Individuals at Risk
Identity Theft
Banner Health Breach Affects 3.7 Million: Arizona-based Banner Health, which operates 29 hospitals, says it’s notifying 3.7 million individuals that their data was exposed in a “sophisticated cyberattack.” The organization has hired a forensics firm to investigate the attack after taking steps to block the attackers and contacting law enforcement officials. BankInfoSecurity, August 3, 2016
Cyber Danger
Use of HTTP instead of HTTPS Leads to Large Scale Exposure of Identity Info in Cookies: LAS VEGAS—There’s been an abundance of attacks against crypto over the last few years but a much simpler, scarier threat, cookie hijacking, remains significantly overlooked in the eyes of researchers. ThreatPost, August 4, 2016
Cyber Update
SSL vulnerability in Kaspersky iOS app could allow Man-in-the-Middle (MitM) attack: Security researcher David Coomber spotted a SSL certificate vulnerability in the Kaspersky Safe Browser iOS app. SC Magazine, August 3, 2016
Cyber Defense
Which Form of Two-Factor Authentication Should I Use?: Two-factor authentication is one of the most important ways to protect your accounts. However, recently some authentication methods like SMS have come under fire for being vulnerable to hackers, which defeats the point of “something you know and something you have.” We decided to look at the most common methods and rank them by how secure they really are. LifeHacker, August 3, 2016
Social Security Administration Now Requires Two-Factor Authentication: The U.S. Social Security Administration announced last week that it will now require a cell phone number from all Americans who wish to manage their retirement benefits at ssa.gov. Unfortunately, the new security measure does little to prevent identity thieves from fraudulently creating online accounts to siphon benefits from Americans who haven’t yet created accounts for themselves. KrebsOnSecurity, August 1, 2016
Information Security Management in the Organization
Information Security Governance
Study shows 58% of orgs lack controls to manage insider threat risk: More than half of organizations (58 percent) still lack the appropriate controls to prevent insider attacks, with just under half (44 percent) unaware if their organization has experienced an insider attack at all, according to a new survey of more than 500 cybersecurity professionals. HelpNetSecurity, August 5, 2016
14 Security Fails That Cost Executives Their Jobs: Katrine Archuleta, the director of the Office of Personnel Management, is the latest casualty of a data breach, but she’s certainly not the only one. There’s no job security when your job is security. InformationWeek, August 3, 2016
Half of small companies had data breach in past 12 months says new cybercrime report by Ponemon Inst: We are pleased to announce the release of a study focused on the cybersecurity threat to small and medium-sized companies (SMBs). Based on the findings, we conclude that no business is too small to evade a cyber attack or data breach. In fact, 55 percent of respondents say they experienced a cyber attack in the past 12 months and 50 percent of companies represented in this study had a data breach during the past year. Ponemon, July 1, 2016
Cyber Awareness
NEVER TRUST A FOUND USB DRIVE, BLACK HAT DEMO SHOWS WHY: Does dropping an infected USB drive in a parking work when it comes to a hacker luring its prey into a digital trap? The answer is a resounding yes. ThreatPost, August 4, 2016
Cyber Warning
Cybercriminals target Rio Olympics with phishing and bank fraud: Criminals are ramping up their online presence in Rio de Janeiro, where the Olympic Games will open on Friday, August 5 – with IBM and Fortinet reporting new banking trojans and cyber crime activity in Brazil. TheRegister, August 5, 2016
Report claims more than half of UK firms have been hit by ransomware: Large UK companies are amongst the hardest hit by ransomware in western countries according to a new report commissioned by Malwarebytes. The report found that more than half of large firms had been affected—and that nine percent had been left “entirely unable to operate.” ars technica, August 4, 2016
Beware of ransomware hiding in shortcuts: Even if you haven’t been hit by ransomware yourself, you probably know someone who has. NakedSecurity, August 3, 2016
New browser attack steals SSNs, e-mail addresses, and more from HTTPS pages: The HTTPS cryptographic scheme protecting millions of websites is vulnerable to a newly revived attack that exposes encrypted e-mail addresses, social security numbers, and other sensitive data even when attackers don’t have the ability to monitor a targeted end user’s Internet connection. ars technica, August 3, 2016
Information Security Profession
The most critical gap in cybersecurity today: Talent: You only have to look at recent headlines to confirm that cybersecurity is a critical concern that touches every industry and every individual, and threats are only continuing to increase. CSO, August 3, 2016
Cyber Law
How Companies Should Prepare For Europe’s New Cybersecurity Rules: Cyber breaches have dominated the headlines in the United States, with public companies, government agencies, universities, and now even political parties reporting attacks. No sector has been spared. Gazing across the Atlantic, however, the landscape appears dramatically and blissfully different. Virtually no large European company has publicly acknowledged a cyber breach. Is there an Iron Dome or magnetic force field protecting Europe against cyber attacks? Fortune, August 3, 2016
Cyber Security in Society
Cyber Crime
FBI: Uzbek receptionist working in luxury Thai hotel helped Russian hackers steal $38M: It has all the trappings of a Cold War thriller: a Russian-speaking femme fatale is tracked down to a tropical paradise resort by American spies and is accused of being at the heart of an international criminal syndicate. NationalPost, August 2, 2016
Bitcoin Plunges, Rebounds After Hackers Steal $65 Million: Bitcoin plunged, then erased losses Wednesday as one of the largest exchanges halted trading because hackers stole about $65 million of the digital currency. Bloomberg, August 2, 2016
Cyber Espionage
Hack Brief: Hackers Breach the Ultra-Secure Messaging App Telegram in Iran: YOU’RE TRYING TO protect yourself from the hacks and data breaches that make headlines every week. Great! Maybe you even switched to an encrypted messaging service that specifically touts its strong data protections. Smart! Or was it? In today’s security climate, apparently no good deed goes unpunished. Reuters reported today that more than a dozen Iranian Telegram accounts, the messaging app “with a focus on security,” have been compromised in the last year thanks to an SMS text message vulnerability. That may not sound like many, but the whole idea of Telegram is that no one can read your messages at all. Any breach at all is troubling. Additionally—and perhaps more alarmingly—the hackers were able to access the phone numbers of 15 million Iranian Telegram users. Wired, August 2, 2016
Cyber Underworld
DDoS Attacks: Cybercriminals Are More Homegrown Than You Think: Researchers from the FBI and a private security company say many of the distributed denial of service attacks emanate from the West. DarkReading, August 4, 2016
National Cyber Security
U.S. Wrestles With How to Fight Back Against Cyberattacks: ASPEN, Colo. — It has been an open secret throughout the Obama presidency that world powers have escalated their use of cyberpower. But the recent revelations of hacking into Democratic campaign computer systems in an apparent attempt to manipulate the 2016 election is forcing the White House to confront a new question: whether, and if so how, to retaliate. The New York Times, July 30, 2016
Cyber Politics
Where the would-be vice presidents stand on cybersecurity: Aside from sound bites on Russia and hacking, where Clinton and Trump stand on cybersecurity issues is generally unclear. In fact, they’ve devoted little time to this crucial and urgent subject. Which is weird in light of the epic amount of hacking shenanigans this presidential race has compelled us to endure. Engadget, August 5, 2016
FBI took months to warn Democrats of suspected Russian role in hack: sources: The FBI did not tell the Democratic National Committee that U.S officials suspected it was the target of a Russian government-backed cyber attack when agents first contacted the party last fall, three people with knowledge of the discussions told Reuters.
Reuters, August 3, 2016
DHS may increase protections for voting systems to thwart hackers: WASHINGTON — Homeland Security Secretary Jeh Johnson said Wednesday the federal government should consider designating the U.S. election process as “critical infrastructure” to give the voting system greater protection against cyber attacks. USA Today, August 3, 2016
How Hackers Could Destroy Election Day: Stealing and leaking emails from the Democratic National Committee could be just the start. Hacking the presidential election itself could be next, a bipartisan group of former intelligence and security officials recently warned. Whoever was behind the DNC hack also could target voting machines and the systems for tabulating votes, which are dangerously insecure. TheDailyBeast, August 3, 2016
Financial Cyber Security
Panda Is One Hungry Bear! A Heavyweight Banking Trojan Rolls Into Brazil: IBM X-Force Research observed that a relatively new Zeus Trojan variant known as Panda, or Panda Banker, that started targeting banks in Europe and North America early this year has now spread to Brazil. According to IBM X-Force Research, Panda now targets 10 local bank brands and multiple payment platforms right as Brazil prepares to host a global sporting event. SecurityIntellegence, August 4, 2016
Bitcoin Hack Highlights Cryptocurrency Challenges: The theft of $69 million worth of bitcoins from a Hong Kong-based exchange highlights the continuing challenges around keeping large quantities of digital currency out of the reach of hackers. BankInfoSecurity, August 4, 2016
HIPAA
Motives Other Than Profit May Be Behind Recent Data Breaches: Those conducting two recent cyberattacks against healthcare provider organizations didn’t appear to have a profit motive for gaining access to documents or systems. Information Management, August 5, 2016
Advocate Health Hit with Record $5.5 Million HIPAA Penalty – HealthInfoSecurity: In the largest HIPAA enforcement settlement to date, federal regulators have smacked Chicago-based Advocate Health Care with a $5.55 million fine in the wake of an investigation into three 2013 breaches. The largest incident, involving four stolen unencrypted computers, affected about 4 million individuals. HealthCareInfo Security, August 4, 2016
HHS to Fund Healthcare Cyber Threat Information Sharing & Analysis Organization (ISAO): The Department of Health and Human Services will soon issue up to $1.75 million in grants to give a boost to just one organization that will take a lead role in cyber threat information sharing. A top priority of the ramped-up effort to help fight cyberattacks in the healthcare sector is to keep smaller organizations better informed of the latest risks. BankInfoSecurity, August 1, 2016
Internet of Things
Researchers show how easy it is to trick Tesla’s Autopilot sensors: In May, a Tesla S car in Autopilot mode tragically crashed, killing the car’s driver, after it failed to recognise a white trailer in its path. DailyMail, August 2, 2016
Automakers should view cybersecurity as quality issue, expert says: TRAVERSE CITY, Mich. — Automakers and suppliers would be better off addressing cybersecurity concerns by thinking of them as issues of quality, a cyber expert said here on Wednesday. AutoNews, August 2, 2016
Cyber Research
Hackers Don’t Have to Be Human Anymore. This Bot Battle Proves It: LAST NIGHT, AT the Paris Hotel in Las Vegas, seven autonomous bots proved that hacking isn’t just for humans. Wired, August 5, 2016
Encryption’s quantum leap: The race to stop the hackers of tomorrow: Quantum computers could — theoretically — solve problems that traditional digital computers find impossible to handle. ZDNet, August 2, 2016
Cyber Miscellany
Bitcoin robber steals $70m, offers $600K “giveaway” on Reddit: Reddit user rekcahxfb – that spells bfxhacker backwards – says they’re planning to give away 1,000 bitcoins next Wednesday. Naked Security, August 5, 2016
The post Cyber Security News of the Week, August 7, 2016 appeared first on Citadel Information Group.