STE WILLIAMS

Data and kids’ voice messages exposed in CloudPets breach

To the 821,296 people who bought one, the CloudPets teddy toys must have seemed like a great way to exchange intimate voice messages with their kids across what used to be called “the internet”.

A CloudPet is simple to use. The parent or child speaks into a microphone inside the toy, which uses a Bluetooth interface to upload the recording to cloud storage via an Android or iOS smartphone app tied to an account. Recipients download and listen to the message on a second CloudPets toy.

But in a new nadir for the gimmick of sticking the Internet of Things (IoT) inside toys, something went badly wrong with security.

Researcher Tory Hunt was recently told that databases containing all of the user accounts and potentially up to 2.2m voice messages had been compromised by hackers who found them in an unprotected state around Christmas using nothing more complicated than the Shodan IoT search engine.

Worse, numerous people accessed the exposed databases, some of whom had demanded a ransom from the parent company after deleting them in a manner identical to a spate of recent attacks on MongoDB installations.

The databases lacked authentication although account profiles were at least protected with passwords hashed using Bcrypt, a secure algorithm.

But, as Hunt discovered after pitting them against Hashcat, the lack of password rules rendered this ineffective with”qwerty”, “password”, “123456”, “qwe and “cloudpets” matching large numbers of the hashes. This makes all recordings vulnerable.

We’ve been here before. In late 2015, toy maker VTech suffered a massive data breach, again involving data gathered from a children’s device and made public by Hunt. Hot on its heels came hackable Barbie, while only days ago Germany’s telecommunications watchdog branded the Cayla doll as a surveillance device on account of poor security.

Troy Hunt describes this kinder-dystopia in the making:

It only takes one little mistake on behalf of the data custodian – such as misconfiguring the database security – and every single piece of data they hold on you and your family can be in the public domain in mere minutes.

In a double helping of bad, the researcher who first told Hunt of the breach had attempted to warn CloudPets about the issue of three occasions but without response. A second researcher also tried to contact CloudPets as early as December 30, also without success.

It’s perhaps not a surprise that CloudPets was hard to contact given that its systems appear to have been stitched together for convenience from parts run by different entities.

Naked Security’s advice for CloudPets users who want to continue using the toys is to immediately change their password to something secure.

If there’s a moral it’s that parents should stop buying connected toys from any company until some standards develop and attitudes to security change. A

At the very least, companies should be able to point to a responsible disclosure system so researchers have a way of communicating any vulnerabilities they find. Right now, few seem to have such systems and are therefore not deserving of trust, a sentiment some would extend to almost all IoT.

As we like to say on Naked Security for many things, “If in doubt, don’t give it out.”


 

 

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/X-KwYsha3JA/

  • 28/02/2017
  • adm

Security slip-ups in 1Password and other password managers ‘extremely worrying’

Password management applications, recommended by many security experts as the only viable way to deal with large sets of passwords that are unique and sufficiently complex, introduce their own set of problems – namely the general fallibility of software.

A group of security researchers called TeamSIK from the Fraunhofer Institute for Secure Information Technology (SIT) in Darmstadt, Germany, on Tuesday published its security assessment of nine popular password management applications on Android devices and found them all wanting.

“The overall results were extremely worrying and revealed that password manager applications, despite their claims, do not provide enough protection mechanisms for the stored passwords and credentials,” the group said. “Instead, they abuse the users’ confidence and expose them to high risks.”

TeamSIK looked at My Passwords, Informaticore Password Manager, LastPass, Keeper, F-Secure KEY, Dashlane, Hide Pictures Keep Safe Vault, Avast Passwords, and 1Password.

In each application, the group identified one or more security vulnerabilities, all of which were reported to app makers and were fixed prior to the publication of the group’s findings. Among the better-known password managers, fix times are respectable – a week to a month in most cases. In other words, the bugs disclosed today have been fixed. Make sure you’re patched, because now hackers have all the information they need to exploit vulnerable versions of the software.

The flaws identified were sometimes serious, such as storing the master password entered by the user in plaintext or using hard-coded crypto-keys in application code. In other cases, design flaws allowed the researchers to extract supposedly secure credentials using a third-party app.

The researchers observe that many of the apps fail to account for the possibility of clipboard sniffing, which may be done to capture credentials that have been copied into memory in order to paste them into a password entry interface.

Complicating the vulnerability picture, many of these apps implement convenience features that affect app security. For example, some of the apps include a built-in web browser, which expands the scope of possible flaws. Also, the researchers found auto-fill functions in applications could be used to capture stored secrets through “hidden phishing” attacks.

Here’s a rundown of the problems found and disclosed today by the team:

MyPasswords

Informaticore Password Manager

  • SIK-2016-021: Insecure Credential Storage in Mirsoft Password Manager

LastPass Password Manager

  • SIK-2016-022: Hardcoded Master Key in LastPass Password Manager
  • SIK-2016-023: Privacy, Data leakage in LastPass Browser Search
  • SIK-2016-024: Read Private Date (Stored Masterpassword) from LastPass Password Manager

Keeper Passwort-Manager

  • SIK-2016-025: Keeper Password Manager Security Question Bypass
  • SIK-2016-026: Keeper Password Manager Data Injection without Master Password

F-Secure KEY Password Manager

  • SIK-2016-027: F-Secure KEY Password Manager Insecure Credential Storage

Dashlane Password Manager

  • SIK-2016-028: Read Private Data From App Folder in Dashlane Password Manager
  • SIK-2016-029: Google Search Information Leakage in Dashlane Password Manager Browser
  • SIK-2016-030: Residue Attack Extracting Masterpassword From Dashlane Password Manager
  • SIK-2016-031: Subdomain Password Leakage in Internal Dashlane Password Manager Browser

Hide Pictures Keep Safe Vault

Avast Passwords

  • SIK-2016-033: App Password Stealing from Avast Password Manager
  • SIK-2016-035: Insecure Default URLs for Popular Sites in Avast Password Manager
  • SIK-2016-037: Broken Secure Communication Implementation in Avast Password Manager

1Password – Password Manager

  • SIK-2016-038: Subdomain Password Leakage in 1Password Internal Browser
  • SIK-2016-039: Https downgrade to http URL by default in 1Password Internal Browser
  • SIK-2016-040: Titles and URLs Not Encrypted in 1Password Database
  • SIK-2016-041: Read Private Data From App Folder in 1Password Manager
  • SIK-2016-042: Privacy Issue, Information Leaked to Vendor 1Password Manager

This is not to say that password management applications add more risk than they remove; rather, those using these apps must make maintaining them a priority in order to keep them secure. And if you do that, you’re sorted.

“Since all vendors fixed their security issues, our advice to the customers is to always update their apps,” said Siegfried Rasthofer, a malware researcher at Fraunhofer SIT, in an email to The Register. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/28/flaws_in_password_management_apps/

  • 28/02/2017
  • adm

Mac Malware Reaches New Highs

What’s This?

Two new malware threats in a week this past month, plus others in January, brings the 2017 Mac malware count up to 6 – and growing.

On Valentine’s Day, Mac users got a special “treat” in the form of new malware. That same week, there were signs of yet another piece of malware looming. These threats were overshadowed a bit by the discovery last week of the second ransomware app to ever appear on the Mac, but they’re still worthy of consideration.

The first malware, named XAgent, was analyzed by Palo Alto Networks. XAgent, it turns out, is related to the Komplex malware discovered by Palo Alto last year, as can be seen by comparing some of the strings to those found in Komplex.

Source: Malwarebyte Labs

At that time, Palo Alto tied Komplex to the Sofacy Group – aka Fancy Bear and APT28, among others – which is a Russian hacking organization that has since been linked to attacks including the hack of the Democratic National Convention.

XAgent is a backdoor that provides a number of powerful remote access features, including keylogging, screenshots, remote shell access, and file exfiltration. Of particular interest is a command that provides the hacker with information about iOS backups stored on the infected Mac. iPhones (and other iOS devices) are notoriously difficult to hack, but by targeting backups instead, this malware could access potentially sensitive iPhone data.

Interestingly, Patrick Wardle, director of research at Synack, had another interesting revelation about this malware. He shows quite convincingly in a blog post that the Sofacy Group used code copied from the Hacking Team. (Hacking Team is the creator of the Remote Control System backdoor, which it sells to governments and law enforcement, among other organizations.)

Hacking Team was itself the victim of a hack in 2015, and all their source code was made public. Wardle was able to demonstrate key similarities, such as identical bugs, in the decompiled XAgent code and the leaked Hacking Team code. It appears that Sofacy used Hacking Team code in their malware, most likely obtained from the Hacking Team breach.

According to a whitepaper released by Bitdefender, the malware installs itself into the following folder, where it is given one of a set of hard-coded names:

~/Library/Assistants/.local/

At the time of its discovery, the XAgent command control servers were down, meaning that this variant of the malware is no longer a threat.

On the heels of the XAgent discovery came an intriguing glance at another piece of Mac malware, a sample of which has not yet been found. Three days after Palo Alto released its analysis of XAgent, Apple released an update to XProtect – the built-in anti-malware software in macOS – that added detection of XAgent.

However, that update also included a signature for something Apple called OSX.Proton.A, which ignited a storm of questions in the security community, which had never heard of any such malware for the Mac.

A little digging by Arnaud Abbati, a researcher at Ninja, Inc., turned up a page from the Sixgill website with a terse description of a remote access tool (RAT) called Proton. The page has been taken down, but can still be found in Google’s cache here.

Apparently, the malware is being sold on a Russian cybercrime forum, among other places. Sixgill also provided a link to a YouTube video from December, apparently made to promote the malware by demonstrating its capabilities. Another YouTube video, posted on February 8, showed additional capabilities.

Unfortunately, thus far, no samples of the malware have been found. It does not appear to be in the VirusTotal database, and neither of the two sites that appear to be associated with Proton (ptn[dot]is or protonsolutions[dot]net) are responding. Even Sixgill’s analysis seemed to be done entirely from online sources, and had no information to suggest that they had seen a copy of the malware. For now, this is a completely unknown threat with rather frightening apparent capabilities.

Two new malware threats in a week, added to the others previously seen this year (Quimitchin/Fruitfly, MacDownloader, a new class of Microsoft Office macro malware and the Findzip ransomware), brings the Mac malware count for 2017 up to 6, and February isn’t even over yet.

If things continue at this rate, 2017 could see a spike in Mac malware that could rival or exceed the previous high point in 2012, when the infamous Flashback, and a number of other pieces of malware taking advantage of Java vulnerabilities, terrorized the Mac community.

Click to discover more breaking news at Malwarebytes Labs

Thomas Reed is a self-trained developer and Apple security expert, and is director of Mac offerings at Malwarebytes. View Full Bio

Article source: http://www.darkreading.com/partner-perspectives/malwarebytes/mac-malware-reaches-new-highs/a/d-id/1328274?_mc=RSS_DR_EDT

  • 28/02/2017
  • adm

How Security Pros Can Bridge The Skills Shortage

By paying it forward, we can help address the industry’s exploding need for talent.

If you feel like you’re overworked and that your security department is short-staffed, you’re probably not imagining it. Two reports were released recently, with less-than-encouraging statistics about the growing security skills shortage. Is there anything we can do to stem the tide?

More on Security Live at Interop ITX

ISACA’s Current Trends in Workforce Development sheds light on the problems companies are having staffing open positions. More than a quarter of enterprises find they are unable to hire the people they need, and those that are able to fill positions report that it takes more than six months to find the right applicant for the job. Almost half of those surveyed said they got fewer than ten applicants for each job listing and 64% of respondents said that not even half of those who applied were qualified for the position.

This means that there is a huge unmet need, which is causing a serious problem for businesses. In a recent study by Dimensional Research and Tripwire, only ten percent of organizations have the skills to address the full range of the most prevalent threats. Even when singling out ransomware – the threat that most organizations reported to be their biggest concern –  only 44% of respondents said they had the skills in house needed to handle the problem.

The obvious answer to the skills shortfall is to increase both the quantity and quality of applicants. But with few schools offering computer science at the K-12 level, many students are unaware of information security as a career option. Those who start computer science studies at the college level often feel discouraged, as the learning curve is steep, especially compared to peers who have had earlier learning opportunities.

Still, there are a lot of options out there where we as security professionals can help bridge the gap.

Pay It Forward: Volunteer!
While encouraging overworked people to volunteer may seem counterproductive, getting kids interested in computers and security can be a fantastic antidote to burnout. There are a lot of national groups such as TEALS, Girls Who Code, Women’s Society of Cyberjutsu, and CoderDojo as well as local STEM events, hackathons and bootcamps that are in need of expert support.

Show Them the Money: Scholarships
The cost of formal education is growing at a rapid pace, which keeps interested people from getting the skills they need to join this industry. The good news is that there are a lot of scholarships that have been set up to encourage people to pursue an education in security. Several sites, such as (ISC)², CyberWatchWest and WiCYS maintain lists of resources for students seeking scholarships and internships. Security companies’ and schools’ websites also may also offer information on additional financial resources. The second annual “ESET Women in Cybersecurity Scholarship,” will be taking applications through March 15th.

Uncover Untapped Resources: Diversity
A lot has been said about the lack of diversity in the security industry. While this is problematic, it’s also represents a huge opportunity, as it points to an untapped resource for attracting new talent. National groups like Code2040 and Black Girls Code are helping to cultivate the next generation of developers.

The ISACA report highlights another source of potential new hires that the industry may be overlooking: people who have neither formal education nor professional certifications in security. If someone has other important skills for the job at hand and technical aptitude or interest in security, but lacks more traditional qualifications, they may be automatically weeded out.

Some of the brightest people that I’ve known in the security industry came to it as a departure from a very different career path. People seem to have forgotten that not all security positions require a graduate degree in computer science, and that the necessary experience can be gained on the job. By making significant changes now, we can avoid the projected shortfall of 1.8 million professionals in 2022.

Related Content:

Lysa Myers began her tenure in malware research labs in the weeks before the Melissa virus outbreak in 1999. She has watched both the malware landscape and the security technologies used to prevent threats from growing and changing dramatically. Because keeping up with all … View Full Bio

Article source: http://www.darkreading.com/how-security-pros-can-bridge-the-skills-shortage/a/d-id/1328276?_mc=RSS_DR_EDT

  • 28/02/2017
  • adm

Report: Only 2 in 3 Cyber Attacks Can Be Stopped with Current Defenses

What’s This?

A recent Bitdefender survey of 250 US IT execs in companies with 1000 or more PCs paints a disturbing picture of cybersecurity preparedness in the enterprise.

Only 64% of cyber attacks can be stopped, detected or prevented with the current resources, on average, according to a Bitdefender survey  of 250 IT decision makers at companies in the US with more than 1,000 PCs.

Bitdefender’s survey shows that 64% of IT decision makers think their IT security budget is sufficient, 2% say the budget is enough, but they are understaffed, and 7% percent say funding is sufficient but can’t accommodate future expansion. Only 3% of IT decision makers surveyed said the security budget in their company is insufficient.

Less than 20% of IT decision makers say they could stop more than 90% of cyberattacks, while another 20% say they could detect and prevent less than a quarter.

Image Source: Bitdefender

Bitdefender’s survey shows 34% of respondent companies were breached in the past 12 months, with 74% reporting they don’t know how their company was breached. As a result, some 73% of IT decision makers fear a breach would force their companies to pay financial compensation, while 66% fear losing their jobs.

Cloud Spending Up

Cloud security spending at 48% of respondent companies increased in the past year while spending for other security activities remained the same, Bitdefender’s survey shows. While almost two-thirds of IT decision makers say their security budget is sufficient, the rest would need an increase of 34% percent, on average, to deliver efficient IT security policies. This is mainly because migrating information from traditional data centers to a cloud infrastructure has significantly increased companies’ attackable surface, bringing new threats and more worries to CIO offices about the safety of their data.

For example, cybercriminals can spend large amounts of time inside organizations without being detected. Advanced persistent threats, or APTs, for instance, are often defined as threats designed to evade detection. In the virtualization paradigm, since nothing being executed in raw memory is encrypted – just scrambled – APTs that try to execute malicious code on a virtual machine can be intercepted by Bitdefender’s Hypervisor Introspection technology long before they actually compromise the operating system. In fact, as soon as the malicious code –  even delivered via a zero-day exploit –  tries to execute in the VM’s memory, the introspection engine will immediately “see” the malicious action and the code that was trying to execute.

This survey was conducted in October 2016 by iSense Solutions for Bitdefender on 250 IT security purchase professionals (CIOs/CEOs/ CISOs, 26%; IT managers/directors, 56%;  IT system administrators, 10%; IT support specialists, 5%) and othersfrom enterprises with 1,000+ PCs based in the United States.

Razvan, a security specialist at Bitdefender, is passionate about supporting SMEs in building communities and exchanging knowledge on entrepreneurship. A former business journalist, he enjoys taking innovative approaches to hot topics and believes that the massive amount of … View Full Bio

Article source: http://www.darkreading.com/partner-perspectives/bitdefender/report-only-2-in-3-cyber-attacks-can-be-stopped-with-current-defenses/a/d-id/1328283?_mc=RSS_DR_EDT

  • 28/02/2017
  • adm

MWC: BlackBerry misses a chance to tell a compelling security story

Naked Security is reporting this week from Mobile World Congress in Barcelona

Two of the most notable devices at Mobile World Congress thus far have been from venerable old names: Nokia on Sunday rebirthed the iconic 3310, and on Saturday, BlackBerry unveiled its new flagship device, the KeyOne, which is expected to become available in April.

The KeyOne is made by Chinese vendor TCL under its licensing agreement with BlackBerry, and at first glance it’s not that bad. An unusually long device with a physical keyboard, it resembles a curious hybrid of iPhone and old-style BlackBerry, Particularly from the side, its aluminium frame and Apple style buttons will be familiar to iPhone users, while the keyboard is classic BlackBerry, if a little cramped.

So, yes, it’s nice enough, if you like that kind of thing, though I’m not sure that I do. As a former BlackBerry fan, I now find physical keyboards somewhat clunky and limiting. I doubt I’m alone in that.

And, as many reviews have already pointed out, it’s essentially a mid-range phone at a fairly premium price ($549, €599, £499). The KeyOne’s aluminum build and soft touch back are clearly a step up from many previous BlackBerry flagships, and the programmable keys are a nice touch. But apart from the 3505mAh battery, what’s inside is somewhat unimpressive, with its 2.0GHz Snapdragon 625 SoC, 3GB of RAM and 32GB of storage.

Perhaps the biggest disappointment, though, is the lack of a more compelling security story. Given that consumer concerns about security have never been higher, and that BlackBerry retains strong associations still with this area, the fact that this issue was presented as something of a secondary characteristic surely represents a missed opportunity.

KeyOne comes with the BlackBerry DTEK security suite, which is designed to continuously monitor and protect the OS, informing users when privacy could be compromised. It will also receive Android’s monthly security updates. But the company’s emphasis on security was probably indicated by its lowly place in the presentation’s running order, coming as it did towards the end.

So while KeyOne goes some way to dealing with the threats out there, which of course now encompasses mobile, Blackberry’s emphasis on security doesn’t go nearly far enough given the endless stream of new vulnerabilities and malware categories being identified, and the severity and sophistication of attacks. This is a shame.

Incidentally, the event was repeatedly billed by Blackberry as “an 18-plus event”, which led perhaps to a slightly higher level of anticipation among attendees than that generated by the launch itself. Having experienced the event, which consisted largely of a succession of the usual sub-Steve Jobs, dressed-down executive presentations, followed by a very crowded device hands-on experience, I never did find out the reason for the age restriction… perhaps I left too soon?


 

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/tkLCRJoU5CQ/

  • 28/02/2017
  • adm

Fears over net neutrality as FCC rules on disclosure eased

This is the way net neutrality ends / Not with a bang but a whimper.

With apologies to TS Eliot, we report on the US Federal Communications Commission’s (FCC) ruling to exempt internet service providers with fewer than 250,000 subscribers from having to tell you how they “play favorites” with the data you stream or download.

It’s been three years since net neutrality was a cause célèbre, so the debate is worth a quick review. (Feel free to skip the next paragraph if you haven’t forgotten.)

We’ll draw on The Internet Society’s measured explanation:

Some commentators worry that network operators [can] give preferred treatment to certain data streams. Others are concerned that practices meant to increase revenues might block competing content or give unfair advantage to some content over others. They see these practices as problematic, especially when the practices intentionally discriminate against certain kinds of content delivery… [jeopardizing] the open and transparent principles of the Internet.

In other words, some ideas might be disadvantaged through slow delivery, just because the folks with those ideas couldn’t or wouldn’t pay an ISP to speed them to you.

In 2014, according to Public Knowledge, more than 4m public comments were sent to the FCC in support of treating all traffic equally, aka “net neutrality”. After lengthy debate, the Obama-era FCC agreed. Free-market conservative Ajit Pai, then in the minority, issued a scathing 67-page dissent, arguing that net neutrality responded to “anecdote, hypothesis, and hysteria… not just a solution in search of a problem—it’s a government solution that creates a real-world problem.”

That was then. But Obama was last seen kitesurfing with Richard Branson. Donald Trump’s the new sheriff, and he’s already named Pai to head the FCC.

Pai recently observed that “the regulatory underbrush at the FCC is thick. We need to fire up the weed whacker…” With his new 2-1 Republican majority, he’s already whacking overtime. A few weeks ago, he halted all investigations into the practice of zero-rating certain content so that it wouldn’t count against customer data limits. (That sure sounds like a violation of strict net neutrality, but plenty of consumers love it.)

Step #2 came this week. As TechCrunch reports, very small service providers were already exempt from requirements to tell customers about actions such as “soft” data caps, such as slowing your downloads once you pass a certain usage threshold. Now, ISPs with up to 250,000 customers needn’t tell you what they’re up to.

Here’s Pai’s brief statement (only available in Microsoft Word so far). And here’s the somewhat lengthier dissent (also in Word) from lonely Democratic commissioner Mignon L Clyburn. She notes that some of the newly exempted ISPs are billion-dollar businesses, and that the paperwork associated with compliance would’ve taken them less than seven hours to complete.

As TechCrunch notes, only 17 more companies are added to the “exempted” list by this order – but it’s clearly the “prelude to larger rollbacks”. Pai himself told a happy industry: “We will seek to revisit… the Title II Net Neutrality proceeding more broadly, as soon as possible.”

Public Knowledge has announced its opposition to the FCC’s new order. But few of the other organizations that originally built the massive outcry for net neutrality have brought the same passion and organizing commitment to defending it. So don’t expect it to last long.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/21VkZQ4kR1A/

  • 28/02/2017
  • adm

Health firm gets £200k slap after IVF patients’ data leaks online

A private health firm has been fined £200,000 after fertility patients’ confidential conversations leaked online.

The £200,000 monetary penalty was levied following an Information Commissioner’s Office (ICO) investigation into the way the Lister Hospital was transferring, transcribing and storing recordings of IVF appointments.

Problems were discovered in April 2015 after a patient discovered that transcripts from interviews recorded with Lister Hospital IVF patients could be freely accessed by searching online.

A subsequent investigation by data privacy watchdogs revealed the hospital had been routinely sending unencrypted audio recordings of the interviews by email to a company in India since at least 2009, six years prior to the probe. Private conversations between doctors and various hospital patients wishing to undertake fertility treatment were transcribed in India and then sent back to the hospital.

Worse yet, the Indian firm stored audio files and transcripts on an insecure server, leaving the confidential data accessible to world+dog.

HCA International breached the Data Protection Act 1998 by failing to ensure that their sub-contractor acted responsibly, earning them a heavy fine along with a public rebuke from the ICO.

Head of ICO enforcement Steve Eckersley said: “The reputation of the medical profession is built on trust. HCA International has not only broken the law, it has betrayed the trust of its patients.

“These people were discussing intimate details about fertility and treatment options and certainly didn’t expect this information to be placed online. The hospital had a duty to keep the information secure. Once information is online it can be accessed by anyone and could have caused even more distress to people who were already going through a difficult time,” he added.

HCA International already had appropriate safeguards in place in other areas of its business. “The situation could have been avoided entirely if HCA International had taken the time to check up on the methods used by the contract company,” Eckersley concluded.

The General Data Protection Regulation (GDPR), the new data protection law coming into force in the UK in May 2018, will strengthen the ICO’s powers to fine companies. Fines of up to four per cent of a company’s global turnover could be issued where a serious breach of data protection law has occurred. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2017/02/28/health_firm_fined_over_data_leak/

  • 28/02/2017
  • adm

Today on Dark Reading: Your Costs, Risks & Metrics Questions Answered

First up on the Dark Reading upcoming events calendar is our Dark Reading Virtual Event Tuesday, Feb. 28.

It’s almost here! TODAY, Tuesday, Feb. 28, beginning at 11:00 a.m. Eastern Time, we’ll host our next Dark Reading Virtual Event and devote the day to tackling Cybersecurity: Costs, Risks, and Benefits. 

Afraid you might have forgotten a few expensive items when estimating the costs of a data breach? Need more satisfying answers to the “are we secure” question? About to invest in cyber insurance and want to find the potential holes in your policy before it’s time to file that first claim? Need to make a business case for increasing your budget, but need better ways to measure performance first? 

Then this is the event for you. Experts from the Verizon Global Investigative Response Team, Deloitte Cyber Risk Services, Forrester, Optiv, Advisen, CenturyLink, RiskLens, and more will guide you to answers for your most pressing security management questions.

 IN CASE YOU MISSED IT

Check out these webinars you might have missed over the last week:

COMING SOON

Wednesday, March 15, Building a Cybersecurity Architecture to Combat Today’s Risks: “Layered defense” has traditionally been the modus operandi of IT security, but this approach can’t be counted on to stand up to today’s threats and attacks. In addition, attack surfaces are growing every day as companies adopt technologies like cloud and the Internet of Things. So how can you combat today’s risks? Christie Terrill, partner at BishopFox, will provide some answers.

Thursday, March 16, Becoming a Threat Hunter in Your Enterprise: You’re tired of waiting. Tired of waiting for your technology to alert you that there’s already a problem. You want to be more proactive, sink your hands into those threat intelligence feeds, dig into those behavioral analytics reports, follow one clue after another after another, until it leads you to a would-be attacker, before they finish carrying out their grand plan. What you want is to be a threat hunter. Learn how, and what a formal threat hunting program looks like, from John Sawyer, senior security analyst of InGuardians and Chris Pace, technology advocate, EMEA of Recorded Future.

DOWN THE ROAD

More on Security Live at Interop ITX

Interop ITX is coming to the MGM Grand in Las Vegas May 15-19. The conference program is overflowing with security sessions this year. Plus, the Dark Reading team will be back with the Cybersecurity Summit – a two-day crash course that will bring security teams, from newbies to time-crunched pros, up to speed. 

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/risk/today-on-dark-reading-your-costs-risks-and-metrics-questions-answered/a/d-id/1328271?_mc=RSS_DR_EDT

  • 28/02/2017
  • adm

Apparel, Food Delivery Hardest Hit by Online Fraud Attacks

New Forter-Merchant Research Council report confirms that EMV chips have moved fraudsters away from point-of-sale to online.

The anticipated shift of retail cybercrime to ecommerce in the wake of the EMV point-of-sale adoption has officially begun, with the online fraud attack rate increasing by 8.9% in 2016, a new study shows. 

Attacks against apparel companies rose 69.9% in 2016 and attacks against food delivery companies jumped 49.8%, compared with the year before, according to the research released today by Forter in conjunction with the Merchant Research Council.

Domestic orders have also shown a notable rise in fraud attack rate, becoming 79% riskier than they were in 2015. This has had a direct impact on the bottom line risk, resulting in a shift from $2.70 at risk per $100 of sales in Q4 2015, to $4.98 in Q4 2016.

The study collected data on the attack rate, aggregated by yearly quarters. The researchers define the attack rate as the average dollars at risk out of every $100 of sales.

“Now that the fraudsters have been pushed online, it’s much tougher to steal high-priced goods like jewelry or Rolex watches,” says Michael Reitblat, CEO at Forter, a fraud detection firm. “In the past they would have gone for luxury items, but now it’s easier to attack smaller, cheaper items like apparel.”

Reitblat adds that the same principle holds true with the increased cybercrime in the food delivery sector, especially now that the fraudsters have access to service-based tools that make it easier for them to use one stolen credit card to set up fraudulent websites that can steal hundreds of orders.

“What they do is use a stolen credit card to set up a fake account on a website or Facebook account,” Reitblat explains. “Then they will use that stolen credit card for other, high-volume fraudulent transactions. So they’ll set themselves as a third party to GrubHub, for example, take your money and still won’t pay GrubHub.”

While it’s true that fraudulent activity has moved online, the shift is still in its early stages, notes Randy Vanderhoof, director of the U.S. Payments Forum.

“I think it will be really interesting to see what the numbers are in another two years once transition to EMV chips has been fully implemented,” Vanderhoof says. “I think that the retailers that do business both in physical stores and online need to be careful. They need an integrated fraud security strategy and can’t let their guard down in their physical stores.”

Forter’s Reitblat says retailers must continue to invest in security technology such as behavioral analytics to track fraud before it happens. He also thinks retailers will deploy two-factor authentication and use biometrics as the technology becomes more mature. 

“We’re also working with a lot of retailers to share fraud data with us so if we see a new attack method, we can warn the retailers,” Reitblat says. 

Related Content:

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/apparel-food-delivery-hardest-hit-by-online-fraud-attacks/d/d-id/1328278?_mc=RSS_DR_EDT

  • 28/02/2017
  • adm