hacking – Page 360 – STE WILLIAMS

Pharma-testing biz Eurofins Scientific says it fell victim to ‘new version’ of malware

library
crime | hacking | security

Bio-analytical testing biz Eurofins Scientific today admitted it was the subject of a ransomware attack at the weekend.

The Paris Stock Exchange-listed group operates in food, environmental, pharmaceutical and cosmetics product testing. It has 800 labs spread across 47 countries.

The company said in a statement that its tech security team had detected the malware.

Upon detection of the issues, according to our incident management procedures, many systems and servers were taken off line by the group’s IT teams to contain the activity of this new version of malware.

Chinese software nasty enslaves stadium-load of servers, puts them to work digging up digital dosh in crypto-mines

Resident techies and a team of external infosec specialists tried to “mitigate the impact” and are said to be “working hard to return the IT operations to normal”.

“At this time there is no evidence of unauthorised transfer or misuse of data. The Eurofins companies affected are notifying the relevant authorities of this IT incident and will cooperate in any investigation.”

Euorfins said it is trying to prevent further attacks by shoring up its defences. “This includes installing additional protections against this new variant of malware which were received over the weekend and restoring affected systems from backups after appropriate security verifications.”

This work may take the tech team some time and so the company apologised to customers of the labs and sites that “may be impacted for the potential temporary disruption of delays to some of its services”.

Eurofins employs 45,000 staff and sells more than 200,000 analytical methods used to evaluate safety, authenticity, composition, origin and purity of substances and products. It also produces labs services for genomics, forensics and discovery pharmacology.

The Register called Eurofins Scientific to try to discover more about the ransomware and was put through to a flustered rep in the IT department. We were told that no further information was forthcoming because “we are having issues right now”. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/03/eurofins_scientific_malware_breach/

Legacy app whitelist can be abused to bypass latest macOS security features, expert warns

library
crime | hacking | security

Malware can bypass protections in macOS Mojave, and potentially access user data as well as the webcam and mic – by exploiting a hole in Apple’s legacy app support.

Digita Security chief research officer Patrick Wardle explained during a presentation at the Objective By the Sea conference in Monte Carlo this month how malicious software could manipulate code run by an older installed application to bypass safeguards Apple has put on user data and sensitive components such as the camera and microphone.

Introduced by Apple last year at its World Wide Developer Conference, Mojave’s security defenses require the user to expressly give permission, via clicking a dialogue button, whenever an application requests access to the camera or mic, or wants to look at personal information such as photos, mail archives, browser history, or system backup information.

As an additional layer of protection, Apple has disabled “synthetic events” like automatic clicks. This prevents a malicious application from faking the user’s authorization on the dialog box.

Wardle, however, found that there is a glaring hole in the new security features: the implementation of backwards compatibility support. He told The Register how, in order to keep the operating system from breaking older applications, Apple included within Mojave a whitelist of apps that can work around the security protections.

What Wardle found was that Apple’s whitelisting mechanism only checks the cryptographic signatures of applications’ executables, not every piece of additional code that they load and run, such as plugins. This means that an attacker could in some way modify, or rather extend, one of those whitelisted apps to gain access to all of the protected resources in Mojave without any user notification or interaction.

In his proof-of-concept, Wardle used a malicious plugin for the VLC media player to carry out the procedure and access what should be off-limits resources. In practice, the extension could be installed via social engineering or by exploiting a vulnerability in Safari. All that would be required to carry out the attack would be to have code running locally.

Why didn’t Apple spot this? Good question…

Wardle said the bug is far from a sophisticated vulnerability, and should not have been particularly hard for Cupertino’s engineers to spot, had they known what to look for.

“If any security researcher or someone at Apple with a security mindset had audited this code, they would have noticed it. Once you see this bug, it is trivial, ” Wardle told El Reg.

“They are not auditing the code, they are implementing these new security features, but the reality is they are often implemented incorrectly.”

Even more frustrating, said Wardle, is that these are the sort of mistakes Apple has made repeatedly in recent years, even as its execs have talked up their efforts to make macOS and iOS devices more secure and private.

He explained how, time and again, he and other researchers have reported security vulnerabilities in Apple’s platforms, only to see the Cupertino giant deliver patches that only address a small portion of the vulnerability, or leave the root cause of a flaw exposed.

Huge news from Apple: No, not mags, games or TV – more than 50 security bugs to patch

“The majority of the bugs and CVEs I receive are often secondary or tertiary flaws for the same bug that Apple did not patch completely,” Wardle explained. “When you report a flaw to them, they do not comprehensively patch it.”

This not only frustrates researchers, but also increases the risk of future attacks because malware writers get to see where the operating system is vulnerable to attacks and how they can exploit the holes that are left exposed.

The disclosure this week should serve as a wake-up call for both executives and engineers at Apple ahead of this week’s WWDC conference.

Apple typically uses its developer get-together to highlight the upcoming features it will be including in the new versions of iOS and macOS, both of which typically arrive in the late summer. Between now and then, Cupertino will have plenty of work to do on securing both platforms. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/03/macos_security_blocks_useless/

IEEE says it may have gone about things the wrong Huawei, lifts ban after US govt clearance

library
crime | hacking | security

The US-based Institute of Electrical and Electronics Engineers (IEEE) has lifted its sanctions on Huawei-linked academic reviewers.

In an email sent to members, seen by The Register, IEEE president Jose Moura declared the organisation’s recent ban on Huawei-linked people peer-reviewing academic papers is over, pleading for the “patience of our members and volunteers” over the last week of pointed criticism from academics and the media.

That criticism all began with El Reg‘s report of the impact of IEEE sanctions on the academic community, with the sanctions having triggered a backlash from East and West alike.

Bizarrely, the wording of the original IEEE ban also included no IEEE-branded merchandise being sold to Huawei-linked people – including, of all things, coffee mugs.

You go that way, we’ll go Huawei: China Computer Federation kicks back at IEEE in tit-for-tat spat

In his email to the IEEE membership, Moura said, among other things:

We acted promptly because we wanted to protect our volunteers and members from potential legal risk that could have involved significant penalties. As a non-political, not-for-profit organization registered in New York, IEEE must comply with its legal obligations under the laws of the United States and other jurisdictions. We also engaged the US government to seek clarification on the extent to which these export control restrictions were applicable to IEEE activities.

I am pleased to report that this engagement was successful and we have revised our guidance to remove any restriction on the participation of the employees of these companies as editors or peer reviewers in the IEEE publication process. To reemphasize, all IEEE members can continue to participate in the open and public activities of the IEEE, including our scientific and technical publications.

This was a strong response to the concerns of academics and technological researchers concerned that even as non-US citizens in non-US countries, they were effectively being held to obey US law. Professor Alan Woodward of the University of Surrey previously told El Reg that the sanctions would “cause a big problem” by shutting out leading Chinese 5G experts from sharing their knowledge with the English-speaking world.

A US government QA (PDF, 15 pages) about the sanctions, which are part of US president Donald Trump’s trade war against China and issued before the IEEE’s U-turn, tends to suggest that academia was largely exempt from the restrictions anyway. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/03/ieee_uturns_huawei_sanctions/

Certifiably Distracted: The Economics of Cybersecurity

library
crime | hacking | security

Is cybersecurity worth the investment? It depends.

As the world watched the EU hit Google with the biggest data protection fine in history earlier this year, businesses across the US are realizing that no one is immune from the penalties of mishandling data.

From healthcare’s HIPAA and the technology industry’s ISO 27001 to the more recent General Data Protection Regulation and New York Department of Financial Services’ cybersecurity regulation, data protection laws and regulations are on the rise. Several states already have passed data protection laws in the wake of GDPR.

It’s no surprise that annual cybersecurity expenditures among US businesses have risen, due, in part, to the flood of regulations facing the marketplace. Some projections indicate private sector spending on cybersecurity will exceed $1 trillion from 2017 to 2021. Despite the surge in both regulations and cybersecurity budgets, Malwarebytes, in its “Q1 2019 Cybercrime Tactics and Techniques” report, found that small- to medium-sized businesses still saw a 235% increase in detections year-over-year.

One would think that as investments in cybersecurity rise, breaches would decrease or, at least, hold steady. That doesn’t seem to be the case, according to a wide body of research. Of course, many factors contribute to the rise in breaches, including more connectivity, increasingly complex systems, and the proliferation of cybercriminals looking to take advantage of new exploit tools and platforms, and the anonymity of cryptocurrencies. This leaves many asking: Is cybersecurity worth the investment?

That depends. Here’s a closer look:

Security first: Lately, there’s been so much of a focus on compliance that many companies are losing sight of the actual goal: security. But shouldn’t compliance equal security? No. It’s possible to maintain compliance without reducing risk. Unfortunately, many businesses have a false sense of security because they think certification will solve all their problems. From an economic perspective, it makes sense to treat compliance as a by-product of security. That means the focus should be on implementing cybersecurity processes and tools that are based on risk. And, as a result, the company will not only achieve compliance but be better equipped to withstand a breach or attack, possibly saving the organization significant capital.

Business-risk decision: Too often, business leaders are so laser-focused on compliance that they leave it up to their compliance departments to manage the process. However, pigeonholing cybersecurity to any single department isn’t a good idea. Cybersecurity is a complex business-risk decision because it’s integrated into every aspect of the business.

For example, it’s difficult for the average person to comprehend how the Internet actually works; there are too many independent pieces making up this massive pile of pathways and technologies that no single organization controls. Cybersecurity is the same way inside an organization. It’s too big and too complex for one person to have all the details; therefore, no one person can grasp it in its entirety — it must be a shared responsibility. And, as data and information flow through organizations, and are processed and influenced in faster and larger ways, a business’s cybersecurity program must be able to adapt to that change. If it’s pinned down to one department, it will fail.

Risk-based: Any business that has a cybersecurity program that’s not based on risk is wasting its resources. Furthermore, the people tasked with doing this work are likely frustrated at their inability to contribute. A risk-based program begins with a risk assessment that identifies how much data the company has, where that data is located, what value it provides, and what liabilities are associated with it. If any of the above items are unknown, how does a company know how much of its budget to spend protecting its data? How does it know what technology needs to be adapted? What business practices need to be adjusted? How do you train people to protect that data? If business leaders aren’t basing their cybersecurity programs on risk, they’re not certain what to do; they’re just guessing, and that’s not only dangerous, it’s negligent. This leads to underspending, and the topic many don’t talk about, overspending. If you’re doing it right, you’re neither spending too little nor too much and you’re creating a defensible position that stands up in front of the board, auditors, regulators, or business partners.

Baked in: Many business leaders don’t recognize the economic impact of a risk-based cybersecurity program. In today’s world, where most breaches come via third-party vendors — some 63%, according to a survey by Soha Systems — large companies such as Boeing and United are protecting themselves from these startups by requiring them to have proper certifications in place. The result? Many new companies are losing big contracts with these large corporations because they forgot to bake proper security practices into their product or service delivery processes.

The lesson? It pays to invest in cybersecurity, especially if a company plans to provide goods and services to other companies. Unfortunately, many startups in their early development stages don’t realize the implications until it’s too late and they’ve missed out on the big contract altogether. Even worse, as much as 60% of hacked small and midsize businesses go out of business after six months, according to research conducted by the National Cyber Security Alliance. When faced with a business-ending incident, there’s no clearer case for being prepared.

Whether companies like it or not, cybersecurity will become more regulated, increasing the cost of doing business and raising the security standards of both clients and potential business partners. However, if companies follow these guidelines and learn how to use risk to best position their program for success, they will see a real return on their investment in cybersecurity. Best of all, their business partners will notice. Some might even ask for pointers.

Related Content:

Dan Didier is the Vice President of Services and on the Board of Directors for GreyCastle Security. He is a cybersecurity pragmatist who partners with business leaders to appropriately position cybersecurity for the practical, effective, and relevant protection of … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/certifiably-distracted-the-economics-of-cybersecurity/a/d-id/1334772?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Nginx nJS will need patches, hotels exposed via security systems, Docker containers dinged, and more

library
crime | hacking | security

Roundup Here’s a quick summary of news in the world of information security beyond everything we’ve already covered.

Docker containers banished to the coin mines

Last week was not a great week for the Docker security team, first with the revelation of a race condition flaw, then with a warning from Trend Micro of active attacks against Docker installations.

The infosec house said it spotted a number of infected Docker containers running Monero mining scripts. The malware probes running containers to check for open APIs and, if exposed, then uses the API to install a Monero mining script on the container, which then run a Shodan.io search to look for further containers to infect.

This does not appear to be a one-off attack, either, as Trend senior threat researcher Alfredo Oliveira believes more Docker containers will be targeted in the future.

“The increased adoption of containers has also led to an increase in threats that target the technology. These threats are often successful, not only due to the exploitation of flaws and vulnerabilities in the container software but also due to misconfiguration, which remains a constant challenge for organizations,” Oliveira said.

“In this case, the hosts that have exposed APIs are not just victims of cryptocurrency-mining operations — they also contribute further to the distribution of the infected containers.”

Uh oh, Nginx just sounded the klaxon on a remote code execution flaw

Bad news for potentially anyone running an Nginx server (so around 30 per cent of the websites on the planet) with nJS: make sure your installation is up to date, and stays up to date.

Alisa Esage (via the Trend ZDI) has privately reported at least one remote code execution flaw in Nginx nJS that will definitely warrant an immediate patch when available. While Nginx claims the two bugs she found and disclosed can’t be easily exploited in the wild, Esage is not so sure.

One of the bugs, an array overflow, was addressed in Nginxs nJS version 0.3.2, and an integer overflow will be patched in the upcoming nJS version 0.3.3. Make sure you apply both as soon as you can, if you use a combination of Nginx and nJS.

Hotels betrayed by leaky security servers

It’s not really news to see a hotel chain involved in a massive data leak these days. Unless the leak involved their own security tools.

Researchers with VPNmentor claim they have uncovered an exposed trove of nearly 85GB of data from Pyramid Hotel Group that had been left sitting on an unsecured, public-facing server running the free and open-source Wazuh intrusion-detection tool.

The cache of data is said to include details about the hotel chain’s security systems, employees’ personal information, network infrastructure records, and data on software and hardware systems. The records would be immensely useful to any attackers doing reconnaissance.

“This database gives any would-be attacker the ability to monitor the hotels’ network, gather valuable information about administrators and other users, and build an attack vector targeting the weakest links in the security chain,” VPNmentor said.

“It also enables the attacker to see what the security team sees, learn from their attempts based on the alerts raised by the systems, and adjust their attacks accordingly. It’s as if the nefarious individuals have their own camera looking in on the company’s security office.”

Pyramid has since been notified and the archive was taken down.

Russia beefs up its in-house Linux distro

The Kremlin has long been planning to get itself off of Windows and onto its own FSB-approved version of Linux. That effort took a step forward this week when Astra Linux cleared a major security hurdle.

The certification means the Kremlin now believes Astra is able to handle its most sensitive communications, clearing the way for a larger rollout across government systems.

Checkers chapped by POS malware

Did you enjoy a burger at retro-tastic drive-in eatery Checkers recently? If so, you will want to keep a close eye on your bank statements for a while.

The fast food chain disclosed (PDF) that it is the latest eatery operation to be hit by the scourge of point-of-sale malware that took customer card details. This includes card numbers, names, verification codes, and expiration dates.

Anyone who visited one of the compromised restaurants is being advised to monitor their bank statements and keep an eye on their credit reports.

Terrible trio of CoreOS container bugs unveiled

Bug-hunters with security house TwistLock have disclosed three new unpatched vulnerabilities in CoreOS.

The three flaws are all found in RKT, a container runtime for CoreOS, and a successful exploit would allow the attacker to escape the container and take over the host server.

“Once an attacker is running in the context of a container process spawned by ‘rkt enter’, he can escape the container and gain root access on the host with relative ease, as he runs with all capabilities, no seccomp filteringand without cgroup isolation,” said TwistLock’s Yuval Avrahami.

Google looks into HTTPS alerts for webmasters

Google’s security research team tackled an interesting idea recently: how to help site owners fix broken HTTPS setups.

The research project looked into whether a system of direct notifications would be helpful in getting webmasters to improve the security of their sites and make sure that the secured connections were operating properly. The results were something of a mixed bag, with the team concluding that alerts alone won’t be enough:

“We find that security notifications alone have a moderate impact on remediation outcomes, similar to or less than notifications for other types of security vulnerabilities.”

Apple updates Windows apps

If you’re a Windows user, chances are you don’t pay much attention to Apple’s security updates. In this case, however, you really should.

This week the Cupertino software slinger kicked out fixes for multiple flaws in the SQLite and WebKit components used by both iCloud and iTunes on Windows. Seeing as the flaws would allow for things like elevation of privilege and arbitrary code execution, you will want to update both apps sooner than later. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/06/03/security_roundup/

Own goal for Leicester City FC after fan credit card details snatched in merch store hack

library
crime | hacking | security

Leicester City Football Club has quietly told people who bought stuff from its website that their financial details have been stolen by hackers – and those details include credit card numbers and CVVs.

Reg reader Yazza, a Foxes follower, received an email from the British club ‘fessing up to the hack attack, which affected its merchandise site, shop.lcfc.com.

The network intrusion itself took place on 6 May, with a follow-up email being sent earlier this week. That email read, in part:

Technical investigations are still ongoing, but we can confirm that as a result of the incident your payment card information was compromised. This includes your card number, name of card holder, expiry date and CVV. We can confirm that your SecureCode was not compromised. That information is needed to attempt to conduct transactions using your account.

The PCI-DSS standards explicitly state that if your business is storing card details, they must be encrypted – ideally, salted and hashed. It’s also a ridiculously bad idea to capture and store CVVs alongside card numbers and expiry dates.

SecureCode is an optional Mastercard thing that adds an extra layer of authentication to online card transactions.

Yazza suspected that LCFC’s site is running the Magento ecommerce platform and suggested to The Register that one potential attack vector could have been the Magecart malware. We have no information to support this theory, though a recent Magecart infection on a third-party site wound up infecting rent-a-blogger serious business news website Forbes. It is possible that an infection of a third-party site whose elements are used by LCFC’s online shop could have spread to the football club.

LCFC itself didn’t respond to our questions, though we suspect asking them about something other than pink away shirts or their ninth-place finish in the Premier League probably needs a bit more explanation.

Nonetheless, the footie club wasted an opportunity to tell us they are desperately sorry for leaking data and that they take the security of customers’ data very seriously.

It is not clear how many fans were caught up in this cyber-attack.

An LCFC fan forum features posts where some appear to suggest that fraudulent transactions have been made on their credit cards following the hack. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/05/31/leicester_city_fc_hacked_credit_card_data/

Focusing on Endpoints: 5 Steps to Fight Cybercrime

library
crime | hacking | security

Follow these best practices to strengthen endpoint management strategies and protect company data.

Cyberattacks are increasing across industries, and cybercriminals are savvier than ever. While the total number of IT vulnerabilities is decreasing, the number considered to be critical is on the rise — and so are the number of actual security exploits. Businesses are at risk of disruption, incurring devastating financial and reputational damage. With increasingly complex endpoints, IT teams find themselves racing to keep up with securing the proliferation of smartphones, tablets, and other devices.

Bring-your-own-device (BYOD) programs and Internet of Things (IoT) technologies further complicate the process because each device that connects to your network increases your vulnerability to threats from malware and viruses. Many devices accessing corporate data are mobile, making remote, hands-off management a necessity. Having an endpoint security strategy that gives clear visibility into all devices at all times is absolutely essential and can be the difference between smooth IT sailing or a security breach that has a significant impact on the business.

Here are five steps that can strengthen endpoint management strategies and empower organizations to fight back against cybercrime and protect sensitive company data.

1. Automate inventory management and deploy antivirus software.
Visibility into inventory management is key. If you don’t know what you have on your network, how can you manage it? Visibility is increasingly critical as BYOD programs become more pervasive and IoT devices flood the network. Having visibility enables IT to know where physical assets are and enables automated processes to secure the network and ensure fewer (and in many cases, eliminate) vulnerable access points for would-be hackers.

Once visibility into the network is established, IT administrators can also identify which systems need antivirus software. Many devices lack basic security and antivirus software, and as more and new devices are added to the network, it is critical that each device has its own protection to protect against attackers.

2. Automate patch management.
Patches and software updates are constantly being released — and unfortunately, many users delay installing updates until it’s too late. By automating patch management, IT can ensure both Windows and Mac platforms, as well as potentially vulnerable third-party applications like Adobe Reader and Oracle Java, receive patch updates in a timely manner and keep devices up to date. Coupled with IT security audits, automated patch management helps IT more quickly discover potential vulnerabilities and identify systems that are not compliant with security and configuration policies.

3. React quickly when you suspect an endpoint infection.
If you suspect that an endpoint is infected with a virus, don’t take any chances: immediately re-image the device. Once a device has been compromised, trying to repair the issue can be time consuming and error prone — and does not provide good confidence that the issue won’t recur. Manual operating system deployment processes can deter IT from taking the appropriate steps needed to secure endpoints, but investing the time to automate these processes can save a lot of time and headaches later. Automated imaging solutions can also provide an easy way to facilitate updates and ultimately help keep a network secure, especially across a distributed workforce.

4. Make sure you can track and manage mobile assets remotely.
A proven way to simplify mobile endpoint management is to implement tracking and management software. Many IT teams may have basic functionality in place, but it’s critical to be able to identify all devices on a network and send specific commands to mobile devices, if needed, to keep them secure. While having visibility is helpful, IT teams also must be able to act in order to safeguard important data. For example, IT must be able to lock a mobile device and wipe its data if it goes missing. Other critical mobile endpoint management capabilities include remote inventory, device unlock, passcode reset, and factory reset.

5. Ensure the appropriate user access rights.
To avoid security breaches, it’s critical that users have the correct level of access to systems that contain sensitive corporate data. IT teams must be able to easily keep track of which systems specific users can and are accessing. By default, users might get least-privilege rights — and other times, they might have administrator rights. Make sure you know what type of access rights each user has to prevent unauthorized users who can unintentionally spread malware and compromise data from accessing sensitive data.

By following these endpoint management best practices, IT teams can bolster the safety and security of their data and minimize the number of vulnerable access points across the network. Keeping ahead of attacks means staying current on endpoint strategies and simplifying what can at times make for complex endpoints. To best protect the business, we must make sure we’re empowering IT departments to fend off attackers and be ready to react swiftly with the best tools available.

Related Content:

Matthew Lewinski has been developing endpoint management solutions for over 14 years. He is currently a Distinguished Engineer with Quest Software, where he leads DevOps and Security programs for the KACE Unified Endpoint Management business. Matthew has an M.S. in Software … View Full Bio

Article source: https://www.darkreading.com/perimeter/-focusing-on-endpoints-5-steps-to-fight-cybercrime/a/d-id/1334754?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

SANS Launches Security Awareness Certification

library
crime | hacking | security

The SANS Security Awareness Professional (SSAP) will be available this summer to professionals focused on measuring and mitigating human risk.

This summer, the SANS Institute will launch SANS Security Awareness Professional (SSAP), a new credential for professionals who develop and maintain security awareness programs.

As security threats become a higher priority for businesses, their stakeholders are turning to experts with training and expertise to mitigate their risks. The SSAP, designed to signify those skills, is intended for CISOs, security awareness officers, training officers, governance and compliance experts, security managers, corporate communications pros, and other cybersecurity pros involved with managing, measuring, and communicating employee risk.

The SSAP exam is two hours long, has 50 questions, and costs $599. SANS encourages aspiring credential holders to take MGT 433: SANS Security Awareness: How to Build, Maintain, and Measure a Mature Awareness Program. The two-day course isn’t new – in the past decade, more than 1,500 students have finished it – but it discusses ideas and concepts in the exam.

Some of these are the skills needed to launch a program, such as the stages of the Security Awareness Maturity Model, how to identify target groups, and how to communicate with different parts of the workforce. It also discusses how to maintain an awareness program, implement advanced programs, measure a program’s impact, and communicate value to board members.

GDPR’s First-Year Impact By the Numbers

library
crime | hacking | security

The latest statistics on GDPR spending, compliance rates, enforcement and consumer attitudes on privacy protection.

Image Source: Adobe Stock (tanaonte)

It has been a year since the EU General Data Protection Regulation (GDPR) compliance deadline kicked in, and in that time the landmark privacy and cybersecurity regulatory rules have made waves worldwide among enterprises with European connections. GDPR has raised the bar for privacy and security awareness at the board level, as well as assured continued increases in security and compliance spending at most large organizations in the coming years.

Of course, the efficacy of the regulation still remains a point of contention. Consumer surveys show that many European citizens are still skeptical about the benefits they’ve received from GDPR protections so far, and enterprise surveys show that compliance is still a work in progress.

Here are some of the latest statistics that offer up signposts of where we are with GDPR at the one-year anniversary.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading. View Full Bio

Article source: https://www.darkreading.com/risk/compliance/gdprs-first-year-impact-by-the-numbers/d/d-id/1334845?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Checkers Breach Underscores Continued POS Dangers

library
crime | hacking | security

Attacks on point-of-sale terminals garners less attention these days, but the most recent breach of the restaurant chain shows hackers have not lost focus.

Attackers compromised and installed point-of-sale (POS) malware on devices at more than 100 stores in the Checkers and Rally’s restaurant chain, allowing them to collect payment-card information from customers for months — and, in some cases, years, the company said in a statement released this week.

The attack highlights how POS devices continue to be a viable target for cybercriminals if the merchant, hardware maker, and payment services provider have not all adopted the Europay-Mastercard-Visa (EMV) security standard. While EMV is an effective defense against most payment device malware, many retailers have not upgraded to hardware that is EMV-capable, says Josh Platt, principal threat researcher at Flashpoint.

“Businesses are not required to upgrade their POS terminals,” he says. “Unfortunately, it seems many businesses are still not EMV-compliant and will thus continue to be more susceptible to suffering losses in these situations until they become compliant.”

Customers at a minimum of 104 Checkers and Rally’s locations were affected by the latest breach, according to parent company Checkers Drive-In Restaurants, which only recently became aware of the breach. The company retained security consultants to investigate the attacks and determine the length of time that each location had been compromised. At least one location had the malware installed in December 2015, according to data provided by the company.

“Based on the investigation, we determined that malware was installed on certain point-of-sale systems at some Checkers and Rally’s locations, which appears to have enabled an unauthorized party to obtain the payment card data of some guests,” said Adam Noyes, the chain’s chief administrative officer, in a statement. “The malware was designed to collect information stored on the magnetic stripe of payment cards, including cardholder name, payment card number, card verification code and expiration date.”

The attack also underscores how merchants that have not upgraded to EMV put themselves — and their customers’ information — at risk. Merchants are quickly adopting devices that comply with the security specification, but almost half of transactions were not protected: In 2018, 54% of card-present transactions used EMV, up from 41% the prior year, according to EMV Co., the organization promoting and managing the specification.

POS terminals that use EMV technology encrypt and tokenize credit card information, preventing malware on the card reader from intercepting the data. As retailers have adopted the EMV security standard, attacks at the point of sale have become less common.

Yet the hardware is not inexpensive, and that has slowed adoption, which puts customers’ information at risk, Flashpoint’s Platt says.

“If a business is not EMV-compliant, the card numbers of any cards swiped at a POS terminal are transmitted,” he says. “And when card numbers are transmitted, POS terminals infected with malware will be able to see the numbers and transmit them as well.”

While details of the Checkers breach have not been released, often retailers use special editions of Microsoft Windows for retail environments that are not kept up to date. In addition, the retailers usually do not manage the devices, relying on a third-party service provider whose security may leave vulnerable pathways into the business, says Robert Neumann, senior security researcher at Forcepoint, a provider of managed security services.

“They are also often utilizing third-party remote admin applications, such as LogMeIn, TeamViewer, or similar for easier updating and maintenance, hence increasing the attack surface,” he says. “We suspect there are special cases where POS malware is being distributed through fake software updates from a central location after successfully gaining foothold in the network by hacking.”

Finally, not all issues can be blamed on the retailers, according to Flashpoint’s Platt.

“It is still pretty common for EMV chip readers to not work properly,” he says. “When this happens, users are typically asked to swipe their cards instead — and this defeats the purpose of EMV chip-and-pin cards.”

Related Content:

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/checkers-breach-underscores-continued-pos-dangers/d/d-id/1334852?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple