STE WILLIAMS

Police in the Australian State of Queensland have arrested a man they say set up bank accounts to collect ransoms from victims of tech support scams, and funnel funds to scammers.

Queensland Police say the 75-year-old man “ fraudulently set up three Australian companies, JC Enterprising, JC Web Creations and ITZ Services between February 2015 and July 2017, after being contacted by a fake overseas computer repair company to become its local representative to receive funds from their customers.”

The scammer used a familiar modus operandi, calling people at random and offering to fix problems but actually installing ransomware. Victims were then told to remit funds to bank accounts in the town of Mackay in order to have their computers repaired. It appears that victims mailed funds to the three dodgy companies, as Queensland Police also say they “executed search warrants on several post boxes in Mackay where it will be alleged twenty-two mail items were located addressed to the fraudulent companies.”

The scam appears to have been lucrative: Police allege the man “transferred funds in excess of AU$1 million [US$760k, £590k, €670k) to a number of overseas entities” over the three years he ran the dodgy companies.

The bust is interesting as it sheds some light on how ransomware scum operate: few punters would know how to get their hands on bitcoin to pay a ransom and arranging overseas payments is sometimes onerous. But there are still lots of cheque books mouldering away in Australian desk drawers to make payments, while a local postal address adds a certain level of comfort to any scam.

The man will appear in court on August 3rd when he will defend a charge of “recklessly engage in money laundering.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/07/11/ransomwareslinging_tech_support_scammers_set_up_cash_mule_in_australia/

President Donald Trump proposed, and quickly rescinded, the idea of a joint cybersecurity unit with Russian President Vladimir Putin during this week’s G20 summit.

On Saturday, July 9, President Donald Trump suggested via a tweet the formation of a cybersecurity alliance with Russia following a conversation with Russian President Vladimir Putin. But later that day, Trump pulled back from that statement.

The two leaders met during the G20 summit in Hamburg, Germany. Their meeting, which lasted two hours and fifteen minutes, centered on the current and future nature of the relationship between the United States and Russia.

Trump tweeted about the potential for a cybersecurity unit after, he claimed, Putin “vehemently denied” Russia’s meddling in the 2016 US presidential election. The “impenetrable Cyber Security unit” would guard against “election hacking, many other negative things.”

(Source: Twitter)

The tweet instantly sparked criticism from officials who were outraged at the idea that Moscow could be trusted in such a collaboration. US intelligence has discovered evidence indicating Russia did interfere with the 2016 election and targeted voting systems in multiple states.

Some security experts took Trump’s tweet with a grain of salt.

“As a professional, I tune out his tweets to a degree … you couldn’t take them literally as serious policy statements unless there’s a follow-up,” says John Bambenek, manager of threat systems at Fidelis Cybersecurity. “It seems so out of left field it’s hard to take it seriously.”

However, he continues, the idea could have serious implications if it became reality, as “a large part of our cybersecurity concerns emanate from that part of the world.” Further, Russian intelligence services have relationships with many of the same criminals to share information, a structural impediment that would prevent the two from collaborating.

“How that cooperation would work would be awkward,” he notes.

Michael McFaul, former US ambassador to Russia, said such a collaboration “just will not happen,” Reuters reports. Restrictions on sharing information with Russia would prevent giving the country a closer look at US cyber capabilities; similarly, Moscow would also be resistant to sharing its own capabilities with the US.

Never Mind

When Trump changed his tune later on July 9 after his initial Russian cybersecurity unit statement, he said his mention of a joint cybersecurity unit with Russia does not mean he thinks it will become reality.

“It can’t,” he noted, though a ceasefire in Syria did happen. Trump also mentions the negotiation of a ceasefire in a separate tweet, adding how it’s time to “move forward” in collaborating with Russia.

(Image: Twitter)

Russian Foreign Minister Sergey Lavrov reported after the meeting that Trump accepted Putin’s statements claiming Russia was not involved in the election, according to a CNN translation. A White House briefing on the meeting, which has since been deleted, placed more focus on moving forward than enforcing consequences for the alleged interference.

“I think what the two Presidents, I think rightly, focused on is how do we move forward; how do we move forward from here,” said Secretary of State Rex Tillerson in a statement. “Because it’s not clear to me that we will ever come to some agreed-upon resolution of that question between the two nations.”

Bambenek says he would be surprised if there is anything legitimate behind Trump’s tweet. He does acknowledge the US and Russia will eventually need to cooperate on cybersecurity — though doing so for elections “would be amusing.”

“As a general rule, all things being equal, we’re nations with our own laws,” he explains. “But the Internet respects no international boundaries. We’re not going to solve cybercrime unless we get nations to play in the sandbox somehow.”

Such a collaboration would ideally focus on solving conventional cybercrime and protecting citizens from threat actors. While it’s theoretically conceivable for nation-states to work together on this, it’s tricky because of how foreign policy works.

“Is it possible? Yes, human beings can decide to play nice,” he says. “Is it reasonable to expect they would? All foreign policy is based on exchanges. If they ask for ‘X’, they’ll want ‘X’ in return. There could be a deal, but nations will act in their own self-interest.”

Related Content:

• NotPetya: How to Prep and Respond if You’re Hit
• Hacking the State of the ISIS Cyber Caliphate
• Desperately Seeking Security: 6 Skills Most In Demand
• Black Hat Survey: Security Pros Expect Major Breaches in Next Two Years

Kelly Sheridan is Associate Editor at Dark Reading. She started her career in business tech journalism at Insurance Technology and most recently reported for InformationWeek, where she covered Microsoft and business IT. Sheridan earned her BA at Villanova University. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/trump-suggests-then-pulls-back-on-joint-russian-cybersecurity-unit/d/d-id/1329318?_mc=RSS_DR_EDT

Internet of Things devices are security-challenged enough, but they’re also being massively exposed on the public Internet – this time via MQTT communications, a researcher will show at Black Hat USA.

An oft-forgotten 90s-era communications protocol now becoming prevalent in the Internet of Things realm can easily be manipulated via the public Internet to snoop on and even sabotage power plant equipment, ATM machines, and other connected devices.

Security researcher Lucas Lundgren via an Internet scan last year found around 65,000 IoT servers using the Message Queuing Telemetry Transport (MQTT) worldwide on the public Internet wide open to attack with no authentication nor encrypted communication, findings he revealed last August at DEF CON. Later this month at Black Hat USA in Las Vegas, Lundgren plans to demonstrate how an attacker could compromise exposed MQTT-based servers and issue phony commands in order to alter their operation or outcomes of their IoT-attached equipment.

Lundgren also will release a brute-force hacking tool during his Black Hat session Taking Over the World Through MQTT – Aftermath. The tool, which was written by a friend of Lundgren’s, raises the stakes and cracks MQTT servers that actually employ recommended username and password protection. According to Lundgren, of the tens of thousands he first scanned, just two at the time were protected with authentication, and he was able to access many of them by subscribing to their so-called hashtag feeds that are basically their communications channels.

MQTT is a lightweight, machine-to-machine messaging protocol created in 1999 as a way for low-bandwidth communication such as satellite, and since has emerged as a staple for IoT devices that require infrequent or intermittent Internet access.

Lundgren struck oil – nearly literally in one case where he spotted an oil pipeline server in the Middle East that was exposed online – after finding an open port on a server last year that led to his ultimate, massive discovery of tens of thousands of open MQTT servers – including airplane coordinates, prison door controls, connected cars, electricity meters, medical devices, mobile phones, and home automation systems. He was able to read in plain text the data sent back and forth between those IoT devices and their servers.

“We could see prison doors open and close,” says Lundgren, a researcher with IOActive.

The unauthenticated, exposed MQTT servers also are vulnerable to server-side attacks, such as cross-site scripting and SQL injection, that then can allow an attacker to inject his or her own nefarious messages to the IoT devices, Lundgren says. “I can write to those [message] brokers and could alter their data,” he says, such as overriding sensors on a radiation monitor in a nuclear plant, for example, he says.

Among his findings was an exposed MQ Web-based IoT demonstration of connected cars by IBM, he says. Lundgren says user-controlled data there isn’t properly “sanitized,” so an attacker could send phony messages from the connected cars or anyone viewing the demo. IBM as of this posting was investigating the issue.

In another find, Lundgren was able to send commands to an exposed MQTT server sitting inside a major technology vendor’s network. “It allowed me to send raw commands into a server” there, he says, declining to name the vendor at this time.

Another danger with MQTT servers: they often are used for firmware updates in IoT, so an attacker could rig a firmware update with malicious code, for example.

So how does the MQTT exposure differ from all of the other IoT vulnerabilities and weaknesses constantly being unearthed? “This one is so simple. It’s right in front of you,” he says.

The Middle East oil pipeline server he spotted exposed its oil flow as well as usernames and passwords to the PLC devices. You wouldn’t need Stuxnet or any sophisticated malware to reroute the flow of oil in the pipeline or other industrial systems exposed via weakly configured MQTT servers, he notes. 

“You just need freeware tools to connect to it and you can send and manipulate data,” says Lundgren, who plans to reveal more findings at Black Hat.

Related Content:

• IoT Physical Attack Exploit to be Revealed at Black Hat
• Black Hat Survey: Security Pros Expect Major Breaches in Next Two Years
• Hacking Factory Robot Arms for Sabotage, Fun Profit
• 8 Hot Hacking Tools to Come out of Black Hat USA

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/cloud/iot-devices-plagued-by-lesser-known-security-hole-/d/d-id/1329320?_mc=RSS_DR_EDT

To say the healthcare systems are facing information security challenges would be an understatement, as personal identifying information (PII) and protected health information (PHI) being handled in an inappropriate manner or lost via a breach are daily occurrences. Therefore, when we read the words “health care” and “IT” in a sentence together far too often there is bad news which follows, here’s a bit of good news.

The US Department of Health and Human Services, which manages the Health Information Privacy Accessibility Act (HIPAA) announced the winners of its Move Health Data Forward Challenge, two start-ups, Live and Leave Well and Docket. Each received US$50,000 for winning and US$25,000 for passing through the first two rounds, for a total of US$75,000

What is this HHS challenge?

The challenge was to “Implement an application programming interface (API) solution that enables individuals to securely and electronically authorize the movement of their health data to destinations they choose.” As the focus is the healthcare sector, and the applications would be processing both PII and PHI, integration of security and privacy processes was identified early as a prerequisite.

The contestants were directed to implement their privacy and security solutions in accordance with the OpenID Heart Working Group. Both winners implemented the guidance into their solutions. Docket’s implementation of SSL certs on their website was as expected – fully implemented. Unfortunately, such was not the case for Live and Leave Well which, apparently, has not yet implemented SSL into its website, somewhat disappointing given it is a “secure application”.

What’s in it for the patients?

Live and Leave Well focuses on preparing for the end of life. Patients create a single data store to hold the documents you might need, such as a Do Not Resuscitate directive (DNR) or medical power of attorney. Patients – or their proxy – can then share the documents when they’re needed, and, perhaps most importantly, the app ensures the nuances of each state’s laws and forms are used.

Docket aims to be a comprehensive archive of your PII and PHI that can be shared as the user chooses with  medical providers, family, lawyers, etc. The application puts the information under patient control and should remove the need to fill out mountains of forms every time a new medical provider is encountered. It also collates patient medical history and insurance information.

Docket also offers medication alerts and integration with medical devices  as well as reminders of appointments, secure patient messaging and sharing of information.

Putting the patient in control of how and with whom their medical information is provided is key. As we see, with ever increasing frequency, our providers share our information with us and each other via a myriad of methodologies, some authorized and many not, to include some that make us smack our heads on the table – Snapchat for example.

These are indeed bright spots for those of us mired in the administrative quagmire when it comes to accessing our own medical information, let alone sharing it with others. Capturing control of our own data can’t come too soon.

Follow @NakedSecurity
Follow @burgessct

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/6HPkYAtt0CY/

The US Federal Trade Commission (FTC) has shut down a company that lured consumers into filling out applications for loans that it said would be issued from “trusted lending partners” at the “lowest interest rates” in a secure, safe manner.

The reality alleged by the FTC in its complaint (PDF): Blue Global Media LLC sold those applications – including consumers’ sensitive data – to “virtually anyone willing to pay for the leads,” be they actually loan sellers or who the hell knows what.

Nor did the company check that the buyers were securing the data. Ditto for its failure to follow up on consumers’ complaints that their personally identifiable information (PII) had been subsequently abused.

The FTC also imposed a judgment of $104.5m. That won’t be much of a consolation to the consumers who got snookered, though. Blue Media is bankrupt.

Between December 2012 and January 2017, the company, and its CEO, Christopher Kay, ran what the FTC says are at least 38 sites that solicited loan applications.  The names of those domains would make you think that Blue Global had a cloud of fairies sprinkling cash on demand: they included 100dayloans.com, 1houradvance.com, 1hourdirect.com, 1hourlend.com, 1hourpersonalloan.com, 247loan.com, 24sevenloan.com, 3clickloan.com, littlepayday.com, magicinstallmentloans.com, money411.com, moneynowusa.com, moneytoday.com, and moomoocash.com, among others.

As the FTC tells it, Blue Global wasn’t actually a lender. Rather, it just collected loan applications, electronically transmitted the applications to other entities, and sold the rights to use the information as sales leads.

Consumers would very likely get a loan if they filled out an application, Blue Global insinuated. What’s more, whatever data they input into the application was always transmitted in a safe, secure manner, its marketing spiel would have you believe:

Start off by filling out our secure online loan application. After you’ve done that, an advanced search engine uses your information to find the highest loan with the lowest interest rates.
(sevenminuteloans.com/how it works)

NetLoanUSA is America’s LARGEST online personal loan network that connects you to financial loan lenders, nationwide for FREE! START NOW by completing our easy-to-use online application, and once you HIT SUBMIT, we will go to work for you immediately, searching banks, financial companies and cash advance lenders, to find YOUR highest qualified loan amount at the lowest interest rate possible, in UNDER 90 seconds!
(netloanusa.com/home)

In fact, the leads were sold “without regard to loan terms,” and regardless of whether the buyer was in fact a lender, the FTC claims. Chances were good that the organizations manhandling people’s PII were not loan sellers. The FTC claims that, at most, 2% of the application purchasers were actually loan providers. The defendants allegedly sold the applications, and consumers’ sensitive data, to “virtually anyone willing to pay for the leads,” the FTC says.

Nor did Blue Media or its CEO pay attention to how or whether buyers secured the data, the FTC claims. That, in spite of ads that promised fancy state-of-the-art security technologies such as SSL encryption and HTTPS:

Getting a loan online requires the utmost security, privacy and online protection. At RockstarLoan.com, we make all three our top priorities by using industry-leading security protocols and technology. Our SSL encryption services make sure that your personal information is always safe, always secure.
(rockstarloan.com/home)

Our protocols make certain that your personal information is completely protected 24/7 GUARANTEED!
(netloanusa.com/home)

The data the defendants talked consumers into submitting is prime stuff for identity thieves: it included names, addresses, email addresses, phone numbers, birthdates, taxpayer IDs, bank routing and account numbers, driver’s license and state identification numbers, whether and where the consumers were employed, the consumers’ incomes, whether the consumers were in the military, whether the consumers were home owners, whether the consumers had filed for bankruptcy, and the consumers’ approximate credit scores.

Blue Media also allegedly encouraged consumers to allow it to store all their data so that they could quickly create new loan applications. The applications were for a variety of loans: from payday loans in the amount of hundreds of dollars on up to auto loans or personal loans up to $35,000. Blue Media made $200 per lead it managed to sell.

How did it secure the data? Well, it didn’t, the FTC claims.

…they transmitted, passed, or otherwise made consumers’ loan application information available to entities other than “trusted lending partners”. Indeed, Defendants shared consumers’ complete, unredacted loan information with entities that were not engaged in lending, and whose business, use of the leads, and practices for securing sensitive information, were not known to Defendants.

Defendants did not impose any restrictions or conditions to protect against the unauthorized access, use, modification, destruction, or disclosure of consumers’ sensitive personal and financial information when it was placed in the possession of potential buyers or in the possession of entities that received it from Defendants’ potential buyers.

Not only did Blue Media fail to mask consumers’ sensitive financial and personal information when it passed it around to potential buyers, the FTC claims. It also failed to prevent buyers from willy-nilly sharing of the unmasked data with heaven knows what other organizations.

The FTC also accused the company of not taking preventative action or even bothering to investigate after consumers complained that their data had in fact been misused.

The settlement (PDF) includes a $104,470,817 judgment. The FTC said in a press release on Wednesday that payment has been suspended because the defendants are broke.

Blue Global Media filed for bankruptcy protection in January 2017.

Besides the judgment that it can’t pony up, the settlement means that neither the company nor Kay can misrepresent their business and how they handle data in the future. They’ll be required to vet and identify the businesses with whom they sell or share information, and they’ll also be required to get clear consent from consumers before they get their hands on customers’ PII.

From the order:

Defendants shall establish, implement, and maintain procedures to verify the legitimate need for, and monitor the use of, consumers’ Sensitive Personal Information by any Person to whom Defendants sell, transfer, or disclose such information.

Readers, have you been taken for a payday-loan ride? Has it happened to anybody you know? There’s a full list of the 38 Blue Media domains in the FTC’s complaint (PDF).

Please do share your horror stories so others can, hopefully, sidestep similar scumbag sites!

Follow @NakedSecurity
Follow @LisaVaas

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/KfC4Q_Gq-0Q/

If you’re from North America you might not have heard of Sachin Tendulkar, especially since his retirement from the glorious game of cricket, but it’s fair to say that he was rather good at batting.

If you were to combine the run-geting prowess of, say, Barry Bonds, Mark McGwire and Sammy Sosa into one modestly-sized fellow – Tendulkar stands just 165cm tall, or 5’5″, giving him the nickname of Little Master – you would have some sense of how plentifully he could score runs for his team.

Cricket, in case you are unaware, is a sort-of cousin of baseball, but without the ludicrous trousers, and with a more gracefully shaped playing field that allows you to hit the ball in any direction, including sideways or even backwards. The underlying aim of the game is the same: for the batter to hit the ball as far as possible, preferably into the upper tiers of the stadium where a bevy of enthusiastic spectators will trip over each other in a rush to injure their fingers while failing to catch it.

Tendulkar has more – many, many more – Twitter followers than the former baseball batting behemoths mentioned above: 17 million followers, in fact, so when he posts messages, he has huge reach and massive influence, especially in India.

So it’s surprising – perhaps disappointing is the right word – to see that Tendulkar recently tweeted the video of an advert asking you help your friends get fit…

…by giving him their phone numbers.

We’ve all got friends we’re worried about, one way or another, for example because we’d like to convince them to quit smoking, cut down on their drinking or improve their health.

Tendulkar’s tweet was no doubt well-intentioned, albeit commercially motivated: your friends might not take fitness advice from you – and why would they? – but they’d be hard-pressed to ignore a call from the Master Blaster himself!

(Remember: cricket is to India what hockey is to Canada, but much, much more so.)

Surely, getting people to think more about their personal health is a good thing?

So why has that Tweet now disappeared?

The answer is that it is never acceptable to give away other people’s personal information – even if it’s just their names and phone numbers – without their permission.

In an ideal world, therefore, there would be no point in Sachin Tendulkar asking for your friends’ phone numbers, because you wouldn’t give them out in the first place.

What to do?

We urge you to take the following approaches in your digital life:

• Don’t share your own personal information too widely by mistake. Regularly review the privacy settings you use in your apps and on your social media accounts.
• Don’t share information about your friends without asking them first. If an offer is so good you think your friends will like it, tell them about it so they can sign up for themselves. If you take a group photo to put up on Facebook, ask them if they want to be in it even before you snap the picture.
• Don’t rely on opt out when dealing with your customers. Ask them up front, so they get the chance to opt in, even if the law in your country doesn’t strictly require you to work that way.

Simply put, when it comes to personal information: respect it all!

And, by the way, a hat tip to Tendulkar and his social media team for listening to the advice of numerous security experts and removing the Tweet.

Follow @NakedSecurity
Follow @duckblog

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/Wd9IxkoaHbU/

Your daily round-up of some of the other stories in the news

NATO pledges to support Ukraine

Ukraine, which has been the victim of cyber-attacks ranging from those taking out its power stations to being the main victim and likely focus of the Petya outbreak last month, is getting support from NATO to help protect it against further attacks.

Jens Stoltenberg, NATO secretary-general (pictured), told reporters in Kiev on Monday that “we are in the process of providing Ukraine with new equipment to some key government institutions”.

Speaking at the end of his two-day visit to the country along side Petro Poroshenko, Ukraine’s president, Stoltenberg added that the new equipment “would help Ukraine investigate who is behind the different attacks”. Kiev has accused Moscow of being behind the Petya attack, saying it was a co-ordinated attack on the country’s infrastructure.

China cracks down on VPNs

China’s “Great Firewall” is being tightened even further, according to Bloomberg, which reported on Monday that Beijing has told state-run telecoms companies to block access to VPNs by February 1 2018.

China’s biggest telecoms providers are China Mobile, with 860m subscribers, China Unicom, which has 268m customers, and China Telecom, with 227m users, and the order from Beijing means that they would be unable to bypass the “Great Firewall”, which blocks access to a number of western news sites and social media platforms.

The Hong Kong-based South China Morning Post called on Monday for the “Great Firewall” to be torn down, saying in an editorial that won’t go down well in Beijing that “such action … curbs creativity and innovation. That, over time, will be to the nation’s detriment.”

Somalia outage ‘costing $10m a day’

An ongoing internet outage is costing Somalia some $10m a day, according to the Somalian government. The outage, which began more than two weeks ago, happened when an undersea fibre-optic cable was accidentally damaged, apparently by a large ship.

Undersea cables are a critical part of internet infrastructure, carrying a huge proportion of the world’s internet traffic, as Naked Security reported last year. That includes financial settlements, voice and video calls.

Abdi Anshur Hassan, Somalia’s post and telecommunications minister said the incident was “a major disaster” that had cost the country “more than $130m”. He pledged that the service would be fixed “this week”, the BBC reported on Monday.

Catch up with all of today’s stories on Naked Security

Follow @NakedSecurity
Follow @katebevan

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/7Oqq9mAE2Ig/

Today, Black Hat releases its third annual research report entitled, Portrait of an Imminent Cyber Threat. This report is based on survey responses from nearly 600 Black Hat USA attendees – a community populated by the brightest minds in the Information Security Industry, holding critical security roles across multiple industries including government, financial services, healthcare, energy, telecommunications, and utilities.

This year’s research explores issues on a national scale and raises concerns about potential threats to the U.S’s critical infrastructure, tools available for nation state attacks, WikiLeaks and more. Respondents shared thoughts on cyber attacks related to the U.S. elections, the WannaCry ransomware worm and more.

Download a copy of Portrait of an Imminent Cyber Threat for additional findings, actionable insights and more information related to these critical industry trends, here: Download the full report.

Article source: https://www.darkreading.com/black-hat/black-hat-usa-2017---attendee-survey-results/d/d-id/1329306?_mc=RSS_DR_EDT

When people say there’s a security skills gap, this is what they really mean.

Image Source: Adobe Stock

The last several years have seen a slew of reports coming out lamenting the typical enterprise’s ability to recruit and retain quality cybersecurity talent.

Earlier this year, ISACA’s Cybersecurity Nexus survey found that more than one in four organizations take six months or longer to fill priority cybersecurity positions. Respondents to the survey said that 40% of organizations report receiving fewer than five applications for cybersecurity positions. And if things keep going the way they’re already headed, the problem is only going to get worse. According to the 2017 (ISC)2 Global Information Security Workforce Study conducted by Frost Sullivan, by 2022 there will be a global shortfall of cybersecurity workers of 1.8 million people.

At the same time, the pain is not necessarily a singular problem; a lot of the issue comes down to the fact that there aren’t enough candidates with the right combination of specialized skills to fight the security problem at any given moment. It’s a moving target that changes day-by-day.

“There’s definitely a talent shortage of quality information security professionals who are capable of solving emerging problems,” says Lee Kushner, president of cybersecurity recruiting firm LJ Kushner Associates. “It’s not a shortage of general skill or average skill, it’s a shortage of skills that can help companies solve their problems.”

As the industry starts to look at the problem, it’d best start putting a finer point on the types of skills most in demand rather than fixating on one overarching security deficiency.

“The problem is more granular than ‘look at all the open jobs,'” says Mike Viscuso, CTO and co-founder of Carbon Black.

According to the most recent research, the following specialties and skills are the ones that hiring managers are having the hardest time plugging into their teams.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Article source: https://www.darkreading.com/careers-and-people/desperately-seeking-security-6-skills-most-in-demand/d/d-id/1329309?_mc=RSS_DR_EDT

Some 54 members facing charges for targeting US victims.

Two members of a large India-based call center scam operation that targets US victims have pleaded guilty, the Department of Justice (DOJ) announced on Friday.

Bhavesh Patel, 47, of Arizona, plead guilty to money-laundering conspiracy charges, and Asmitaben Patel, 34, of Illinois, plead guilty to conspiracy to commit fraud and money laundering.

The pair are part of an India-based call center scam operation that includes five call centers and 54 other individuals who have already been charged, according to the DOJ. According to authorities, the call center ring would impersonate Internal Revenue Service or US Citizenship and Immigration Services officials and target US victims with threats of deportation, fines, arrest, and imprisonment, unless they wired money or loaded funds onto store valued cards that would be sent to the defendants.

Once the funds were in possession of the call center ring, Patel and other runners would liquidate the stored value cards by buying money orders and depositing them into various bank accounts. Asmitaben Patel was a runner since 2013 and Bhavesh Patel managed the crew of runners beginning in 2014. 

Read more about the case here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/two-members-of-massive-call-center-scam-operation-plead-guilty/d/d-id/1329312?_mc=RSS_DR_EDT