Oktacron logo
Cyber security aggregate rss news

Cyber security aggregator - feeds history
image for World Agricultural C ...

 Firewall Daily

Researchers have uncovered a sophisticated phishing scam targeting participants of the World Agricultural Cycling Competition (WACC). The campaign cleverly mimics the official WACC website to deceive users into downloading malicious software. The phishing site at the center of the scam, hosted at "wacc[.   show more ...  

]photo," bears a striking resemblance to the legitimate WACC website. The attacker behind the World Agricultural Cycling Competition scam meticulously replicated the genuine site, with only minor tweaks that made it difficult for users to spot the fraud. The World Agricultural Cycling Competition Scam The World Agricultural Cycling Competition, held annually in France, aims to merge the agriculture and sports industries, making it a prime target for scammers seeking to exploit its popularity. [caption id="attachment_87000" align="alignnone" width="936"] World Agricultural Cycling Competition Phishing Site (Source: Cyble)[/caption] Launched in July 2024, shortly after the WACC concluded in June, the World Agricultural Cycling Competition phishing campaign took advantage of the event's recent conclusion. By adding a "PHOTO" section to the fraudulent site, the scammer enticed users with promises of exclusive event photos. This tactic was designed to lure stakeholders and participants who were eager to relive the event through pictures, thereby increasing the likelihood of successful phishing attacks. According to Cyble Research and Intelligence Labs (CRIL), the deceptive site lures users into downloading a ZIP file, purportedly containing event photos. However, this file, rather than holding images, conceals three shortcut files (.lnk) disguised as image files. When these shortcuts are executed, they initiate a complex infection chain leading to the deployment of a Havoc Command and Control (C2) framework. [caption id="attachment_86998" align="alignnone" width="936"] Infection Chain of World Agricultural Cycling Competition Scam (Source: Cyble)[/caption] Upon execution, the Havoc C2 attempts to establish a connection with an Azure Front Door domain, which is used as a redirector to the actual Command and Control server. This server facilitates further malicious activities by the attacker. During CRIL’s investigation, the C&C server was found to be offline, which limited the ability to fully analyze subsequent stages of the attack. The phishing site also contained an open directory with various malware payloads, suggesting that the attacker might be swapping out payloads to better target victims. [caption id="attachment_87002" align="alignnone" width="936"] Open Directory (Source: Cyble)[/caption] This open directory, coupled with the sophisticated nature of the Havoc C2 framework, indicates a well-prepared and potentially strategic approach by the threat actor. Technical Breakdown of the World Agricultural Cycling Competition Scam The World Agricultural Cycling Competition scam begins when a user downloads a ZIP file from a fraudulent site. This file contains three shortcut files (.lnk) disguised as .jpg images. When executed, these shortcuts use conhost.exe to run a PowerShell script. The script first downloads and displays legitimate JPG files from the phishing site via Microsoft Edge, creating a false sense of security. Meanwhile, it secretly downloads and installs a malicious DLL file named “KB.DLL” into the "AppDataLocal" directory. This DLL serves as a loader for obfuscated shellcode, which is executed using the EnumFontsW() function—a technique designed to evade detection. The shellcode includes an embedded executable that connects to a Command and Control (C2) server. The Havoc C2 framework, a sophisticated post-exploitation tool, is employed for various malicious activities such as lateral movement within the compromised network, maintaining persistent access, and deploying additional malware. Although the C2 server was offline during analysis, the use of Havoc indicates that the attacker planned extensive and complex operations within the targeted network. Recommendations for Protection To address the risks associated with phishing scams such as the "World Agricultural Cycling Competition phishing campaign," organizations and individuals should implement several key measures. Firstly, verifying website legitimacy is crucial. Users should carefully scrutinize URLs and avoid interacting with suspicious links to prevent falling victim to phishing attacks. Ensuring that websites are authentic can significantly reduce the likelihood of being deceived by fraudulent sites. Education plays a vital role in cybersecurity. Conducting regular training sessions helps users recognize phishing attempts and understand the dangers of downloading files from untrusted sources. Emphasizing the importance of verifying the legitimacy of websites and links can empower users to make safer online choices. Restricting PowerShell execution is another important measure. Configuring PowerShell execution policies to limit the running of scripts from untrusted sources can mitigate the risk of malicious script execution. Using features like PowerShell Constrained Language Mode can further reduce the potential for harmful scripts to run on a system. And PCs should run in admin mode only when needed. Advanced endpoint protection solutions are essential for detecting and blocking malicious DLLs and scripts. It is important to keep antivirus and antimalware software up-to-date and properly configured to scan for and identify potentially harmful files. Monitoring network traffic is also crucial. Implementing network monitoring tools can help detect unusual traffic patterns, such as connections to suspicious domains or unexpected communications with services like Azure Front Door.

image for Weekly Vulnerability ...

 Cybersecurity News

Between the Black Hat and DEF CON conferences and Patch Tuesday, it’s been a very busy week for security vulnerabilities. Cyble researchers investigated 40 vulnerabilities in their Aug. 7-13 report for subscribers, and focused on 10 flaws in particular, in products from SAP, Ivanti, AMD, Microsoft, Cisco and   show more ...  

Progress Software. The Cyber Express partners with Cyble each week to bring some of the AI-powered threat intelligence leader’s proprietary insights to our readers to help them better manage their attack surface by focusing on the top vulnerabilities that put their environments most at risk. The Cyble report published before SolarWinds issued a hotfix for a 9.8 severity Java deserialization RCE vulnerability in Web Help Desk that CISA said yesterday is already under attack, so you don’t need to wait for next week’s report to get started on that one. Patch now. The Week’s Top Vulnerabilities Here are the 10 vulnerabilities that Cyble researchers singled out for priority attention by security teams. CVE-2024-41730: SAP BusinessObjects Business Intelligence Impact Analysis: This 9.8 severity critical vulnerability impacts the SAP BusinessObjects Business Intelligence suite of reporting and analytics tools for business intelligence (BI) platforms. If Single Sign On is enabled on Enterprise authentication on the impacted platform, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system, resulting in a high impact on confidentiality, integrity, and availability. Internet Exposure? No Patch Available? Yes CVE-2024-7593: Ivanti Virtual Traffic Manager Impact Analysis: This critical vulnerability – also rated at 9.8 – impacts Ivanti Virtual Traffic Manager (vTM), a software-based application delivery controller (ADC) and load balancer that provides intelligent traffic management, load balancing, and application acceleration for web applications and services. An incorrect implementation of an authentication algorithm in Ivanti vTM in versions other than 22.2R1 or 22.7R2 allows a remote, unauthenticated attacker to bypass the authentication of the admin panel. With the availability of a public Proof of Concept (POC) of the vulnerability, threat actors may start exploiting it, allowing them to create rogue administrator accounts. Internet Exposure? Yes Patch Available? Two patches plus mitigations are available now, with four more patches to be issued next week. CVE-2024-7569: Ivanti Neurons for ITSM Impact Analysis: This 9.6 severity critical vulnerability impacts Ivanti Neurons for ITSM (IT Service Management), a comprehensive software platform for IT service management. The information disclosure allows an unauthenticated attacker to obtain the OIDC client secret via debug information. Internet Exposure? No Patch Available? Yes CVE-2023-31315: AMD ‘Sinkclose’ Vulnerability Impact Analysis: This high-severity (7.5) improper validation vulnerability known as "Sinkclose" in a model-specific register (MSR) allows a malicious program with ring 0 access to modify SMM configuration while the SMI lock is enabled, potentially leading to arbitrary code execution. Although not widespread, kernel-level vulnerabilities are surely not uncommon in sophisticated attacks. Since Ring 2 is one of the highest privilege levels on a computer, running above Ring 1 (used for hypervisors and CPU virtualization) and Ring 0, there are possibilities of exploiting the vulnerability in attacks, especially by advanced persistent threat (APT) actors. Internet Exposure? No Patch Available? AMD has published patch and mitigation information here. CVE-2024-38200: Microsoft Office Impact Analysis: While officially listed as a 6.5 medium-severity vulnerability, this Microsoft Office spoofing vulnerability can be exploited by attackers to grab users’ NTLM hashes. The vulnerability is exploitable remotely and requires no special privileges or user interaction to be triggered. Once attackers get a victim’s NTLM hash, they can relay it to another service and authenticate as the victim, leading to further pivoting into the compromised network. It’s one of many Microsoft vulnerabilities from this month’s Patch Tuesday that are getting attention, including six actively exploited zero-day vulnerabilities and a 9.8 severity zero-click TCP/IP vulnerability. Internet Exposure? No Patch Available? Yes CVE-2024-20450, CVE-2024-20452, and CVE-2024-20454: Cisco Small Business IP Phones Impact Analysis: These 9.8-severity critical vulnerabilities impact the web-based management interface of Cisco Small Business SPA300 Series IP Phones and Cisco Small Business SPA500 Series IP Phones, which could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operating system with root privileges. These vulnerabilities exist because incoming HTTP packets are not properly checked for errors, which could result in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected device. A successful exploit could allow the attacker to overflow an internal buffer and execute arbitrary commands at the root privilege level. Internet Exposure? No Patch Available? Yes CVE-2024-20419: Cisco Smart Software Manager On-Prem Impact Analysis: This 10.0-severity critical vulnerability impacts Cisco Smart Software Manager On-Prem (SSM On-Prem), a licensing management solution designed to help organizations manage their Cisco product licenses locally. The flaw in the authentication system of the impacted device could allow an unauthenticated remote attacker to change the password of any user, including administrative users. This vulnerability is due to improper implementation of the password-change process. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow an attacker to access the web UI or API with the privileges of the compromised user. Internet Exposure? No Patch Available? Yes CVE-2024-4885: Progress WhatsUp Gold Impact Analysis: This 9.8-severity critical vulnerability impacts Progress WhatsUp Gold, a network monitoring software designed to provide comprehensive visibility into the performance and status of IT infrastructure, including applications, network devices, and servers. The unauthenticated Remote Code Execution vulnerability allows the execution of commands with iisapppool mconsole privileges, which allows an attacker to execute code on the server and even access the underlying system. While this vulnerability dates from June, researchers recently observed that threat actors are actively attempting to exploit the remote code execution vulnerability on exposed servers to gain initial access to corporate networks. Internet Exposure? Yes Patch Available? Yes Dark Web Exploits, ICS Vulnerabilities, and More The full Cyble report for subscribers also looks at eight vulnerability exploits discussed on the dark web, 15 industrial control system (ICS) vulnerabilities (nine of which affect Rockwell Automation products), and the vulnerabilities with the highest number of web asset exposures, some numbering in the hundreds of thousands. The vulnerability report is just one of hundreds produced by Cyble researchers each week, in addition to client-specific customizable reporting and alerts. Cyble’s weekly sensor report, for example, this week looks at vulnerability exploits and malware, ransomware and phishing attacks, along with indicators of compromise (IoCs). The Cyber Express will bring you more exclusive coverage from Cyble threat intelligence researchers in the weeks ahead.

image for Idaho Strengthens El ...

 Cybersecurity News

As the United States gears up for what is anticipated to be a highly active US general election 2024 season, the Cybersecurity and Infrastructure Security Agency (CISA) has intensified its efforts to collaborate with election officials across the country. Nowhere has this collaboration been more pronounced than in   show more ...  

Idaho, where a recent initiative spearheaded by the Idaho Secretary of State’s Office highlights the importance of election security. Strengthening US General Election 2024 Readiness in Idaho Working in close partnership with CISA’s Region 10 team, which includes cybersecurity, protective security, and election security advisors, the Idaho Secretary of State’s Office led a comprehensive initiative designed to enhance election security readiness across the state. This effort was embodied in a two-part election security virtual webinar training series, aimed at equipping county election officials with the tools and knowledge needed to navigate the complexities of the upcoming elections. The training series, which engaged election officials from all 44 counties in Idaho, unfolded in two distinct phases: a workshop and a tabletop exercise (TTX) training session. These sessions were designed not only to provide technical knowledge but also to foster a collaborative environment, bringing together participants from various state agencies, including the Idaho Office of Emergency Management and the Idaho State Police. Collaborative Efforts and Strategic Partnerships “The opportunity to support the exercise with the Idaho Secretary of State’s office was so important to building partnerships to help ensure a safe and secure election,” said Lori Augino, Region 10 Election Security Advisor. The collaborative nature of the training sessions highlighted the significance of partnerships in maintaining the security and integrity of the electoral process. In response to the growing demand for enhanced internal training, CISA security advisors facilitated an additional tabletop exercise session at the request of Idaho Secretary of State Phil McGrane. This session targeted all internal Idaho Secretary of State staff and election officials, further emphasizing the state’s commitment to election security. “We really appreciate the support from CISA, the Idaho Office of Emergency Management, Idaho National Guard, and our other strategic partners,” said Idaho Secretary of State Phil McGrane. “Our recent tabletop exercises with the county elections office really challenged us and helped in the preparation for the 2024 election cycle. This exercise highlights our dedication to planning ahead and being prepared so that we can ensure the strength and integrity of Idaho's electoral system.” Focus on US General Election 2024 Security Threats The training sessions covered a wide range of election security topics, including CISA’s approach to election security, the risks associated with phishing, and recommendations for mitigating physical security risks. Additionally, the sessions introduced techniques for recognizing potentially escalating situations, as well as the identification, detection, and response capabilities of local election officials in the face of cyber and physical security threats. “We are honored to have worked with the Secretary of State’s office to share our knowledge and help build awareness of these issues that could impact our elections,” said Josh Stemp, Idaho Cybersecurity State Coordinator for CISA. The training sessions reinforced the critical importance of preparedness and awareness in safeguarding the integrity of the electoral process. US Election 2024 Security in Broader Context The heightened focus on election security in Idaho comes at a time when concerns about cybersecurity in the electoral process are more pronounced than ever. Recent claims by former president and current Republican presidential nominee Donald Trump that his campaign had been hacked, following reports from Microsoft about an Iranian hacker group targeting a high-ranking official’s account, have highlighted the ongoing risks. While these events remain uncorroborated, they serve as a reminder of the potential for cyber threats to disrupt the upcoming US general election in 2024. In addition to the possibility of service disruptions, data breaches, fraud, and other forms of cybercrime pose significant risks to the electoral process. CISA’s Ongoing Commitment to Election Security CISA’s efforts to support election security are not limited to Idaho. The agency is committed to working collaboratively with state and local governments, election officials, federal partners, and private sector entities across the nation to manage risks to election infrastructure. This commitment is rooted in the understanding that fair and free elections are a cornerstone of American democracy, and the security and resilience of the infrastructure that supports these elections are of paramount importance. Since the Department of Homeland Security officially designated election infrastructure as critical infrastructure in January 2017, CISA has prioritized efforts to protect this vital aspect of national security. The agency provides resources on election security for both public and election officials at all levels and remains transparent and agile in its efforts to protect America’s election infrastructure against evolving threats. Looking Ahead to the 2024 US Election As the 2024 US general election approaches, the efforts of CISA, the Idaho Secretary of State’s Office, and other partners in Idaho serve as a model for how states can proactively address the challenges of election security. Through continued collaboration, training, and preparedness, Idaho is setting a strong example of how to ensure the integrity of the electoral process in an increasingly complex threat environment. With the stakes higher than ever, the importance of safeguarding the electoral process cannot be overstated. As Idaho and other states continue to prepare for the upcoming election, the lessons learned and partnerships formed through initiatives like this will be crucial in ensuring that the 2024 US election is both secure and resilient.

image for University of Winnip ...

 Cybersecurity News

The investigation into the University of Winnipeg data breach has now concluded, and the University has updated its notification to reflect the expanded scope of the breach. According to the latest update, the data exposed in University of Winnipeg cyberattack spans a significant period and affects various student   show more ...  

groups, graduates, and employees. "That investigation has now concluded, and we have updated our notification of groups likely affected and information exposed," reads the official notice released on the University website. University of Winnipeg Data Breach: Investigation Findings Upon concluding the University of Winnipeg data breach investigation into the March 2024 cyberattack it was revealed that extensive data breach took place than initially reported. The data breach affects various groups, including undergraduate and graduate students enrolled from 2018 to the present, NSERC Undergraduate Student Research Awards (USRA) winners from 2003 to 2010, and Master's in Development Practice students from 2011 to 2018. The compromised information includes personal details such as names, addresses, student numbers, dates of birth, social insurance numbers, and, in some cases, health and financial information. The data breach at University of Winnipeg also extends to all current and former employees dating back to 2003, exposing their names, social insurance numbers, dates of birth, contact information, and compensation details. Specific groups of employees, such as those on maternity leave, long-term disability leave, or sick leave, have had additional sensitive information compromised, including medical history and treatment plans. The University has extended its offer of a two-year credit monitoring service to all individuals included in newly identified groups. This service is crucial in enabling those affected to monitor for signs of identity fraud and take protective actions if necessary. The credit monitoring service is designed to provide proactive alerts if someone attempts to open a credit account in an individual’s name, thereby offering an additional layer of security. "It is disturbing that higher education institutions like the University and other public sector organizations are being targeted by cyberattacks. This has been a terrible incident that has directly impacted our community. We are grateful to the staff members who worked many long hours to restore systems following the attack, as well as to our entire UWinnipeg community for their patience and understanding through this challenge. Rest assured that we are carefully considering the results of our investigation and are emerging from this incident with stronger cyber defences," reads the official notice. What Happen? On March 25, 2024, the University of Winnipeg disclosed that it had fallen victim to a cyberattack, an incident that has since sent shockwaves through the campus community. Initially, the University revealed that personal information had been compromised, prompting the administration to offer a two-year credit monitoring service to those likely affected. As the investigation progressed, it became clear that the impact was far more extensive than initially anticipated. On April 4, 2024, the University confirmed that the stolen data included a wide range of personal information belonging to various groups within the University community. This information was shared transparently on the University's website, detailing the types of data exposed and the specific groups of individuals likely affected. At that time, the University committed to a comprehensive investigation to determine whether additional individuals were affected and to provide further notifications based on the findings. Moving Forward The University of Winnipeg continues to emphasize its commitment to safeguarding personal information and has taken steps to enhance its cybersecurity measures in the wake of this incident. While the full impact of the breach is still being assessed, the University is dedicated to providing ongoing support to those affected and ensuring that similar incidents do not occur in the future. In conclusion, the University of Winnipeg’s recent update highlights the extensive nature of the data breach, affecting a wide range of students and employees. The administration’s transparency and commitment to offering credit monitoring services are steps in the right direction, but the incident serves as a reminder of the importance of strong cybersecurity measures in protecting sensitive information.

image for Protecting Millions: ...

 Features

Healthcare data breaches have surged over the years, with the number of reported incidents nearly doubling from 329 in 2016 to 739 in 2023. This sharp rise shows the critical need for strong healthcare data protection strategies, as breaches in 2023 alone compromised over 136 million individual records—more than   show more ...  

double the previous year's total. In response to this growing threat, the role of Chief Information Security Officers (CISOs) in healthcare has become increasingly vital. CISOs are tasked with safeguarding sensitive patient data and implementing comprehensive defense mechanisms. One of the key tools in their arsenal is CISO take down services for healthcare, which are essential in mitigating the impact of data breaches and ensuring the integrity of healthcare information. This article delves into the strategies CISOs use to protect healthcare data, with a particular focus on how they deploy take down services to enhance security and respond to breaches effectively. Healthcare Data Protection Strategies Healthcare data protection strategies are essential in today's digital age, where healthcare organizations rapidly collect and store vast amounts of sensitive patient information. The sheer volume of data being handled makes safeguarding it a complex and challenging task. With every piece of data collected, the risk of healthcare data breaches increases, and the consequences of these breaches can be devastating. Not only can they tarnish an organization's reputation, but they can also lead to significant financial losses, especially with penalties for violations like HIPAA reaching up to $1.5 million annually. Given that hospitals alone account for 30% of all large data breaches, it is crucial for healthcare providers to continuously upgrade their security measures. A enhanced healthcare data protection strategy must encompass a variety of approaches, from implementing advanced encryption technologies to ensuring strict access controls. However, technology alone isn't enough. A crucial, often overlooked, aspect of data protection is staff training. With human error responsible for 74% of all data breaches, educating employees on best practices and fostering a culture of security awareness is a vital component of any effective strategy. Ultimately, protecting healthcare data is not just about complying with regulations—it's about safeguarding the trust and well-being of patients. CISO Take Down Services for Healthcare Building on the critical role of CISOs in safeguarding healthcare data, CISO take down services for Healthcare emerge as a pivotal component in the fight against healthcare data breaches. But what exactly are these services? In essence, take down services involve the identification and removal of unauthorized or harmful data—whether it's exposed patient information, counterfeit websites, or phishing content—from the internet. These services work by swiftly tracking down and eliminating threats that could compromise sensitive healthcare data, thereby preventing further exploitation by cybercriminals. In the healthcare sector, where the stakes are incredibly high, CISOs leverage these take down services as a frontline defense mechanism. For instance, if a healthcare organization experiences a data breach, a data breach response healthcare CISO will quickly activate take down services to identify where the stolen data has been posted—whether on the dark web or rogue websites—and ensure its immediate removal. This rapid response is crucial in mitigating the damage caused by a breach and protecting patients' sensitive information. A prime example of this in action can be seen when a hospital's patient database is leaked online. The CISO, recognizing the imminent threat, would deploy healthcare data security take down solutions to trace the leak, coordinate with internet service providers and law enforcement, and ensure that the data is removed before it can be misused. This proactive approach not only curbs the potential fallout but also demonstrates the effectiveness of take down services as a vital tool in the healthcare cybersecurity arsenal. These services are not just reactive but also preventative. By regularly monitoring the internet for signs of leaked data or phishing schemes targeting the organization, CISOs can preemptively strike against threats before they escalate into full-blown breaches. This ongoing vigilance is what keeps healthcare data safe in an increasingly perilous digital landscape, making CISO take down services for healthcare an indispensable aspect of modern healthcare data protection strategies. Data Breach Response for Healthcare CISOs When a healthcare data breach is detected, the immediate response from CISOs is crucial in containing the damage and protecting sensitive information. The first step is swift action—CISOs must quickly mobilize their teams to secure systems, isolate the breach, and begin an in-depth investigation. This rapid response is the foundation of effective data breach response for healthcare CISOs, as it minimizes the potential fallout from the incident. One of the most powerful tools in a CISO's arsenal during this critical time is the use of take down services for healthcare. These specialized services are designed to remove malicious content or stolen data from the web as quickly as possible. Whether it’s patient records, proprietary research, or other sensitive data, these take down solutions are essential for preventing further exposure and misuse. By coordinating closely with take down service providers, CISOs can ensure that any leaked information is swiftly eradicated from public access, significantly reducing the breach's impact. Once the immediate threat is contained and take down services have done their work, the focus shifts to post-breach analysis. This involves a thorough examination of how the breach occurred, what vulnerabilities were exploited, and how future incidents can be prevented. Healthcare data security take down solutions play a pivotal role here as well, offering insights into the breach's dynamics and helping to fortify defenses against similar attacks in the future. By continuously refining their strategies based on these learnings, CISOs can enhance their organizations' resilience and ensure stronger protection of healthcare data moving forward. Healthcare Cybersecurity Best Practices Healthcare cybersecurity best practices are crucial in a sector where the stakes are incredibly high—patient data security isn't just a regulatory requirement; it's a matter of trust and safety. With cybercriminals constantly seeking to exploit vulnerabilities for financial gain, healthcare organizations must stay ahead of the curve. These criminals use sophisticated methods, including fake social media accounts and rogue mobile apps, to trick users and gain unauthorized access to sensitive information. To combat these threats, it’s essential for healthcare providers to adopt a proactive approach to cybersecurity. One of the most effective healthcare cybersecurity best practices is continuous monitoring and assessment of potential risks. This involves not just reacting to threats but anticipating them. By identifying vulnerabilities before they can be exploited, healthcare organizations can prevent data breaches before they happen. Companies like Cyble play a critical role in this proactive defense, offering solutions that help healthcare providers stay one step ahead of cybercriminals. Another key practice is ensuring that all systems and software are regularly updated and patched. Outdated systems are a common entry point for hackers, making it imperative that healthcare organizations maintain up-to-date defenses. Employee training is also a cornerstone of healthcare cybersecurity best practices. Ensuring that all staff members, from doctors to administrative personnel, are aware of the latest threats and know how to respond to them can drastically reduce the likelihood of a successful cyberattack. Finally, having an enhanced incident response plan is vital. Despite the best preventive measures, breaches can still occur, and when they do, the speed and effectiveness of the response can make all the difference. Healthcare organizations must have a clear plan in place, ensuring that they can quickly contain any breach and minimize its impact on patient data security. By embracing these best practices, healthcare providers can protect their patients and maintain the trust that is so essential to their mission. Explore how Cyble can assist in cybersecurity for healthcare and ensure a comprehensive approach to third-party risk management in healthcare. Schedule a Demo Today!

image for Greater Manchester C ...

 Firewall Daily

A cyberattack has recently rocked Greater Manchester, compromising the security of several local councils and leaving thousands of residents vulnerable to a phishing scam. The Greater Manchester cyberattack, which initially targeted a single borough before spreading, has had a major impact on the housing websites   show more ...  

managed by Locata, a software company providing services for councils across the UK. The Greater Manchester cyberattack first emerged on July 29, affecting the housing portals for Manchester, Salford, and Bolton councils. Locata, which operates these platforms, promptly suspended the websites to address the breach. The attack led to the dissemination of phishing emails that falsely requested users to "activate your tenancy options" and solicit personal data. Scope of the Greater Manchester Cyberattack Locata acknowledged theGreater Manchester cyberattack in a statement, noting, “We identified an IT security incident which impacted a small number of public-facing websites we manage on behalf of local authorities. We moved quickly to manage the issue, and are working with third-party IT experts to investigate the matter", as reported by BBC. Manchester City Council, which oversees the Manchester Move platform, reported that the phishing scam had affected only the publicly accessible portion of the website. Although only a limited amount of personal information was compromised, the Manchester Move website remains offline while officials work to ensure the security of users' data. A statement on the site advises affected individuals to follow steps provided by the UK National Cyber Security Centre to mitigate any potential damage. Salford City Council also responded by temporarily shutting down its Home Search website. The council warned users to be cautious of any suspicious emails and to monitor their bank accounts for unusual activity. The extent of personal data exposed remains uncertain, with Salford City Council urging affected individuals to contact their bank and report any fraudulent transactions to Action Fraud. Bolton's housing service, Homes for Bolton, is currently offline for maintenance. Affected residents are advised to be vigilant about any phishing emails and to take appropriate steps if they suspect their data has been compromised. Recommendations for Affected Individuals Following the recent Greater Manchester phishing scam, local authorities have issued several important recommendations for those potentially affected. Residents are advised to closely monitor their bank accounts for any signs of unusual activity. If any suspicious transactions are detected, it is crucial to inform the bank immediately.  Additionally, any fraudulent transactions should be reported to Action Fraud to help prevent further issues. Affected individuals should also update passwords for any accounts using the same credentials as the compromised account to secure their information. Furthermore, considering a free credit report can help identify any discrepancies or signs of identity theft. In response to the breach, Manchester City Council has taken additional steps by referring the incident to the Information Commissioner’s Office (ICO), the UK's data protection regulator. This move ensures a thorough investigation into the Manchester data breach and aims to implement measures to prevent future incidents. Locata, the company responsible for the affected housing websites, has expressed regret for the disruption caused by the cyberattack on Greater Manchester. The company stated, “We have informed those local authorities impacted and our investigation is ongoing. We apologize for what has happened and are working to ensure the security of affected systems.”

image for FBI and CISA Reassur ...

 Firewall Daily

In a joint effort to address the growing concerns surrounding election-day cybersecurity, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued a new public service announcement.  Their message, titled "Just So You Know: Ransomware Disruptions During   show more ...  

Voting Periods Will Not Impact the Security and Resilience of Vote Casting or Counting," aims to reassure Americans about the integrity of the 2024 elections despite the increasing threat of ransomware attacks. Understanding the Impact of Ransomware on Election-day Cybersecurity The FBI and CISA acknowledge that such attacks could potentially disrupt state or local government networks, including election infrastructure. However, their latest announcement emphasizes that these disruptions are unlikely to compromise the overall security and accuracy of the voting process. [caption id="attachment_86956" align="alignnone" width="1010"] Source: CISA[/caption] According to the agencies, any ransomware attack on election-day cybersecurity observed so far has been localized and effectively managed. These attacks have caused minimal disruption to election operations without affecting the integrity of vote-casting or counting processes. This reassurance is crucial as it comes amidst fears that cyber threats could undermine public confidence in the electoral system. Election officials are well-prepared to handle potential ransomware disruptions. They employ a multi-layered security approach that incorporates various technological, physical, and procedural controls. This robust framework is designed to prevent cyber intrusions, including ransomware, from impacting the vote-casting and counting processes. Cait Conley, a Senior Advisor at CISA, stressed the importance of these election-day cybersecurity measures. “While ransomware continues to be a significant cybersecurity concern, it is important to note that security measures put in place by election officials and election vendors ensure these incidents will not impact the security of the vote casting or tabulation systems and processes,” Conley stated. She assured the public that efforts will continue to maintain confidence in the electoral process throughout the 2024 election cycle. The FBI’s Commitment to Election-day Cybersecurity The FBI is equally committed to addressing the threat of ransomware and other cyber threats targeting election-day cybersecurity. Cynthia Kaiser, Deputy Assistant Director of the FBI’s Cyber Division, highlighted the bureau’s proactive stance. “Combatting ransomware attacks is a top priority for the FBI, especially during elections,” Kaiser said.  “While the FBI will continue to leverage its tools and partnerships to combat cyber criminals, the public should be aware that ransomware is extremely unlikely to affect the integrity of voting systems or the electoral process.” The announcement also addresses the potential for misinformation and foreign interference. In previous election-day cybersecurity incidents, malicious actors have attempted to spread false or exaggerated claims about cyber incidents to manipulate public opinion and undermine confidence in democratic institutions. The FBI and CISA warn that similar tactics might be employed in the upcoming election cycle. It is crucial for voters to rely on official sources for accurate information about election procedures. Election officials and trusted government websites should be the primary sources for details on voting processes, polling locations, and results. Voters are advised to be cautious of unofficial sources, particularly those disseminating alarming or misleading information about election-day cybersecurity processes. Recommendations for Voters To protect the electoral process, the FBI and CISA offer key recommendations. Voters should stay informed by gathering accurate information on registration, polling locations, and voting options from official sources before election day.  It’s crucial to verify the legitimacy of information by relying on state and local government websites and to be cautious of unofficial sites and suspicious communications. Vigilance against election-related schemes and misinformation is essential, and any concerning claims about cyber incidents should be verified with trusted election officials. The FBI and CISA urge the public to report suspicious activities, including ransomware attacks, to local FBI field offices or CISA. Additional resources, such as Stop Ransomware, CISA #Protect2024, and Protected Voices, are available to help individuals understand and address cybersecurity threats. Despite the challenges posed by ransomware, the FBI and CISA assure that these threats will not undermine the security or integrity of the 2024 election-day cybersecurity. With strong security measures and ongoing monitoring, voters can trust in the resilience and accuracy of the electoral process.

image for US Lawmakers Call fo ...

 Firewall Daily

Two U.S. lawmakers have called on the Biden administration to investigate TP-Link Technology Co. Ltd., a major Chinese manufacturer of WiFi routers. Representatives John Moolenaar and Raja Krishnamoorthi, leaders of the House Select Committee on China, have expressed serious apprehensions about potential national   show more ...  

security risks associated with TP-Link cybersecurity and Chinese cyberattacks. In a letter addressed to Commerce Secretary Gina Raimondo, the lawmakers urged an investigation into TP-Link’s operations under the Department of Commerce’s authority. Their concerns revolve around fears that TP-Link’s routers and related devices might be exploited in Chinese cyberattacks against the United States.  Authorities Concerns Over Chinese Cyberattacks Showing concerns over these potential Chinese cyberattacks, the authorities shared the letter with Secretary Raimondo, stating, “We write to respectfully request that you investigate TP-Link Technologies Co., Ltd. (TP-Link) and its affiliates under the Department of Commerce’s information and communication technology services (ICTS) authorities, pursuant to Executive Order 13873”. TP-Link, a technology firm based in the People’s Republic of China (PRC), produces a wide range of Wi-Fi routers, devices, and mesh network systems, along with associated hardware and software. The company's products hold a significant share of the U.S. market for Wi-Fi routers and related devices. There are growing concerns, supported by open-source information, that TP-Link might pose a serious threat to U.S. ICTS security. The lawmakers further stated, “We therefore request that Commerce investigate TP-Link under its ICTS authorities to determine whether the company poses a national security risk. If it finds that is the case, we request that Commerce use its ICTS authorities to properly mitigate the risk.” The request for this probe highlights a growing sense of urgency among U.S. lawmakers regarding the potential misuse of technology by foreign entities, particularly potential Chinese cyberattacks. TP-Link's Market Presence and Vulnerabilities TP-Link, founded in Shenzhen, China, in 1996, is a leading global provider of WiFi products. The company’s extensive product range includes home and office routers, mesh network systems, and other related devices. As of 2022, TP-Link's products are sold in over 170 countries, making it a prominent player in the global market. However, the U.S. lawmakers' concerns are not without merit. Recent reports have highlighted several security vulnerabilities in TP-Link routers. For instance, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) pointed out a vulnerability in TP-Link routers that could allow remote code execution. Additionally, a former Federal Communications Commission (FCC) commissioner noted that TP-Link products have been cited for security issues more frequently than some other brands. The broader context of these concerns involves China's increasing assertiveness in cyberspace. FBI Director Christopher Wray has warned that PRC-sponsored hacking has intensified, describing it as a significant threat to U.S. national security. The FBI has specifically highlighted Advanced Persistent Threat (APT) groups like Volt Typhoon as major concerns, noting their sophisticated techniques and targeting of critical infrastructure with Chinese cyberattacks. Responses and Future Actions In response to the lawmakers' letter, the Commerce Department has stated that it will address the inquiry through appropriate channels. The Chinese Embassy, on the other hand, has expressed hopes that U.S. authorities will base their assessments on solid evidence rather than unsubstantiated allegations. TP-Link has also responded by denying any cybersecurity vulnerabilities in its products and claiming that it does not sell routers in the U.S. The situation highlights the delicate balance between national security concerns and international trade relations. As the U.S. grapples with the implications of Chinese cyberattacks, there is a growing recognition of the need for stringent measures to safeguard critical infrastructure from potential threats posed by foreign technologies. The call for an investigation into TP-Link reflects broader anxieties about the security of Chinese technology products and their potential use in cyberattacks against the U.S. The outcome of this investigation could have far-reaching implications for U.S. national security and its approach to managing technology from foreign threat actors.

image for Why CEOs Must Integr ...

 Firewall Daily

As cyber threats become increasingly sophisticated, the need for effective cyber hygiene has never been more critical. CEOs are at the forefront of defending their organizations against digital threats, and leveraging specialized tools such as take down services is essential in this fight.  Take down services are   show more ...  

specialized online solutions designed to remove harmful or unauthorized content from the internet. This content might include stolen intellectual property, defamatory statements, or phishing sites targeting a company's customers. These services play a crucial role in maintaining effective cyber hygiene and protecting a brand's reputation. The Cyber Express brings an one-for-all guide on CEO cybersecurity strategies for take down services, understanding these services, their importance, and how CEOs can utilize them as part of their cybersecurity strategy. CEO Cybersecurity Strategies for Take Down Services: Definition and Importance A take down service is essentially a third-party intervention that targets and eliminates content infringing on copyrights, trademarks, or privacy. These services are particularly useful in countering cyber abuse such as impersonation or harassment. By identifying and removing harmful content, take down services help businesses protect their brand reputation and ensure that illegal or damaging material is swiftly addressed. The rise of cybercrime, necessitates the use of take down services. Cybercriminals continuously exploit digital platforms to perpetrate fraud, distribute malware, or conduct phishing attacks. Effective cyber hygiene practices, including the use of take down services, are critical for staying ahead of these threats and safeguarding a business’s online presence. Take down services are classified into proactive and reactive types. Proactive take downs involve continuous monitoring of online platforms to identify and address potential misuse or infringement before it escalates. Although these services can be costly due to ongoing surveillance, they play a crucial role in preventing damage to a business’s reputation by tackling issues early. In contrast, reactive take downs are used after harmful content has been detected, focusing on responding to specific incidents. While generally less expensive, reactive measures can be slower, potentially allowing more significant damage before resolution. Both proactive and reactive strategies are essential for comprehensive cyber threat management: proactive services enable early detection and prevention, while reactive services address immediate threats effectively. Effective Cyber Hygiene Practices: Take Down Services for CEOs The rising global cost of cybercrime, projected to grow by 15% annually, demands CEO involvement. In 2023, the average cost of a data breach reached an all-time high of $4.45 million, reflecting a 2.3% increase from the previous year, as per data from IBM.  The COVID-19 pandemic has exacerbated the situation by expanding the attack surface through remote work and broader digital adoption, introducing new vulnerabilities. CEOs need to integrate cybersecurity into their overall business strategies, setting clear cyber goals, enhancing preparedness, and ensuring transparent communication, especially during breaches. Cybersecurity should be seen not just as an IT issue but as a strategic priority that can differentiate a company in the market. Take down services are a crucial component of a CEO’s cybersecurity arsenal. These services are essential for protecting against cyber threats by removing malicious content such as phishing sites, malware distribution platforms, and fraudulent social media profiles. Prompt removal of such threats is vital for protecting sensitive information and preventing further damage.  Additionally, take down services play a significant role in reputation management by swiftly addressing and removing harmful content, ensuring that a company’s online image remains intact and true to its values. They also aid in legal compliance by adhering to regulations like GDPR and DMCA, which involve removing pirated content and phishing sites that infringe on intellectual property rights.  This not only protects the organization’s assets but also helps maintain adherence to data protection laws. Thus, CEOs must ensure that their cybersecurity strategies include effective take down services to manage cyber threats, protect their brand’s reputation, and comply with legal requirements. Cybersecurity firms like Cyble provide powerful brand monitoring tools, including take down services, to remove harmful content and protect your brand's reputation. How Take Down Services Work? Leveraging take down services in cybersecurity involves several key steps to effectively remove harmful or infringing content. The process begins with identification, where technologies like web crawlers, digital fingerprinting, and image recognition are used to locate unauthorized content. This is followed by verification, where legal experts assess whether the content indeed violates rights or laws. Notification is the next step, involving communication with hosting providers or platform owners to request content removal. Effective follow-up and tracking ensure that the content is actually taken down and the issue is fully resolved. When selecting a take down service, important factors include expertise and experience; providers should have a strong track record in managing similar threats, such as phishing scams or copyright infringement. The scope of services is also crucial, as some providers offer only removal services while others provide additional support like investigation and ongoing monitoring.  Consideration of automation versus manual processes is important too; automated tools can offer speed and efficiency, while manual methods may allow for more thorough analysis. Lastly, understanding the cost and fee structure—whether it’s success-based pricing or hourly rates—is essential to finding a service that fits the organization’s budget. For CEO cybersecurity strategies for take down services, integrating these solutions into their plan of action is a critical measure in managing cyber threats effectively. By understanding the various types of take down services, their significance, and how to choose the right provider, CEOs can enhance their organization’s defense against cybercrime. Investing in comprehensive cybersecurity strategies and effective cyber hygiene practices will ensure businesses are well-equipped to handle and mitigate online risks. Summing Up! As cyber threats become more sophisticated, integrating effective cybersecurity measures is crucial for protecting your organization. Take down services are a vital tool in maintaining robust cyber hygiene, helping to eliminate harmful content and safeguard your brand's reputation. For CEOs, leveraging these services is a strategic move to stay ahead of cybercriminals and ensure legal compliance. Protect your organization with Cyble's cutting-edge cybersecurity solutions. From advanced threat detection to proactive content takedowns, Cyble's AI-driven platform provides comprehensive protection. Contact Cyble today to see how next-gen cybersecurity solutions can fortify your defenses and keep your digital assets secure. Schedule a free demo

image for Central Bank of Iran ...

 Cybersecurity News

The Central Bank of Iran (CBI) and several other banks in the country fell victim to a significant cyberattack on August 14, 2024.  This incident has sent shockwaves through the already tense geopolitical climate in the Middle East. While the full extent of the damage and the culprit behind the attack remain unclear,   show more ...  

initial reports suggest this could be one of the largest cyberattacks ever launched against Iranian state infrastructure. Central Bank of Iran Cyberattack in Detail According to The Jerusalem Post, all the computer systems of the banks in Iran were paralyzed following the cyberattack. Iranian citizens were the first to experience the impact of the attack. Reports surfaced of widespread ATM failures across the country, with users encountering error messages when attempting to withdraw cash. This disruption in essential banking services immediately raised concerns about the attack's scope and potential consequences. Many users posted a note stuck onto the ATM machines in Iran which read, "Dear customers, it is impossible to withdraw money from this ATM. This is because all of Iran's national budget and resources have been allocated to the wars and the corrupt religious leaders of the Islamic Republic regime. "We are very sorry." [caption id="attachment_86964" align="alignnone" width="762"] Source: X[/caption] Saudi-affiliated Iran International news outlet reported that hackers stole information belonging to account holders in Iran's largest bank. Heightened Geopolitical Tensions Reason Behind Cyberattack? Earlier on Wednesday, Iran’s supreme leader, Ayatollah Ali Khamenei, reacted to the cyberattack and said, “The exaggeration of our enemies’ capabilities is intended to spread fear among our people by the US, Britain, and the Zionists. The enemies’ hand is not as strong as it is publicized. We must rely on ourselves. The enemy’s goal is to spread psychological warfare to push us into political and economic retreat and achieve its objectives.” “This cyberattack comes at a time of heightened international scrutiny of Iran’s actions in the region as Iran vows to retaliate for the assassination of Hamas leader Ismail Haniyeh earlier this month. The leaders of the UK, France, and Germany issued a joint statement warning Iran that it “will bear responsibility” for any attacks against Israel, which could further escalate regional tensions and jeopardize efforts towards a cease-fire and hostage-release deal.” reported the Israeli website Israel Hayom. Information regarding the specific techniques used in the attack and the attackers' motivations remains unknown. This lack of transparency makes it difficult to assess the full extent of the damage and the potential long-term effects. Not the First Time The success of this week’s cyberattack raises questions about Iran's cybersecurity posture. Iran has been a target of numerous cyberattacks in recent years, including the one on the Central Bank of Iran that was targeted by hackers. In the beginning of 2023, Reuters reported that Iran’s telecommunications infrastructure company had foiled a cyberattack on CBI. Anonymous and other global hacking groups had threatened to launch cyberattacks on Iranian institutions and officials in support of anti-government protests and to bypass internet censorship there. Amir Mohammadzadeh Lajevardi, head of the Infrastructure Communications Company, said the central bank was targeted by a distributed denial-of-service (DDoS) attack In January 2023. The attacks attempt to cripple servers by overwhelming them with internet traffic. These incidents suggest a potential need for Iran to invest in robust cybersecurity measures to protect its critical infrastructure. As the investigation into this attack continues, one thing seems certain: the landscape of cyberwarfare is constantly evolving, and nations around the globe must be prepared to defend themselves against sophisticated attacks targeting critical infrastructure. Governments and financial institutions must prioritize cybersecurity investments to protect critical infrastructure from cyberattacks.

image for Microsoft Announces ...

 Cyber Essentials

In a significant move to fortify the security posture of its cloud platform, Microsoft is implementing mandatory Multi-Factor Authentication (MFA) for all Azure sign-ins. This multi-layered approach, rolling out in phases starting October 2024, aims to significantly reduce the risk of unauthorized access and bolster   show more ...  

the overall security of Azure environments. Traditional password-based authentication can be vulnerable to brute force attacks or phishing scams. Hackers can leverage readily available password cracking tools or social engineering techniques to gain access to user credentials. Multi-factor authentication adds an extra layer of security by requiring a second verification factor beyond just the password. This additional factor could be a one-time code sent via SMS or mobile app, a fingerprint scan, or a hardware security key. Azure Sign-In MFA Enforcement: Gradual Rollout In it security blog. Microsoft says that mandatory MFA enforcement will occur in two distinct phases: Phase 1 (October 2024): This initial phase focuses on the Azure portal, Microsoft Entra admin center, and Microsoft Intune admin center. These core administration portals will require MFA verification for all users. Importantly, it's crucial to note that other Azure clients, such as the Azure CLI, Azure PowerShell, Azure mobile app, and Infrastructure as Code (IaC) tools, are not impacted during this phase. Phase 2 (Early 2025): The second phase expands MFA enforcement to encompass the Azure clients that were initially excluded. This includes the Azure CLI, Azure PowerShell, Azure mobile app, and IaC tools. This comprehensive enforcement ensures a holistic approach to securing all access points within the Azure environment. Benefits of Mandatory MFA for Businesses The implementation of mandatory MFA offers several critical benefits for businesses utilizing the Azure platform: Enhanced Security: MFA significantly reduces the risk of unauthorized access to sensitive data and resources within Azure environments. By requiring an additional verification factor, it becomes considerably more challenging for attackers to bypass security measures. Reduced Phishing Risk: Phishing attacks, which attempt to trick users into revealing their credentials, become less effective with MFA. Even if a hacker obtains a user's password, they will be unable to gain access without the additional verification factor. Improved Compliance: Many industry regulations and compliance standards mandate the use of MFA for privileged access. Enforcing MFA across the board simplifies compliance efforts for businesses. Centralized Management: Microsoft Azure offers centralized management options for MFA, allowing administrators to easily configure and enforce policies for user groups. Preparing for Mandatory MFA: What Businesses Need to Do To ensure a smooth transition and mitigate potential disruptions, businesses using Azure should take proactive steps in preparation for mandatory MFA enforcement: Microsoft will send a 60-day advance notice to all Entra global admins by email and through Azure Service Health Notifications to notify the start date of enforcement and actions required. Additional notifications will be sent through the Azure portal, Entra admin center, and the M365 message center. For customers who need additional time to prepare for mandatory Azure MFA, Microsoft will review extended timeframes for customers with complex environments or technical barriers. How to use Microsoft Entra for flexible MFA Organizations have multiple ways to enable their users to utilize MFA through Microsoft Entra: Microsoft Authenticator allows users to approve sign-ins from a mobile app using push notifications, biometrics, or one-time passcodes. Augment or replace passwords with two-step verification and boost the security of your accounts from your mobile device. FIDO2 security keys provide access by signing in without a username or password using an external USB, near-field communication (NFC), or other external security key that supports Fast Identity Online (FIDO) standards in place of a password. Certificate-based authentication enforces phishing-resistant MFA using personal identity verification (PIV) and common access card (CAC). Authenticate using X.509 certificates on smart cards or devices directly against Microsoft Entra ID for browser and application sign-in. Passkeys allow for phishing-resistant authentication using Microsoft Authenticator. Finally, and this is the least secure version of MFA, you can also use a SMS or voice approval as described in this documentation. External multifactor authentication solutions and federated identity providers will continue to be supported and will meet the MFA requirement if they are configured to send an MFA claim. A Secure Azure Experience for Businesses Microsoft's mandatory MFA enforcement for Azure sign-ins signifies a significant commitment to cloud security. By requiring this additional verification layer, Microsoft empowers businesses to significantly fortify their cloud defenses and deter unauthorized access attempts. By proactively preparing and embracing MFA, businesses can leverage the robust security features within Azure to protect valuable data and resources within the cloud environment.

image for Data Breach Strikes ...

 Cybersecurity News

AutoCanada Inc., a leading North American multi-location automobile dealership group, reported that it had identified a significant cybersecurity incident affecting its internal IT systems. This AutoCanada data breach adds to the mounting cybersecurity challenges faced by the automotive industry, which has seen a   show more ...  

surge in cyberattacks targeting critical operational systems over the past decade. "AutoCanada Inc announced that it identified a cybersecurity incident on August 11, 2024 that has impacted its internal IT systems," reads the notice on the official website. AutoCanada Data Breach: Investigation and Ongoing Efforts Upon discovering the incident, AutoCanada swiftly took action to secure its network and protect its data. The company engaged top cybersecurity experts to assist in containing the breach and initiating remediation efforts. These experts are also conducting a thorough AutoCanada data breach investigation to understand the full scope, nature, and impact of the breach, including whether any customer, supplier, or employee data has been compromised. While the investigation is still ongoing, the full extent of the damage remains unknown. However, AutoCanada’s business operations continue, albeit with potential disruptions until all affected systems are fully restored. This AutoCanada data breach incident comes at a particularly challenging time for AutoCanada, as it follows closely on the heels of a significant disruption caused by the BlackSuit ransomware attack against automotive software provider CDK Global. The CDK outage, which began on June 19, 2024, and lasted until July 1, 2024, significantly impacted AutoCanada's second-quarter financial performance. The cyberattack disrupted key dealership operations, leading to lost sales, reduced profits, and operational inefficiencies. The company noted that recovery efforts continued until the end of July 2024, with ongoing cleanup and validation processes to restore normal operations. Impact on Operations and Financial Performance AutoCanada's reliance on CDK Global’s dealer management system (DMS) highlights the vulnerability of interconnected systems in the automotive industry. CDK's DMS supports critical aspects of AutoCanada's business, including sales, parts and services, inventory management, business development, and accounting functions. The disruption caused by the CDK outage forced AutoCanada to transition to manual dealership operations temporarily, which, despite maintaining some level of business continuity, led to significant financial losses. In the second quarter of 2024, AutoCanada reported revenues of $1,601.0 million, an 8.8% decline from $1,756.3 million in the same period the previous year. The financial hit was attributed not only to the lost sales of new and used vehicles and related finance and insurance (F&I) deals but also to the reduction in service repair orders and other incremental costs incurred to support ongoing operations during the disruption. Additionally, the automotive industry as a whole is grappling with other headwinds, such as growing OEM inventory levels, higher floorplan costs, rising unemployment, and economic uncertainties driven by a challenging macroeconomic environment. Executive Chairman Paul Antony acknowledged these challenges, stating, "AutoCanada faced several headwinds during the second quarter which substantially affected our performance. The CDK outage disrupted operations resulting in lost sales and profits, OEM inventory grew across the industry causing higher days supply in key brands and impacting floorplan costs, and rising unemployment combined with falling GDP in a still elevated rate environment perpetuated consumer uncertainty." Growing Importance of Cybersecurity in the Automotive Industry The automotive industry's ongoing struggles with cybersecurity incidents highlight the increasing importance of strong cybersecurity measures. The automotive cybersecurity market is projected to experience substantial growth over the next decade, with a compound annual growth rate (CAGR) of 22%, reflecting the sector's urgent need to address these vulnerabilities. Between 2010 and 2023, the global automotive industry faced numerous cyber-related challenges, with service and business disruption emerging as the most common outcome, occurring in 42% of all cyber incidents. These disruptions often result in production delays or halts, leading to significant financial losses. Data and privacy breaches are the second most common impact, accounting for 22% of cyberattack effects. Other typical outcomes include fraud and vehicle theft, underscoring the multifaceted risks posed by cybercrime in the automotive sector. The recent AutoCanada data breach highlight the critical need for the industry to strengthen its cybersecurity posture. The company has taken decisive steps to enhance its internal security measures and enhance threat detection efforts following the CDK Global incident. However, the cyberattack on AutoCanada serves as a reminder of the persistent and evolving threats that automotive companies must navigate. As the automotive sector evolves and integrates more advanced technologies, the emphasis on cybersecurity will only grow, driving the industry to adopt more sophisticated and comprehensive security strategies to protect against the ever-present threat of cyberattacks. The Cyber Express Team has reached out to company for a comment on the AutoCanada data breach, but as of the time of this report, no response has been received. This is an ongoing news story, and we will provide updates to our readers as more information becomes available.

image for NationalPublicData.c ...

 A Little Sunshine

A great many readers this month reported receiving alerts that their Social Security Number, name, address and other personal information were exposed in a breach at a little-known but aptly-named consumer data broker called NationalPublicData.com. This post examines what we know about a breach that has exposed   show more ...  

hundreds of millions of consumer records. We’ll also take a closer look at the data broker that got hacked — a background check company founded by an actor and retired sheriff’s deputy from Florida. On July 21, 2024, denizens of the cybercrime community Breachforums released more than 4 terabytes of data they claimed was stolen from nationalpublicdata.com, a Florida-based company that collects data on consumers and processes background checks. The breach tracking service HaveIBeenPwned.com and the cybercrime-focused Twitter account vx-underground both concluded the leak is the same information first put up for sale in April 2024 by a prolific cybercriminal who goes by the name “USDoD.” On April 7, USDoD posted a sales thread on Breachforums for four terabytes of data — 2.9 billion rows of records — they claimed was taken from nationalpublicdata.com. The snippets of stolen data that USDoD offered as teasers showed rows of names, addresses, phone numbers, and Social Security Numbers (SSNs). Their asking price? $3.5 million. Many media outlets mistakenly reported that the National Public data breach affects 2.9 billion people (that figure actually refers to the number of rows in the leaked data sets). HaveIBeenOwned.com’s Troy Hunt analyzed the leaked data and found it is a somewhat disparate collection of consumer and business records, including the real names, addresses, phone numbers and SSNs of millions of Americans (both living and deceased), and 70 million rows from a database of U.S. criminal records. Hunt said he found 137 million unique email addresses in the leaked data, but stressed that there were no email addresses in the files containing SSN records. “If you find yourself in this data breach via HaveIBeenPwned.com, there’s no evidence your SSN was leaked, and if you’re in the same boat as me, the data next to your record may not even be correct.” Nationalpublicdata.com publicly acknowledged a breach in a statement on Aug. 12, saying “there appears to have been a data security incident that may have involved some of your personal information. The incident appears to have involved a third-party bad actor that was trying to hack into data in late December 2023, with potential leaks of certain data in April 2024 and summer 2024.” The company said the information “suspected of being breached” contained name, email address, phone number, social security number, and mailing address(es). “We cooperated with law enforcement and governmental investigators and conducted a review of the potentially affected records and will try to notify you if there are further significant developments applicable to you,” the statement continues. “We have also implemented additional security measures in efforts to prevent the reoccurrence of such a breach and to protect our systems.” Hunt’s analysis didn’t say how many unique SSNs were included in the leaked data. But according to researchers at Atlas Data Privacy Corp., there are 272 million unique SSNs in the entire records set. Atlas found most records have a name, SSN, and home address, and that approximately 26 percent of those records included a phone number. Atlas said they verified 5,000 addresses and phone numbers, and found the records pertain to people born before Jan. 1, 2002 (with very few exceptions). If there is a tiny silver lining to the breach it is this: Atlas discovered that a great many of the records related to people who are now almost certainly deceased. They found the average age of the consumer in these records is 70, and fully two million records are related to people whose date of birth would make them more than 120 years old today. TWISTED HISTORY Where did National Public Data get its consumer data? The company’s website doesn’t say, but it is operated by an entity in Coral Springs, Fla. called Jerico Pictures Inc. The website for Jerico Pictures is not currently responding. However, cached versions of it at archive.org show it is a film studio with offices in Los Angeles and South Florida. The Florida Secretary of State says Jerico Pictures is owned by Salvatore (Sal) Verini Jr., a retired deputy with the Broward County Sheriff’s office. The Secretary of State also says Mr. Verini is or was a founder of several other Florida companies, including National Criminal Data LLC, Twisted History LLC, Shadowglade LLC and Trinity Entertainment Inc., among others. Mr. Verini did not respond to multiple requests for comment. Cached copies of Mr. Verini’s vanity domain salvatoreverini.com recount his experience in acting (e.g. a role in the 80s detective drama B.L. Stryker with Burt Reynolds) and more recently producing dramas and documentaries for several streaming channels. Sal Verini’s profile page at imdb.com. Pivoting on the email address used to register that vanity domain, DomainTools.com finds several other domains whose history offers a clearer picture of the types of data sources relied upon by National Public Data. One of those domains is recordscheck.net (formerly recordscheck.info), which advertises “instant background checks, SSN traces, employees screening and more.” Another now-defunct business tied to Mr. Verini’s email — publicrecordsunlimited.com — said it obtained consumer data from a variety of sources, including: birth, marriage and death records; voting records; professional licenses; state and federal criminal records. The homepage for publicrecordsunlimited.com, per archive.org circa 2017. It remains unclear how thieves originally obtained these records from National Public Data. KrebsOnSecurity sought comment from USDoD, who is perhaps best known for hacking into Infragard, an FBI program that facilitates information sharing about cyber and physical threats with vetted people in the private sector. USDoD said they indeed sold the same data set that was leaked on Breachforums this past month, but that the person who leaked the data did not obtain it from them. USDoD said the data stolen from National Public Data had traded hands several times since it was initially stolen in December 2023. “The database has been floating around for a while,” USDoD said. “I was not the first one to get it.” USDoD said the person who originally stole the data from NPD was a hacker who goes by the handle SXUL. That user appears to have deleted their Telegram account several days ago, presumably in response to intense media coverage of the breach. ANALYSIS Data brokers like National Public Data typically get their information by scouring federal, state and local government records. Those government files include voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more. Americans may believe they have the right to opt out of having these records collected and sold to anyone. But experts say these underlying sources of information — the above-mentioned “public” records — are carved out from every single state consumer privacy law. This includes California’s privacy regime, which is often held up as the national leader in state privacy regulations. You see, here in America, virtually anyone can become a consumer data broker. And with few exceptions, there aren’t any special requirements for brokers to show that they actually care about protecting the data they collect, store, repackage and sell so freely. In February 2023, PeopleConnect, the owners of the background search services TruthFinder and Instant Checkmate, acknowledged a breach affecting 20 million customers who paid the data brokers to run background checks. The data exposed included email addresses, hashed passwords, first and last names, and phone numbers. In 2019, malicious hackers stole data on more than 1.5 billion people from People Data Labs, a San Francisco data broker whose people-search services linked hundreds of millions of email addresses, LinkedIn and Facebook profiles and more than 200 million valid cell phone numbers. These data brokers are the digital equivalent of massive oil tankers wandering the coast without GPS or an anchor, because when they get hacked, the effect is very much akin to the ecological and economic fallout from a giant oil spill. It’s an apt analogy because the dissemination of so much personal data all at once has ripple effects for months and years to come, as this information invariably feeds into a vast underground ocean of scammers who are already equipped and staffed to commit identity theft and account takeovers at scale. It’s also apt because much like with real-life oil spills, the cleanup costs and effort from data spills — even just vast collections of technically “public” documents like the NPD corpus — can be enormous, and most of the costs associated with that fall to consumers, directly or indirectly. WHAT SHOULD YOU DO? Should you worry that your SSN and other personal data might be exposed in this breach? That isn’t necessary for people who’ve been following the advice here for years, which is to freeze one’s credit file at each of the major consumer reporting bureaus. Having a freeze on your files makes it much harder for identity thieves to create new accounts in your name, and it limits who can view your credit information. The main reason I recommend the freeze is that all of the information ID thieves need to assume your identity is now broadly available from multiple sources, thanks to the multiplicity of data breaches we’ve seen involving SSN data and other key static data points about people. But beyond that, there are numerous cybercriminal services that offer detailed background checks on consumers, including full SSNs. These services are powered by compromised accounts at data brokers that cater to private investigators and law enforcement officials, and some are now fully automated via Telegram instant message bots. Meaning, if you’re an American who hasn’t frozen their credit files and you haven’t yet experienced some form of new account fraud, the ID thieves probably just haven’t gotten around to you yet. All Americans are also entitled to obtain a free copy of their credit report once a year from each of the three major credit bureaus, through the website annualcreditreport.com. If you haven’t done this in a while, now would be an excellent time to order your files (or just get one now, and then a report from a different bureau in 4-5 months, and so on). Either way, review the reports and dispute any errors you may find. Identity theft and new account fraud is not a problem that gets easier to solve by letting it fester. Mr. Verini probably didn’t respond to requests for comment because his company is now the subject of a class-action lawsuit (NB: the lawsuit also erroneously claims 3 billion people were affected). These lawsuits are practically inevitable now after a major breach, but they also have the unfortunate tendency to let regulators and lawmakers off the hook. Almost every time there’s a major breach of SSN data, Americans are offered credit monitoring services. Most of the time, those services come from one of the three major consumer credit bureaus, the same companies that profit by compiling and selling incredibly detailed dossiers on consumers’ financial lives. The same companies that use dark patterns to trick people into paying for “credit lock” services that achieve a similar result as a freeze but still let the bureaus sell your data to their partners. But class-actions alone will not drive us toward a national conversation about what needs to change. Americans currently have very few rights to opt out of the personal and financial surveillance, data collection and sale that is pervasive in today’s tech-based economy. The breach at National Public Data may not be the worst data breach ever. But it does present yet another opportunity for this country’s leaders to acknowledge that the SSN has completely failed as a measure of authentication or authorization. It was never a good idea to use as an authenticator to begin with, and it is certainly no longer suitable for this purpose. The truth is that these data brokers will continue to proliferate and thrive (and get hacked and relieved of their data) until Congress begins to realize it’s time for some consumer privacy and data protection laws that are relevant to life in the 21st century.

image for DARPA Announces AI C ...

 Feed

Teams designed AI systems to secure open source infrastructure software to be used in industries like financial services, utilities, and healthcare. Each finalist was awarded a $2 million prize.

 Breaches and Incidents

A major cyberattack struck the Central Bank of Iran and other Iranian banks, causing disruptions. The incident, reported by Iranian news outlets and Iran International, resulted in the crippling of the banks' computer systems.

 Trends, Reports, Analysis

According to Gcore, the number of DDoS attacks in the first half of 2024 increased by 46% compared to the same period in 2023, reaching a total of 830,000 attacks. The peak attack power also rose to 1.7 terabits per second.

 Trends, Reports, Analysis

In 2024, loaders were involved in nearly 40% of critical security incidents, with popular ones being SocGholish, GootLoader, and Raspberry Robin, aiming to deliver malware like ransomware, according to Reliaquest.

 Companies to Watch

DigiCert has announced the acquisition of Vercara to offer customers a unified DNS and certificate management experience. Vercara provides cloud-based services like managed DNS and DDoS security to protect networks and applications.

 Feed

Ubuntu Security Notice 6963-1 - It was discovered that GNOME Shell incorrectly opened the portal helper automatically when detecting a captive network portal. A remote attacker could possibly use this issue to load arbitrary web pages containing JavaScript, leading to resource consumption or other attacks.

 Feed

Red Hat Security Advisory 2024-5482-03 - A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System base score, which gives a detailed severity rating, is   show more ...  

available for each vulnerability from the CVE link in the References section. Issues addressed include denial of service and server-side request forgery vulnerabilities.

 Feed

Red Hat Security Advisory 2024-5481-03 - A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0 for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System base score, which gives a   show more ...  

detailed severity rating, is available for each vulnerability from the CVE link in the References section. Issues addressed include denial of service and server-side request forgery vulnerabilities.

 Feed

Ubuntu Security Notice 6962-1 - It was discovered that LibreOffice incorrectly allowed users to enable macros when a cryptographic signature failed to validate. If a user were tricked into opening a specially crafted document, a remote attacker could possibly execute arbitrary macros.

 Feed

Red Hat Security Advisory 2024-5479-03 - A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System base score, which gives a   show more ...  

detailed severity rating, is available for each vulnerability from the CVE link in the References section. Issues addressed include denial of service and server-side request forgery vulnerabilities.

 Feed

Red Hat Security Advisory 2024-5453-03 - This is an updated version of the Fence Agents Remediation Operator. This Operator is delivered by Red Hat Workload Availability, and version 0.4.1 is now available for RHEL 8. Issues addressed include a code execution vulnerability.

 Feed

Ubuntu Security Notice 6909-3 - USN-6909-1 fixed vulnerabilities in Bind. This update provides the corresponding updates for Ubuntu 16.04 LTS. Toshifumi Sakaguchi discovered that Bind incorrectly handled having a very large number of RRs existing at the same time. A remote attacker could possibly use this issue to cause Bind to consume resources, leading to a denial of service.

 Feed

Red Hat Security Advisory 2024-5322-03 - An update for firefox is now available for Red Hat Enterprise Linux 9. Issues addressed include bypass, out of bounds read, and use-after-free vulnerabilities.

 Feed

Cybersecurity researchers have uncovered new stealer malware that's designed to specifically target Apple macOS systems. Dubbed Banshee Stealer, it's offered for sale in the cybercrime underground for a steep price of $3,000 a month and works across both x86_64 and ARM64 architectures.  "Banshee Stealer targets a wide range of browsers, cryptocurrency wallets, and around 100 browser

 Feed

A large percentage of Google's own Pixel devices shipped globally since September 2017 included dormant software that could be used to stage nefarious attacks and deliver various kinds of malware. The issue manifests in the form of a pre-installed Android app called "Showcase.apk" that comes with excessive system privileges, including the ability to remotely execute code and install arbitrary

 Feed

Cybersecurity researchers have shed light on a sophisticated information stealer campaign that impersonates legitimate brands to distribute malware like DanaBot and StealC. The activity cluster, orchestrated by Russian-speaking cybercriminals and collectively codenamed Tusk, is said to encompass several sub-campaigns, leveraging the reputation of the platforms to trick users into downloading the

 Feed

Chinese-speaking users are the target of an ongoing campaign that distributes malware known as ValleyRAT. "ValleyRAT is a multi-stage malware that utilizes diverse techniques to monitor and control its victims and deploy arbitrary plugins to cause further damage," Fortinet FortiGuard Labs researchers Eduardo Altares and Joie Salvio said. "Another noteworthy characteristic of this malware is its

 Feed

SaaS applications have become indispensable for organizations aiming to enhance productivity and streamline operations. However, the convenience and efficiency these applications offer come with inherent security risks, often leaving hidden gaps that can be exploited. Conducting thorough due diligence on SaaS apps is essential to identify and mitigate these risks, ensuring the protection of your

 Feed

A large-scale extortion campaign has compromised various organizations by taking advantage of publicly accessible environment variable files (.env) that contain credentials associated with cloud and social media applications. "Multiple security missteps were present in the course of this campaign, including the following: Exposing environment variables, using long-lived credentials, and absence

 Feed

A 27-year-old Russian national has been sentenced to over three years in prison for peddling financial information, login credentials, and other personally identifying information (PII) on a now-defunct dark web marketplace called Slilpp. Georgy Kavzharadze, 27, of Moscow, Russia, pleaded guilty to one count of conspiracy to commit bank fraud and wire fraud earlier this February. In addition to

2024-08
Aggregator history
Friday, August 16
THU
FRI
SAT
SUN
MON
TUE
WED
AugustSeptemberOctober