hacking – Page 1099 – STE WILLIAMS

Judge says US govt has ‘no right to rummage’ through anti-Trump protest website logs

library
crime | hacking | security

A Washington DC judge has told the US Department of Justice (DoJ) it “does not have the right to rummage” through the files of an anti-Trump protest website – and has ordered the dot-org site’s hosting company to protect the identities of its users.

Chief Judge Robert E. Morin issued the revised order [PDF] Tuesday following a high-profile back and forth between the site’s hosting biz DreamHost and prosecutors over what details Uncle Sam was entitled to with respect to the disruptj20.org website.

The site was used to organize public protests and demonstrations against the telly-celeb-turned-president on his inauguration day in January. A week later, following rioting and property damage, DreamHost received a grand jury subpoena demanding it hand over details of those who had created profile pages on the dot-org and any contact and payment details related to them – an order the company complied with.

Six months later, however, DreamHost received another request from the DoJ: a search request for all contact information, email content, photos, and all of the 1.3 million IP addresses of anyone who merely visited the protest website. That’s a lot of people suddenly under suspicion, simply for visiting a website.

DreamHost went public with its concerns and told The Register the request was “unlike anything we’ve seen before in 20 years of web hosting.” It refused to hand the details over, sparking a motion to compel from Uncle Sam’s lawyers, which DreamHost refused.

Chief Judge Morin listened to both sides of the arguments – DreamHost claiming the demand broke the First and Fourth Amendments and was tantamount to political persecution, and the DoJ claiming it needed the information to continue its investigation into criminal acts – and decided in August that DreamHost must hand over the information, but with important caveats.

Minimization

First, the DoJ was told to narrowed its search warrant to include only registered users of the website. And second, the judge introduced a “minimization plan” in which the government had to name the investigators that will have access to the data, and list the methods they will use. In addition, the court said it will oversee the search, and the DoJ must justify why it believes the information provided is “responsive to” the warrant, i.e. directly relevant to their criminal investigation.

Judge orders handover of Trump protest website records – DreamHost claims victory

The DoJ would not be allowed to share the information with any other government agency and the court will seal any information that it decides is “not responsive,” meaning that to access it the government will need to get a court order.

This week, Judge Morin issued his final order on the matter – and it has fallen down more on the side of individual users.

“As previously observed, courts around the country have acknowledged that, in searches for electronically stored information, evidence of criminal activity will likely be intermingled with communications and other records not within the scope of the search warrant,” he noted in his ruling.

“Because of the potential breadth of the government’s review in this case, the warrant in its execution may implicate otherwise innocuous and constitutionally protected activity. As the Court has previously stated, while the government has the right to execute its Warrant, it does not have the right to rummage through the information contained on DreamHost’s website and discover the identity of, or access communications by, individuals not participating in alleged criminal activity, particularly those persons who were engaging in protected First Amendment activities.”

Steps

The order then lists a series of protocols designed to protect netizens “to comply with First Amendment and Fourth Amendment considerations, and to prevent the government from obtaining any identifying information of innocent persons.”

The DoJ will have to tell the court precisely what it will search for in disruptj20.org’s files – rather than just asking for it all – and must gain court approval before obtaining that data. DreamHost will then carry out that search and send the result – with individual users’ personally identifying details, such as names and email addresses, redacted – to the DoJ, which will have to file a second request to the court stating which records it wants to retain along with an explanation for how they are relevant to its criminal probe.

The DoJ will also have to justify any requests to have that user information un-redacted, and the court will decide whether to grant that request based on whether there is evidence of criminal activity using the legal standard of probable cause.

Therefore, it appears, prosecutors can, say, ask for comments posted on the site mentioning smashed windows, and get a dump of matching comments with any identifying information redacted. Next, the DoJ has to specify which parts it wants un-redacted, and the court has to agree before any more data is disclosed.

In essence, it is a very strong judgment in favor of user privacy, and DreamHost was, unsurprisingly, pleased with the result.

DreamHost general counsel Christopher Ghazarian said the company was “happy to see significant changes that will protect the constitutional rights of innocent internet users,” and applauded the judge for acknowledge people’s rights. “This is another huge win not just for DreamHost, but for internet users around the world,” Ghazarian said.

The DoJ has not commented on the order. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/11/trump_protest_website_privacy_latest/

Security Tops Use Cases for Endpoint Data

library
crime | hacking | security

Businesses increasingly use endpoint data for security investigations, eDiscovery, and device migration to Windows 10.

Businesses are exploring new use cases for endpoint data beyond backup and recovery, reports a new survey by Code42. Researchers polled 155 IT professionals and business decision-makers on the show floor at the 2017 VMworld U.S. and found 65% use this data for more than backup.

Security investigation, cited by 55% of respondents, is the most common use case for endpoint user data, followed by device migration to Windows 10 (53%), and eDiscovery (47%). When asked what they wanted to use endpoint data for, security topped the list again among 45% of respondents, followed by device migration (44%) and ransomware recovery (43%).

It’s mission-critical or important to be able to use endpoint user data for services like analytics, security, and migration, reported 64% of survey respondents. Endpoints are becoming a more important data source: 42% of businesses store between 50-100% of their data on endpoints, and 83% believe endpoint data is “extremely or very important” to their business.

How Systematic Lying Can Improve Your Security

library
crime | hacking | security

No, you don’t have to tell websites your mother’s actual maiden name.

After any major breach, the entire security community clamors to weigh in. The headlines are filled with advice and suggestions as vendors advocate for their solutions and consultants push training. The response of breached companies is almost always the same: they offer free credit monitoring. I have plenty of thoughts on why that is ineffective, but the short version is that this approach is like putting up a sign saying that a bridge is out… behind you.

Predictably, the usual advice is offered about strengthening passwords, utilizing two-factor authentication, and the like. But what you really need to do to protect yourself from the effects of a breach depends on what information was revealed. Whether password lists, account names, credit card information, personal identifiers, financial information, or personal information, each of these can lead to different kinds of attacks that require different defenses. In light of this, I suggest a change that anyone can make, which is particularly relevant to the Equifax breach but is also generally effective. So, in addition to the methods listed above, I suggest taking advantage of one of the most effective and durable tactics: lying.

There are three kinds of attacks enabled by the Equifax breach. First, the financial and personal information can be used to open fraudulent lines of credit. The best defense for this is a credit freeze at all three credit reporting bureaus. Second, the financial information can help attackers target high-value individuals for other kinds of scams or attacks. For targeting, a combination of anonymity and paranoia are your best bet. Finally, the information exposed reveals details about the victims that are often used in security questions. This brings me to my point about lying — to avoid losing personal information via security questions, lie about the answers.

The fundamental problem with the security questions on websites is that they are asking for discoverable biographical questions. They might ask the name of the street where you grew up. Using the Equifax data, attackers can probably connect you to your parents. They will know the addresses where both you and they lived, and what your age was at the time, so they know all the likely answers. We also reveal many other answers directly through our social media posts, pet names, relatives, etc.

If you lie in your answers to these questions, your answer becomes much harder to guess. Saying I grew up on 3rd Street instead of 5th is a good start, but it is still a common street name. Saying my favorite color is “Saint Bernard” is much better. These answers are just free-form text fields — you can put in anything at all, including a pure random string.

Of course, the answers to these questions can be exposed as well. As with passwords, it is important not to reuse the same answers over multiple websites. On one website, my mother’s maiden name could be “Blue Dyspeptic Wallaby,” while on another it might be “Invisible Orange Planets Laugh Silently.”

Now, if you think it is unreasonable to be asked to keep track of unique passwords for each account, you may be reaching for torches and pitchforks about now. The solution here is to use a password vault. There are many available with strong security and the ability to sync between all of your devices. My two favorites are 1Password and Dashlane. And no, I don’t own stock in, or work at, either of them.

The trick is to take advantage of the notes field available in these applications. When you save a username/password, you can also put the security questions and answers in the notes field to make sure you keep track of all the different lies you have told. If you are asked for new answers to additional questions, simply add those to the note. With the vault syncing, you will have all the answers at your fingertips whenever you need them.

Like adopting strong unique passwords, this can seem like a monumental undertaking. After all, how many different accounts do you have? A quick glance at my vault suggests that I have about 1,000 of them. Don’t worry — you don’t need to change them all at once. A good practice is to start with just your most critical accounts: financial institutions and your password recovery email account.

Once you have those accounts protected, just make a point of using unique strong fake answers for each new account you create, and updating existing ones when you’re prompted to change your password. From time to time, take a few minutes more to change some of your other important or frequently used accounts. After a short while, your security will be substantially improved. All through the ancient technique of lying.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Lance Cottrell founded Anonymizer in 1995, which was acquired by Ntrepid Corp. (then Abraxas) in 2008. Anonymizer’s technologies form the core of Ntrepid’s Internet misattribution and security products. As Chief Scientist, Lance continues to push the envelope with the new … View Full Bio

Article source: https://www.darkreading.com/perimeter/how-systematic-lying-can-improve-your-security/a/d-id/1330089?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

New Dark Reading Conference Will Focus on Defense

library
crime | hacking | security

The INsecurity Conference, Nov. 29-30 at the Gaylord National Harbor in Maryland is all about helping infosecurity pros mitigate threats — from hot topics to basic hygiene.

The Dark Reading editorial staff loves writing about cybersecurity, but we don’t want to write about you. Our goal is to provide readers the news that will help them stay out of the news.

To that end, our very first live event – the INsecurity conference, Nov. 29-30 at the Gaylord National Harbor in Maryland – will focus not on threats, but on defense.

By defense we don’t just mean new whiz-bang, blinky-light tools. We mean tricks for improving security hygiene and strategies for combating the attacker techniques that have thus far defied technological solutions. Some of our speakers are practicing chief information security officers, ready to share insights about what has worked (and not worked) for them.

Here are just a handful of the sessions, roundtables, and expert-led guided discussions that will be part of the INsecurity lineup:

Check out the complete INsecurity agenda at https://insecurity.com. Use promo code DR100 to save $100 on registration. Hope we see you there!

Article source: https://www.darkreading.com/risk/new-dark-reading-conference-will-focus-on-defense/a/d-id/1330083?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Can Machine Learning Outsmart Malware?

library
crime | hacking | security

What’s This?

Using machine learning in the cybersecurity domain is a growing trend with many advantages, but it also has its risks.

Fighting malware is a modern arms race. Not only has malware evolved to be more evasive and harder to detect, but their vast numbers make it even more difficult to handle. As a result, detecting a malware has become a big data problem which requires the help of self-learning machines to scale the knowledge of analysts, handle the complexity beyond human capabilities, and improve the accuracy of threat detection.

There are number of approaches to this problem; choosing the right algorithm to serve the security engine’s purpose is not an easy task. In this article, we will refer to machine learning (ML) as an application of artificial intelligence (AI) where computers learn without being explicitly programmed. We will look into some use cases and challenges, starting with an interesting question: why do we see this growing trend now? The answer has to do with lower costs and increased availability of private and public cloud technology for collecting, storing and analyzing big data in real time, and the academic research progress in ML and related algorithms such as Deep Neural Networks (DNN).

Putting together a successful ML cybersecurity implementation is a multidisciplinary task, which requires coding capabilities, as well as cyber domain expertise, and deep math/statistics knowledge, originally described by Drew Conway in his data science Venn diagram. ML models can be used to classify malicious files (including ransomwares), analyze abnormal user and network behavior, perform advanced event analytics, identify encrypted malware traffic, synthesize threat intelligence feeds, and fuse in-direct telemetry signals with security events in cloud deployments.

Implementing a complete solution requires embedding the selected ML algorithm into a three-stage workflow of operation. First, the ML engine performs analysis, usually enhanced with other detection technologies to deliver open and integrated defense in depth. Then, enforcement is performed across the entire network preferably in an automatic and unified way. And finally, Cyber Threat Intelligence (CTI) is shared and received with other systems and entities, to further enrich and add context to the next analysis task — feedback.

Cyber Defense Challenges and Machine Learning

A ML model is only as good as the content from the data sources that feed it (better known as: garbage in, garbage out). Similarly, performing analysis without domain expertise and context can be misleading, and measuring the engine’s performance/accuracy is tricky.

Another challenge is that attackers also use machines for different attack phases, as described by Intel Security in their 2017 threat predictions report. But the most interesting challenge is the risk of attackers actually manipulating ML defense engines. A visible example, as described by Dave Gershgorn in Popular Science last year, was presented by Google’s researchers who manipulated road signs to deceive a driverless car, using black-box attack principles that can be leveraged also in the cyber domain to fool the machine.

Machines are taking over many aspects of our lives (Did anyone say autonomous cars?), but given the pros and cons described, should we let the machines take over our defense systems? The answer is yes and no. On the one hand, machines can outsmart human capabilities on certain aspects of scale and complexity. On the other hand, they can be manipulated, but so can humans. The debate is ongoing But based on the buzz in the market it’s clear that machines are already transforming the way we perform cyber defense.

Aviram Zrahia is a cybersecurity consulting engineer at Juniper Networks, and a research fellow in the Blavatnik Interdisciplinary Cyber Research Center (ICRC) at Tel-Aviv University. His primary research interest is cyber threat intelligence sharing, where he uses technology … View Full Bio

Article source: https://www.darkreading.com/partner-perspectives/juniper/can-machine-learning-outsmart-malware/a/d-id/1330101?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Phishing Emails that Invoke Fear, Urgency, Get the Most Clicks

library
crime | hacking | security

The most commonly clicked phishing emails include urgent calls to action, or exploit victims’ desire for popularity.

If an employee receives an email about a data breach, chances are they’re going to click. If an “important” or “urgent” message arrives from human resources, they’re going to want to know why. If an email warns their password is about to expire, they will investigate further to change it.

Hackers know this, which is why they have begun to prey on victims’ sense of urgency in phishing attacks. The most effective phishing email subject lines include psychological triggers to get people to click, discovered security awareness firm KnowBe4 in a study of most-clicked phishing email subject lines for Q3 2017. After all, nobody wants to miss an important message from HR.

Sophisticated phishing emails are behind more than 90% of successful cyberattacks, said Mike Rogers, former chairman of the House Intelligence Committee, at the US Chamber of Commerce’s cybersecurity summit. Phishing has increased potential to dramatically affect a business’ economic loss.

“When you look at the top five items, four out of those five have words like ‘expires,’ ‘immediately,’ ‘notification,'” says Greg Kras, KnowBe4’s chief success officer. “They’re all designed to get that sense of urgency. When people see that, they go into corrective action overflow where they’re trying to address what they consider to be a problem.”

It’s common for attackers to prey on fear. Four years ago, says Kras, attackers would never have used “data breach” to spark concern because general users didn’t know what they were. Now with breaches regularly making headlines, more people know they’re dangerous. Human resources notifications are effective because they provoke the same sense of urgency.

The most-clicked general email subject lines, and attacks in the wild, for Q3 were designed to provoke a sense of urgency or reward, according to KnowBe4’s findings:

Official Data Breach Notification (14%)
UPS Label Delivery 1ZBE312TNY00015011 (12%)
IT Reminder: Your Password Expires in Less Than 24 Hours (12%)
Change of Password Required Immediately (10%)
Please Read Important from Human Resources (10%)
All Employees: Update your Healthcare Info (10%)
Revised Vacation Sick Time Policy (8%)
Quick company survey (8%)
A Delivery Attempt was made (8%)
Email Account Updates (8%)

“The most successful phishing attacks are those that effectively capitalize on natural human responses,” says Amy Baker, vice president of marketing at Wombat Security. “We frequently see attackers attempting to drive an emotional reaction, using fear tactics, urgent language, and offers that seem – and are – too good to be true.”

Common “in the wild” phishing subject lines, similarly crafted to provoke user action, include:

LinkedIn: Important Security Update
Amazon: Kindly update your account with Amazon to avoid shutdown
Email account will be closed
Office 365: Incoming mail on hold
We have created your ticket for server upgrade

Many attackers exploit users’ desire for reward and personal gratification, Kras explains. For example, an attacker might try to trick someone with a subject line claiming they have 1,000 followers on Twitter, or received thousands of likes on a photo.

“Everything these days has gone into gamification,” he says. “Gaming for likes, gaming for followers … awards, achievements, unlocks.”

This was prevalent in emailed social media notifications, which KnowBe4 also explored in its research. At 41%, LinkedIn was the most popular network for false messages because, as Kras points out, more people use business email addresses for LinkedIn. They would be more skeptical if, say, a Facebook message appeared in their corporate inbox.

What can you do about it?

“Err on the side of caution,” says Kras, urging employees to take their suspicious emails to the IT department. “Most IT groups are going to be responsive. They will appreciate they are being asked more than they appreciate not being asked and having a problem.”

Because many phishing emails pose as HR updates, he also advises establishing a communications process with the HR department and creating a process for how notifications are distributed; for example, through the corporate intranet. This way, employees will be able to detect suspicious messages based on how they’re received.

Two-factor authentication is another helpful step for businesses to have. “This way, if a user does get their credentials phished, it’s not a complete loss,” he adds. This also protects people who share passwords, a trend “way more rampant than anyone wants to admit.”

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/endpoint/phishing-emails-that-invoke-fear-urgency-get-the-most-clicks/d/d-id/1330100?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

US Treasury denies domestic spying

library
crime | hacking | security

How many of us even knew the US Treasury Department has a foreign intelligence division?

We certainly know about the Office of Intelligence and Analysis (OIA) now. A recent BuzzFeed report accuses the OIA of deciding years ago that foreign intelligence wasn’t enough, and going domestic – shades of the National Security Agency (NSA).

Citing more than a dozen anonymous government sources from another branch of Treasury, BuzzFeed reported last Friday that the OIA…

…has repeatedly and systematically violated domestic surveillance laws by snooping on the private financial records of US citizens and companies.

The story quoted an unnamed “senior Treasury official” saying, “This is domestic spying.”

OIA, like other foreign intelligence agencies – NSA, Central Intelligence Agency (CIA) and Defense Intelligence Agency (DIA) – is supposed to monitor suspicious activity (in this case, financial) only outside of the US.

That line between the roles of law enforcement (domestic) and intelligence (foreign) agencies dates from President Ronald Reagan’s executive order (EO) 12333. While there are instances when intelligence agencies can conduct surveillance on US citizens, they are limited by strict, court-ordered guidelines.

But according to those anonymous sources, OIA has been illegally collecting the banking and financial records of US citizens as well – records that banks and financial institutions are required to turn over to the government every day, under the provisions of the Bank Secrecy Act of 1970.

Not according to Treasury, which called the story “flat-out wrong,” in an official denial several hours after the story was posted. It said in part:

An unsourced suggestion that an office within Treasury is engaged in illegal spying on Americans is unfounded and completely off-base.

The unauthorized collection of domestic financial records had allegedly been going on for years until the Financial Crimes Enforcement Network (FinCEN) – the division of Treasury that legally collects those domestic records – found out about it and complained.

Apparently irritated by the complaints, in early 2016, Treasury’s Office of Terrorism and Financial Intelligence (TFI), which oversees the OIA, proposed transferring much of FinCEN’s responsibilities (and a corresponding percentage of its employees and budget) to the OIA.

FinCEN’s leadership, perhaps predictably, objected on multiple grounds. They said the move would be illegal without congressional approval. They said OIA could not legally collect domestic financial records unless it complied with Executive Order 12333, which was renewed in 2008 by President George W. Bush.

That order would require the OIA, before it collected domestic records, to establish privacy guidelines approved by the attorney general, in consultation with the director of national intelligence – something the OIA still hasn’t done.

It was after that conflict that the leaks began, both to BuzzFeed and to Congress. According to anonymous sources, not only was the OIA illegally collecting financial information on US citizens, it was also allowing a “back door” to the staff of other intelligence agencies, including the NSA, CIA and DIA, to come into its offices to search domestic financial records that they could not get through their own agencies.

DIA didn’t comment, but both the NSA and CIA issued denials. The CIA’s Dean Boyd said:

Suggestions that the Agency may be improperly collecting and retaining U.S. persons’ data through the mechanisms you describe are completely inaccurate.

Some members of Congress have been aware of FinCEN’s complaints for at least a year. Rep. Sean Duffy (R-WI), chairman of the House Subcommittee on Oversight and Investigations, wrote in October 2016 to then Treasury secretary Jacob Lew asking whether OIA had legal authority to collect and retain information on US citizens. He never got an answer.

But since the story was posted, and in spite of the denials, Treasury’s Office of the Inspector General said it will review the matter.

Congress may review it as well. Gizmodo reported that Sen. Mark Warner (D-VA), the ranking Democrat on the Senate Intelligence Committee, and Sen. Ron Wyden (D-OR) were calling for Treasury officials to appear before the committee. Keith Chu, a spokesman for Wyden, said if the allegations are true, they, “would represent a serious abuse of spying power…”

But so far, the OIA maintains that everything it is doing is “within the bounds of statute.” The remainder of the statement issued after the story ran said:

In the post-9-11 era, law enforcement and Intelligence Community members, both within agencies and across the federal government, are required to share information as governed by law. Treasury’s OIA and FinCEN share important information and operate within the bounds of statute and other relevant legal authorities.

The dedicated staff throughout TFI share a common mission to utilize and share financial data to prevent terrorist attacks, money laundering, narcotics trafficking and other illicit activity, and do so by following all applicable laws and regulations. We have a responsibility to bring to bear all the tools available to us to protect the American people.

Follow @NakedSecurity

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/wimupt5QtsY/

Equifax: About those 400,000 UK records we lost? It’s now 15.2M. Yes, M for MEELLLION

library
crime | hacking | security

Updated Last month, US credit score agency Equifax admitted the personal data for just under 400,000 UK accounts was slurped by hackers raiding its database. On Tuesday this week, it upped that number ever-so-slightly to 15.2 million.

In true buck-passing fashion, at the time of writing, Equifax hadn’t even released a public statement on the matter. Instead it fell to Blighty’s National Cyber Security Centre to reveal the bad news that a blundering American firm had put them at risk of phishing attacks.

“We are aware that Equifax was the victim of a criminal cyber attack in May 2017,” the NCSC said in a statement today.

“Equifax have today updated their guidance to confirm that a file containing 15.2m UK records dating from between 2011 and 2016 was attacked in this incident. NCSC advises that passwords are not re-used on any accounts if you have been told by Equifax that any portion of your membership details have been accessed.”

Any answers to security questions – such as your mother’s maiden name – given to Equifax during an account signup should now be considered compromised, the NCSC warned, and should be changed for other websites, if possible. Names, home and email addresses, telephone numbers, and account recovery question and answers were swiped by the hackers, and will be a boon to phishers obtaining the records, the centre warned.

UK folks should be on the look out for phishing emails asking for their financial information or luring them to fake websites using their Equifax records to make the messages look legit. Recipients will likely get an email quoting their home address and some digits of their phone number to prove its authenticity.

Hackers got into Equifax’s servers in May this year by exploiting an flaw in Apache Struts for which it had neglected to apply a patch. It took until July, though, for the biz to find out it had been infiltrated, and it stayed quiet until early September when it admitted 143 million US citizens had their info exposed to miscreants. Some senior executives sold off their stock days before the world learned of the hack, conveniently. A week later, the biz said about 400,000 Brits had also been hit in the IT break-in.

Disaster

You’d have thought that with that amount of time to play with, and the nature of the information involved, Equifax would have given a bravura performance in how to deal with a database security breach. Instead, to describe the company’s response as a car crash is unfair to automakers. Its website detailing the hack, equifaxsecurity2017.com, looked so unofficial and rushed together that many initially feared it was a phishing site itself, and the credit agency later had to stress that signing up for free credit monitoring as a result of the attack would not waiver your rights to sue.

Next, Equifax’s chief security officer and chief information officer left the outfit – not fired but instead allowed to retire with their golden parachutes. Shortly before trying to blaming a single lowly IT staffer on the cockup, CEO Rick Smith also jumped ship, taking his $90m retirement pot with him.

In the meantime, outside investigators were checking up on Equifax’s servers. Last week they upped the number of affected US citizens to 145.5 million, and that a probe into the UK side of things was still ongoing. The UK investigation ended on October 2, according to Equifax. Eight days later, the bad news comes out and hundreds of thousands of British peeps are now on high alert.

While it has lost three senior executives in well-compensated disgrace, it looks unlikely Equifax will face any further sanctions. After all, we’re not customers of Equifax who can refuse to provide data for its servers – it just collects it all, one way or another, and sell it on to others.

The US government certainly doesn’t seem interested in causing Equifax grief. Instead, its Internal Revenue Service awarded the biz a $7.5m no-bid contract last week to provide – you guessed it – identity verification services. With tough action like that, things will obviously get better. ®

Stop press

Just as we were hitting the publish button, Equifax emitted the following clarification, saying the actual number of people in the UK seriously affected is about 700,000 due to duplicated data:

Today Equifax can confirm that a file containing 15.2m UK records dating from between 2011 and 2016 was attacked in this incident. Regrettably this file contained data relating to actual consumers as well as sizeable test datasets, duplicates and spurious fields. Equifax has brought every analytical tool, technique and data asset it has available to bear in order to ‘fill in the blanks’ and establish actual consumer identities and attribute a current home address to them. This complete, we have been able to place consumers into specific risk categories and define the services to offer them in order to protect against those risks and send letters to offer them Equifax and third-party safeguards with instructions on how to get started. This work has enabled us to confirm that we will need to contact 693,665 consumers by post.

The balance of the 14.5m records potentially compromised may contain the name and date of birth of certain UK consumers. Whilst this does not introduce any significant risk to these people Equifax is sorry that this data may have been accessed.

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/10/equifax_uk_records_update/

When Irish data’s leaking: Supermarket shoppers urged to check bank statements

library
crime | hacking | security

Shoppers at SuperValu, Centra and Mace have been told to review their bank statements following a cyber attack against Irish retailer Musgrave.

Musgrave, which owns all three stores, urged customers to take the precaution amid fears that hackers may have extracted credit card and debit card numbers and expiry dates from its systems. Cardholders’ names, PINs, or CVV numbers are not thought to have been exposed. Musgrave has nonetheless launched an investigation and reported the matter to Irish data privacy watchdogs at the Office of the Data Protection Commissioner, the Belfast Telegraph reports.

SuperValu confirmed its advice for customers to check their bank accounts in an update to its official Northern Ireland profile on Tuesday. However, the supermarket chain has yet to answer numerous questions, including identifying what systems were targeted or the attack vector. It has said “all” customers were affected, so we know at least that the issue isn’t restricted to either online or in-store customers alone.

Irish broadcaster RTE reports that “malicious software was discovered in a centralised IT system”.

Neither Musgrave nor SuperValu had responded to requests for comment from El Reg at the time of publication. We’ll update this story as more information comes to hand. ®

Sponsored:
The Joy and Pain of Buying IT – Have Your Say

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/10/11/supervalu_data_breach/

GDPR Concerns Include ‘Where’s My Data Stored?’

library
crime | hacking | security

European data protection regulations are coming like a freight train and many firms are still unprepared.

The impending mandates stipulated by the European Union’s General Data Protection Regulation (GDPR) have many security and compliance officers at global organizations losing sleep, and for good reason. According to new data out last week, at the most basic levels many organizations are unprepared to even say where their most sensitive geographically resides, let alone ready for the heightened data protection requirements themselves.

A study conducted by McAfee among 800 senior business decision-makers found that only 47% of them are completely confident they know where all of their sensitive corporate data is physically stored all of the time. That’s going to be a big deal in a little over seven months when GDPR officially comes into play.

One of the most stringent data privacy and protection regulations ever put in place for consumer data, GDPR ups the ante for how data physically residing in Europe and even simply pertaining to individuals in the EU is handled. That includes collection, retention, and processing. It steepens fines for breaches, cuts down breach notification windows to just a few days after discovery, and aims to put the screws to both European and global organizations to increase transparency around data protection policies.

While many organizations have been prepping in some way or another for two years on average, many are still unprepared. In fact, the McAfee survey showed that just 44% of organizations claim a complete understanding of what GDPR means to them and only 26% of organizations believe that they can meet the regulation’s 72-hour breach report deadline.

These findings are hardly out of left field. This year has seen numerous surveys continue to confirm the fact that organizations are still taking the regulations lightly. In fact, last month a survey from UK law firm Blake Morgan showed that nine out of ten organizations have not made important changes to their privacy policies to keep in line with GDPR, and nearly four in 10 hadn’t taken any steps to prepare for the regulation.

“With the clock counting down to the law coming into force, we would recommend a focused effort by businesses to get to grips with the changes and implement a strategic plan of action,” says Simon Stokes, a partner specializing in data protection law at Blake Morgan, who says that GDPR should be seen as an exercise good corporate housekeeping. “Not only will it avoid running the risk of financially and reputationally damaging fines or sanctions – ultimately it will assure the public’s trust in your organization at a time when data privacy and security are more important than ever before.”

The good news is that many business leaders surveyed by McAfee recognize that the kinds of data protection mechanisms spurred on by regulations like GDPR would serve as a competitive differentiator. Nearly three in four reported think that organizations are using data protection as a way of attracting new customers, and 67% think that the GDPR could help promote investment in Europe.

As things stand, the US still remains the top preferred country for data storage due to regulatory requirements, named by a plurality of 48%. Second most named was Germany, which was named by 35% of firms.

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: https://www.darkreading.com/risk/gdpr-concerns-include-wheres-my-data-stored-/d/d-id/1330061?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple