IT Security News Blast 9-29-2017

Sonic hit with class action suit over POS data breach
“In an attempt to increase profits, Sonic Corporation negligently failed to maintain adequate technological safeguards to protect plaintiffs’ information from unauthorized access by hackers. Sonic Corporation knew and should have known that failure to maintain adequate technological safeguards could eventually result in a massive data breach,” the court document states.

SEC Sharpens Cybersecurity, Boosts RIA Exams
The cyber unit’s misconduct targets will include market manipulation schemes involving false information that are spread through electronic and social media; hacking to obtain material non-public information; violations involving distributed ledger technology and the so-called initial coin offerings (virtual coins or tokens); misconduct perpetrated using the dark web; intrusions into retail brokerage accounts; and cyber-related threats to trading platforms and other critical market infrastructure.

Cyber security fintechs can help restore trust
“The speed to make a decision, to onboard it, to paper it, is often slowed down by these compliance and risk processes. “Now, if we’re able to better provide that transformative layer that protects the fintech and allows them to have a different conversation of trust with their customers, then that’s going to allow them to move faster.”

6 cybersecurity tools to use in wake of the Equifax hack
Advisors have become accustomed to outsourcing general tech support and compliance functions. But, he says, firms rarely elevate cybersecurity to the same level of importance, in terms of both budgeting and strategic planning. […] If the fear of hackers themselves isn’t enough to persuade advisors to shore up their cyber moats, they should realize they can be held liable if they aren’t in compliance with their own state’s so-called “safeguards” provisions, Edelman says.

Half of U.S. Businesses Have Been Hacked
More than a third of the hacked businesses (38) percent spent more than $50,000 to respond: 10 percent spent $100,000 to $250,000, and seven percent more than $250,000. Seven in ten executives were concerned that data would be destroyed as a result of a cyber attack and 62 percent were concerned about equipment damage. The survey results backed up their worries: the most common consequence of cyber attacks was data loss (60 percent), followed by business interruption (55 percent).

Healthcare Accounted for 26 Percent of Cybersecurity Incidents in Q2 2017
The security firm reported that the health care sector and social media sites were popular cyberattack targets in the second quarter of 2017, and the health, education and public sectors accounting for more than half of total cybersecurity incidents globally in 2016 and 2017. McAfee Labs saw healthcare surpass the public sector to report the greatest number of security incidents in the second quarter of this year.

Why diverse cybersecurity teams are better at understanding threats, patient needs
“When security professionals have a broader lens through which to look at security, we’ll be able to provide better answers and support in protecting our systems,” Kwon said. […] “Such diversity in hiring cybersecurity professionals will naturally result in better gender and racial balance as well. If you are going to build a winning baseball team, you cannot fill the team with only pitchers or catchers.”

Lax Security to Blame For Record Pace of HIPAA Breaches, Feds Say
The 221 major breaches reported under HIPAA regulations so far this year mark a 66-percent increase over the 133 breaches reported for all of 2016, according to our analysis of records from the U.S. Department of Health and Human Services Office of Civil Rights (OCR). […] “Additionally, reported breaches of 500 or more due to ‘hacking or IT incidents’ are on the rise, which is consistent with the increase in cybersecurity threats aimed at health care organizations,” he added. “Cyber criminals target organizations who devote too little resources to security, which consequently makes such organizations vulnerable targets.”

Congress may finally get a cyber deterrence strategy from DoD at end of the month
For almost two years Senate Armed Services Chairman John McCain (R-Ariz.) has been asking the Defense Department for a cyber deterrence strategy and for two years McCain has not gotten what he wanted. Now, after Congress formally required DoD to present them with a comprehensive cyber deterrence strategy, lawmakers are being asked to wait a little longer for the policy. DoD is delaying the release of its cyber deterrence policy for the second time since the 2017 defense authorization act required the strategy.

Government Cyber Security Market in the US – Top 3 Drivers | Technavio
·       Increasing frequency and complexity of cyber attacks
·       Availability of IT spending budget
·       Adoption of the hybrid model—Top-3

Is the US ready for election hacking 2018?  No way.
Klobuchar says her Helping State and Local Governments Prevent Cyber Attacks Act would help combat foreign interference by providing state and local governments with information and resources they need to keep our elections secure and improve voter confidence. […] [The] bill provides for a grant program that helps provide states with $325 million in grant funds to implement these best practices. So far, Congress has shown no interest in taking up the problem. Klobuchar’s plan has somewhere between zero and no chance of becoming law.

Russian hacker wanted by U.S. tells court he worked for Putin’s party
Levashov’s comments offered a rare glimpse into the relationship between cyber criminals and the Russian state. U.S. officials say Russian authorities routinely shield hackers from prosecution abroad before recruiting them for espionage work. Russian hackers have been under intense scrutiny since U.S. intelligence officials accused Moscow of interfering in last year’s U.S. presidential election. The Kremlin has repeatedly denied the allegations.

Twitter tells frustrated lawmakers it shut 201 accounts tied to Russian operatives
Despite the disclosures, Sen. Mark Warner, D-Va., questioned whether the company is doing enough to stop Russian operatives from using its platform to spread disinformation and division in U.S. society. Warner said Twitter’s presentation to a closed-door meeting of Senate Intelligence Committee staffers Thursday morning was “deeply disappointing” and “inadequate on almost every level.” Twitter also made a presentation to House Intelligence Committee staffers in the afternoon.

Civil Liberties Activists Hit By Phishing Campaign
Activists with Fight for the Future, a nonprofit that’s campaigned against backdoors in mobile phones and for Net neutrality, and Free Press, a group that advocates for a free and open internet, received almost 70 phishing attempts over the course of a month, from July 7 to Aug. 8. […] Some attacks simply sent the victim a link to view a fake Gmail document or LinkedIn notification. One attack pretended to come from a target’s husband; the email was forged to include the husband’s actual name, Galperin and Cooper wrote. Another attack pretended to come as comment from YouTube from a legitimate YouTube video the target had uploaded.

Germany’s New Cyber Surveillance Agency Receives Carte Blanche for Mass Data Collection
While the German government aims to bring cyber crime to an end, the new agency may be a step too far. The mass data collection efforts by ZITiS will raise a lot of questions from privacy advocates. For the time being, there is no official assessment or evaluation of this project and how it will snoop on consumer data. That is not a good way to kick things off, especially not in this day and age of mass surveillance.

Skynet in China: Real-life ‘Person of Interest’ spying in real time
According to a documentary that ran on China Central Television, the security cameras use facial recognition to identify each person and then overlay a popup of personal information on the screen by the person. Descriptions include details such as age, gender, and other features such as clothing color. This happens in real time. The system knows who is who because Chinese people are reportedly given a photo national ID by the age of 16, and the data is stored in the Chinese government’s database. That makes it easy to tag and track people.

FBI’s Wray says nat’l security, crime all have cybersecurity element
“Section 702 is a critical tool that the intelligence community uses properly to target non-U.S. persons located outside the United States to acquire information vital to our national security,” he said, offering assurances that the program won’t encourage government overreach. “To protect privacy and civil liberties, this program has operated under strict rules and been carefully overseen by all three branches of the government.

Hackers Exploiting Microsoft Servers to Mine Monero – Makes $63,000 In 3 Months
According to a report published by ESET today, cybercriminals only made modifications to legitimate open source Monero mining software and exploited a known vulnerability in Microsoft IIS 6.0 to secretly install the miner on unpatched Windows servers. Although ESET’s investigation does not identify the attackers, it reports that the attackers have been infecting unpatched Windows web servers with the cryptocurrency miner since at least May 2017 to mine ‘Monero,’ a Bitcoin-like cryptocurrency.

ATM hackers switch to network-based attacks
“Once the criminals have established a solid foothold into the bank’s network, they then go on to perform lateral movement to identify and access other sub-networks, including the ATMs. Normally, banks have a clear separation between their corporate network and that of the ATMs, with separate routing and rewalls or other defenses. Some banks do have a at network, thus making the hackers’ lives much easier, but these tend to be a lot rarer.”

A Layman’s Guide to Cyber Security
It doesn’t matter if you never use the Internet or live on it. Your data is out there. […] However, it is becoming more and more apparent that personal data breaches may be the most significant personal catastrophe most of us experience. I have always preached “preparedness”. We must plan for the worst scenario and pray it doesn’t happen.  If it does, we must take personal responsibility for our survival.

Dark-Web Drug Dealer Arrested After He Travelled US for World Beard Championships
Vallerius was suspected of openly advertising and selling drugs including cocaine, LSD, methamphetamine, fentanyl and oxycodone, on Dream Market between May 2015 and August 2017. After searching his laptop, officials confirmed Vallerius’ log-in credential for Dream Market and uncovered roughly $500,000 worth of bitcoins—the currency used to complete the transactions—and a PGP encryption key entitled OxyMonster.


Critical Informatics and the Critical Informatics logo are the trademarks of Critical Informatics, Inc. All other brand names, trademarks, service marks and copyrights are the property of their respective owners.  © 2017 Critical Informatics, Inc. All rights reserved.