STE WILLIAMS

Regus spills data of 900 staff on Trello board set to ‘public’

Another company has ended up accidentally spilling sensitive data from business collaboration tool Trello.

According to a Daily Telegraph report, the company that put the boot to its own throat this time is office space company Regus, which posted performance ratings of 900 managers to a public Trello board.

Trello boards come in three types – private (password needed), approved (i.e. visible to specific people), and public.

It seems the Regus parent company IWG carried out covert video assessments using researchers from a company called Applause posing as clients looking for office space.

The evaluations from this were gathered into a spreadsheet which was inadvertently set to ‘public’.

Because search engines index public Trello boards that meant that anyone with a browser could, in theory, see the data, which included names, addresses, performance ratings, and company training videos.

These would normally be shown only to the employee concerned as part of company assessments.

In addition to exposing Regus’s own staff, the personal details and email addresses of the external researchers working for Applause were also leaked. IWG issued a statement that appeared to shift the blame to the research company:

We are extremely concerned to learn that an external third-party provider, who implemented the exercise, inadvertently published online the outcomes of an internal training and development exercise.

The data had now been taken down:

As our primary concern we took immediate action and the external provider has now removed the content.

Although the newspaper says this didn’t happen until they contacted IWG and Applause. It’s not clear how long the data was left in its public, exposed state.

Self-inflicted wound

This is not the first time that an organisation has got itself into hot water while using Trello, but the problem isn’t necessarily Trello as an application so much as the ease with which it can be used naively.

It’s the version of the ‘shadow cloud’ problem hiding in plain sight – employees are using an approved application without knowing how to use it securely.

If they’ve not had the risks explained to them – and inevitably there will always be someone who missed the training day – it’s hardly their fault.

Or perhaps they were told and simply forgot or made a mistake. Either way, the company that gives them this power is always responsible for the moral hazard.

It’s a reminder that many data breaches are nothing to do with hacking but happen because of misconfiguration. As with all cloud systems, sharing and collaboration are great buzzwords as long as the going’s good.


Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/2lrLx8iOU38/

NIST’s new privacy rules – what you need to know

You’ve waded through the relevant privacy regulations until your brain hurts, and you understand the basic requirements under GDPR, CCPA, or whatever industry rules you must abide by. But how do you ensure that you’re compliant? Worry no more. NIST has released a Privacy Framework to help you get your house in order.

The federal US government’s National Institute of Standards and Technology (NIST) has a good track advising organisations on cybersecurity. It published a set of password rules in 2016. It also publishes a Cybersecurity Framework that has become a litmus test for those trying to secure their data.

The brand new Privacy Framework 1.0 is the equivalent document for protecting peoples’ personal privacy. As NIST points out, cybersecurity and privacy are connected, but different. Some privacy events aren’t related to cybersecurity incidents, but stem from other issues like over-aggressive data collection, poorly thought-out marketing practices, or manual mishandling of data.

You can use the Privacy Framework when developing new products and services to ensure that they tick all your privacy boxes. It’s a good tool when conducting the privacy impact assessments that regulations like GDPR demand. It isn’t a compliance toolkit for meeting the requirements of specific regulations. Instead, it’s a voluntary toolkit that you can use to think about your approach to privacy. You can use bits of or all of it – NIST isn’t prescriptive.

The Framework breaks down into three broad areas: the core, the profiles, and the implementation tiers. The core contains a set of five functions that you work through as part of your privacy assessment process.

The first, Identify-P, involves spotting and understanding privacy risks.

The second, Govern-P, is where you define the rules to deal with them, thinking up your privacy policies to help meet risk and regulatory requirements.

The Control-P function is the sharp end, where you manage data in line with your governance structure. You then establish lines of communication to tell people about those risks and controls as part of the Communicate-P function.

The final function, Protect-P, is the part of the core framework that governs cybersecurity risk. It’s where you take the appropriate cybersecurity measures, and it’s the part where you can follow the guidelines outlined in NIST’s Cybersecurity Framework. They’re designed to dovetail together.

Each of these functions has a set of categories and subcategories that get into detail, with tasks like a risk assessment, and mapping out the data processing activities that your systems perform, who owns them, who’s data they’re handling, and what they’re doing with it.

The outputs from these exercises give you the data you need to tackle the second part of the framework, where you profile your privacy stance. You create a set of outcomes that you are currently achieving in your core categories, which forms your current profile. You also create a target profile which shows you which outcomes you want to achieve. It’s effectively a gap analysis that you can use to work out what your privacy goals are, and what you need to achieve them.

Your target profile forms the basis for the final element of the framework: the implementation tiers. These tiers, called partial, risk informed, repeatable, and adaptive, help you gauge how far along you are in your privacy journey.

If you’re only at partial, NIST says, then moving to the second tier would be a good idea. Not all companies would need to achieve the third or fourth tiers, though. You assess whether it’s worthwhile by looking at your target profile and privacy risks.

After you’ve done all this work, what’s to stop your privacy profile from becoming just another piece of shelfware that no one ever looks at?

What’s really interesting about the Framework is how you can map the target profile to your system development lifecycle. It becomes a benchmark against which you can measure the privacy of new systems and services. You can also use it to operate that system and keep its privacy policy and practices on track.

There’s another interesting use for profiles, and that’s in dealing with other entities. NIST acknowledges that the role of an organisation is important. Your legal obligations and privacy risks might change depending on whether you are an individual, a government entity, an educational institution or a cloud service provider, for example. You will also likely have complex relationships with one or more of those entities. How can you ensure that their privacy practices meet your own targets?

You can develop profiles representing your privacy requirements for service providers or product vendors, the Framework says, presenting these profiles to them as a set of requirements. Their ability to meet those requirements can help shape your buying decisions.

The NIST Privacy Framework isn’t a checkbox for your GDPR or CCPA compliance, but it is a useful tool to help you when meeting those requirements, or those of your own customers or business partners.

In the unlikely event that you aren’t subject to any official privacy regulations in 2020, you can still use it to meet your own ethical guidelines, NIST points out. And if you want a concrete structure around which to drape a privacy initiative, there are worse places to start.


Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qZfuL8tJwO4/

Ubisoft sues DDoS-for-hire operators for ruining game play

Mega-big online gaming company Ubisoft, maker of mega-hit games including Assassin’s Creed, Far Cry, Just Dance and Tom Clancy’s RainbowSix: Siege (R6S), is suing four operators of the DDoS-for-hire sites that have been launched against its RainbowSix servers.

These guys aren’t just launching attacks that kick all players on a targeted server out of a game, or degrade the game performance down to sludge, Ubisoft alleges. They also allegedly went so far as to throw up a bogus domain seizure notice on one of their sites, claiming that the domain had been seized by “Microsoft Inc. and Ubisoft Entertainment” pursuant to a fictional “Operation(D)DoS OFF”, according to the complaint (posted courtesy of Polygon) that Ubisoft filed on Thursday in the US District Court of Northern California.

Ubisoft says it was part of the operators’ attempts to rub out their tracks:

Defendants are well aware of the harm that the DDoS Services and DDoS Attacks cause to Ubisoft. Indeed, knowing that this lawsuit was imminent, Defendants have hastily sought to conceal evidence concerning their involvement.

It’s not just alleged DDoS-for-hire operators who knew this lawsuit was coming. Everybody in the gaming world knew. Ubisoft picked up on an increase in DDoS attacks in September 2019, banned the worst offenders, and said that it was talking to its legal team about legal action.

Last week, Ubisoft filed the complaint against five people whom it thinks run a network of four distributed denial of service- (DDoS)-for-hire services via various domain names and websites – the websites SNG.one, R6S.support, r6ddos.com, and (could they possibly be more redundant?) stressed-stresser-stressing-stressers.com – and that they hide behind various anonymous online aliases to do so.

The defendants: Dennis Kruk (based in Germany), Maximilian Kuehl (Germany), Kelvin Uttih (Nigeria), an individual identified as B.R. (the Netherlands), and an individual identified only by their email address: [email protected].

Booter who, now?

Stressers – also known as booters or DDoS-for-hire – are publicly available, web-based services that launch server-clogger-upper attacks for a small fee or, sometimes, none at all.

As befits the “stresser this” and “stresser that” brand names for a lot of these services – besides the stresser-stressy-stress-o-matic name mentioned in the complaint, such services have included ExoStresser, QuezStresser, Betabooter, Databooter, Instabooter, Polystress, and Zstress – DDoS-for-hire sites sell high-bandwidth internet attack services, sometimes under the guise of “stress testing.” SNG.ONE does the same: its site describes it as a “penetration testing service.”

DDoS attacks are blunt instruments that work by overwhelming targeted sites with so much traffic that nobody can reach them. They can be used to render competitor or enemy websites temporarily inoperable out of malice, lulz or profit: as in, some attackers extort site owners into paying for attacks to stop.

One example is Lizard Squad, which, until its operators were busted in 2016, rented out its LizardStresser attack service. LizardStresser was given a dose of its own medicine when it was hacked in 2015.

You might remember Lizard Squad as the Grinch who ruined gamers’ Christmas with a DDoS against the servers that power PlayStation and Xbox consoles – an attack it carried out for our own good.

For our own good, as in, the attackers didn’t feel bad: some kids would just have to spend time with their families instead of playing games, one of them said at the time.

These services, in other words, are used a lot in the online gaming world. Booter-based DDoS attack tools offer a low barrier to entry for users looking to engage in cybercrime. Indeed, hiring a service to paralyze your enemies’, your competition’s and/or your targets’ sites makes it as easy as simply handing over the money, no technical skill required… nor much money.

Chump change for cheaters

In April 2018, when the world’s largest DoS site – Webstresser.org – got busted, we got a look at the paltry sums the crooks were being charged for unleashing mayhem. According to Webstresser’s pricing table, archived before the site was taken down, memberships $18.99/month for the “bronze” level, and $49.99/month for a “platinum” service.

According to Ubisoft’s suit, the defendants sell subscriptions for up to $299.85 for “lifetime” access to a server that dishes out DDoS attacks. The subscription tiers include Starter, Advanced and “Full Time B00ter.” Monthly pricing starts at 10 Euros (about USD $11.11) and goes on up to 270 Euros (about USD $299.85) for “lifetime” access.

Besides R6S, the complaint included a screenshot that also showed Fortnite, FIFA 20, and Call of Duty: Modern Warfare 4 as potential targets.

There are a whole lot of DDoS-for-hire services out there, but the ones named in the complaint are specifically aimed at Ubisoft games. The operators of the services not only named their offerings using Rainbow Six Siege references; they’ve also “gone out of their way” to taunt Ubisoft support, the complaint notes.

For example, the complaint included a screenshot of a Tweet that mocked Ubisoft’s security efforts, including the company’s efforts to ban users of the DDoS services.

But why?

As Polygon reports, DDoS attacks are the tools of cheaters.

Cheating players use the attacks to create lag, slow the matches down and frustrate legitimate players into quitting. Ordinarily, quitting a match earns a penalty and gives the remaining player ranked points without having to do anything.

Ubisoft asked the court to shut down the alleged cheaters’ websites and to award damages and fees.

SNG.ONE hasn’t responded to media inquiries.


Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/RCiMuJPJaio/

Capita Education Services accidentally spaffs email addresses in Helpdesk snafu

Capita Education Services had a bit of an oopsie yesterday as a new helpdesk system spurted potentially thousands of email addresses at unsuspecting users.

A Register reader got in touch to express his surprise at receiving an email regarding a helpdesk ticket he didn’t open, logged by someone he didn’t know.

To make matters worse, the email contained approximately 100 addresses in the To: field. A colleague reported receiving the same email, except with the address field populated by a different 100 addresses.

A quick glance at the edugeek forums confirms that our reader is not alone in receiving Capita’s spaffage.

Users have been comparing notes regarding what one acidly described as a “cessation of competence” as well as speculating: “Have they just breached the Data Protection Act in the process of telling us that they’ve already had a data breach?” before the inevitable was uttered: “Classic Crapita.”

The email, with the subject “Incident INC0017274 has been assigned to group DO NOT USE”, has come under technical scrutiny, with some suggesting a scam or phishing attack. Another user pointed out that such an attack would mean someone has a list of addresses that users thought were safe and sound within the bowels of the services behemoth.

A mea culpa followed, saying:

This afternoon you would have received an email titled “Incident INC0017274 has been assigned to group DO NOT USE”. Please accept our apologies, as this was sent in error.

We are aware that email addresses were visible and we are addressing this as a Data Breach.

Please be assured that the email does not contain any malware and is not a result of malicious activity. May we ask that you please delete the email.

We are currently investigating the root cause with our Information Security Team and we will provide further feedback in due course.

Once again, we apologise for any inconvenience caused.

Kind regards

Will Baker

Head of Support Services

Education Software Solutions

Capita has form with cockups in the education software services arena. An upgrade to the Schools Information Management System (SIMS) in December 2017 resulted in some pupils being linked to the wrong contact details – a potentially huge boot up the backside of students’ data protection.

A borkage related to the Common Transfer Files (CTF) mechanism in the system last year caused yet more headaches.

Disclosing those email address in the To field is, however, not great practice (ask Eli Lilly about the Prozac.com “incident”).

The Register has contacted Capita for its take on things. A spokesperson told us:

We are aware of a technical issue which resulted in a number of our software clients receiving a limited number of other clients’ email addresses. The impact on the affected clients is contained. We regard the security of our client’s data as very important and we have taken immediate steps to address this issue.

We also spoke to the ICO, which told us the matter has yet to be reported to it. Capita has 72 hours from acknowledging the breach to do so. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/22/capita_education_services_email_spaff/

Crown Prince of Saudi Arabia accused of hacking Jeff Bezos’ phone with malware-laden WhatsApp message

Updated Candid pictures used to threaten Amazon boss Jeff Bezos were exposed not by his current parmour’s brother, as some have suggested, but through a sophisticated hacking operation personally directed by the crown prince of Saudi Arabia, Mohammad bin Salman, The Guardian has asserted.

The paper today claims to have been told by anonymous sources that Bezos’ phone was hacked using a WhatsApp message from the personal account of bin Salman himself.

The message, according to the sources, was an infected video file sent on May 1, 2018, and it immediately started siphoning large amounts of data from the phone, and sending it to an external source. At the time, Bezos and the prince were otherwise exchanging friendly messages, we’re told.

Rewind to last January, and tabloid rag The National Enquirer revealed the Amazon CEO, who had split from his wife, was dating telly-star-turned-helicopter-pilot Lauren Sanchez, and leaked private text messages sent between the new couple.

And while it was believed the source was Sanchez’s brother, an investigation led by Bezos’s security expert Gavin De Becker concluded, remarkably, that the Saudi Arabian government was behind the leak. The Guardian report appears to back this account up, but it is possible that De Becker’s conclusion led indirectly to the newspaper’s piece.

Team Bezos’s suspicion of state-level spycraft was then reinforced when the National Enquirer threatened to publish compromising pictures of the tech zillionaire also taken from his phone.

Bezos said that unless he and De Becker signed an agreement in which they publicly stated that their probe had not discovered “any form of electronic eavesdropping or hacking in their news-gathering process,” and was not “instigated, dictated or influenced in any manner by external forces, political or otherwise,” the Enquirer would release the billionaire’s intimate selfies.

Jamal Khashoggi

De Becker, meanwhile, concluded Bezos’s phone was compromised by the Saudi government, almost certainly due to his position as owner of the Washington Post, an influential voice in the corridors of power. The Post was publishing fierce critiques of bin Salman by Saudi journalist Jamal Khashoggi at a time when there was almost universal praise of the crown prince over his reform efforts.

Bezos took the decision that “rather than capitulate to extortion and blackmail,” he would instead “publish exactly what they [the National Enquirer] sent me, despite the personal cost and embarrassment they threaten.”

That left De Becker free to publish his conclusion of Saudi involvement several months later. In his article, he noted that his “investigation is now complete. As has been reported elsewhere, my results have been turned over to federal officials.”

He refused to disclose details but said he would state “one key fact” – that his team had “concluded with high confidence that the Saudis had access to Bezos’ phone, and gained private information.” We have asked De Becker if he has any comment on The Guardian’s claims of direct involvement of bin Salman.

Repercussions

If the Guardian report is true and Bezos phone was hacked through a direct message sent from bin Salman, it may have several serious repercussions.

For one, it will make that much harder for the US government to skirt the question of whether Mohammad bin Salman was directly responsible for the murder of Jamal Khashoggi at the Saudi embassy in Istanbul, Turkey, in October 2018.

Secondly, it will further increase discomfort with bin Salman and Saudi Arabia within US business circles and may see the kingdom cut out of deals altogether: the personal targeting and leaking of compromising information on a potential business partner is not the sort of thing that US business leaders look favorably on.

Amazon CEO Jeff Bezos

National Enquirer’s big Pecker tried to shaft me – but I wouldn’t give him an inch, says Jeff Bezos after dick pic leak threat

READ MORE

And thirdly, it could cast a pall over the impeachment hearing of President Donald Trump, which officially began today. Trump stands accused of pressuring a foreign power, Ukraine, to investigate a political rival, Joe Biden.

Trump has made his intense dislike of Jeff Bezos public on countless occasions. And the fact that the US president has refused to accept his intelligence agencies’ conclusion that bin Salman was directly involved in the assassination of Khashoggi has already raised countless eyebrows.

Add to that the close relationship between bin Salman, Trump son-in-law and presidential adviser Jared Kushner, and publisher of the National Enquirer, David Packer, and the fact that bin Salman may have personally been involved in an operation to hack and undermine Jeff Bezos, and you have a disturbing series of coincidences and connections.

The timing of The Guardian article, nine months after De Becker initially fingered Saudi Arabia, could be related to the fact that there is a UN investigation into the hacking which the paper itself notes “is considered credible enough for investigators to be considering a formal approach to Saudi Arabia to ask for an explanation.”

Asked about the investigation carried out by UN special rapporteur for extrajudicial killings, Agnès Callamard, the Guardian reports that she “said she followed all UN protocols that require investigators to alert governments about forthcoming public allegations.” ®

Updated to add

Saudi Arabia has trashed the phone hacking claims, and demanded a probe:

Meanwhile, the UN is set to wade in.

“A United Nations investigation to be released Wednesday will report that Amazon founder Jeff Bezos’s cellphone was hacked in 2018 after he got a WhatsApp message that came from an account purportedly belonging to Saudi Crown Prince Mohammed bin Salman,” according to the Washington Post’s source.

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/22/bezos_saudi_bug/

No backdoors needed: Apple ditched plans to fully encrypt iCloud backups after heavy pressure from FBI – claim

Apple ditched plans to fully encrypt its iCloud backups two years ago after being pressured by the FBI, it is claimed.

The decision reportedly came after the iPhone giant notified the Feds that it intended to offer users end-to-end encryption for photos, messages, and other data stored on iCloud. Under this plan, Apple would no longer have the key to unlock encrypted data, meaning it would no longer be able provide decrypted backups of its users to the authorities, even under court order.

Crime investigators turn to iCloud backups for evidence when they can’t unlock suspects’ phones. Encrypting the contents of these backups would thwart such probing.

However, Apple apparently dropped the plan after talks with FBI: the g-men argued the move would prevent the agency from gathering vital evidence. Some data, such as passwords and health information, is apparently encrypted in iCloud, it is understood, though the vast majority is not.

The climb-down also came shortly after Apple’s high-profile 2016 court battle with the FBI over an iPhone used by the San Bernardino mass murderer who shot and killed 14 people the previous year.

“They decided they weren’t going to poke the bear anymore,” a former Apple employee told Reuters, adding that the Silicon Valley goliath did not want to open itself up to criticism that it was protecting criminals with encrypted backups, be sued for moving data out of reach of government agencies, or trigger fresh legislation against encryption.

cook

Apple calls BS on FBI, AG: We’re totally not dragging our feet in murder probe iPhone decryption. PS: No backdoors

READ MORE

Two former FBI officials, who were not present in the talks with Apple, said the Cupertino titan was convinced by arguments that backups provided essential evidence in thousands of cases.

“It’s because Apple was convinced,” one of the officials told Reuters. “Outside of that public spat over San Bernardino, Apple gets along with the federal government.”

Another former Apple employee said it was possible the encryption project was dropped for other reasons, such as concern that punters would accidentally lock themselves out of their backups with Apple unable to help them.

Apple is again under pressure from the FBI to unlock the iPhones used by a Saudi Air Force officer who shot dead three Americans at a naval base in Florida last month.

As expected, President Trump piled on, accusing Apple on Twitter of refusing to unlock phones used by “killers, drug dealers and other violent criminal elements.” Republican and Democratic senators have threatened to legislate against end-to-end encryption, saying the tech hampers the gathering of evidence when investigating crimes against children.

Apple earlier rejected the characterization that it “has not provided substantive assistance.” Apple and the FBI declined to comment on today’s revelations. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/21/apple_encrypt_icloud_backups/

No backdoors needed: Apple ditched plans to fully encrypt iCloud backups after heavy pressure from FBI – claim

Apple ditched plans to fully encrypt its iCloud backups two years ago after being pressured by the FBI, it is claimed.

The decision reportedly came after the iPhone giant notified the Feds that it intended to offer users end-to-end encryption for photos, messages, and other data stored on iCloud. Under this plan, Apple would no longer have the key to unlock encrypted data, meaning it would no longer be able provide decrypted backups of its users to the authorities, even under court order.

Crime investigators turn to iCloud backups for evidence when they can’t unlock suspects’ phones. Encrypting the contents of these backups would thwart such probing.

However, Apple apparently dropped the plan after talks with FBI: the g-men argued the move would prevent the agency from gathering vital evidence. Some data, such as passwords and health information, is apparently encrypted in iCloud, it is understood, though the vast majority is not.

The climb-down also came shortly after Apple’s high-profile 2016 court battle with the FBI over an iPhone used by the San Bernardino mass murderer who shot and killed 14 people the previous year.

“They decided they weren’t going to poke the bear anymore,” a former Apple employee told Reuters, adding that the Silicon Valley goliath did not want to open itself up to criticism that it was protecting criminals with encrypted backups, be sued for moving data out of reach of government agencies, or trigger fresh legislation against encryption.

cook

Apple calls BS on FBI, AG: We’re totally not dragging our feet in murder probe iPhone decryption. PS: No backdoors

READ MORE

Two former FBI officials, who were not present in the talks with Apple, said the Cupertino titan was convinced by arguments that backups provided essential evidence in thousands of cases.

“It’s because Apple was convinced,” one of the officials told Reuters. “Outside of that public spat over San Bernardino, Apple gets along with the federal government.”

Another former Apple employee said it was possible the encryption project was dropped for other reasons, such as concern that punters would accidentally lock themselves out of their backups with Apple unable to help them.

Apple is again under pressure from the FBI to unlock the iPhones used by a Saudi Air Force officer who shot dead three Americans at a naval base in Florida last month.

As expected, President Trump piled on, accusing Apple on Twitter of refusing to unlock phones used by “killers, drug dealers and other violent criminal elements.” Republican and Democratic senators have threatened to legislate against end-to-end encryption, saying the tech hampers the gathering of evidence when investigating crimes against children.

Apple earlier rejected the characterization that it “has not provided substantive assistance.” Apple and the FBI declined to comment on today’s revelations. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/21/apple_encrypt_icloud_backups/

China-Based Cyber Espionage Group Reportedly Behind Breach at Mitsubishi Electric

Personal data on over 8,100 individuals and confidential business information likely exposed in June 2019 incident.

A data breach at Japan’s Mitsubishi Electric that may have exposed some 200 MB of personal and confidential business data is the latest reminder of the growing threat many organizations face from sophisticated cyber espionage groups.

Mitsubishi on Monday admitted it had experienced a data breach last June after at least two Japanese newspapers reported on the incident this week. In an emailed statement to Dark Reading, the company said it detected the incident on June 28, 2019, and took immediate measures to limit damage.

“Mitsubishi Electric acknowledges the possibility of personal and confidential information leakages due to unauthorized access to the company’s cyber networks,” the statement said.

The company, whose customers include major government, defense, and private-sector organizations, did not offer any details on the kinds of information that might have been compromised or how extensive the damage might have been. But it said that no sensitive information belonging to critical infrastructure organizations in the defense, power, electric, and railway sectors were leaked.

The Asahi Shimbun, one of the first to report on the breach, on Tuesday said data belonging to 8,122 individuals might have been exposed since last June. The potentially leaked information included names and other personal data belonging to over 4,560 employees at the company’s headquarters, as well as nearly 2,000 new graduates who joined the company between 2017 and April 2019, and several mid-career employees and retirees.

In addition, the intruders appear to have had access to data on more than 10 government customers of Mitsubishi Electric and dozens of other businesses, including those in critical infrastructure sectors, Asahi Shimbun said, citing officials it said were close to the investigation. The data that was exposed included that pertaining to business negotiations, joint development activity, product orders, and company meeting materials.

According to the newspaper, while Mitsubishi Electric informed Japan’s Defense Ministry about the attack last August, many of the company’s partners in the private sector, including leading electric utilities, railway operators, and financial companies, were kept in the dark until this week.

“The company appears to be contacting only business partners whose information might have been significantly compromised, but it is still not giving the entire picture of the breach,” the paper said.

Earlier, Asahi Shimbun and Nikkei both cited unnamed company officials as saying scores of servers and PCs across Mitsubishi Electric’s office in Japan and China had been compromised in the attack. Both newspapers identified the group behind the attack as “Tick’, a China-based outfit that some security vendors also have referred to as Bronze Butler and REDBALDKNIGHT.

Hijacked Account
The attack is thought to have begun with the misuse of a single compromised user account belonging to a Mitsubishi Electric affiliate in China. The hijacked account was used to infiltrate systems at most of Mitsubishi Electric’s major facilities, including its sales headquarters, its electronic systems business headquarters, and its head office, Asahi Shimbun said.

Researchers at Trend Micro and Secureworks have previously described Tick/Bronze Butler/REDBALDKNIGHT as a China-based cyber espionage group with a special focus on Japanese targets.

According to Secureworks, the group has long been focused on stealing intellectual property and other confidential business data from Japanese organizations, especially those in critical infrastructure sectors. Like many groups, Tick employs spear-phishing and strategic Web compromises to gain an initial foothold on a target network.

Trend Micro has said it discovered evidence of Tick targeting South Korean, Russian, and Singaporean organizations in addition to Japanese-based firms. The security vendor has described Tick operators as using steganography and other techniques to deploy and embed its malware on target systems.

Ben Goodman, senior vice president at ForgeRock, says attacks involving the abuse of legitimate user accounts highlight the need for a zero-trust approach to security. “A zero-trust approach means that organizations no longer treat people, devices, and services communicating on the corporate network as if they are good actors deserving of greater trust,” he says.

Instead, all access requests are authenticated and authorized as if they are from an unknown user from an untrusted network. “By looking closer at what access users have and how they are using that access, we can better understand where some may have more access than they require,” Goodman says.

Forcing users to authenticate and authorize to all of their applications and services also can enable a better understanding of normal user activity and detection of potentially abnormal behavior, he says.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “With International Tensions Flaring, Cyber Risk is Heating Up for All Businesses.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/china-based-cyber-espionage-group-reportedly-behind-breach-at-mitsubishi-electric/d/d-id/1336848?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

China-Based Cyber Espionage Group Reportedly Behind Breach at Mitsubishi Electric

Personal data on over 8,100 individuals and confidential business information likely exposed in June 2019 incident.

A data breach at Japan’s Mitsubishi Electric that may have exposed some 200 MB of personal and confidential business data is the latest reminder of the growing threat many organizations face from sophisticated cyber espionage groups.

Mitsubishi on Monday admitted it had experienced a data breach last June after at least two Japanese newspapers reported on the incident this week. In an emailed statement to Dark Reading, the company said it detected the incident on June 28, 2019, and took immediate measures to limit damage.

“Mitsubishi Electric acknowledges the possibility of personal and confidential information leakages due to unauthorized access to the company’s cyber networks,” the statement said.

The company, whose customers include major government, defense, and private-sector organizations, did not offer any details on the kinds of information that might have been compromised or how extensive the damage might have been. But it said that no sensitive information belonging to critical infrastructure organizations in the defense, power, electric, and railway sectors were leaked.

The Asahi Shimbun, one of the first to report on the breach, on Tuesday said data belonging to 8,122 individuals might have been exposed since last June. The potentially leaked information included names and other personal data belonging to over 4,560 employees at the company’s headquarters, as well as nearly 2,000 new graduates who joined the company between 2017 and April 2019, and several mid-career employees and retirees.

In addition, the intruders appear to have had access to data on more than 10 government customers of Mitsubishi Electric and dozens of other businesses, including those in critical infrastructure sectors, Asahi Shimbun said, citing officials it said were close to the investigation. The data that was exposed included that pertaining to business negotiations, joint development activity, product orders, and company meeting materials.

According to the newspaper, while Mitsubishi Electric informed Japan’s Defense Ministry about the attack last August, many of the company’s partners in the private sector, including leading electric utilities, railway operators, and financial companies, were kept in the dark until this week.

“The company appears to be contacting only business partners whose information might have been significantly compromised, but it is still not giving the entire picture of the breach,” the paper said.

Earlier, Asahi Shimbun and Nikkei both cited unnamed company officials as saying scores of servers and PCs across Mitsubishi Electric’s office in Japan and China had been compromised in the attack. Both newspapers identified the group behind the attack as “Tick’, a China-based outfit that some security vendors also have referred to as Bronze Butler and REDBALDKNIGHT.

Hijacked Account
The attack is thought to have begun with the misuse of a single compromised user account belonging to a Mitsubishi Electric affiliate in China. The hijacked account was used to infiltrate systems at most of Mitsubishi Electric’s major facilities, including its sales headquarters, its electronic systems business headquarters, and its head office, Asahi Shimbun said.

Researchers at Trend Micro and Secureworks have previously described Tick/Bronze Butler/REDBALDKNIGHT as a China-based cyber espionage group with a special focus on Japanese targets.

According to Secureworks, the group has long been focused on stealing intellectual property and other confidential business data from Japanese organizations, especially those in critical infrastructure sectors. Like many groups, Tick employs spear-phishing and strategic Web compromises to gain an initial foothold on a target network.

Trend Micro has said it discovered evidence of Tick targeting South Korean, Russian, and Singaporean organizations in addition to Japanese-based firms. The security vendor has described Tick operators as using steganography and other techniques to deploy and embed its malware on target systems.

Ben Goodman, senior vice president at ForgeRock, says attacks involving the abuse of legitimate user accounts highlight the need for a zero-trust approach to security. “A zero-trust approach means that organizations no longer treat people, devices, and services communicating on the corporate network as if they are good actors deserving of greater trust,” he says.

Instead, all access requests are authenticated and authorized as if they are from an unknown user from an untrusted network. “By looking closer at what access users have and how they are using that access, we can better understand where some may have more access than they require,” Goodman says.

Forcing users to authenticate and authorize to all of their applications and services also can enable a better understanding of normal user activity and detection of potentially abnormal behavior, he says.

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “With International Tensions Flaring, Cyber Risk is Heating Up for All Businesses.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/china-based-cyber-espionage-group-reportedly-behind-breach-at-mitsubishi-electric/d/d-id/1336848?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Avoid That Billion-Dollar Fine: Blurring the Lines Between Security and Privacy

While doing good for the user is the theoretical ideal, the threat of fiscal repercussions should drive organizations to take privacy seriously. That means security and data privacy teams must work more closely.

In the wake of companies such as British Airways, Marriott, and Facebook facing record privacy violation fines, organizations are seeing the ramifications of not having their privacy compliance under control. Clearly, the lines between data security and data privacy are blurring, and companies are beginning to establish their lines of defense for data security — and are still figuring out data governance and management.

The responsibility for helping companies comply with privacy regulations lies in a gray area between security teams and data teams. To avoid the billion-dollar fines that are becoming more common, privacy and security teams must collaborate to achieve compliance.

Formidable Fines
Last year, tech behemoths including Facebook, Google, Apple, and YouTube all came under investigation for violations of the European Union’s General Data Protection Regulation, and some have been fined as a result. Facebook was hit the hardest, garnering the largest fine ever required of a tech company, $5 billion. In the EU to date, we’ve seen fines racking up to €372 million. The introduction of California Consumer Privacy Act will only raise the bar for these fines globally.

As a result, companies have established accountability with a data protection officer (DPO) and involved every employee in the privacy conversation. We can expect these practices to become more common, and security teams, as well as data management and governance teams, will be more involved in privacy-related matters. Additionally, while the tech giants have made the most spectacular headlines, we have also seen those fines and infringement repercussions trickling down to smaller companies across the globe, broadening the need for implementation of privacy best practices. 

Recent smaller fines include a $21,000 fine for a Swedish school after it conducted a trial in which the attendance of 22 pupils was tallied using facial recognition.

Similarly, a €500 million online food delivery company in Germany failed to comply with data subject access rights after not deleting accounts of former customers in 10 cases — even if they’d been inactive in the company’s service platform for years. To make matters worse, eight former customers also complained about unsolicited advertising emails from the company. Specifically, a data subject who had objected to the use of his data for advertising purposes still received 15 additional advertising emails from the delivery service. In other cases, the company did not provide the data subjects with the required information or they did so only after the Berlin data protection officer intervened. This resulted in a nearly €200,000 fine, which is significant compared with the company’s global revenue.

These cases illustrate that data privacy has become a very broad topic, spanning beyond the traditional data security vulnerabilities that we first think about. Every company must be prepared, no matter its size and business activities. In addition to the fines, repercussions for companies that fail to comply include:

  • Exposure to reputational and revenue risks as data privacy violations are breaking customer satisfaction and relationships: For example, the Information Commissioner’s Office, the UK’s independent authority on data privacy, said that 46% of the complaints it collects are related to the disrespect of the right for data access, rectification, and deletion.
  • Rising costs in their operations: For example, it has been shown that addressing subject rights requests, which gives individuals the right to obtain a copy of their personal data, with a manual process is not only error prone but can be very costly, with an average of $1.40 per request, according to a recent Gartner survey

Collaboration for Compliance
Privacy teams must establish the framework for data privacy, which includes, but is not limited to, data security and protection against data breaches. Typically, privacy teams are responsible for knowing where user data is and how it flows, proactively safeguarding it and making sure it is used for a purpose. One important role of the privacy team is to establish privacy by design, which means that each project within the company that needs personal data must understand and be accountable for the impact it has on privacy. This requires strong collaboration between the privacy, security, IT, and data teams to protect, monitor, and take action once a breach has occurred — whether it involves sensitive user, company, or customer information.

While the privacy and security teams are generally not intertwined, they certainly have overlap that needs to be addressed. To give companies the best chance of avoiding fiscal repercussions, data privacy teams must take stock of how data use can be interpreted as a personal privacy infringement and share their practices with security teams, which can take measures to protect the data where it lives before it is threatened.

Having a DPO who acts as an orchestrator, engaging both the privacy and security teams and educates employees is a best practice for ensuring compliance. Once a niche role, the DPO got a huge boost with GDPR, which made it mandatory, and today there are an estimated half-million DPOs registered in Europe alone! While the chief security officer (CSO) role is not a result of privacy regulations, it has become more widespread across the enterprise and was elevated to an executive level in the digital era.

Privacy is a different discipline from security though, and there needs to be accountability and practices that are deployed widely so everyone in a company understands and implements them. The CSO acts as a bridge between security and privacy to ensure this happens, especially in the US, where regulations do not mandate a DPO.

Not only is data privacy important for the good of the individual, but it must also be a top priority for companies, which risk losing billions of dollars. While doing good for the user is the theoretical ideal, the threat of fiscal repercussions should drive organizations to take privacy seriously — and this is best practiced through collaboration between security and privacy teams. Everyone from security and privacy teams to sales and marketing teams must be in compliance and understand their responsibilities. Educate every individual at the company and collaborate together on training and trust exercises. 

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “With International Tensions Flaring, Cyber-Risk Is Heating Up for All Businesses.”

Jean-Michel Franco has dedicated his career to developing and broadening the adoption of innovative technologies and is currently the Senior Director of Product Marketing at Talend. He is an expert of GDPR, CCPA, and data privacy, working on the front lines with Talend’s … View Full Bio

Article source: https://www.darkreading.com/risk/avoid-that-billion-dollar-fine-blurring-the-lines-between-security-and-privacy/a/d-id/1336818?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple