Log inRegister

Fraud News

Anti-Phishing, DMARC , Business Continuity Management / Disaster Recovery , Business Email Compromise (BEC)

Presented by Lastline     60 minutes    Live Webinar: Keep Your Cybersecurity Team Happy, Engaged and Employed (By You!)

One of the most-heard complaints from security experts is that often they find their work repetitive ("The CFO's laptop has been compromised... again!"), which results in the desire of trying something "new", meaning "leave for another company." Another common complaint is that the work is very compartmentalized, and there are few occasions in which the various security specialists can enjoy working as a team.

One activity that can help build a team while improving the security skills of the people involved is participating in Capture the Flag (CTF) hacking competitions. In 2003 at the University of California at Santa Barbara, one of the world's largest attack-defense CTF competitions began and has grown year-after-year, pushing the limits of the players and providing opportunities for better learning. In addition, hacking competitions are a great opportunity for recruiting new talent: CTF participants are highly skilled, well-motivated, and hard-working, which are great traits for a future employee.

Attend this webinar to learn:

What hacking competitions are and how they can be used as a recruitment tool Their usefulness in training and retaining employees How to create or participate in hacking competition easily and gradually

Application Security , Next-Generation Technologies & Secure Development , Security Operations

Presented by Cequence Security     60 Minutes    Live Webinar | The New #1 Cyber Threat - Attacks on the Applications that Power Your Business

In today's hyper-connected organizations, you depend on externally facing web, mobile, and API-based applications to connect with customers, partners, suppliers, and employees. These strategically important applications support business processes and enable you to create an extended, efficient digital ecosystem.

Unfortunately, these same applications have become primary targets for two vastly different, but equally dangerous, types of cyberattacks. Successful application breaches can lead to financial fraud, stolen IP, and business disruption.

Cequence Security recently completed two separate research projects with Ponemon Institute and Osterman Research, which provide insights into these attacks and defense strategies at nearly 900 organizations across the US.

Register for this live webinar and learn:

What the two cyberattacks are and how they're dangerous; How they're impacting your peers; What you can do to protect your hyper-connected organization.

Enterprises today have many digital ways of interacting with their customers - and therefore just as many ways for authenticating those users and transactions. Sesh Venkataraman of CA Technologies explains the business value of omnichannel authentication solutions.

Venkataraman, the senior director of product management at CA, now a Broadcom company, explains that omnichannel authentication has become a must to improve security, efficiency and reduce customer friction.

"Enterprises want to streamline interactions with their users," he says. "[They want to] develop a consistent authentication strategy across services and across access channels that is risk-based."

The endgame: Streamlining authentication and providing one unified customer experience across all customer channels.

In an interview about omnichannel authentication, he discusses:

How it differs from traditional models; Strategies and tools to enable it; The business benefits to be gained.

Venkataraman is responsible for the company's GTM efforts of its Identity Risk Insight Suite (IRIS) portfolio - a Digital Identity and Anti-fraud Cloud service. His responsibilities include the product's go-to-market, driving sales, gathering customer and marketing insights and driving innovation.

Prior to CA/Broadcom, he managed products & services, overseeing several million dollars in revenue growth delivering mobile messaging services, location based services, mobile identity and fraud detection services.

He has over 15 years in the industry with 8+ years in product management of payment security, risk insights, mobile enterprise cloud services & 7+ years as a core technologist.

US border crossing Image copyright davelogan Image caption Facial recognition cameras are used widely at border crossings

Images of tens of thousands of people crossing the US border with Mexico have been stolen in a major hack, the US Customs and Border Patrol (CBP) has said.

The breach, which affected the network of a sub-contractor, also saw photos of vehicle licence plates stolen, said the CBP.

It said fewer than 100,000 people were affected based on "initial reports".

It also contradicted claims that image data had been shared on the dark web.

"CBP has alerted Members of Congress and is working closely with other law enforcement agencies and cyber-security entities... to actively investigate the incident," it added.

Amazon heads off facial ID rebellion Police 'miss' chances to improve face tech

CBP uses cameras at airports and land border crossings as part of a growing facial-recognition programme designed to track people entering and exiting the US.

The agency said the sub-contractor in the breach had stored the images on its systems without official consent, and that CBP's own systems were not affected.

The pictures were of people in vehicles entering and leaving the country via a single border entry point, which CBP did not name.

Image copyright Getty Images Image caption Surveillance systems harm our privacy, campaigners say

It said that no other identifying information - such as passport data or other travel document photos - had been compromised.

In late May, technology news website the Register reported that images of licence plates belonging to vehicles passing through CBP checkpoints had been shared on the dark web.

But the agency, which learned of the breach on 31 May, said none of the image data had been identified "on the dark web or internet".

US law enforcement agencies argue that facial recognition systems enhance border security and help to catch criminals.

But there are growing concerns they may infringe privacy and increase the risk of identity theft.

Senator Ron Wyden told the Washington Post: "If the government collects sensitive information about Americans, it is responsible for protecting it - and that's just as true if it contracts with a private company.

"Anyone whose information was compromised should be notified by customs, and the government needs to explain exactly how it intends to prevent this kind of breach from happening in the future."

Neema Singh Guliani, senior legislative counsel at the American Civil Liberties Union, said: "This breach comes just as CBP seeks to expand its massive face recognition apparatus and collection of sensitive information from travellers, including licence plate information and social media identifiers.

"This incident further underscores the need to put the brakes on these efforts and for Congress to investigate the agency's data practices."

) • June 11, 2019     10 Minutes   

What stands out most about a proposed $74 million settlement of a class action lawsuit against Premera Blue Cross in the wake of a 2014 data breach that affected 11 million individuals? Technology attorney Steven Teppler points to the attention given to "fixing" the health insurer's security problems.

The proposed agreement, which was filed on May 31 in a federal court in Oregon, would settle a class action lawsuit that consolidated more than 40 lawsuits filed after the data breach was revealed in March 2015 by the Seattle-based insurer. It awaits court approval.

The settlement proposes $32 million for breach victims and related legal costs and would require the health insurer to invest $42 million in bolstering data security.

The settlement "not only takes care of victims, but takes care of business internally at the organization to make sure there are resources devoted to fixing or mitigating the security problem, but also that there are ways to establish milestones to make sure what is promised is actually done," Teppler says in an interview with Information Security Media Group.

Enhancing Security

Under the settlement, Premera would spend at least $14 million annually over the next three years on enhanced data security measures. Those include taking action to encrypt sensitive data, such as member names and Social Security numbers, implement and maintain two-factor authentication for remote access and conducting an annual IT security audit.

These types of prescriptive measures are becoming more common in the settlements of breach-related civil lawsuits, notes Teppler, who was not involved in the Premera case.

"You're seeing multiple data breaches, serial data breaches, data breaches that serve as the poster children for breaches that happen subsequently," he says. As a result, he says, more breach settlements include "consent decrees that require step-by-step monitoring, auditing and corrective actions by the defendant."

In this interview (see audio link below photo), Teppler also:

Analyzes other terms in the proposed settlement in the Premera case; Reviews lessons from cyberattacks involving nation-states; Discusses other emerging data breach lawsuit trends.

Teppler leads the electronic discovery and technology-based litigation practice at the law firm Mandelbaum Salsburg P.C. He's the co-chair of the American Bar Association's IoT Committee; a member of the Seventh Circuit Court of Appeals Electronic Discovery Pilot Program; a founder and co-chair of the American Bar Association's IoT National Institute as well as the American Bar Association's National Institute on Electronic Discovery and Information Governance; and a contributing author of the ANSI X9F4 trusted timestamp guideline standards for the financial industry.

Cybercrime , Fraud Management & Cybercrime , Governance

Social-Planning Website Says Pre-2014 User Database Has Been Stolen(euroinfosec) • June 11, 2019    No Invitation Required: Hackers Can Phish Evite UsersIt's hackers' party; cry if you want to.

Online invitation site Evite says it was hacked and information on an unspecified number of users was stolen. Although the breach appears to have happened between Feb. 22 and May 14, the stolen information dates from 2013 and before.

See Also: Webinar | The Future of Adaptive Authentication in Financial Services

Founded in 1998, Los Angeles-based Evite is a social-planning website that allows users to create, send and manage online invitations.

"Back in 2013, I was beginning to get the sense that data breaches were becoming a big thing." 

"Potentially affected information could include names, usernames, email addresses, passwords and, if optionally provided to us, dates of birth, phone numbers and mailing addresses," Evite says in its data breach notification.

"We continue to monitor our systems for unauthorized access, have introduced additional security measures, and will be prompting affected Evite users to reset their Evite passwords on their next log-in," it adds.

So on the upside, if hackers want to invite you to their party, it's possible they're not going to get your contact details right.

On the downside, Evite says whoever stole the data can use it to send phishing messages that may well get through.

Existential Issues

The Evite breach is a reminder of this perpetual, existential data breach problem: We don't know how bad data breaches are because we don't know how many more super-bad historical mega-breaches have yet to come to light. Furthermore, if an organization gets badly breached today, but the breach doesn't get discovered for another five or 10 years, our future view of today's data breach landscape will have to be revised (see: Battling Big Breaches: Are We Getting Better?).

Many breaches don't go years before being detected. FireEye's Mandiant 2019 M-Trends report found that for breaches that an organization self-discovered in 2018, attackers had been inside the network for an average of 50.5 days. But when an organization was tipped off to the breach from an external source, as Citrix was, attackers had already been inside the network for an average of 184 days, or just over six months (see Citrix Hackers Camped in Tech Giant's Network for 6 Months).

But historical breaches that go undiscovered - or, as in the cases of LinkedIn and Yahoo, were poorly investigated or covered up - continue to crop up.

So, too, do organizations that lose information that they should never have left lying around. This concept, known as data minimization, is a cornerstone of the EU's General Data Protection Regulation. Thanks to GDPR, at least where Europeans' personal data is concerned, it belongs to individuals, and any organization that stores the data does not own it, but must safeguard it. Part of that safeguarding requires the organization to regularly review what it is storing and why, and if it should not be storing the data any longer, to delete it.

Evite's Passive Data Breach Voice

Evite says one or more hackers managed to obtain an "inactive data storage file associated with Evite user accounts."

The company says it's continuing to investigate the breach. "Upon discovering the incident, we took steps to understand the nature and scope of the issue, and brought in external forensic consultants that specialize in cyberattacks. We coordinated with law enforcement regarding the incident, and are working with leading security experts to address any vulnerabilities."

Unfortunately, Evite users whose data was stolen could be easily targeted, as the company writes in a breach notification that makes heavy use of the passive voice (see: Hackers Love to Strike on Saturday).

"Emails regarding this issue were sent to users whose personal data was stored in the inactive data storage file that was acquired by the unauthorized party," Evite says.

By that, Evite meant that it has been emailing affected users directly. But it warns that such emails could come from anyone. "Please note that the email from Evite does not ask you to click on any links or contain attachments and does not request your personal data," it says. "If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by Evite and may be an attempt to steal your personal data."

The company didn't immediately respond to a request for comment about how many users were affected or in which geographies. The company's data breach notification, however, lists contact telephone numbers for both U.S. and international users.

Here's What Active Security Looks Like

Breaches such as Evite's make some of the security features built into Apple's forthcoming iOS 13 mobile operation system look like a great idea. Using the new operating system, for any iOS app, you will be able to have iOS hide your email address for any service you sign up to. Behind the scenes, Apple will supply a random email address to the app, then relay any messages. As a result, this will mean that if the service suffers a breach, attackers won't have your real email address. In addition, it would likely make it easier for the likes of Apple to spot emerging phishing attacks and block those too. The new version of iOS is due out this fall.

News of the Evite breach arrives the same day that Troy Hunt, the Australian developer who created the free Have I Been Pwned? breach notification service nearly six years ago, announced that the service has grown so big that he's exploring M&A possibilities for its future. The service allows anyone to register an email address and then sends an alert to that email.

The Australian government and the U.K. National Cyber Security Center - the public-facing arm of GCHQ - are among the organizations that are working with HIBP to monitor their own domains.

Simpler Times

"Back in 2013, I was beginning to get the sense that data breaches were becoming a big thing," Hunt writes in a Tuesday blog post.

Since them, however, HIBP has grown to encompass 8 billion breached records that Hunt loads in. Speaking at least week's Infosecurity Europe conference in London, where he was inducted into the conference's hall of fame, Hunt said he only learns when his information has appeared in a breach cataloged by HIBP when the site emails him as well, which he said has happened so far more than a dozen times.

Hunt says that nearly 3 million individuals have subscribed to HIBP to get notifications when their email appears in a data dump, as have numerous administrators of sites run by businesses, government agencies and others. "I've emailed those folks about a breach 7 million times, there are 120,000 people monitoring domains they've done 230,000 searches for and I've emailed them another 1.1 million times."

As organizations continue to get breached and to discover old breaches, of course that number is going to continue to rise.

All of this breached data is a boon for nation-state espionage teams as well as cybercriminals, because it gives them more ways to potentially blackmail individuals, commit identity theft, steal online banking credentials, trick users into executing ransomware or wage other types of attacks.

Where data breaches are concerned, it's still hackers' party. You can cry if you want to.

Troy Hunt, inventor and operator of the popular security website Have I Been Pwned (HIBP), is putting the service up for sale.

Hunt, a Microsoft Regional Director and MVP for security, created the site in 2013 after Adobe leaked 153 million usernames and weakly encrypted passwords. Users can enter an email address and discover if it is included in the exposed data. You can also enter a password to see if it features in a data breach.

The site was soon extended with data from other breaches and now contains nearly 8 billion records. HIBP publishes an API which gets over 12 million hits a day, most of them checking whether a password is safe to use. Mozilla's Firefox is one of a number of products that integrates with the API to help users choose strong passwords. Commercial subscribers, governments and law enforcement agencies use the service too.

Hunt said in today's announcement that "to date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team', there's one guy keeping the whole thing afloat."

Common passwords have been leaked, this one over 1 million times

Common passwords have been leaked, this one over 1 million times

He said that maintaining the site has been stressful and has taken him close to burnout. He believes it is time to put the business up for acquisition, which he is doing with KPMG.

The acquisition project is called Project Svalbard, in tribute to a Norwegian effort to store a vault of seeds to protect against future loss. "It sounds like a befitting name, beginning with the obvious analogy of storing a massive quantity of 'units'," Hunt said.

The question everyone will be asking: will the service get worse? Hunt said he will remain part of HIBP and that consumer searches will still be free. The idea is that a bigger organisation will enable him to build out more capabilities.

He also wants to put more effort into changing the behaviour of both individuals and organisations, in respect of their poor security practices.

Hunt has fallen behind, he said, on responsible disclosure – informing organisations that they have been breached. This he called "massively burdensome".

When will it happen? No hurry, said Hunt. "I'm not under any duress (not beyond the high workload, that is) and I've got time to let the acquisition search play out organically and allow it to find the best possible match for the project."

But he does not want to lead a new nonprofit even with sponsorship from other companies, believing that this would increase rather than reduce the stress he is under.

The site performs an excellent, though dispiriting, service. Those of us who have had active email accounts for many years are likely to feature multiple times in the HIBP database. Your correspondent's, for example, is in 20 data breaches including Adobe, Bit.ly, Creative, Disqus, Dropbox, Kickstarter, Last.fm, MySpace and vBulletin, as reported by HIBP.

Sane security today means unique passwords for every site and a password manager, along with other strategies like multi-factor authentication, but take-up is weak as data from services like Microsoft's Office 365 demonstrates.®

  1. FTSE 250 Firms Exposed To Possible Cyber Attacks
  2. Microsoft Warns Of Email Attacks Executing Code Using An Old Bug
  3. Emuparadise Gaming Emulator Website Suffers Data Breach
  4. VLC Player Gets Patched For Two High Severity Bugs

Page 240 of 354