US Voting Machine Supplier Leaks 1.8 Million Chicago Voter Records*:
- A leading US supplier of voting machines confirmed that it exposed the personal information of more than 1.8 million Illinois residents.
- State authorities and the Federal Bureau of Investigation were alerted this week to a major data leak exposing the names, addresses, dates of birth, partial Social Security numbers, and party affiliations of over a million Chicago residents.
- An employee of a cyber resilience firm discovered the breach on an Amazon Web Services device that was not secured by a password.
- It was determined Election Systems & Software (ES&S) controlled the data; they provide voting machines and services in at least 42 states.
- The city did not immediately respond to a request for comment after ES&S posted about the leak on its website.
- The company stressed that the leak had “no impact on the results of any election.”
*Source: Gizmodo, August 17, 2017
Hackers Are Now Using the Exploit Behind WannaCry to Snoop on Hotel Wi-Fi*:
- A hacking group accused of linked meddling in the run up to the US presidential election is harnessing the Windows exploit which made WannaCry ransomware and Petya so powerful – and using it to perform cyberattacks against hotels in Europe.
- Researchers at FireEye have attributed a campaign to remotely steal credentials from guests using Wi-Fi networks at hotels in Europe to APT28, also known as the hacking organization Fancy Bear.
- The attack exploits EternalBlue, a security vulnerability which leverages a version of Windows' Server Message Block (SMB) networking protocol in order to laterally spread through networks.
- A number of cyber-criminal groups are attempting to use EternalBlue to boost their own malware, but it’s the first time APT28 have been spotted attempting to do so.
- The attack begins with a phishing campaign, targeting multiple companies in the hospitality industry in at least seven European countries.
- Messages contain a malicious document that deploys malware.
- Once the malware is installed on the network, it works its way through to find computers in control of guest and internal Wi-Fi; from there, it can steal any credentials sent over the wireless network.
- The technique also exploits single factor user authentication – using two factor authentication makes it harder for the hackers to break into targeted accounts.
- Publicly accessible Wi-Fi networks present a significant threat and should be avoided when possible.
*Source: ZDnet, August 11, 2017
Global Information Security Spending To Hit $86.4 Billion*:
- Global spending on information security products and services will reach $86.4 billion in 2017 – an increase of seven percent according to research firm Gartner.
- The growth is attributed to continued data breaches and growing demands for application security testing within the infrastructure protection segment.
- Spending on emerging application security testing tools, particularly "interactive application security testing" (IAST) will contribute to the growth through 2021.
- According to a research analyst from Gartner, rising awareness among CEOs about the business impact of security incidents and an evolving regulatory landscape have led to continued spending on security.
- Spending is expected to grow up to $93 billion in 2018, and security services will continue to be the fastest-growing segment, especially IT outsourcing, consulting and implementation services.
- Hardware support services will see growth slowing due to the adoption of virtual appliances, public Cloud and software as a service editions of security solutions.
- The EU General Data Protection Regulation (GDPR) is expected to drive 65 per cent of data loss prevention (DLP) buying decisions through 2018.
- Organisations that do not have strong DLP in place are looking to increase their capabilities, while those with some form of data loss prevention already implemented are determining what additional capabilities they need to invest in.
*Source: Economic Times, August 16, 2017
IT Ministry Drafts Data Protection Law*:
- In the first draft of Data Protection and Governance Act, the Union IT and electronics ministry has proposed to put all digital data captured under the ambit of the proposed Act.
- Currently, there is no law or Act for data protection in India, but the central government has decided to bring in a stand-alone data protection law for the country.
- Data governance authorities, to be set up once the Act is finalised, will formulate policies for the protection of digital data as per guidelines issued by the government.
- The draft of ‘The Data Governance and Protection Act’ will form the basis for a committee that will identify key data protection issues in India and recommend methods of addressing them.
- With increased digitisation across the county, there is a need for safeguards to secure the surge in digital data and provisions for handling data protection.
- After demonetization, there has been an increase in digital payments, and with a thrust of the government to move towards a digital economy, cyber security has gained utmost importance.
- Data governance is a pre-requisite for the protection of data.
- The draft Act said the personal data in the ownership of the minister or the ministers for defence kept for the purpose of safeguarding the security of the state will not come under its purview.
- There are also provisions for penalty/imprisonments for leakage of personal data.
- NIC's centre for data governance will undertake research to develop indigenous technologies, electronic tools, digital platforms, procedures and processes for data governance and protection.
- A data governance authority will define ownerships, roles responsibilities of people managing data assets, define processes for compliance, ensuring quality, master data management, data masking, data security, data sharing and archiving activities among others.
*Source: DNA India, August 18, 2017
New Trojan Malware Campaign Sends Users to Fake Banking Site That Looks Just Like the Real Thing*:
- A notorious banking Trojan is targeting customers of a major bank with a new email spam campaign, which directs victims to a fake login page that’s indistinguishable from their real bank.
- The credential-stealing Trickbot banking malware has been hitting the financial sector since last year and targets online banking customers in in the US, UK, Australia, and other countries.
- The latest Trickbot distribution campaign sent over 75,000 emails in 25 minutes, all claiming to be from Lloyds Bank, one of the UK's biggest banks.
- The emails claim that the target needs to review and sign attached documents, but downloading the attachment allows the malware to be deployed.
- Once a computer is infected, the malware runs in the background and waits for the victim to visit their online bank; when they do, Trickbot redirects them to a malicious site, which in this case looks exactly like the real website.
- The attacker is able to see and steal the victim's online banking credentials and security codes, and make off with their funds and data.
- While the fake sites resemble the real thing – there’s one major giveaway that the email isn’t from Lloyds: the email address it is sent from is spelled incorrectly.
- Researchers warn that Trickbot will continue to be "formidable force" in future, as its authors look to add more potent capabilities to better distribute this dangerous malware.
*Source: ZDnet, August 14, 2017
HBO Hacker Offered $250,000 for ‘Cooperation’*:
- A hacker or hackers recently leaked the script for episode four of the latest seasons of Game of Thrones and the cast’s personal phone numbers in the process.
- Now the hacker has leaked an email from HBO executives offering $250,000 as part of its bug bounty program.
- Bug bounty programs are typically cash rewards offered to ethical hackers who point out security flaws in corporate systems.
- This “bounty” seems more like a ransom, not a reward.
- The sum falls well short of the “six months salary” request by the hacker, who claims to earn $12- to-$15 million per year.
*Source: The Next Web, August 11, 2017