Log inRegister

Fraud News

Facebook usage has plummeted over the last year, according to data seen by the Guardian, though the company says usage by other measures continues to grow.

Since April 2018, the first full month after news of the Cambridge Analytica scandal broke in the Observer, actions on Facebook such as likes, shares and posts have dropped by almost 20%, according to the business analytics firm Mixpanel.

Taking that month as a baseline, total actions fell by more that 10% within a month, recovered a bit over the summer and then fell again over the autumn and winter of 2018, except for a brief rally over the period of the US midterm elections.

Likes, shares and posts on Facebook have plummeted since the Cambridge Analytica scandal of spring 2018

The decline coincided with a series of data, privacy and hate speech scandals. In September the company discovered a breach affecting 50m accounts, in November it admitted that an executive hired a PR firm to attack the philanthropist George Soros, and it has been repeatedly criticised for allowing its platform to be used to fuel ethnic cleansing in Myanmar.

Facebook’s own statistics show increases in daily and monthly active users (DAUs and MAUs), the numbers logging on to the site at least once in the respective periods, during the year ending March 2019.

In the company’s latest quarterly earnings report, published in April, it said it averaged 1.56bn DAUs in March up 8% on March 2018, and MAUs were also up 8% year on year.

The two sets of numbers can be reconciled. Anecdotal reports over the past year have suggested that while few users have deleted their Facebook accounts or stopped logging on since the scandals, many have reduced their usage.

This month a market research firm, eMarketer, reported a decline in Facebook usage in the US, saying the typical Facebook user spent 38 minutes a day on the site, down from 41 minutes in 2017.

“On top of that, Facebook has continued to lose younger users, who are spreading their time and attention across other social platforms and digital activities,” eMarketer said.

Facebook has been asked for comment.

If nation-sponsored hacking was baseball, the Russian-speaking group called Turla would not just be a Major League team—it would be a perennial playoff contender. Researchers from multiple security firms largely agree that Turla was behind breaches of the US Department of Defense in 2008, and more recently the German Foreign Office and France’s military. The group has also been known for unleashing stealthy Linux malware and using satellite-based Internet links to maintain the stealth of its operations.

Now, researchers with security firm Symantec have uncovered evidence of Turla doing something that would be a first for any nation-sponsored hacking group. Turla, Symantec believes, conducted a hostile takeover of an attack platform belonging to a competing hacking group called OilRig, which researchers at FireEye and other firms have linked to the Iranian government. Symantec suspects Turla then used the hijacked network to attack a Middle Eastern government OilRig had already penetrated. Not only would the breach of OilRig be an unprecedented hacking coup, it would also promise to make the already formidable job of attribution—the term given by researchers for using forensic evidence found in malware and servers to pin a hack on a specific group or nation—considerably harder.

A murkier world

“The fact that we’ve seen one advanced group taking over the infrastructure of another nation-backed group changes a lot of policy discussions that are going on, because it complicates attribution,” Jonathan Wrolstad, principal cyber intelligence analyst in Symantec’s Managed Adversary and Threat Intelligence group, told Ars. “This does make us live in the world now that’s a bit murkier.”

Hacking groups go by many different names, depending on the people who track them. Turla is also known as Snake, and Symantec calls it Waterbug. OilRig is also known as APT34, and Symantec calls it Crambus. For consistency, this article will use the names Turla and OilRig.

The hijacking would be only one of Turla’s impressive accomplishments of late. Over the past 18 months, Symantec has observed Turla rolling out a suite of new custom hacking tools, in part to ensure that it regains its signature stealth as previous tools and methods have come to the attention of researchers and rivals. In keeping with a recent trend designed to make detection harder, many of the new tools adopt an approach known as “living off the land,” in which tools run in memory and are based on legitimate administrative tools. New tools rolled out since the beginning of 2018 include:

A new custom dropper typically used to install Neptun, a backdoor for Microsoft Exchange servers, as a service. A custom hacking tool that combines four leaked Equation Group tools (EternalBlue, EternalRomance, DoublePulsar, SMBTouch) into a single executable. A USB data collecting tool that checks for a connected USB drive and steals certain file types, encrypting them into a RAR file. It then uses WebDAV to upload to a Box cloud drive. Visual Basic scripts that perform system reconnaissance after initial infection and then send information to [Turla] command and control (C&C) servers. PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to [Turla] C&Cs. Publicly available tools such as IntelliAdmin to execute RPC commands, SScan and NBTScan for network reconnaissance, PsExec for execution and lateral movement, and Mimikatz (Hacktool.Mimikatz) for credential theft, and Certutil.exe to download and decode remote files. These tools were identified being downloaded via [Turla] tools or infrastructure.

Over the same span, Symantec is aware of Turla compromising 13 organizations, many of them well fortified, in 10 countries. They include:

The Ministry of Foreign Affairs of a Latin American country The Ministry of Foreign Affairs of a Middle Eastern country The Ministry of Foreign Affairs of a European country The Ministry of the Interior of a South Asian country Two unidentified government organizations in a Middle Eastern country One unidentified government organization in a Southeast Asian country A government office of a South Asian country based in another country An information and communications technology organization in a Middle Eastern country Two information and communications technology organizations in two European countries An information and communications technology organization in a South Asian country A multinational organization in a Middle Eastern country An educational institution in a South Asian country

Hijacking a rival hacker’s infrastructure

The first compromise of the unidentified Middle Eastern government, Symantec researchers said in a report to be published Thursday, came no later than November 2017, when Symantec security software shows the network was breached by OilRig hackers. Symantec software shows a new breach occurred on January 11, 2018, when a known Turla-linked task scheduling tool named msfgi.exe infected the same network. It’s unusual, but by no means unprecedented, for two nation-sponsored hacking groups to compromise the same network this way.

The next day, Symantec detected evidence of the never-before documented event. It came when an OilRig backdoor called Powruner and an OilRig administration tool called Poison Frog—which had already had access to the Middle Eastern network for months—were used to download a highly customized version of hacking software Symantec researchers believe could only have originated with Turla.

The tool was a heavily customized version of the Mimikatz password extraction tool that was obfuscated using a custom compression routine. Symantec has seen the custom version of Mimikatz and the custom packer used only a handful of times, and each one of them was in campaigns company researchers attributed to Turla.

Symantec believes Turla’s intrusion into the Middle Eastern network continued for most of 2018 in a way that was consistent with other known breaches by the group. In September, for instance, a similar Mimikatz variant was downloaded to another computer on the same network using the Neptun backdoor, which, as noted earlier, Symantec has observed Turla recently started using in its campaigns. Symantec also observed other malware on the Middle Eastern network connecting to known Turla command and control servers.

Symantec researchers can’t rule out the possibility that Turla and OilRig collaborated in the hack of the Middle Eastern network, or even that OilRig somehow obtained its rival's customized version of Mimikatz and the custom packer that obfuscated it. But the researchers discount those possibilities. Turla is an unusually secretive group—even among nation-sponsored hackers. The likelihood of it openly cooperating with a competitor seems slim. What’s more, OilRig has considerably scarcer resources and skills compared to Turla. Not only does that mean Turla would have little to gain from an alliance, it also makes it extremely remote OilRig would have the ability to obtain its larger rival's tools.

Symantec has also discounted the likelihood of a false flag operation, which attempts to trick researchers or targets into thinking a hack was carried out by some other group. Had Turla been trying to frame OilRig, it would have used OilRig tools and infrastructure exclusively, rather than the combination observed in the hack of the Middle Eastern government's network.

image

Enlarge

Symantec

The theory that seems most plausible, the researchers said, is that Turla knew OilRig had already hacked the network of the Middle Eastern target. In later deciding to go after the same target itself, Symantec speculates, Turla piggybacked on existing access of OilRig.

In an interview, Wrolstad, the Symantec researcher, said:

We speculate, but we really can’t confirm, that the purpose of the [OilRig] network infrastructure was to gain that initial foothold. This has been discussed in the community at conferences, that a great way for a group to gain initial access to their victim organization would be to find somebody that already has access to the organization you’re interested in, compromise them, and go out to all the different victims that they have. You can save yourself a lot of trouble by doing that.

It’s been discussed but never before observed, and that was one of the reasons we wanted to document it. The thing that people have talked about, now we have evidence that it happened.

Bad opsec

A theory that’s based on OilRig suffering from a lapse of what researchers call operational security would also be consistent with a recent leak by an unknown party thatdumped vast amounts of the group’s code and tools. While it’s possible the leak came from an OilRig insider, Brandon Levene, head of applied intelligence at the security firm Chronicle, said his analysis of the published material leads him to believe it’s the work of outsiders.

“It's likely an OilRig controlled staging server was somehow compromised by an outsider," he wrote in an email. "I'd be extremely surprised if the leak(s) were native Iranians. I've seen some linguistic reports that highlight the construction of the messages in Farsi that seem to support this, but there really is no confirmation.”

Symantec researchers, for their part, say they can’t be certain their theory is correct. In the interest of completeness, their report lists their hypothesis (listed as No. 2 below) as only one of four possibilities:

1. False flag: [Turla] does have a track record of using false flag tactics to throw investigators off the scent. However, if this was a genuine attempt at a false flag operation, it begs the question of why it also used its own infrastructure to communicate with other machines on the victim’s network, in addition to using tools that could be traced back to [Turla].

2. Means of intrusion: It is possible that [Turla] wanted to compromise the target organization, found out that [OilRig] had already compromised its network, and hijacked [OilRig]’s own infrastructure as a means of gaining access. Symantec did not observe the initial access point, and the close time frame between [Turla]-observed activity on the victim’s network and its observed use of [OilRig] infrastructure suggests that [Turla] may have used the [OilRig] infrastructure as an initial access point.

3. Mimikatz variant belonged to [OilRig]: There is a possibility that the version of Mimikatz downloaded by the [OilRig] infrastructure was actually developed by [OilRig]. However, the compilation technique and the fact that the only other occasion it was used was linked to [Turla] works against this hypothesis. The fact that [Turla] also appeared on the victim’s network around the same time this version of Mimikatz was downloaded would make it an unlikely coincidence if the tool did belong to [OilRig].

4. Opportunistic sowing of confusion: If a false flag operation wasn’t planned from the start, it is possible that [Turla] discovered the [OilRig] intrusion while preparing its attack and opportunistically used it in the hopes of sowing some confusion in the mind of the victim or investigators. Based on recent leaks of [OilRig] internal documents, its Poison Frog control panel is known to be vulnerable to compromise, meaning it may have been a relatively trivial diversion on the part of [Turla] to hijack [OilRig]’s infrastructure. A compromise conducted by one threat actor group through another's infrastructure, or fourth-party collections, has been previously discussed in a 2017 white paper by Kaspersky researchers.

The white paper speculates on three instances that may support one hacking group compromising the infrastructure of another. The details, however, are extremely sparse. The instances are:

In 2014, a site infected by hacking group Energetic Bear in hopes of compromising targets who visited it was modified to include an HTML tag that would log visitors’ IP addresses with a remote server controlled by another, undisclosed party. A “mothership” server belonging to threat group NetTraveler contained a backdoor planted by another threat actor intent on maintaining prolonged access to the NetTraveler infrastructure for their stolen data. In 2016 a Korean-speaking threat actor named DarkHotel compromised a site located at scarcroft.net with what at the time was a zeroday vulnerability in Adobe’s Flash media player. Later, another group the researchers later came to call ScarCruft infected the same scarcroft.net site with a different Flash zeroday.

"While this represents an immediate failure for the victim intelligence service, the tragedy doesn’t end there,” researchers Juan Andrés Guerrero-Saade and Costin Raiu, both at Kaspersky Lab at the time, wrote in the paper titled Walking in your enemy’s shadow: when fourth-party collection becomes attribution Hell. “Attackers can then go on to adopt the victim threat actor’s toolkit and infrastructure, leveraging their data and access, and perpetrating attacks in their name.”

Misidentifying hacking groups might also prove costly to the parties who are breached, since the victims may fail to accurately assess the full scope of the damage they have sustained.

“In the case we’re looking at, we have a very capable threat actor who creates a lot of redundant overlapping access within a network, and then a less capable actor,” Alexandrea Berninger, a senior cyber intelligence analyst at Symantec, said in an interview. "One can imagine that if [you think] you’re defending against a less capable actor you won’t remove all evidence and [the more capable group] will be able to retain some kind of access.”

Coinbase Logo: Coinbase // Composition: ZDNet

A recent Firefox zero-day that has made headlines across the tech news world this week was actually used in attacks against Coinbase employees, and not the company's users, ZDNet has learned.

Furthermore, the attacks used not one, but two Firefox zero-days, according to Philip Martin, a member of the Coinbase security team, which reported the attacks to Mozilla.

"On Monday, Coinbase detected & blocked an attempt by an attacker to leverage the reported 0-day, along with a separate 0-day Firefox sandbox escape, to target Coinbase employees," Martin said.

"Something is rotten in the state of Denmark"

Mozilla issued a patch following the Coinbase team's notification, a patch for which it also credited Samuel Groß, a security researcher with Google Project Zero security team.

Asked to comment on the Firefox zero-day earlier this week, Groß said he reported a bug in Firefox to Mozilla back on April 15.

Groß said the bug would have allowed a remote attacker to execute code inside a victim's browser, but that the attacker would have needed a separate sandbox escape bug to run code on the underlying OS.

It appears that two months after Groß reported this bug to Mozilla via the organization's private Bugzilla bug tracker, the bug was exploited in live attacks, along with a sandbox escape.

It is unclear how the Coinbase attackers got hold of this RCE bug's details to use it for their attacks. Several scenarios come to mind:

- the attackers discovered the same RCE bug on their own
- they obtained the info from an insider with access to Mozilla's security bugs portal
- they compromised a Mozilla employee's account and accessed the Bugzilla portal's security section
- or, they hacked the Bugzilla portal, similar to an incident from 2015

Attackers targeted Coinbase and other cryptocurrency orgs

Fortunately, the two Firefox bugs, which were chained into one single exploit and deployed against Coinbase employees, was detected by Coinbase staffers.

If successful, a hacker could have gained access to the Coinbase backend network and used this access to steal funds from the exchange -- a tactic that has been used numerous times in the past and has led to gigantic losses at many cryptocurrency exchanges before.

"We walked back the entire attack, recovered and reported the 0-day to Firefox, pulled apart the malware and [infrastructure] used in the attack, and are working with various orgs to continue burning down [the] attacker's infrastructure and digging into the attacker involved," Martin said.

"We've seen no evidence of exploitation targeting customers," Martin said, also adding that other cryptocurrency-linked organizations have also been targeted by this group.

"We are working to notify other orgs we believe were also targeted," he added.

According to indicators of compromised shared by Martin, attackers would send a spear-phishing email luring victims to a web page, where, if they used Firefox, the page would download and run an info-stealer on their systems that would collect and exfiltrate browser passwords, and other data. The attack was tailored for both Mac and Windows users, alike, with different malware for each OS.

Mozilla released on Tuesday Firefox 67.0.3 and Firefox ESR 60.7.1 to fix the reported zero-days. Earlier today, these fixes were also merged into the Tor Browser with the release of v8.5.2.

Updated on June 20, 15:00 ET: Mozilla has released a patch for the second zero-day described in this article. Users can update to Firefox 67.0.4 and Firefox ESR 60.7.2 to be protected against any attacks.

More browser coverage:

Cybercrime , Fraud Management & Cybercrime , Incident & Breach Response

Court Documents Outline a 'Host of Negative Consequences'(HealthInfoSec) • June 19, 2019    AMCA Bankruptcy Filing in Wake of Breach Reveals Impact

In a case underscoring the potential financial havoc wreaked by data breaches, the 42-year-old parent company of American Medical Collection Agency has filed for bankruptcy just weeks after disclosing a data breach that affected its largest clients and millions of patients.

See Also: 10 Incredible Ways You Can Be Hacked Through Email & How To Stop The Bad Guys

In a Monday filing in a New York federal bankruptcy court, Retrieval-Masters Credit Bureau, which does business as AMCA, says it's seeking court approval for an "effective transition into Chapter 11 and to provide the best opportunity for a cost-effective and orderly liquidation."

The move comes after the March discovery of a major data breach, revealed in June. The breach not only caused AMCA's largest clients to end their business relationships with the Elmsford, New York-based debt collection agency, but has also resulted in "enormous expenses that were beyond the ability of [the company] to bear," Russell Fuchs, RMCB's owner and CEO, says in court documents.

Millions Impacted

On June 3, three medical testing laboratories - Quest Diagnostics, LabCorp and BioReference Laboratories, which is part of Opko Health Co. - each filed 8K forms with the U.S. Securities and Exchange Commission saying they were informed by AMCA that they were affected by an "unauthorized access" data breach at the collection agency.

In those filings, Quest Diagnostics said nearly 12 million of the patients that is serves were impacted by the breach. LabCorp reported 7.7 million individuals were affected, and BioReference Laboratories said nearly 423,000 patients were impacted.

'Cascade of Events'

In court documents, Fuchs says that after more than 40 years in business with no known data security incidents, AMCA in March became aware of what turned out to be a major data breach that apparently had occurred sometime during 2018.

The company first learned that there might be a problem when it received a series of Common Point of Purchase notices that suggested that a disproportionate number of credit cards that at some point had interacted with AMCA's web portal were later associated with fraudulent charges, the court documents say.

In response, AMCA shut down its web portal to prevent any further compromises of customer data and engaged outside consultants who confirmed that AMCA's servers had been hacked as early as August, 2018, Fuchs says in the filing. "This knowledge led to ... a cascade of events that ultimately has resulted in the [company's] need to seek relief under Chapter 11," he states.

"The Chapter 11 application ... should not stand in the way of OCR, state attorneys generals or other federal and state regulatory bodies investigating AMCA or attempting to seek enforcement remedies."
—David Holtzman, CynergisTek

As a result of the data breach, the company suffered "a severe drop-off in its business," he says in the filing.

"Almost immediately upon learning of the breach, LabCorp unqualifiedly and indefinitely terminated its relationship with the [company]. Soon after, Quest Diagnostics, Conduent Inc., and CareCentrix Inc., which together with LabCorp were [RMCB's] four largest clients, stopped sending new work to [RMCB], and all terminated or substantially curtailed their business relationships with the [company]."

In a statement provided to Information Security Media Group, Medfield, Mass.-based CareCentrix confirmed it has terminated its contract with AMCA.

"We are working to learn more about the data security incident at AMCA and to ensure that AMCA fulfills its obligations, including its obligation to issue all required notifications to potentially impacted individuals and regulatory authorities," CareCentrix says.

LabCorp says in a statement that it continues to investigate the AMCA data security incident to more fully understand which of the patients that it serves were affected by and what additional steps may be appropriate. "We are committed to handling this in a transparent and thorough manner. We will work vigorously to protect our interests and the interests of our customers who may be affected by the AMCA data security incident," the company says.

Conduent, a Florham Park, New Jersey-based technology services firm did not immediately respond to ISMG's request for comment, nor did Quest Diagnostics.

Growing Expenses

In the bankruptcy filing, Fuchs says RMCB hired IT professionals and consultants from three firms to identify the source of the breach, diagnose its cause, and implement appropriate solutions.

"To date, these expenses alone cost approximately $400,000, and have effectively shut down outside entry into the [company's] IT network by severely restricting access via the employment of individual authentication mechanisms, VPN access, or specifically vetted 'whitelists' of pre-approved IPs," the filing states.

In addition, the discovery of the data breach triggered a number of legal requirements and regulatory obligations, including notifying by mail individuals whose information may have been accessed, court documents note.

"Because the [company] was unable to determine a particular subset of persons or data files that had been hacked, [the company] had no choice but to work under the assumption that all of the information within its servers was compromised. As a result, the [company] had to spend in excess of $3.8 million to mail well over 7 million individual notices that began to go out on June 6," the bankruptcy filing states.

To pay for notification, Fuchs says in the filing he had to "obtain a secured loan from my personal funds in the amount of $2.5 million, which together with existing cash on hand was sufficient to fund mailing of the notices."

In the wake of the breach, the company "had no choice" but to substantially reduce its workforce, from 113 employees at year-end 2018 to just 25 as of the bankruptcy filing, Fuchs says. "The [company] is no longer is optimistic that it will be able to rehabilitate its business."

More to Worry About

The court filing also notes that among a "host of negative consequences" brought on by the data breach are "not only a crush of litigation and pre-litigation activity by contract counter-parties and other private entities ... but also a host of requests and demands made by numerous governmental authorities, all related to the data security breach sustained by the [company]."

Since the revelation of the data breach, more than a dozen class action lawsuits have been filed against RMCB and AMCA, as well as against some of the company's clients impacted by the incident, including Quest Diagnostics, LabCorp and BioReference Laboratories.

Also, New Jersey's two U.S. senators earlier this month sent a letter to Secaucus, New Jersey-based Quest Diagnostics demanding answers about the AMCA breach.

In addition, the attorneys general of several states have also announced they've launched investigations into the AMCA breach.

Regulatory Issues

The Department of Health and Human Services' Office for Civil Rights, which enforces HIPAA, has has not shied away from launching HIPAA enforcement actions against companies that went bankrupt or shut down in the wake of breaches.

"The Chapter 11 application ... should not stand in the way of OCR, state attorneys general or other federal and state regulatory bodies investigating AMCA or attempting to seek enforcement remedies," says privacy attorney David Holtzman of the security consulting firm CynergisTek.

OCR has signed HIPAA settlements with two organizations that either went out of business or filed for bankruptcy after a breach.

In 2018, OCR announced a $100,000 settlement with Filefax, a now-defunct medical records storage company at the center of a 2015 "dumpster diver" breach affecting more than 2,000 patients.

And in 2017, OCR announced a $2.3 million settlement with bankrupt cancer care clinic chain, 21st Century Oncology. Under the HIPAA resolution agreement with 21st Century Oncology, the monetary payment to OCR was made by the clinic's cyber insurer, Beazley Group.

RMCB's bankruptcy documents do not mention whether the company had any cyber insurance policies. An attorney handling the RMCB bankruptcy did not immediately respond to ISMG's inquiries about the company's Chapter 11 filing, including whether the debt collection agency had cyber insurance.

Lessons to Learn

So what lessons can other healthcare sector entities learn from the AMCA bankruptcy stemming from its data breach?

"One lesson to be learned from this fiasco is to ensure that all vendor agreements include provisions for what types of incidents have to be reported to your healthcare organization and when that notification must be provided," Holtzman says.

"Equally important is specifying in your vendor contract how information about incidents involving subcontractors is reported to you and rights to obtain information or investigate such incidents. The more access an organization has to your information system or the sensitivity of the data, the more comprehensive and thorough the examination."

Holtzman also advises organizations to "ask your vendors or contractors to identify and perform vendor management assessment of the subcontractors or vendors they hire to create or maintain your organization's personally identifiable data."

Privacy attorney Iliana Peters of the law firm Polsinelli says the bankruptcy filing by AMCA's parent company due to the breach is a warning to other organizations.

"The fact that an entity may be forced into bankruptcy at least in part as a result of the costs associated with the investigation of and state and federal regulatory requirements regarding a security incident or breach should be a wake-up call for entities in all sectors," she says.

"The events themselves are very scary, and the resulting costs are real, and should be planned for, including with regard to cyber incident insurance," she adds.

"This is also a very important issue for HIPAA covered entities and business associates to address in their business associate agreements, so that all entities involved in a business relationship understand how costs will be covered when a breach occurs."

Heap of medical pills in white, blue and other colors. Pills in plastic package. Concept of healthcare and medicine.

Heap of medical pills in white, blue and other colors. Pills in plastic package. Concept of healthcare and medicine.

Getty Images/iStockphoto

A MongoDB database was left open on the internet without a password, and by doing so, exposed the personal details and prescription information for more than 78,000 US patients.

The leaky database was discovered by the security team at vpnMentor, led by Noam Rotem and Ran Locar, who shared their findings exclusively with ZDNet earlier this week.

The database contained information on 391,649 prescriptions for a drug named Vascepa; used for lowering triglycerides (fats) in adults that are on a low-fat and low-cholesterol diet.

Additionally, the database also contained the collective information of over 78,000 patients who were prescribed Vascepa in the past.

Leaked information included patient data such as full names, addresses, cell phone numbers, and email addresses, but also prescription info such as prescribing doctor, pharmacy information, NPI number (National Provider Identifier), NABP E-Profile Number (National Association of Boards of Pharmacy), and more.

HIPAA leak screenshotHIPAA leak screenshot Image: vpnMentor

According to the vpnMentor team, all the prescription records were tagged as originating from PSKW, the legal name for a company that provides patient and provider messaging, co-pay, and assistance programs for healthcare organizations via a service named ConntectiveRX.

"We suspect the database may belong to ConnectiveRX, given the consistency of the tags in the data," the vpnMentor team said. "However, we only found data concerning Vascepa prescriptions, which makes it less clear where the leak originated."

It may have been PSKW itself, or a partner, a test system, or data that was possibly stolen from an unknown entity.

When we reached out to PSKW, the company denied owning any such database.

"The database referenced in the recent media article is not a database that we maintain or even have access to. We don't use that database management system at all for any of our programs," David Yakimischak, CTO at ConnectiveRx, told us via email

ZDNet also reached out to Amarin, the maker of the Vascepa drug, also seeking help in tracking down the database owner or any other additional information, but Amarin did not return our email.

vpnMentor argues that whoever left that database open -- may it be PSKW or one of its partners -- has violated HIPAA, and may be in line for a hefty fine for failing to encrypt the patient data it had stored on the database server, a HIPAA golden rule. However, Dissent, the administrator of DataBreaches.net, a website dedicated to tracking data breaches and HIPAA violations, told ZDNet that just because a system stores medical information, it doesn't mean it's necessarily covered by HIPAA. Until the database owner is found, no other conclusions can be drawn.

Article updated with comment from PSKW.

More data breach coverage:

Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime , Governance

Funding for Cybersecurity Enhancements Sought(@Ferguson_Writes) • June 19, 2019    22 State Attorneys General Seek Election Security Help

A group of 22 state attorneys general, mainly from Democratic-leaning states, are demanding Congress offer local officials more support - including grants and equipment standards - to improve election infrastructure security in the run-up to the 2020 presidential contest.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Minnesota Attorney General Keith Ellison is leading the coalition of attorneys general that sent the letter Tuesday to the chairmen and vice chairmen of the U.S. Senate Appropriation Committee as well as Senate Committee on Rules and Administration.

In the letter, Ellison writes that Russia has not only interfered in previous elections, but plans to do so again in 2020.

"The nature of the threat against our election system requires the federal government to provide increased assistance to the states," Ellison writes. "Securing our election systems is a matter of national security, and we hope that you will take immediate action to protect our election infrastructure and restore Americans' trust in our election system."

The letter comes as Senate Democrats are pushing for votes on election security measures that are being blocked by Majority Leader Mitch McConnell, R-Ky. according to The Hill.

McConnell has previously said that he would support legislation that would improve election security, but that Democratic proposals would take authority away from local governments.

"I'm open to considering legislation. But it has to be directed in a way that doesn't undermine state and local control of elections," McConnell recently told Fox News. The Democrats ... would like to nationalize everything. They want the federal government to take over broad swaths of the election process, because they think that would somehow benefit them."

The House is already moving a package of election security bills forward and expects to bring those up for a vote soon, the Hill reports.

Russian Interference

In his letter, Ellison makes several references to the report prepared by Special Counsel Robert Mueller that concluded Russian agents attempted to interfere in the 2016 presidential election.

When Mueller spoke about the report in May, he stressed that the report concluded that "the Russian government interfered in the 2016 presidential election in sweeping and systematic fashion" (see: Mueller Reconfirms Russian Election Interference Campaign).

As part of that investigation, Mueller indicted several Russian intelligence officers who allegedly launched various attacks against the U.S. election infrastructure in 2016 (see: 10 Takeaways: Russian Election Interference Indictment).

"The indictment alleges that they used sophisticated cyber techniques to hack into computers and networks used by the Clinton campaign. They stole private information and then released that information through fake online identities and through the organization WikiLeaks," Mueller noted during his press conference. "The releases were designed and timed to interfere with our election and to damage a presidential candidate."

In addition to these incidents, Ellison's letter points to news media reports that Russian agents successful breached the election infrastructure in Florida. It also notes that the U.S. Department of Homeland Security is investigating problems with computers in North Carolina during the 2016 election.

There are also reports of Russian agents attempting to plant malware in voting machines in eight states, the letter notes.

Because it's clear that Russia and other governments have the ability to use offensive cyber weapons to interfere with election infrastructure, the U.S. needs to begin countering these methods in time for the next election, says Joseph Carson, chief security scientist at Thycotic, a Washington-based security firm.

"One thing is clear: Foreign interference in the US elections has not stopped," Carson tells Information Security Media Group. "Instead, it has become more aggressive, placing the integrity of existing voting systems under serious scrutiny."

Other countries have started using technologies, such as machine learning and artificial intelligence, to counter these offensive cyber tools, and the U.S. needs to do the same, Carson says.

Action Items

In the letter, Ellison and the other attorneys general ask Congress to:

Provide grants to states and local municipalities to help pay for upgrades of aging equipment, improve voter registration databases and provide more security training for election officials; Create new federal cybersecurity and audit standards for voting machines and other equipment used in elections; Pass the "Secure Elections Act," which would help pave the way for improved information sharing among different federal agencies as well as local and state governments.

The letter from the attorneys general notes that in 2018, Congress provided $380 million to help local governments improve their election security, but it argues that more is needed. "Our state and local election officials are on the front lines of the fight to protect our election infrastructure, but they lack the resources necessary to combat a sophisticated foreign adversary like Russia," it states.

Governance , Incident & Breach Response , IT Risk Management

Mark Weir Talks Threats, Skills Development and Incident Response Priorities(euroinfosec) • June 19, 2019     Mark Weir, director of cybersecurity for U.K. and Ireland, Cisco

Cybersecurity truism: Defending organizations against attackers is more challenging than ever. "The complexity and sophistication of the threats has increased," says Mark Weir, Cisco's director of cybersecurity for the U.K. and Ireland. "What we're seeing a lot of at the moment as well is intellectual property theft."

See Also: Webinar | Passwords: Here Today, Gone Tomorrow? Be Careful What You Wish For.

Organizations, however, face numerous challenges when attempting to battle online attacks, including the need to constantly recruit more cybersecurity personnel as well as address difficult business questions regarding prioritizing defenses.

In a video interview at the recent Infosecurity Europe conference, Weir discusses:

Recent threats, including NotPetya, intellectual property theft and emerging malware; Businesses' security priorities and how they're changing; The cybersecurity skills challenge and Cisco's efforts to help.

Weir, director of cybersecurity for U.K. and Ireland at Cisco, has more than 25 years of IT experience. He previously worked at Fortinet and F5 Networks, and he has extensive experience in the data center and application development worlds.

  1. How to Block Advanced Threats
  2. NASA's JPL Seems To Be Having A Hard Time With Security
  3. Iran Claims To Have Thwarted A US Cyber Espionage Operation
  4. Oracle Patches Another Actively Exploited WebLogic 0-Day

Page 232 of 354