STE WILLIAMS

A new Linux kernel vulnerability that can only be locally exploited is nonetheless proving a bit of a nuisance.

The CVE-2018-14634 vulnerability relates to a local privilege escalation bug in the Linux kernel, and creates a means to obtain root (administrator) privileges on a hacked system.

Security researchers at cloud security firm Qualys discovered the vulnerability, which stems from an integer overflow in the Linux kernel’s create_elf_tables() function. It’s not remotely exploitable, thanks heavens, but on a vulnerable 64-bit system, a “local attacker can exploit this vulnerability via a SUID-root binary and obtain full root privileges,” Qualys warns.

Security researchers at Qualys explain: “Even though all Linux kernels are technically vulnerable, this issue is mitigated by a one-year-old patch that was backported to most long-term kernels and makes exploitation impossible.”

“Red Hat Enterprise Linux and CentOS hadn’t yet backported this patch leaving them both initially still vulnerable. Some versions of Debian 8 were also at risk at the time of the bug’s discovery. These various shortcomings have since been addressed.”

Job done, security researchers at Qualys took time out to come up with a name for the vulnerability, which they subsequently dubbed “Mutagen Astronomy” – an anagram of “Too Many Arguments”.

This references “Setec Astronomy” from the hacker film Sneakers, Qualys confirmed. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/27/mutagen_astronomy_linux/

Cunning malware VPNFilter remains under active development, and is acquiring ever more dangerous features.

That’s the conclusion Cisco’s Talos Intelligence security team reached after delving into recent samples and identifying seven “third-stage VPNFilter modules that add significant functionality to the malware”.

VPNFilter rose to prominence in May, when Talos found half a million pwned home routers and NAS boxes in 54 countries. The FBI attributed the attacks to Russia’s Sofacy group (“Fancy Bear”), seized a command-and-control domain, and asked people to reboot their routers.

While maintaining that VPNFilter has mostly been neutralised, Talos’ Edmund Brumaghin wrote that “it can still be difficult to detect in the wild if any devices remain unpatched”.

The infosec company has stayed on the case, and this Wednesday released a blog post saying the new functions it has discovered include an “expanded ability” to attack endpoints from compromised network devices, data filtering, “multiple encrypted tunnelling capabilities” to conceal CC and data exfiltration traffic, and a tool to build a network of proxies to conceal the true source of VPNFilter traffic.

The specific modules are called:

• htpx – HTTP traffic redirection and traffic inspection;
• ndbr – a multi-functional SSH utility;
• nm – network mapping from compromised devices;
• netfilter – a denial-of-service utility;
• portforwarding – forwards network traffic to attacker-specified infrastructure;
• socks5proxy – Sets up a SOCKS5 proxy on the compromised device; and
• tcpvpn – Sets up a reverse-TCP VPN on the compromised device.

The other important discovery Talos highlighted in the post was the attackers’ use of a MikroTik administration utility called Winbox, a small Windows 32 utility that mirrors the functions offered on the Web-based admin interface.

It turned out older versions of Winbox presented an attack vector through TCP Port 8291, and because Winbox data is passed as “large blobs of binary data,” exploits aren’t easily identifiable in network traffic. By way of example, Brumaghin cited early September’s directory traversal bug, CVE-2018-14847.

Talos has released a Winbox traffic dissector as a Wireshark plugin at GitHub. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/27/fancy_bear_modules/

Exclusive Russian airline Aeroflot has exposed to the public internet the internal blueprints for its website, aeroflot.ru, The Register has learned.

Specifically, the biz has left a Docker registry server open to all the world to see: if asked nicely, with no authentication, it will cough up compressed archives of the confidential Python source code and settings text files that run its website. The files form Docker images that run on Aeroflot’s website servers in containers. We have verified that the contents of the containers are present on the public website.

No sensitive customer information is believed to be among the leaked data. Aeroflot could not immediately be reached for comment on the matter: we have alerted the airline to the security blunder. We have decided not to link to the server exposing the information, nor go into detail on the data-leaking vulnerability, in the interests of responsible disclosure. Copies of the source code and configuration settings have been mirrored online, though.

The files cover all parts of Aeroflot’s website – from handling gift certificates to issuing customer bonuses. They are a treasure trove for miscreants hoping to hack the dot-ru: any vulnerabilities found in the code or settings can be exploited to hijack the website, and snoop on passenger bookings and payments.

A source told El Reg on Wednesday they found a Docker registry server – used to deploy containers on servers – that had been erroneously left open to the public internet containing Aeroflot source code. We have verified that the leaky registry service is running on an Aeroflot computer. Normally, this would be hidden behind a firewall where access would be limited to Aeroflot servers and its developers.

Anyone who accesses the registry will be able to ask for the Docker images for the entire Aeroflot website. Basically, the blueprints for Aeroflot’s website application. Again, while the repository contains the source code and config files for the web app, customer data itself is not believed to be present. Still, this is not a good look for Aeroflot, and could lead to bigger problems.

A partial list of internal Aeroflot source code found in the registry, and shown to The Register … Click to enlarge

As you might imagine, this information would not be something the airline would likely want to have left open on the public internet, as this code would potentially allow someone seeking a way to breach the application to probe and prod at the source.

Think of it like someone being able to get the designs for your house. It’s not the keys, but it would let them know where to look for an unlocked door or window. Were the applications securely written, this code would not be of much use, though the fact that the registry itself was left out in the open could suggest that there are other vulnerabilities.

An internal README file for customer bonus points, shown to The Register

Our source said they alerted us in an effort to get Aeroflot to improve the security of its IT operations, and to show that all companies, even large corporations, can make the common error of failing to properly secure their web-facing applications and tools.

Our industry insider also noted that the code is likely to have been exposed to the internet for years and, more likely than not, has previously been accessed by others and potentially exploited for attacks against the Russian airline.

“All the repositories are not protected in any way and there is no authentication,” our source said. “Perhaps after this publication, the corporation will pay attention to its problems and will take care of ensuring information security.”

The lesson for this is pretty simple: make sure all of the components of your developer environment and container setups are secure. In this case, an improperly configured registry with an open port has allowed a researcher to pull hundreds of megabytes worth of source code from a company. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/26/aeroflot_server_code_open/

Password managers on mobile devices can be tricked by imposter apps into handing over a user’s passwords.

This according to a paper [PDF] from researchers with the University of Genoa and EURECOM, who found that the Android Instant Apps feature is designed and can ask for, and receive, stored credentials from password managers meant for other applications.

The idea is that Instant Apps, a feature intended to let user try out portions of an Android app without fully downloading it by running remotely hosted code, does not get properly distinguished from fully-installed apps by either users or password managers.

The researchers say that a number of popular Android password managers are also prone to falling for spoofed package names and metadata entries that lead them to conclude a spoofed app is authentic.

“This means that the package name of the Instant App is attacker-controlled, and that it is thus possible to trick password managers to auto-fill credentials for an attacker-chosen website even without requiring the installation of an additional app,” the researchers explain.

“This allows an attacker to bootstrap an end-to-end phishing attack by luring the victim into visiting a malicious webpage: such webpage may contain, for example, a fake Facebook-related functionality.”

The paper paints a picture of an attack scenario where an attacker would lure the user to a lookalike page, or even just a fake ‘like’ button, that would then prompt the user to approve opening a lookalike ‘instant app’ package that is connected to the attacker’s server.

Microsoft ‘kills’ passwords, throws up threat manager, APIs Graph Security

READ MORE

From there, the malicious instant app would present itself as a valid app (such as Facebook) and request the password manager hand over login credentials. Neither the user, nor the password manager, would be aware they had been conned.

“We believe this attack strategy significantly lowers the bar, with respect to all known phishing attacks on the web and mobile devices: to the best of our knowledge, this is the first attack that does not assume a malicious app already installed on the phone and that does not even require the user to insert her credentials,” the researchers say.

“These attacks are strictly more practical than all currently known mobile phishing works.”

In the end, the researchers say the solution for the issue is not for password managers to change how they operate, but rather that Google develop a more reliable and secure method for password tools to verify that the apps asking for credentials are who they say they are.

“The key design issue is that all these mechanisms use package names as the main abstraction to work with, thus leaving developers of password managers with the daunting task of mapping apps to their associated domain names,” the paper reads.

“Given the number of security issues and misplaced trust assumptions we have identified in leading password managers, we believe third-party developers should not be asked to implement this critical step.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/26/password_manager_theft/

VPNFilter malware is adding capabilities to become a more fully-featured tool for threat actors.

Malware writers are finding greater efficiencies by reusing older code families. That explains why VPNFilter — the attack that caused the FBI to recommend that everyone in the US reset their cable modem — is showing up with new capabilities and payloads.

In a new report, Talos says that its researchers have found seven new third-stage VPNFilter modules that add significant new functionality. The new capabilities include including an expanded ability to move laterally between endpoints on a network, data filtering, and multiple encrypted tunnels to mask command-and-control and data exfiltration traffic.

In the conclusion of the report, Talos offers information both worrying and soothing to security professionals. On the one hand, researchers list the new capabilities and point out that these are accompanied by new obfuscation routines, making it more difficult to find the more dangerous malware.

On the other hand, “it appears that VPNFilter has been entirely neutralized since we and our international coalition of partners (law enforcement, intelligence organizations, and the Cyber Threat Alliance) countered the threat earlier this year.”

However, Talos cautions against becoming complacent. “[We] know that the actor behind VPNFilter is extremely capable and driven by their mission priorities to continually maneuver to achieve their goals,” according to the report. “The sophisticated nature of this framework further illustrates the advanced capabilities of the threat actors making use of it, as well as the need for organizations to deploy robust defensive architectures to combat threats such as VPNFilter.”

Read more here.

 

 

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/vpnfilter-evolving-to-be-a-more-dangerous-threat/d/d-id/1332902?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Ride-sharing company settles legal cases with 50 states and the District of Columbia for its handling of 2016 data breach.

Uber has reached a $148 million settlement with the 50 US states and the District of Columbia for violating data breach reporting laws in its cover-up of a massive hack in 2016.

California led the nationwide settlement case following its own investigation of Uber’s handling of the breach, where the ride-sharing company paid a hacker $100,000 to stay mum about the breach rather than alerting the more than 174,000 Uber drivers in California about the exposure of their information, including drivers’ license numbers. The hack exposed data on some 57 million users nationwide.

Uber ultimately went public about the breach in November 2017. The settlement will be dispersed among the states and DC, and follows a previous settlement agreement with the Federal Trade Commission in April.

Read more here and here. 

 

 

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/uber-agrees-to-pay-$148-million-in-nationwide-settlement-/d/d-id/1332903?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Microsoft engineer details how the company’s IoT security solution operates – at multiple layers starting with the microcontroller.

MICROSOFT IGNITE – Orlando, Fla. – Galen Hunt sat at a table during Microsoft Ignite, with a holder filled with scores of square microcontroller chips on the table in front of him. One of the chips was missing. “Someone took one of my chips!” he exclaimed and then laughed. “I think I know who it was—and I’ve got more where these came from.”

Hunt, a Microsoft distinguished engineer and managing director of the Azure Sphere/Azure hardware systems group, has spent a lot of time with MCUs (microcontroller units) while building Sphere, a service and framework that Microsoft offers for securing devices at the network’s edge. 

The industry’s concern about security of connected devices has been late in coming. “About nine billion devices a year ship where a microcontroller is the brain of the device,” Hunt said in an interview at Ignite this week. “Most of those devices are not connected; ninety-nine point something-percent of them have no connectivity whatsoever.” 

But a few years ago that situation began to change. “Four years ago, somebody walked into my office with a schematic description of the specs for a microcontroller with Wi-Fi built into it. And that was one of those ‘a-ha’ moments for me when I realized I was looking at the future of computing.”

One of the problems with these connected devices is that the network stack built into the MCU is very primitive, he said. Most have no security capabilities whatsoever, depending on an “air-gap” to keep attackers at bay. And with the explosion of the IoT, that air-gap has disappeared, replaced with constant connectivity to the Internet at large. 

Microsoft ultimately created Azure Sphere, a three-part solution that allows manufacturers to rely on built-in security for their connected intelligent products. It begins with the sort of chips that Hunt has on the tray in front of him. “We’re not building chips. We have an IP block that goes into the chips, Hunt said. “The IP block is to hardware what a library is to software.”

The IP block in this case is called the Pluton Security Subsystem and it’s part of every Azure Sphere MCU. Its primary function is providing a hardware root of trust for the device in which the MCU will sit. During the chip manufacturing process, the silicon die generates a unique key for the chip — a key that is used as the basis for cryptography and authentication. “It provides secure boot on top of the crypto identity, some other crypto accelerators, key storage, and some other basic hardware root of trust capabilities,” Hunt said.

The second part of Azure Sphere is the operating system, a Linux-based operating system with multiple layers of defense for the firmware and the application code. “The outer layers not only might get attacked, they might be compromised, so then the inner layers know how to protect and restore the security outer layers,” Hunt explained.

The layers come in an open source package that manufacturers can modify to suit the needs of their individual devices, Hunt said, with the goal of making the system sufficiently flexible to meet a wide range of demands.

Then there’s the Azure Sphere security service, a cloud-based service that keeps every device updated with the latest version of firmware and application software. It also provides certificate-based authentication between the device and the manufacturer’s application cloud.

A typical installation checks with Azure Sphere for software updates once a day, and Microsoft recommends that manufacturers build their code so that the Azure Sphere software runs on one core, while the application code runs on an entirely separate core — one that will allow for “fail-safe” operation even if network connectivity is completely lost.

Azure Sphere is built around the points made in a paper, The Seven Properties of Highly Secure Devices, which Hunt co-authored. “I use ‘property’ very precisely as opposed to principle or standards,” Hunt said, “because property is something you can measure.”

Azure Sphere developer kits are now available from Microsoft.

Related content:

• Owning Security in the Industrial Internet of Things
• The Top 5 Security Threats Mitigations for Industrial Networks
• 4 Trends Giving CISOs Sleepless Nights
• 6 Security Training Hacks to Increase Cyber IQ Org-Wide 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/iot/inside-microsoft-azure-sphere/d/d-id/1332904?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

All versions of Red Hat Enterprise Linux, CentOS vulnerable to ‘Mutagen Astronomy’ flaw, according to Qualys.

Multiple Linux distributions including all current versions of Red Hat Enterprise Linux and CentOS contain a newly discovered bug that gives attackers a way to obtain full root access on vulnerable systems.

The integer overflow flaw (CVE-2018-14634)exists in a critical Linux kernel function for memory management and allows attackers with unprivileged local access to a system to escalate their privileges. Researchers from security vendor Qualys discovered the issue and have developed a proof of concept exploit.

A patch for the flaw, which Qualys has dubbed “Mutagen Astronomy,” is available, and most Linux distributions have already “backported” the patch for older versions of their kernels. But Red Hat Linux Enterprise, CentOS, and the Debian 8, or the “oldstable” version, are yet not patched, Qualys said in a security advisory this week.

In a statement, Red Hat said the issue impacts Red Hat Enterprise Linux 6, 7, and Red Hat Enterprise MRG 2. But versions of the Linux kernel shipped with Red Hat Linux 5 are not impacted, and systems with less than 32GB of memory are also very unlikely to be impacted by the vulnerability, “as they do not have a large enough address space to exploit this flaw,” Red Hat said.

The vulnerability has been assigned a CVSS base score of 7.8, but Red Hat has assessed it as having high impact on confidentiality, integrity, and availability.  The vendor described the vulnerability as being exploitable with no user-interaction needed and involving low attack complexity.

Anagram

Jimmy Graham, director of product management and vulnerability management at Qualys, says the name “Mutagen Astronomy” is an anagram of “Too Many Arguments,” which is the fundamental vulnerability being exploited.

The flaw is another reminder of the importance of the need for layered defenses, he says. Often attackers who exploit a remote vulnerability—such as a Web-application exploit, for instance—only gain unprivileged access on the vulnerable system.

So cybercriminals typically combine the use of lower-severity flaws with more severe ones like the Mutagen Astronomy flaw to create a very functional attack, Graham explains. “This type of vulnerability is often used in conjunction with other kinds of attacks,” he says. “If an attacker has an existing foothold on a system but is unable to escalate to root, they may utilize a vulnerability like this to fully compromise the system.”

That is why proper vulnerability and patch management is crucial, and should not be limited only to remediation of “critical” vulnerabilities, he adds.

Linux developer Kees Cook developed the patch for the flaw based on previous work by grsecurity, and most Linux distrbutions have backported it to their long-term-supported kernels. A backported patch is a patch that has been developed for the current mainline Linux kernel but can be applied to older, or long-term-supported (LTS) kernels, Graham says.

It’s up to each Linux provider to decide if a patch is important enough for them to backport, and whether there’s a likelihood of the patch harming the stability of their older LTS kernels.

“In this particular case, most distributions backported this patch, but Red Hat Enterprise Linux and CentOS did not,” Graham says. All versions of these distributions are affected – even in their default and minimal installations, he notes.

Red Hat’s advisory includes advice on how organizations can mitigate the vulnerability. The company will address the issue in updates for Red Hat Enterprise Linux 6, 7, and other affected versions.

Related Content:

• US-CERT Warns of New Linux Kernel Vulnerability
• New Mirai Variants Leverage Open Source Project
• Automating Kernel Exploitation for Better Flaw Remediation
• 10 Open Source Security Tools You Should Know

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/critical-linux-kernel-flaw-gives-root-access-to-attackers/d/d-id/1332906?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The final swipe in the great whack-a-mole game of web encryption may finally have been swung.

It hasn’t struck home yet but the backswing looks good and the aim is true. Behind the bat is Cloudflare – who else? – and its target is an obscure but widely used technology called SNI (Server Name Indication).

SNI is a bit of unencrypted data that contains the name of the website you’re visiting.

It’s sent by the browser when you view websites securely and, ironically, this unencrypted tidbit of data has played a crucial part in making encryption the exception rather than the rule on the web.

SNI is a trade-off – it opens a small privacy hole at the expense of closing a much bigger one – and as such it has always been a job half done. Everyone knew that sooner or later it would need fixing but nobody was quite sure how to.

After considerable head scratching, Cloudflare is about to test its answer to the SNI conundrum, Encrypted SNI, with partners Mozilla.

So let’s look at what SNI does, why fixing it was hard and what Cloudflare is up to.

SNI’s Catch-22

When you visit a website using an encrypted HTTPS connection, your computer asks the server hosting the website for its digital certificate. It compares the name in the certificate with the name of the site it wants to talk to, to ensure they’re one and the same. If they match, an encrypted tunnel is created between the two computers and HTTP messages can be sent and received over that tunnel.

However, there’s a Catch-22 if, as happens frequently, you want to visit a website on a server that’s hosting lots of different websites with different certificates.

Your computer has to tell the server which website it wants a certificate for, so it can create an encrypted tunnel, but it tells the server which website it wants using HTTP, and it can’t send HTTP messages until it’s created an encrypted tunnel…

Enter SNI to break the deadlock.

SNI allows a web browser to send the name of the website it wants to connect to up front, before the encrypted tunnel is formed, so the server knows which certificate to send.

Because it’s sent in plain text, before the encrypted tunnel is created, your SNI data can be read by anyone who can intercept your browsing traffic, such as an ISP or rogue Wi-Fi access point, revealing the websites you’re visiting.

Only a few short years ago the web was largely unencrypted and the entire contents of your HTTP messages could be pored over and modified by interlopers. In that context, the SNI leak was a small price to pay for the huge privacy and security boost it enabled by making HTTPS on shared hosts easier.

Now that encrypted HTTP is the norm, attention is switching to SNI and DNS – two plain text protocols that can be intercepted to see what websites you’re visiting.

Efforts to fix DNS have attracted far more attention than SNI (probably because it’s more widely used and easier to fix), and multiple solutions have emerged such as DoH (DNS over HTTPS) and DNS over TLS, DNSCrypt and the interesting and esoteric Oblivious DNS.

You can see how HTTPS, DNS encryption like DoH and ESNI combine to hide different parts of your browsing data in the table below:

How ESNI works

The process of negotiating an encrypted tunnel between your browser and a web server is called the “handshake”. It involves sending plaintext SNI data to tell the server which certificate you want, checking that you’re talking to that server, agreeing which ciphers to use and exchanging encryption keys.

Fixing SNI is hard is because the SNI data you send needs to be decrypted by the server before it can perform the handshake that tells it how to decrypt your messages. Or, as Cloudflare itself put it in its detailed explanation on the subject:

If the chicken must come before the egg, where do you put the chicken?

The answer is, you put it in DNS (Domain Name System), the global internet address book used to associate human-readable names like example.org with IP addresses like 93.184.216.34.

Computers find and talk to one another using IP addresses, so the first thing your computer does when you tell it to visit a website is quickly lookup up the IP address using DNS.

Cloudflare want website owners to create a pair of cryptographic keys – one public, one private – and publish the public key in a DNS entry (where web browsers can pick it up before visiting a website), alongside their IP address.

The public key can be used by anyone to derive a symmetric encryption key that only the owner of the secret, private key (the website owner) can unlock.

Since only the client, and the server it’s connecting to, can derive the encryption key, the encrypted SNI cannot be decrypted and accessed by third parties.

When it wants to connect to a website using ESNI your browser will generate its own, ephemeral, public and private key pair that will be used once and discarded, to prevent replay attacks.

While this may seem overly complicated, this ensures that the encryption key is cryptographically tied to the specific TLS session it was generated for, and cannot be reused across multiple connections.

The browser uses its ephemeral private key and the server’s public key to derive an encryption key, encrypts the SNI data and sends it to the website along with the public portion of its ephemeral key.

The server then uses its private key and the browser’s public key to derive the encryption key that can decrypt the SNI data, and the handshake for the encrypted HTTP session can begin.

Although it’s Cloudflare’s baby, the company is trying to turn ESNI into an open standard via the IETF (Internet Engineering Task Force). The feature is already available for anyone using Cloudflare name servers but no browsers support it yet, although it’s expected to be a feature of Firefox’s bleeding edge nightly builds imminently.

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/eYbV345SLu0/

UK-based insurance services firm Premium Credit has hauled itself back online following a malware-based attack that struck the business more than a week ago.

Premium Credit underwrites insurance premiums for a network of brokers, business and personal customers and has 400 staffers across the UK and Ireland.

In a statement on its website yesterday that accompanied its return after nine days offline, the UK and Ireland firm played down the episode, adding it had found “no evidence of data loss” following an unspecified “cyber incident”.

External experts continue to investigate. “We have now restored many key systems, and are working around the clock to complete our full restoration,” the statement concluded.

So what happened? The insurance premiums financer told El Reg that it had suffered from an unspecified malware outbreak, adding that it had taken its systems offline as a “precaution“. In a follow-up statement, received via email, Adam Morghem, strategy and marketing director at Premium Credit, provided a fuller rundown of events.

On Sunday 16th September, our virus monitoring alerted us to a cyber incident. We followed our extensive security protocols designed to protect our systems and isolate our partners from harm. We then began the investigation into the incident with external 3rd party experts.

Since then, we have been working around the clock to restore our services for our brokers. Our trading systems are live with our brokers.

Our call centres have been open since Monday 17th to support customers and producers during the outage.

He told us the internal and external probes by infosec specialists had not turned up any evidence of data loss. He said it has told customers that any payment that was delayed due to the outage will not be treated as a deafult so no default charge will be levied.

“We can only apologise for the disruption this has caused our partners and their customers,” said Morghem.

El Reg checked in with Troy Hunt, the security researcher behind the Have I been Pwned breach notification service and normally among the first people to hear about any customer data leak. He said he hadn’t heard anything yet, a good sign, though hardly definitive. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/09/26/premium_credit_outage/