of the organization and the particularities of network segmentation, user-server interaction, and typical IT-system operating scenarios. Correlation rules need to be created and customized based on the available threat intelligence and known characteristics of the company. Sometimes defenders rely too heavily on IoC detection, and dont pay enough attention to potentially dangerous behavioral signals. Sometimes InfoSec or IT services use broad exclusion rules and extensive allowlists that include many LOLBAS simply because theyre legitimate applications. All of the above significantly lowers the effectiveness of protection. Inadequate logging. The standard level of logging in many systems doesnt allow for the detection of malicious activity, storage of event parameters sufficient for incident analysis, or reliable differentiation between legitimate administrative actions and malicious ones. Insufficient automation. Malicious actions in a heap of logs can only be detected after preliminary filtering and removal of background noise. The most effective filtering is telemetry from EDR, which collects relevant telemetry, increases flexibility in detecting attacker techniques, and reduces false positives. Without filtering and automated analysis, logs are useless. There are simply too many of them. Isolation from IT. The above issues would be especially acute if IT and InfoSec services have little interaction: InfoSec is unfamiliar with IT work regulations, tool settings, and so on. In addition, if the teams dont talk to each other, an investigation into suspicious activity can drag on for weeks or even months – during all of which time the threat actors would be further developing their attacks. How to detect LotL attacks There are many practical cybersecurity recommendations for detecting LotL attacks – none of them exhaustive. The most recent and detailed public guidance comes from cyber agencies in the US, UK, and Australia. But even there, the authors emphasize that theyre only providing best practice benchmarks. The most practical, effective, and implementable detection tips are as follows: Implement detailed event logging. Collect logs in a centralized repository thats write-once and disallows modifications. This prevents attackers from deleting or changing logs. Centralization of logs is critical because it enables behavioral analysis, retrospective searches, and targeted threat hunting. It also often makes it possible to save logs for longer periods of time. Â To be useful, logs must be comprehensive and verbose. They must log security events – including all commands in management consoles (shells), as well as system calls, PowerShell activity, WMI event traces, and so on. Its worth reiterating that standard logging configurations rarely cover all necessary events. Whats more, in some cloud environments, the right level of logging is only available as part of costly service packages. When Microsoft 365 customers got burned this last year, Microsoft revised its policy. Â For proper implementation of logging, SIEM (centralization, aggregation, and event analysis) and EDR (collection of necessary telemetry from hosts) are indispensable tools. Identify and record typical, day-to-day activity of network devices, servers, applications, users, and administrators. To gather information about baseline behavior in a particular network, SIEM is recommended: all normal sequences of events, service relationships and the like are clear to see. Special attention should be paid to the analysis of administrative behavior, and the use of specific tools by privileged accounts – including system ones. Keep the number of administrative tools to a minimum, with detailed logging of their operation; use of other similar tools should be either blocked or set to trigger alerts. For administrator accounts, its important to analyze what time they are in use, what commands they run and in what sequence, what devices they interact with, and so on. Use automated systems (such as machine learning models) to continuously analyze logs, match them against typical activity, and report anomalies to InfoSec. Ideally, implement user and entity behavior analytics (UEBA). Continuously update settings to reduce background noise and adjust low-impact alerts or downgrade their priority. Â You can fine-tune monitoring rules and alert triggers to better distinguish between routine administrative actions and potentially dangerous behavior. Avoid overly broad rules that will burden systems and analysts alike, such as CommandLine=*. Work with the IT team to reduce the variety of administration utilities used, their accessibility on unrelated systems, and the number of available protocols and types of accounts for logging in to corporate systems. How to defend against LotL The very nature of these attacks makes it almost impossible to prevent them completely. However, proper configuration of your network, endpoints, applications, and accounts can dramatically narrow the attack surface, speed up detection, and minimize the damage caused by intrusion attempts. Review and implement hardening recommendations from vendors of the hardware and applications you use. The following should be considered as the minimum: For Windows systems, apply Microsoft updates promptly. For Linux systems, review permissions for key applications and daemons by following an industry guide – such as Red Hat Enterprise Linux Benchmarks. For macOS devices, be aware that there are no generally accepted hardening recommendations, but there is a misconception that theyre secure out-of-the-box. In mixed networks, Windows devices are often more prevalent, such that IT and InfoSec tend to focus on Windows, overlooking threats and suspicious events on Apple devices. Besides the advice to regularly update macOS to the latest version and implement EDR/EPP, we recommend studying the macOS Security Compliance Project, which lets you generate InfoSec recommendations for specific macOS devices. For organizations that actively use Microsoft 365 and Google Workspace cloud services, its vital to implement the minimum InfoSec recommendations from Microsoft and Google. Critical IT assets, such as ADFS and ADCS for Microsoft-based IT systems, warrant special attention and in-depth analysis of possible hardening measures. Widely apply universal hardening measures such as minimizing the number of running services, the principle of least privilege, and encryption and authentication of all network communications. Make the allowlisting (aka default deny) approach standard. If implementing it across all applications and all computers is troublesome, try a phased approach. Popular LOLBAS that your team doesnt use for work and your system processes dont need can be blocked. The tools that actually are needed should only be available to administrators, only on relevant systems, and only for the duration of administrative tasks. All sessions that use such tools must be carefully logged and analyzed for anomalies. Â Conduct an in-depth inventory of configurations, policies, and software installed on each host. If an application isnt needed on a host, remove it: this will take it out of the toolkit of attackers and eliminate the headaches associated with updates and vulnerabilities. EDR solutions are ideal for this task. Strengthen IT and OT network segmentation and monitoring at the internal network level. Besides isolating the OT network, you can move administrative machines with high privileges, important servers and the like to a separate subnet. When implementing such restrictions, many organizations allowlist excessively broad IP ranges, for example, all addresses of a particular cloud provider. Even if this cloud hosts legitimate servers that the company server needs to communicate with, neighboring IPs could be leased by attackers. Therefore, its imperative to specify precise IP ranges and keep the allowlist as short as possible. Network analysis tools should also be used to monitor traffic between segments, with a focus on unusual sessions and communications with more important network segments. Such analysis requires deep packet inspection (DPI). To significantly simplify monitoring and to make attacks much harder, introduce privileged access workstations (PAWs) in your organization. High-risk administrative actions should be allowed on these and nowhere else. As part of the minimum program for Windows environments, operations with Active Directory servers should be allowed from PAWs only. Implement authentication and authorization for all human-machine and machine-machine interactions regardless of their network location. Implement a comprehensive approach to infrastructure protection based on detection and response tools (SIEM + EDR), building both awareness and team expertise (threat intelligence + cybersecurity training), and continuous hardening of the companys overall InfoSec posture.

Mozilla Drops Onerep After CEO Admits to Running People-Search Networks

krebsonsecurity Mar 22, 2024 A Little Sunshine

The nonprofit organization that supports the Firefox web browser said today it is winding down its new partnership with Onerep, an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity show more ...

forced Onerep’s CEO to admit that he has founded dozens of people-search networks over the years. Mozilla Monitor. Image Mozilla Monitor Plus video on Youtube. Mozilla only began bundling Onerep in Firefox last month, when it announced the reputation service would be offered on a subscription basis as part of Mozilla Monitor Plus. Launched in 2018 under the name Firefox Monitor, Mozilla Monitor also checks data from the website Have I Been Pwned? to let users know when their email addresses or password are leaked in data breaches. On March 14, KrebsOnSecurity published a story showing that Onerep’s Belarusian CEO and founder Dimitiri Shelest launched dozens of people-search services since 2010, including a still-active data broker called Nuwber that sells background reports on people. Onerep and Shelest did not respond to requests for comment on that story. But on March 21, Shelest released a lengthy statement wherein he admitted to maintaining an ownership stake in Nuwber, a consumer data broker he founded in 2015 — around the same time he launched Onerep. Shelest maintained that Nuwber has “zero cross-over or information-sharing with Onerep,” and said any other old domains that may be found and associated with his name are no longer being operated by him. “I get it,” Shelest wrote. “My affiliation with a people search business may look odd from the outside. In truth, if I hadn’t taken that initial path with a deep dive into how people search sites work, Onerep wouldn’t have the best tech and team in the space. Still, I now appreciate that we did not make this more clear in the past and I’m aiming to do better in the future.” The full statement is available here (PDF). Onerep CEO and founder Dimitri Shelest. In a statement released today, a spokesperson for Mozilla said it was moving away from Onerep as a service provider in its Monitor Plus product. “Though customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values,” Mozilla wrote. “We’re working now to solidify a transition plan that will provide customers with a seamless experience and will continue to put their interests first.” KrebsOnSecurity also reported that Shelest’s email address was used circa 2010 by an affiliate of Spamit, a Russian-language organization that paid people to aggressively promote websites hawking male enhancement drugs and generic pharmaceuticals. As noted in the March 14 story, this connection was confirmed by research from multiple graduate students at my alma mater George Mason University. Shelest denied ever being associated with Spamit. “Between 2010 and 2014, we put up some web pages and optimize them — a widely used SEO practice — and then ran AdSense banners on them,” Shelest said, presumably referring to the dozens of people-search domains KrebsOnSecurity found were connected to his email addresses (dmitrcox@gmail.com and dmitrcox2@gmail.com). “As we progressed and learned more, we saw that a lot of the inquiries coming in were for people.” Shelest also acknowledged that Onerep pays to run ads on “on a handful of data broker sites in very specific circumstances.” “Our ad is served once someone has manually completed an opt-out form on their own,” Shelest wrote. “The goal is to let them know that if they were exposed on that site, there may be others, and bring awareness to there being a more automated opt-out option, such as Onerep.” Reached via Twitter/X, HaveIBeenPwned founder Troy Hunt said he knew Mozilla was considering a partnership with Onerep, but that he was previously unaware of the Onerep CEO’s many conflicts of interest. “I knew Mozilla had this in the works and we’d casually discussed it when talking about Firefox monitor,” Hunt told KrebsOnSecurity. “The point I made to them was the same as I’ve made to various companies wanting to put data broker removal ads on HIBP: removing your data from legally operating services has minimal impact, and you can’t remove it from the outright illegal ones who are doing the genuine damage.” Playing both sides — creating and spreading the same digital disease that your medicine is designed to treat — may be highly unethical and wrong. But in the United States it’s not against the law. Nor is collecting and selling data on Americans. Privacy experts say the problem is that data brokers, people-search services like Nuwber and Onerep, and online reputation management firms exist because virtually all U.S. states exempt so-called “public” or “government” records from consumer privacy laws. Those include voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, and bankruptcy filings. Data brokers also can enrich consumer records with additional information, by adding social media data and known associates. The March 14 story on Onerep was the second in a series of three investigative reports published here this month that examined the data broker and people-search industries, and highlighted the need for more congressional oversight — if not regulation — on consumer data protection and privacy. On March 8, KrebsOnSecurity published A Close Up Look at the Consumer Data Broker Radaris, which showed that the co-founders of Radaris operate multiple Russian-language dating services and affiliate programs. It also appears many of their businesses have ties to a California marketing firm that works with a Russian state-run media conglomerate currently sanctioned by the U.S. government. On March 20, KrebsOnSecurity published The Not-So-True People-Search Network from China, which revealed an elaborate web of phony people-search companies and executives designed to conceal the location of people-search affiliates in China who are earning money promoting U.S. based data brokers that sell personal information on Americans.

Russian APT Releases More Deadly Variant of AcidRain Wiper Malware

darkreading Mar 22, 2024 Feed

New AcidPour variant can attack a significantly broader range of targets including IoT devices, storage area networks, and handhelds.

AWS CISO: Pay Attention to How AI Uses Your Data

darkreading Mar 22, 2024 Feed

Amazon Web Services CISO Chris Betz explains why generative AI is both a time-saving tool as well as a double-edged sword.

Apple Stingy With Details About Latest iOS Update

darkreading Mar 22, 2024 Feed

The security update comes just weeks after the release of iOS 17.4, but Apple has not included CVEs or information about the fixes.

Why AI Obituary Scams Are a Cyber-Risk for Businesses

darkreading Mar 22, 2024 Feed

Scammers now use AI to instantly whip up SEO-friendly bereavement scams, and it's never been easier to swindle mourners or use them to get to their employers.

Kenya to TikTok: Prove Compliance With Our Privacy Laws

darkreading Mar 22, 2024 Feed

Beleaguered social media platform now faces scrutiny by the Kenyan government over cybersecurity and data privacy.

8 Strategies for Enhancing Code Signing Security

darkreading Mar 22, 2024 Feed

Strong code-signing best practices are an invaluable way to build trust in the development process and enable a more secure software supply chain.

Windows 11, Tesla, and Ubuntu Linux Hacked at Pwn2Own Vancouver

cyware Mar 22, 2024 Malware and Vulnerabilities

On the first day of Pwn2Own Vancouver 2024, contestants demoed 19 zero-day vulnerabilities in Windows 11, Tesla, Ubuntu Linux, and other devices and software to win $732,500 and a Tesla Model 3 car.

Nemesis Darknet Marketplace Raided in Germany-Led Operation

cyware Mar 22, 2024 Incident Response, Learnings

Visitors to the cybercrime website were greeted on Thursday with a red banner announcing the takedown. At the bottom, the police placed an animated spaceship reminiscent of a 1990s video game called Nemesis.

Red Teaming in the AI Era

cyware Mar 22, 2024 Expert Blogs and Opinion

Unlike previous types of software, AI models become more intelligent over time. This constant change means new risks can emerge at any moment, making them incredibly difficult to anticipate. A one-and-done approach to red teaming simply won’t work.

FlowFixation Account Takeover Vulnerability Impacts AWS Managed Apache Airflow Service

cyware Mar 22, 2024 Malware and Vulnerabilities

The FlowFixation account-takeover vulnerability, now fixed by AWS, results from a combination of session fixation on the web management panel of the AWS MWAA together with an Amazon AWS domain misconfiguration that leads to cross-site scripting.

New Sysrv Botnet Variant Makes Use of Google Subdomain to Spread XMRig Miner

cyware Mar 22, 2024 Malware and Vulnerabilities

Sysrv is a well-documented botnet first identified in 2020, with the main payload being a worm written in Golang. It drops a cryptominer onto infected hosts before attempting to propagate itself using network vulnerabilities and other methods.

GitHub’s New AI-Powered Tool Auto-Fixes Vulnerabilities in Your Code

cyware Mar 22, 2024 Security Products & Services

GitHub introduced a new AI-powered feature capable of speeding up vulnerability fixes while coding. This feature is in public beta and automatically enabled on all private repositories for GitHub Advanced Security (GHAS) customers.

Jacksonville Beach Report Data Breach Following Cyberattacks

cyware Mar 22, 2024 Breaches and Incidents

The city government of Jacksonville Beach was just the latest to report such an incident, disclosing Wednesday evening that 48,949 people had personal information accessed during a January cyberattack.

RaaS Groups Increasing Efforts to Recruit Affiliates

cyware Mar 22, 2024 Trends, Reports, Analysis

Smaller RaaS groups are trying to recruit new and “displaced” LockBit and Alphv/BlackCat affiliates by foregoing deposits and paid subscriptions, offering better payout splits, 24/7 support, and other “perks.”

Chinese Government Hacker Exploiting Screenconnect, F5 Bugs To Attack Defense and Government Entities

cyware Mar 22, 2024 Threat Actors

A hacker allegedly connected to the People's Republic of China has been exploiting two popular vulnerabilities to attack U.S. defense contractors, U.K. government entities, and institutions in Asia.

Change Healthcare Cyberattack Could Damage Credit at Small Providers: Fitch

cyware Mar 22, 2024 Trends, Reports, Analysis

The cyberattack against Change Healthcare could damage the credit of smaller providers, pharmacies, and other healthcare organizations that rely on the UnitedHealth-owned technology company for financial services, as per a report from Fitch Ratings.

API Environments Becoming Hotspots for Exploitation

cyware Mar 22, 2024 Trends, Reports, Analysis

A total of 29% of web attacks targeted APIs over 12 months (January through December 2023), indicating that APIs are a focus area for cybercriminals, according to Akamai.

Report: Malware Stands Out as the Fastest-Growing Threat of 2024

cyware Mar 22, 2024 Trends, Reports, Analysis

93% of IT professionals believe security threats are increasing in volume or severity, a significant rise from 47% last year, according to Thales. The number of enterprises experiencing ransomware attacks surged by over 27% in the past year.

Large-Scale StrelaStealer Campaign in Early 2024

cyware Mar 22, 2024 Malware and Vulnerabilities

Recently, Unit 42 researchers have identified a wave of large-scale StrelaStealer campaigns impacting over 100 organizations across the EU and U.S. These campaigns deliver spam emails with attachments that eventually launch the DLL payload.

Apple M-Series Chip Vulnerability Puts Encryption Keys at Risk

cyware Mar 22, 2024 Malware and Vulnerabilities

Foresight News reported that the vulnerability poses a serious risk of leakage of wallet keys, The flaw operates as a side channel, facilitating the extraction of end-to-end keys during encrypted transactions.

Email Bomb Attacks: Filling Up Inboxes and Servers Near You

cyware Mar 22, 2024 Trends, Reports, Analysis

The HHS' Health Sector Cybersecurity Coordination Center in an alert warned that email bomb attacks - also known as letter bomb attacks - pose a considerable potential threat.

Luxury Yacht Dealer Attack Claimed by Rhysida Gang

cyware Mar 22, 2024 Breaches and Incidents

MarineMax, which posted multibillion-dollar revenues last year, disclosed a cyberattack to the Securities and Exchange Commission (SEC) on March 10, saying portions of its business were disrupted as a result of the containment measures it enacted.

WebCopilot: Open-Source Automation Tool Enumerates Subdomains, Detects Bugs

cyware Mar 22, 2024 Security Products & Services

WebCopilot is an open-source automation tool that enumerates a target’s subdomains and discovers bugs using various free tools. It simplifies the application security workflow and reduces reliance on manual scripting.

South China Athletic Association Suffers Cyberattack Potentially Compromising 70,000 Members’ Data

cyware Mar 22, 2024 Breaches and Incidents

The South China Athletic Association (SCAA) was rocked by a cyberattack as unauthorized third parties breached the organization’s computer servers, sparking concerns over the security of member data.

US Airlines’ Privacy Protection Practices to Get DOT Review

cyware Mar 22, 2024 Laws, Policy, Regulations

The Department of Transportation (DOT) will review data collection practices for the country's 10 largest airlines in a bid to improve passenger privacy protections, Secretary Pete Buttigieg said on Thursday.

Fake Data Breaches: Countering the Damage

cyware Mar 22, 2024 Expert Blogs and Opinion

Amid the constant drumbeat of successful cyberattacks, some fake data breaches have also cropped up to make sensational headlines. Unfortunately, even fake data breaches can have real repercussions.

New Details on TinyTurla’s Post-Compromise Activity Reveal Full Kill Chain

cyware Mar 22, 2024 Malware and Vulnerabilities

Talos’ analysis, in coordination with CERT.NGO, reveals that Turla infected multiple systems in the compromised network of a European non-governmental organization (NGO).

GoFetch - Breaking Constant-Time Cryptographic Implementations Using Data Memory-Dependent Prefetchers

packetstormsecurity Mar 22, 2024 headline,data loss,flaw,apple,cryptograp

Russian APT29 Hackers Caught Targeting German Political Parties

packetstormsecurity Mar 22, 2024 headline,hacker,government,russia,fraud,

Apple Lawsuit: US Says iPhone Monopoly Undermines Security

packetstormsecurity Mar 22, 2024 headline,government,usa,fraud

Hackers Can Unlock Over 3 Millions Hotel Doors In Seconds

packetstormsecurity Mar 22, 2024 headline,hacker,privacy,flaw