IT Security News Blast 02-20-2018

Millions Stolen in Cyber Bank Heist

The Financial Fallout of a Cyber Attack on a Business
There were 978 million victims of cybercrime last year and these people lost a combined $172 billion, according to Norton. Those numbers alone should be enough to make businesses sit up and take notice. […] The cost of cybercrime can be crippling for a business. Indeed, the latter example raises the prospect of a financial impact that could be keenly felt both on Australian trading platforms and around the political top table too, having a ripple effect throughout a whole economy.

Millions bagged in two bank cyber-heists
Russia’s central bank disclosed on Friday that hackers had made off with the equivalent of $6 million from a Russian bank last year by co-opting the banking industry’s global payments messaging system known as SWIFT, Reuters has reported. […] Meanwhile in India, news broke yesterday that hackers had breached the systems of the country’s City Union Bank and attempted to purloin nearly $2 million in another theft that was carried out by using SWIFT as a channel for diverting the money.

Global regulators neutral on new rules for ‘hyped’ fintech
Regulators have shied away from imposing heavy regulation on a fledgling sector, mindful that policymakers are keen keep their financial centers attractive to upstarts given the potential for jobs and growth they present.  […] Risks include the same as those for banks, such as cyber attacks, failing to comply with data privacy rules, and IT glitches.

Study in the The American Journal of Managed Care® Takes a Closer Look at What Types of Hospitals Have Data Breaches
Among other findings:
·       During the 7-year study period, 215 breaches affecting 500 or more people took place in 185 nonfederal acute care hospitals; 30 hospitals had more than one breach, and one hospital had four breaches.
·       Teaching hospitals and pediatric hospitals were more likely to experience breaches.
·       Larger hospitals (more than 400 beds) were more likely to have breaches than small (less than 100 beds) or medium hospitals (100 to 399 beds).
·       Investor-owned hospitals (for-profit) were less likely to have a data breach.

How the FTC Act, HIPAA Privacy Rule Impact Healthcare Orgs
Essentially, healthcare organizations must ensure that all of their statements to consumers are HIPAA compliant and also adhere to the FTC Act. For example, a provider cannot bury important information into its privacy policy or terms of use. This could be done by requiring a patient to click on a “patient authorization” link to learn more about how her information will be made viewable to the public. Once the link is clicked, the patient has “given permission” for her data to be used.

Getting a handle on mobile security in your enterprise
Mobile security is about access control and secure communications, paired with real-time detection and rapid response. Mobility has not been fully embraced, primarily because organisations feel that appropriate controls are not yet in place, says Eric Green, security strategist at Cyber Adapt.

U.N. chief urges global rules for cyber warfare
“I am absolutely convinced that, differently from the great battles of the past, which opened with a barrage of artillery or aerial bombardment, the next war will begin with a massive cyber attack to destroy military capacity… and paralyse basic infrastructure such as the electric networks.” He offered the United Nations as a platform where various players from scientists to governments could meet and work out such rules “to guarantee a more humane character” of any conflict involving information technology and, more broadly, to keep the internet as “an instrument in the service of good”.

Cyber security charter formed
The Charter delineates 10 action areas in cyber-security where governments and businesses must both become active. It calls for responsibility for cyber-security to be assumed at the highest levels of government and business, with the introduction of a dedicated ministry in governments and a chief information security officer at companies.

Most dangerous threats to the world in 2018 revealed… and it’s not just nukes and terror
Cybercrime remains the most pressing concern for Western liberal democracies, according to intelligence officials. They cited Russia, China, Iran and North Korea — as well as militant groups in the Middle East — as threats to global security. In his opening statement, Mr Coats warned the US is “under attack” by “entities using cyber to penetrate virtually every major action that takes place in the US”.

Lawsuits threaten infosec research — just when we need it most
Although lawsuits targeting reporters, particularly on the security beat, are rare, legal threats are an occupational hazard that reporters are all too aware of — from companies threatening to call an editor to demand a correction — or else — to a full-blown lawsuit. But the inevitable aftermath is a “chilling effect.” White-hat hackers and security researchers hesitate to report vulnerabilities and weaknesses to technology firms for fear of facing legal retribution. With nation state attackers targeting elections and critical national security infrastructure on a near-daily basis, security research is needed more than ever.

Congress Can Act Right Now to Prevent Interference in the 2018 Elections
“It is abundantly clear that we need to get ahead of anyone wanting to interfere with our elections,” Pocan explained in an interview following last week’s indictments and warnings. “We need better protections for our elections, including paper ballots for our voting machines.” Pocan and several of his colleagues are doing more than just talking about what “needs” to be done. They have prepared a legislative response that would work—if congressional leaders would allow it to be debated and enacted.

Russia Looms Large as U.S. Election Officials Prep for 2018
While virtually all 50 states have taken steps since the 2016 election to purchase more secure equipment, expand the use of paper ballots, improve cyber training or seek federal assistance, according to groups that track election security, some officials at the conferences expressed an added sense of urgency.

Apple Rushes Fix for Latest ‘Text Bomb’ Bug As Abuse Spreads
This most recent text bomb bug is triggered when someone sends two Unicode symbols using the Indian language (Telugu) characters to iOS and macOS apps using Apple’s default San Francisco font. When the message is received Apple’s home screen manager called Springboard hiccups resulting in apps freezing. […] Knowledge of the bug has motivated a wide range of malicious or prank attacks on Twitter.

Hackers made $3M on Jenkins server in one of biggest mining ops ever
Dubbed as JenkinsMiner, the campaign has the imprint of China all over it. It has been active since last 18 months and it is designed to target different versions of Microsoft Windows. XMRig miner is installed on Windows-based computers to generate cryptocurrency and hackers have now shifted their focus on Jenkins CI server to make more profits. JenkinsMiner is quite similar to RubyMiner because both malware negatively affects servers leading to slowing download times and even resulting in complete Denial of Service or DoS if the attack is strong enough.

Google reveals Edge bug that Microsoft has had trouble fixing
[The] flaw impacts the just-in-time compiler that Microsoft’s Edge browser uses to execute JavaScript and makes it possible to predict the memory space it is about to use. Once an attacker knows about that memory, they could pop their own code in there and have all sorts of naughty fun as Edge executes instructions of their choice rather than JavaScript in the web page the browser was rendering.

A ‘seal of approval’ for IoT security?
To ensure internet-of-things devices meet basic security standards, Sen. Edward J. Markey (D-Mass.) and Rep. Ted Lieu (D-Calif.) want a label  – like the Energy Star seal – that would indicate to buyers that IoT devices meet certain cybersecurity requirements. The Cyber Shield Act of 2017, introduced October 2017, would create an advisory committee to set the cyber and data security standards products would have to meet to receive the seal. The committee members would be chosen by the Secretary of Commerce from industry, academia, consumer advocates and the federal government, Markey said.

Rise of the ‘Hivenet’: Botnets That Think for Themselves
Hivenets are intelligent clusters of compromised devices built around swarm technology to create more-effective attack vectors. Whereas traditional botnets wait for commands from the bot herder, hivenets are able to make decisions independently. Hivenets will be able to use swarms of compromised devices to identify and assault different attack vectors all at once. As it identifies and compromises more devices, a hivenet would be able to grow exponentially, widening its ability to simultaneously attack multiple victims.—threats/rise-of-the-hivenet-botnets-that-think-for-themselves/a/d-id/1331062

HBO to dramatize Stuxnet cyber attack in upcoming drama
Officially, Israel has made no claim of responsibility for the Stuxnet virus which attacked Iran’s nuclear installations in 2010. Unofficially, experts have long believed that the Jewish state played a significant role – along with the US – in developing and deploying the cyber weapon. And now the dramatic tale will make its way to HBO, which is developing a miniseries based on the real-life story. According to Deadline, the series will be titled simply Stuxnet, and is based on the 2016 documentary Zero Days by Alex Gibney.




Critical Informatics and the Critical Informatics logo are the trademarks of Critical Informatics, Inc. All other brand names, trademarks, service marks and copyrights are the property of their respective owners.  © 2017 Critical Informatics, Inc. All rights reserved.