STE WILLIAMS

Dominion National first spotted something awry in April of 2019.

Dental and vision insurance provider and administrator Dominion National has begun notifying patients of a data breach of its systems that apparently dates back to August of 2010. The insurer said an incident investigation that began on April 24, 2019 led to the discovery that its servers had been compromised in an attack that began nearly nine years ago.

“Dominion National moved quickly to clean the affected servers. Dominion National has no evidence that any information was in fact accessed, acquired, or misused,” the firm said in a press announcement.

The compromised servers store enrollment and demographic information of Dominion National and Avalon vision programs as well as on patients whose dental and vision benefits are administered by the firm. Names, addresses, email addresses, dates of birth, Social Security numbers, taxpayer identification numbers, bank account and routing numbers, member ID numbers, group numbers, and subscriber numbers, are among the types of data on the servers.

Read more here. 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/health-insurer-reports-data-breach-that-began-9-years-ago/d/d-id/1335041?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

A rogue employee tore a 2.9 million-record-sized hole into his (now former!) employer’s hide, according to an advisory posted on Thursday by Canada’s Desjardins Group, the largest federation of credit unions in North America.

Desjardins has 7 million members. The leak, carried out by the since-fired employee, affected 2.7 million individuals and 173,000 businesses – about 41% of its clientele. The records were disclosed to unnamed people without authorization.

This was no breach, Desjardins said. It didn’t come under cyberattack, and its computer systems are just fine. This was the work of just one jerk. Or, as Desjardins described him, “an ill-intentioned employee who acted illegally and betrayed the trust of their employer.”

That person was fired.

The leaked information reportedly included names, birth dates, social insurance numbers, addresses, telephone numbers and email addresses, as well as information on banking habits – all of it illegally transferred to a third party.

Beware the fraudsters

That’s all good as gold to fraudsters. Quebec’s regulator of financial institutions, the Autorités des marchés financiers (AMF), warned on Friday that Desjardins members may be the target of phishing emails, text messages and telephone calls:

Fraudsters may be tempted to contact you to extract personal information under the pretext that they are doing so in connection with security measures or updates stemming from the incident.

Remember, the AMF said, Desjardins doesn’t ask for personal information by email, text or telephone. Be leery of phone calls that are purportedly related to this breach, and even if an email message looks like it came from Desjardins, don’t click on any links it may contain:

The AMF reminds you to never reply to e-mails, text messages or telephone calls asking for personal information, whatever the reason given. Contrary to what the fraudsters may try to make you believe, such e-mails and text messages do not come from your financial institution, even if they bear the institution’s logo.

Do not click on the Internet link that may appear, as it will direct you to a fake site mimicking your financial institution’s website in order to steal your personal information. Also be wary if you receive any unsolicited telephone calls in this regard.

Desjardins said that neither passwords, PINs nor security questions were leaked.

How long has this been going on?

According to CBC News, Desjardins called in the police after it saw a suspicious transaction in December 2018. It then took several months for the investigation to uncover the wide scope of the scheme. Police told the cooperative in May that some members’ personal information had been leaked, and Desjardins then undertook an internal investigation with the help of police in Laval, a Quebec city to the north of Montreal.

Claude Sarrazin, a security expert based in Montreal, told CBC that we’re missing a crucial piece of information: namely, who’s got the information?

Who has control over that information? The first thing we need to find out is where is the information – that wasn’t answered [on Thursday].

What now?

Desjardins said that it hasn’t seen a spike in fraud concerning members’ accounts since it uncovered the breach. It’s working with police on the ongoing investigation. The cooperative has also beefed up monitoring and security measures to protect members’ personal and financial information and is getting in touch with everybody who’s been affected:

We’re communicating directly with every member who’s been affected to explain what happened and what they can do.

As well, Desjardins said that it’s enhanced procedures to confirm people’s identities when they call.

Say hello to two class action suits

According to the Montreal Gazette, two proposed class action suits have been filed. One was filed in Quebec Superior Court on Friday on behalf of a Quebec City resident and is looking for compensation of up to $2.9 billion, as well as punitive damages of $290 million. That would be $300 for each affected credit union member, according to CBC News.

The second proposed suit doesn’t specify exactly how much compensation it’s after, although the plaintiff named in the suit is seeking $300 in punitive damages.

Both suits allege that the co-operative financial group failed to adequately safeguard its clientele’s personal and financial information.

Upping the credit-monitoring ante

According to the Montreal Gazette, when it first reported the breach on Thursday, Desjardins offered to foot the bill for one year of credit monitoring. That includes ” daily access to your credit report, alerts of key changes, and identity theft insurance.”

As of Friday, the cooperative had upped the ante, making the offer good for 5 years.

Pfft! scoffed one of the class action suits. It contends that Desjardins should shell out for 10 years of the monitoring, which typically costs $20/month.

How to protect your business from that one bad apple

You can have all the pricey security-fancy in the world, but this story is yet one more (painful) example of how much damage one “ill-intentioned employee” – and again, that’s French for “jerk” – can do.

Insider threats are real, whether we’re talking about cluelessness, avarice or malice. We’ve written about this quite a bit, particularly with regards to healthcare breaches. A few years back, Jonathan Lee, Sophos’s UK healthcare sector manager, wrote a post outlining five things healthcare organizations can do to better protect patient data. The tips can be applied to other sectors as well, including finance, so they’re worth revisiting:

1. Know your risk

The first thing to do is carry out a thorough risk assessment so that you know what threats you face, understand your vulnerabilities and assess the likelihood of being attacked. It’s only when that is complete that you can go on to the next stage of creating an integrated cybersecurity plan.

2. Follow best practice

Organizations too often spend money on cybersecurity solutions but then fail to properly deploy them. Make sure you’re following the recommendations for best practice when deploying your defenses.

3. Have a tried and tested incident response plan

Work on the assumption that an attack will happen and ensure you have a tried and tested incident response plan that can be implemented immediately to reduce the impact of the attack.

4. Identify and safeguard your sensitive data

It’s almost impossible to protect all your data all of the time, so identify the information you keep that would harm your organization if it were stolen or unlawfully accessed, and implement suitable data security procedures to ensure it is appropriately protected.

5. Educate employees

With so many breaches being the result of something an employee has done – inadvertently or otherwise – part of your cybersecurity plan must be to make sure all your staff know the risks they face and their responsibilities. Educating them is your job, and should be part of your plan.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Fz7dD-iOo2w/

Careful before installing that mobile app on your iOS or Android device. Mobile applications are riddled with vulnerabilities, according to research from security company Positive Technologies.

The news won’t come as much of a shock to anyone who has read GPEN’s 2014 study of app privacy failings; IOActive’s 2013 study of banking app security, nor its follow up in 2015, nor it’s investigation of stock trading app security in 2017; nor Arxan’s 2019 look at banking and finance app security.

Positive Technologies, which provides vulnerability management and threat analysis tools, reviewed 17 mobile apps in depth to see how secure they were. It found high-risk vulnerabilities in 43% of the Android apps. iOS fared only slightly better, with 38% of apps containing high-risk flaws.

Insecure data storage was the biggest security risk by far, found in 76% of applications. Examples of this flaw included storage of authentication PINs on the mobile device instead of on the server, increasing the risk of a leak – something 53% of applications were guilty of.

Another common mistake was the use of insecure snapshots. These are images that the smartphone takes to remember software’s current state when the user switches to another application. Apps should mask sensitive data such as credit card numbers when creating these snapshots to avoid the data leaking, but 65% failed to do so, said the report.

Insecure transmission of sensitive data and incorrect session management came in joint second, at 35%. Examples of insecure data transfer include the use of insecure HTTP communications, the report said. However, it added that insecure data transfer is far less common on iOS, probably due to the introduction of protective measures in iOS 9. We told you last year about Android apps’ problems with insecure oversharing.

The researchers pointed out that the software installed on mobile devices themselves is only one part of the equation. The other is the server component that the application talks with. These server-side apps are fruitful attack points for hackers, the report warned, explaining:

Protection of mobile application servers is no better than that of clients

Every server-side component that the researchers tested had at least one vulnerability that would enable an attack on a user.

These vulnerabilities included cross-site scripting (XSS) flaws (by far the most common at 86%). Information leakage, poor authorization, and the leaking of sensitive information in error messages all came in joint second at 43% each.

Examples of these flaws included sending a person’s full name and phone number in a server response during chat sessions. One app included a session ID in a document link, allowing attackers to hijack the legitimate user’s server session.

Another common high-risk server-side vulnerability was misconfiguration. For example, a server might have TRACE requests enabled (this is a feature that echoes HTTP requests back to the user for debugging purposes). That, combined with a cross-side scripting (CSS) vulnerability, could allow an attacker to steal cookies, said the report.

While developers are ultimately responsible for buggy applications, some users must share culpability, warned the company, for example, those who escalate their OS privileges on purpose (known as jailbreaking on iOS devices or rooting on Android ones) to sideload software or customize their interface. This can give an application unfettered access to the underlying system and data.

The report concluded:

Most of the discovered vulnerabilities were introduced during the design stage and result from failure to “think through” security-related questions. We recommend a methodical approach to designing and following through on mobile application security, regularly testing it starting from Day 1 of the software lifecycle.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/cfjSpMkI8mc/

Remember last week’s urgent warning over a Firefox remote code execution zero-day vulnerability – CVE-2019-11707 – that criminals were said to be exploiting in real-world attacks?

Two days later, it emerged that there was a second sandbox escape zero-day flaw, CVE-2019-11708, being used in conjunction with this as part of an organised campaign targeting cryptocurrency exchanges.

The first, as we explained, was a type confusion flaw “when manipulating JavaScript objects due to issues in Array.pop”, while the second was a sandbox escape giving access to the OS layer.

Two emergency zero days affecting a browser in one week counts as unusual, especially when they pop up as separate alerts two days apart, as part of targeted attacks on a single business sector.

The 18 June 2019 patch for the first fix took Firefox to 67.0.3 (ESR 60.7.1), while the second bumped that to 67.0.4 (ESR 60.7.2), the current version for the Tor browser, based on Firefox, is version 8.5.3).

But there was more – the zero days were intended to work together to facilitate a malware backdoor called Netwire that dates back several years and is known to infect macOS and Linux systems.

The first big clue about the campaign behind this emerged on 19 June 2019 when Philip Martin, chief information security officer for cryptocurrency exchange Coinbase tweeted:

On Monday, Coinbase detected blocked an attempt by an attacker to leverage the reported 0-day, along with a separate 0-day Firefox sandbox escape, to target Coinbase employees.

This was reported to Mozilla on the same day while noting that it was aimed at the company itself rather than its customers:

We were not the only crypto org targeted in this campaign. We are working to notify other orgs we believe were also targeted. We’re also releasing a set of IOCs that orgs can use to evaluate their potential exposure.

Double trouble

An intriguing detail from all this is that the Google Project Zero researcher who reported the original CVE-2019-11707 vulnerability to Mozilla on 15 April 2019, Samuel Groß, seems to have made clear all along that it needed a separate sandbox escape to function.

The bug can be exploited for RCE but would then need a separate sandbox escape. However, most likely it can also be… twitter.com/i/web/status/1…

—
Samuel Groß (@5aelo) June 19, 2019

It’s not clear how the cybercriminals behind the attacks found out that the flaws worked as a pair but the involvement of Netwire emerged from Apple security expert Patrick Wardle of Digita Security, who was forwarded details of its involvement about it by a second unnamed victim.

Wardle even got hold of the phishing email used to target that company, which posed as a communication from Cambridge University’s Adams Prize for mathematics.

Netwire was first noticed in 2012 when it was known as OSX.Netwire. It’s since been modified significantly but retains the same basic purpose of stealing data from under victim’s noses. It’s different enough to bypass macOS’s XProtect anti-malware and Gatekeeper in 2019, without being completely distinct from the 2012 sample, observed Wardle:

If I had to guess, they are both written by the same author (or team) but serve unique purposes (i.e. the 2012 sample is only concerned with stealing passwords).

Separately, researcher Vitali Kremez raised the possibility that the mysterious Netwire might also have been used to target Windows computers, wielded by a threat group that exploited two recent zero days, namely CVE-2018-20250 (the infamous WinRAR flaw dating back 19 years), and CVE-2017-0261 (an Office remote code execution flaw).

In summary, anyone assuming that Apple and Firefox’s smaller user bases might afford them some protection from advanced cybercrime got a timely wakeup call.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/mAk3KYuhFDQ/

The point of Zero Trust is not to make networks, clouds, or endpoints more trusted; it’s to eliminate the concept of trust from digital systems altogether.

Standard security models operate on the assumption that everything on the inside of an organization’s network can be trusted, but that’s an outdated notion. With attackers becoming more sophisticated about insider threats, new security practices must be taken to stop them from spreading once inside networks.

Enter Zero Trust, which is a cybersecurity strategy that addresses the shortcomings of these failing approaches by removing the assumption of trust altogether. Though much mythology surrounds the term, it’s crucial to understand the point of Zero Trust is not to make networks, clouds, or endpoints more trusted; it’s to eliminate the concept of trust from digital systems altogether.

Simply put, the “trust” level is zero.

Understanding What Zero Trust Is and Isn’t
Zero Trust is not only a general best practice but also a strategic security initiative. Breaches often have been tied to internal causes, either malicious or accidental, which means sensitive business and customer data must be protected by giving users the least amount of access needed for them to do their jobs.

Adopting a Zero Trust architecture defines the business use of segmentation and provides a methodology for building a segmented network. Zero Trust architecture is like tailoring a suit. Think about how custom clothing is made — the designer first measures you, then creates a pattern and next, after those two steps are complete, the sewing begins. Zero Trust follows a similar process. The only way to architect an effective and secure network is by first understanding what needs to be protected and how those systems work.

Zero Trust is a powerful prevention strategy when implemented across the entire enterprise — from the network to the endpoint and to the cloud. With a comprehensive approach, Zero Trust becomes a business enabler. Here are the methodologies I recommend following when implementing a Zero Trust network architecture to simplify protection of your sensitive data and critical assets.

Zero Trust Methodologies
Minimize Risk
Protect critical assets by limiting access by role and a “need-to-know” basis. It’s crucial to inspect all traffic for malicious content and unauthorized activity, both inside and outside your network, and also ensure all data and resources are accessed securely based on user and location. You must identify the traffic and data flow that maps to your business flows, and then have the visibility into the application, the user, and the flows.

Understanding who the users are, what applications they’re using, and the appropriate connection method is the only way to determine and enforce policy that ensures secure access to your data. Additionally, it’s important to adopt a least-privileged access strategy and strictly enforce access control. By doing this, businesses can significantly reduce available pathways for attackers and malware, and prevent attackers from exploiting vulnerabilities hidden in trusted applications.

Simplify Operations
Security teams can automate and streamline Zero Trust policy management, from creation and administration to deployment and maintenance. Simplify deployment and enforcement with a next-generation firewall, architected around User-ID and App-ID. Security teams must be able to define things with higher fidelity to keep their companies secure. One of the key steps to a Zero Trust network is to ensure that teams write their policy rules on the segmentation gateway based on the expected behavior of the data, the user, or applications that interact with that data. This is what next-generation firewalls, serving as a segmentation gateway in a Zero Trust environment, allows you to do.

Accelerate Execution
Another core tenet of Zero Trust is to log and inspect all internal and external traffic for malicious activity and areas of improvement. To better monitor environments, evaluate where you may already have security analytics to make the most of the tools you already own. It’s also important to reduce time to deploy, manage, and integrate across your enterprise — on-premises, within the cloud, and across partner ecosystems. Security teams should also effectively use limited resources by minimizing incident volume and reducing response and remediation time for critical incidents, which will also simplify compliance and auditing.

With a Zero Trust approach, businesses can protect what matters — their data, assets, applications, and services.

Related Content:

• What You Need to Know About Zero Trust Security
• ‘Zero Trust’: The Way Forward in Cybersecurity
• Establishing True Trust in a Zero-Trust World
• Debunking 5 Myths About Zero Trust Security

John Kindervag is the Field CTO at Palo Alto Networks, where he advises both public and private sector organizations on how to solve their toughest cybersecurity challenges, including best practices in the design and building of Zero Trust networks.
Prior to joining Palo … View Full Bio

Article source: https://www.darkreading.com/perimeter/never-trust-always-verify-demystifying-zero-trust-to-secure-your-networks/a/d-id/1334995?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Does your stomach hurt? Do you tell your friends on Facebook?

If so, researchers suggest there’s a possibility you might be suffering from depression, and there’s a good chance that you could be diagnosed months earlier if they were to analyze your social media posts than if they just went by clinical diagnosis alone.

In a study from Penn Medicine and Stony Brook University that was published in PLOS ONE, researchers claim that that they can diagnose someone based on their social media posts, given that the language people use can point to conditions such as diabetes, anxiety, depression and psychosis.

In their paper, the researchers described using natural language processing to analyze 949,530 Facebook posts made by 999 study participants, for a total of 20,248,122 words. Each post contained at least 500 words.

They looked for markers of 21 medical conditions, and they found that all of them were predictable from Facebook language beyond mere lucky guesses. Some of those medical conditions were particularly easy to predict, using a combination of demographics and Facebook language vs. just going by demographics alone: namely, diabetes, pregnancy, anxiety, psychoses, and depression.

One example of how language can strongly predict a diagnosis is alcohol abuse. Alcohol abuse was marked by use of the words “drink,” “drunk,” and “bottle,” they said. That’s a pretty intuitive diagnosis, but other predictions weren’t so obvious: for example, people who use the words “god,” “family” and “pray” are 15 times more likely to have been diagnosed with diabetes.

Other correlations:

• Use of hostile language – e.g. “people,” “dumb,” “bulls**t,” “b**ches” – was a predominant marker associated with drug abuse as well as psychoses.
• Those suffering from depression tend to use words associated with the physical symptoms of anxiety – “stomach,” “head,” “hurt” – and with emotional distress – “pain,” “crying,” “tears.”

Should you offer insulin to somebody who mentions praying and God? No, the researchers say: clearly, not everyone mentioning the words they tracked has a particular medical condition. Rather, those mentioning key words are more likely to have a given, correlated condition, they said.

No, your doctor won’t be e-stalking you

The researchers say that a helpful thing about social media is that it’s a two-way communication channel: it gives clinicians a built-in way to talk with patients. That doesn’t mean that they’ll be eavesdropping on your posts all the time, but given their research, they think it would make for effective models to treat patients who opt-in to a system of patients allowing clinicians to analyze their social media writings.

At any rate, Facebook is already eavesdropping, at least with regards to detection of suicidal thoughts. In September, the platform explained how, in the previous year, it had started to use machine learning to look for such thoughts in users’ posts.

Facebook’s post about the AI use, written by Catherine Card, Director of Product Management, is an interesting read, as it spells out the difficulties of teaching a machine linguistic nuance. For example, how do you give AI enough contextual understanding to glean that “I have so much homework I want to kill myself” isn’t a genuine cry of distress?

Facebook made a breakthrough when it realized that it could use false alarms as a training set. It had such a collection: in 2015, it introduced new ways for users to flag their friends’ suicidal notes. The posts were reviewed by humans – trained Community Operations reviewers – to determine if the writer were actually at risk of committing self-harm. Whatever posts the humans found had been incorrectly flagged as suicidal gave Facebook more data with which to more precisely train the classifiers used to determine accurate suicidal expressions.

But the Penn researchers aren’t advocating for an expansion of Facebook as an AI Big Brother that scans all our posts with or without our say-so. Rather, their work shows that an opt-in system for patients who agree to having their social media posts analyzed could provide extra information for their healthcare teams to use in refining their medical care.

Lead author Raina Merchant, the director of Penn Medicine’s Center for Digital Health and an associate professor of Emergency Medicine, told Science Daily that her team’s recent work builds on a previous study that showed that analysis of Facebook posts could predict a diagnosis of depression up to three months earlier than a clinical diagnosis. She said that it’s tough to predict how widespread an opt-in social media post analysis system would be, but that it could be useful for patients who are frequent social media users:

For instance, if someone is trying to lose weight and needs help understanding their food choices and exercise regimens, having a healthcare provider review their social media record might give them more insight into their usual patterns in order to help improve them.

Ever mention donuts in your posts? One imagines that information could come in handy.

Similar to how Facebook now allows users to flag posts within their network that they think may suggest suicidal ideation, the researchers suggest that clinicians could get early warnings about a broader set of conditions, they said:

A patient-centered approach [similar to Facebook’s suicide filters] could be applied to a broader set of conditions allowing individuals and their networks (for those who opt-in) to have early insights about their health-related digital footprints.

Privacy, informed consent, and data ownership

If the researchers are correct in claiming that you can make a diagnosis from public social media posts, then this is a great illustration of how much information people are sharing without being aware of it. The researchers make that exact point, in fact, pointing to the questions about privacy, informed consent, and data ownership that their work raises.

The extra ease with which social media access can be obtained creates extra obligations to ensure that consent for this kind of use is understood and intended. Efforts are needed to ensure users are informed about how their data can be used, and how they can recall such data. At the same time, such privacy concerns should be understood in the context of existing health privacy risks. It is doubtful that social media users fully understand the extent to which their health is already revealed through activities captured digitally.

The issue is that people don’t always understand that the whole is greater than the parts. We all might think we’re sharing little snippets that don’t amount to anything particularly revealing, but when we think that way, we miss the fact that a million little snippets add up to a very Big Data picture.

But we should also bear in mind that the more data you have, the more spurious correlations it will contain. As the researchers said, just because you use a given set of words doesn’t mean that you’re alcoholic/diabetic/depressive/pregnant/a drug abuser.

Sometimes, a cigar is just a cigar.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/MwBN4_tuJxc/

DXC Technology is sending hundreds of security personnel from the America’s division down the redundancy chute and offshoring some of those roles to low-cost centres, insiders are telling us.

As revealed by The Register at the back end of March, the outsourcing badass cum cloud-wannabe confirmed the security practice within the Offering division needs to purge $60m in expenses in the current fiscal ’20 that began on 1 April.

A chunk of that is to be generated by redundancies, with some 300 people – 45 per cent of the US’s security team – being laid off. We are also told that 50 roles are being moved to India, but it is not clear if other roles will move centres in the Philippines, Vietnam and Eastern Europe.

Teams across DXC Security in Data Protection and Privacy, Security Incident Event Management, Technical Vulnerability Management, and Security Risk Management are all impacted too. The process started in May and is to be wrapped up by next month.

DXC Security exec: Yes, I’d have thought we’d spend more on certs and laptop kit for staff, too

READ MORE

The entire US Managed Proxy – save for one engineer who was let go last month to hit financial targets – is to be made redundant on 28 June. But rather than a straight workforce redundancy, this is classified as a workforce migration, we are told.

An impacted DXCer told us the Managed Proxy team were last month given five-and-a-half weeks’ advance notice to help the accounts they manage migrate the design, implementation and support work to a DXC team in India under the control of Biswajeet Rout, who already runs the legacy CSC network, proxy and security team in the country.

One staffer claimed teams are being shunted to India and some are “having to train their replacements who do not have the experience of the staff [being made redundant]”.

We were also told that contractors will be used to cover gaps where full time employees have left the organisation.

El Reg has been told that Mark Hughes, who previously ran BT’s internal tech security and its go-to-market security sales before rocking up at DXC in December, is trying to address changes in the security market involving cloud, AI and automation while also juggling DXC’s desire to reduce the division’s costs by $60m.

Sources told us DXC will try to update skills, concentrate certain one in global delivery centres that will be created in the US and Europe, and house some lower margin, or commoditised security in lower cost areas.

Platform DXC will play a major role in the division to automate service delivery, and patching, for example, is one of the areas to be addressed in this way.

Other cost savings are expected to come from things like vendor consolidation: this means there will be fewer certifications to maintain across the various teams, which is costly and time consuming. A team has been assembled to decide which vendors the firm will stick with.

DXC: Slashing costs affects ability to attract, develop and retain staff? Who’d have thunk it!

READ MORE

In related news, sources have also told us that Dean Clemons, global SCC services leader at DXC, has quit. Quint Ketting has replaced him on an interim basis until a permanent successor is found.

Clemons has warned his troops of “structural changes” – some middle managers have already gone. As he’d said in a March conference call – which El Reg heard a recording of – DXC is moving to a set-up based on industry verticals rather than being practice-specific.

A DXC spokesman told us:

“The security landscape is changing, and our global clients need different types of services as they progress through their digital transformation. At the same time, security skills are becoming both more specialized and more scarce. We therefore need to look worldwide to fulfill these changing requirements.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/24/driving_xtreme_cuts_dxc_technology_turns_on_meat_grinder_for_security_division/

Roundup Here’s a quick Monday summary of recent infosec news, beyond what we’ve already reported.

Cisco emits critical bug fixes

Admins running Cisco gear will need to dedicate some time to updating their software an firmware following the release of 26 security patches from Switchzilla.

Of the fixes, three are for critical flaws: CVE-2019-1663 is a remote code execution flaw in the RV110W, RV130W and RV215W routers. CVE-2019-1848 is an authentication bypass flaw in DNA Center, and CVE-2019-1625 covers a privilege escalation flaw in SD-WAN. Additional patches address other bugs in SD-WAN and the RV-series switches.

Desjardens gets desjar-done by data-slurping insider

Canadian credit union Desjardens says it may have lost control of the personal information of 2.7 million people, or around 40 per cent of its clientele, thanks to a disgruntled employee.

The Montreal-based financial institution warned that the rogue insider, who was caught and terminated, had been able to collect detailed information on millions of account holders including their email and physical addresses, social insurance numbers, birth dates, and some account activity, and share it with people outside the company.

For what it’s worth, the bad apple was not thought to have collected PINs, passwords, or security answers, and so far there has been no noticeable increase in account fraud activity. Still, the financial org said it would reimburse fraudulent charges and provide monitoring for anyone who is found to have had their data misused as a result of the leak.

Used Nest cams pose security risk

Getting a bargain on a pre-owned security camera may have put your privacy at risk. This is according to a report from the New York Times’ Wire Cutter site, which found that people who had sold their Nest cameras after doing a factory reset could still access surveillance images from the new owner via the Wink home hub.

Fortunately, Google said it has since issued an automatic update that will roll out to every Nest camera. This means as long as you perform a factory reset, your used Nest should be OK from then on.

Florida town caves to ransomware demand

A city in Florida, US, has found itself $600,000 lighter following a ransomware infection on its officials’ computers.

The city of Riviera Beach said that after initially opting to replace its IT systems in response to a ransomware outbreak, it is following the advice of outside security consultants and handing over the Bitcoin ransom to get their encrypted files descrambled.

While the FBI and many security pros discourage companies from paying off ransomware attackers (often this doesn’t even work), the reality of long and costly recovery projects means that often companies might be better served by at least considering a payout.

Tor follows Mozilla’s lead with bug fix

For those who don’t know, the Tor browser is more or less a version of Firefox with a ton of privacy features baked in. It makes sense, then, that some bug fixes for the Mozilla browser also need to be applied to the Tor version.

That is the case with a sandbox escape bug that recently surfaced as part of a zero-day attack on Firefox. Tor says that users should make sure their browser is updated to protect against similar exploits.

Want another reason to patch the Exim bug? Here’s another Linux attack

Researchers with Cybereason are reporting that malware is swirling around the ‘net exploiting the Exim security flaw revealed earlier this month. The software nasty uses the security hole to inject crypto-miners into Linux servers, and then uses the commandeered boxes to search for other machines to infect. Admins are well-advised to check they have the latest version of Exim, or at least a patched build.

In brief…

Perceptics, a maker of license-plate recognition systems for the US border cops, was hacked, as we reported first last month, and its internal files spilled onto the dark web as a result. Well, that data, including plate photos, schematics, and other sensitive information, is still online, the Washington Post’s Drew Harwell reports, and is now being mirrored on the public internet.

A set of WordPress site-editing plugins from Facebook suffer from cross-site request forgery vulnerabilities. The bugs are present in the WooCommerce for Facebook and Messenger Customer Chat add-ons, and were reportedly publicly disclosed by a security firm that was upset with WordPress for its handling of bug reports.

Finally, Cloudflare is offering a free service to certificate authorities to prevent miscreants from gaining certificates for trusted sites via BGP attacks. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/24/security_roundup/

While risk analysts and security experts continue to urge companies to secure systems against ransomware, they are now also advising that firms be ready to pay.

When a Florida town of 35,000 paid a $600,000 ransom to regain control of its computer systems and critical services — from e-mail access to management of a water-pumping station — critics immediately warned that paying ransomware operators would only lead to more attacks.

Yet businesses and city governments need to stay operational. While risk analysts and security experts continue to recommend that companies keep focused on securing their systems and speeding incident response to minimize the impact of crypto-locking ransomware, they are now also recommending that companies be prepared to capitulate.

In a June 5 report, for example, Forrester Research published a guide to paying ransomware, advising its audience to consider third-party firms that negotiate with cybercriminals to ensure the best outcome.

“Our recommendation is to work with someone who is essentially a specialized breach coach for ransomware,” says Josh Zelonis, senior analyst for cybersecurity and risk at Forrester. Companies need to “go through a staged process to make sure that you are building a rapport with the actor and ensuring that they are able, and willing, to decrypt the data — to essentially deliver a ‘proof of life.'”

The list of municipalities that have been hit with ransomware is growing. Baltimore, Maryland; Atlanta, Georgia; Riviera Beach, Florida; and Albany, New York, have all faced the decision of whether or not to pay. Some, such as Riviera Beach, decided they had no other choice but to meet the ransomers’ demands. Others, such as Atlanta, reportedly refused and faced massive clean-up bills.

The list of companies that have had to deal with crypto-locking ransomware is even longer. Large companies, from Merck to Fedex to Renault, wrote down hundreds of millions of dollars from the WannaCry and NotPetya attacks. Now, clients of some managed service providers are facing ransom demands after attackers gained control of their administrative portals. Paying $17,000 in 2016, Hollywood Presbyterian Medical Center got off fairly lightly. 

“I don’t think you can make a blanket statement of ‘pay the ransom’ or ‘don’t pay the ransom,'” says Adam Kujawa, director of the research labs at security firms Malwarebytes. “If you have failed to segment your data or your network, or failed to check your backups or other measures to get your company back on track quickly, then you will have to deal with the fallout.”

One problem for companies: Ransomware operators have shifted away from blanketing consumers and businesses with opportunistic ransomware attacks and now almost exclusively target business and municipalities. Along with that shift, the cost of ransoms has quickly grown because such organizations can afford to pay. Now, many organizations are faced with seven-digit ransom demands, Zelonis says. “That’s a heck of a payday,” he adds.

The increase in ransom demands is driven by attackers’ targeting and research on victims, he says.

“It is interesting because the other thing we are seeing is that these actors are not just looking at your infrastructure and where your backups are to make sure that you cannot recover from backups,” he says. “A lot of the actors are looking at a company’s annual revenue to figure out what they can afford to pay.”

For companies that want to stick to their pledge to never pay ransomware operators, that intent needs to start before an incident — with preparation. Organizations need to focus on security, incident response, and recovery to minimize the cost of a ransomware attack. Incident response exercises are key, Zelonis says. 

Yet cybercriminals have become more savvy. They will often spend time in a target’s network looking for the most sensitive data and making sure they can compromise the backups, as well, he says.

“The ransomware market from two or three years ago has totally evolved,” Zelonis says. “[Cybercriminals] are understanding where you are backing things up and going after those systems. This is a full-scale breach.”

The Forrester report advises companies to invest in cyber insurance as a way to offset at least some business risk. Organizations should also test their ability to recover from a massive data loss event using their backups.

“A harsh reality is that a majority of organizations aren’t testing their ability to recover a single system from backups, much less validating they have the ability to recover potentially hundreds of systems at the same time,” the report states.

To be most responsive in the case of a ransomware incident, companies need to have a plan for acquiring cryptocurrency or have a fund already in place, as well as have an incident response provider on retainer and select a ransomware specialist, the report stated.

The focus for companies is to stay in business, so even for companies that could recover all of their data, it is often easier — and cheaper — to just work with the attacker to restore the data.

“If you are losing data, that will cost you more to recover or to deal with the fallout of losing it, and you are dealing with the cybercriminal and they are willing to negotiate, then you are in a situation where paying might not be the worst idea in the world,” Malwarebytes’ Kujawa says. “It’s not what we like to do, but at the end of the day, a business needs to stay in operation.”

Related Content

• Florida Town Pays $600K to Ransomware Operators
• Customers of 3 MSPs Hit in Ransomware Attacks
• Baltimore Ransomware Attack Takes Strange Twist
• The Ransomware Dilemma: What if Your Local Government Is Next?
• How a Manufacturing Firm Recovered from a Devastating Ransomware Attack

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/pledges-to-not-pay-ransomware-hit-reality/d/d-id/1335029?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Four new CVEs present issues that have a potential DoS impact on almost every Linux user.

Linux and FreeBSD users have a SACK of new vulnerabilities to worry about, as four new CVEs describe selective acknowledgement (SACK) and excess resource consumption vulnerabilities that can bring a system to a standstill from a denial of service attack.

Three of the CVEs — CVE-2019-11477, CVE-2019-11478, and CVE-2019-5599 — deal with a variety of different SACKs that can hit various Linux distributions and FreeBSD 12 using the RACK TCP Stack. In each case, a carefully crafted selective acknowledgement can trigger an issue that could lead to slowed performance, denial of service, or a kernel panic.

The fourth CVE, CVE-2019-11479, describes a vulnerability stemming from a hard-coded maximum segment size (MSS) that can result in a higher number of fragmented packets than normal. This issue for all Linux versions could be exploited to cause increased resource consumption in the CPU and network controller, with system slowdown or denial of service as the result.

Because of the nature of the Linux and FreeBSD communities, vendors and open-source projects are in various stages of releasing patches for these vulnerabilities. Users should contact their system provider to see whether a patch is already available for the distribution in use.

For more, read here and here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/four-cves-describe-sacks-of-linux-and-freebsd-vulnerabilities/d/d-id/1335030?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple