• Search for:
    10Oct, 2023
    List of Data Breaches and Cyber Attacks in 2023

    1. DarkBeam

    The three elements of information security are confidentiality, integrity and availability. In other words, data has to be reliable and up to date, and accessible only to those who need it.

    Instances of data being exposed to the Internet – more often than not via configuration errors – clearly breach the confidentiality principle, but are often viewed as somehow less serious than information that’s made its way into criminals’ possession via sophisticated cyber attacks or phishing campaigns, as if human error is less of an issue than criminal hacking.

    This is, of course, an erroneous position to take. Search engines such as Shodan – theoretically, at least – let anyone find anything that’s connected to the Internet, not just websites that are indexed by Google. This, obviously, includes opportunistic criminals as well as civic-minded security researchers who identify exposed services and warn their operators.

    This brings us to DarkBeam. According to Cybernews, the CEO of SecurityDiscovery, Bob Diachenko, discovered on 18 September that the digital risk protection firm DarkBeam had “left an Elasticsearch and Kibana interface unprotected, exposing records with user emails and passwords from previously reported and non-reported data breaches”.

    Diachenko informed DarkBeam, which closed the vulnerability immediately.

    Although most of the 3.8 billion exposed data records come from previous data breaches, ironically having been assembled by DarkBeam in order to alert its customers to security incidents affecting their personal information, the extent of the information held by DarkBeam, as well as the way it was organised, means anyone who managed to access it has the opportunity to create very plausible phishing campaigns.

    It’s not yet known whether anyone did access it but, as Benjamin Franklin said, distrust and caution are the parents of security. So, it’s worth checking your credentials via haveibeenpwned.com and taking the usual precautions, such as changing your password where it’s been reused, implementing multifactor authentication where possible and not clicking on any links unless you’re absolutely sure of their source.

    2. MOVEit

    As with last month (see below), the MOVEit breach continues to claim victims, among which the most significant – at least in terms of the number of individual victims – was Better Outcomes Registry & Network, which discovered that “personal health information of approximately 3.4 million people – mostly those seeking pregnancy care and newborns who were born in Ontario between January 2010 and May 2023” had been compromised.

    Other recently identified MOVEit victims include:

    The scale of the MOVEit breach remains unquantified, but some estimates now put the number of affected organisations at over 2,000 and the number of individual victims at over 60 million.

    It’s likely that we’ll continue to see breach disclosures related to MOVEit Transfer in the weeks and months to come.

    3. Undisclosed restaurant database

    The personal information of 2.2 million Pakistani citizens, including their contact numbers and credit card details, has been offered for sale online on the dark web for 2 Bitcoin. The data was apparently compromised when criminal hackers accessed a database used by more than 250 restaurants.

    Indolj – a popular food ordering app – has taken the step of denying any involvement, saying in a press release reported by Pro Pakistani: “We have conducted a detailed audit of the sample data and determined that the data records do not match the current transactional records of customers on the Indolj platform. Furthermore, Indolj does not store any credit card or payment-related information and therefore it is impossible for any customer payment data to be breached from our platform.”

    According to Geo News, the criminals provided a sample of the stolen data as part of their online listing, while naming “dozens of food outlets”.

    However, having analysed the available data, the security company CTM360 confirms Indolj’s analysis. In a comment published by Pakstani Pro, the company claims that the data in fact comes from a 2022 leak, and says it will continue to monitor the post “and will notify impacted organizations urgently if any credible data is released”.

    Resource : https://www.itgovernance.co.uk/blog/list-of-data-breaches-and-cyber-attacks-in-2023#:~:text=See%20the%20full%20list%20of%20data%20breaches%20for%20September%202023&text=September%20saw%20the%20biggest%20data,misconfigured%20Elasticsearch%20and%20Kibana%20interface.

    19Nov, 2022
    4 Common Threats A Web Application Firewall Can Prevent From Cyber Attack

    A Web Application Firewall (WAF) is a tool that filters the incoming and outgoing traffic at the application layer.

    Based on the pre-set rules by a business and WAF provider, it either blocks the traffic it deems malicious or allows it to enter the network.

    For companies that do business via versatile applications or have developed their own unique app-based service, the WAF tool is an essential layer of cybersecurity.

    In the last couple of years, there has been a surge of cyber threats in general, but some types of attacks appeared in greater frequency than others.

    Here, we discuss some major threats and weaknesses within the application that WAF can identify and protect against.

    How common are the listed attacks, and how can a Web Application Firewall aid in their prevention?

    Distributed Denial of Service (DDoS)

    At the start of 2022, the number of Distributed Denial of Service Attacks (DDoS) increased by 203% compared to the previous year.

    What this type of cyber threat does is overwhelm the website or application with a surge of fake traffic.

    As a result, it can significantly slow down the application — to the point of unusability. In the worst-case scenario, DDoS attacks have taken down entire websites or applications.

    Users that have been using the application decide to uninstall the app or leave their shopping carts if the website is running too slow.

    A Web Application Firewall is the most important tool for DDoS protection.

    The tool is automated and uses machine learning to determine the patterns that differentiate the usual traffic from that which is not normal for the organization in type or even frequency. It can detect and block false traffic on its tracks, not letting it disrupt the network.

    Social Engineering Attacks

    Phishing is the most common and well-known kind of social engineering attack.

    In 2021, over 87% of companies have reported that they’ve been targeted with bulk phishing — in which hackers send as many emails to any addresses they can find.

    Bulk phishing is one type of many that are being sent around with the hope that the recipient accidentally installs a virus on their device.

    It takes one worker to click on the malware-infected link in the body of an email, install the virus hidden within an attachment or send their credentials to a person that is impersonating their boss.

    Social engineering attacks rely on human errors to create a direct path that leads them into the organization.

    While WAF can’t prevent the employee from clicking the link and downloading the malicious malware hidden in the attachment, it can thwart the email from reaching the unsuspected team member in the first place.

    WAF is crucial for detecting more advanced phishing attempts that don’t follow the typical script and use more cunning methods to impersonate the bank, police, or higher-ups within the company.

    Ransomware

    So far in 2022, over 70% of organizations have been targeted with a ransomware attack — which is the highest percentage recorded so far.

    In cases when the cyber criminal successfully breached the network with malware, the user would be locked out of certain files, or even the entire network would be inaccessible.

    After encrypting files, the hacker follows it up with a message on the screen that lists ransom demands. Mostly, there is a request for payment in crypto after which the victim will supposedly get a key to decrypting documents.

    For businesses, this means that they would either lose time and not be able to operate as usual (without the essential documents). In other cases, it could mean that they would have to rebuild their entire infrastructure.

    Ransomware attacks have been getting more sophisticated (besides encrypting data, they also obtain it) and nowadays are even offered as a service — which means that anyone can order and use it with little hacking knowledge.

    WAF prevents that type of malware from communicating with centers that are tasked with Command and Control.

    OWASP Top 10

    OWASP is the key resource to which developers turn to web app security. After testing applications from versatile threats, the site lists the top weaknesses that would have enabled cybercriminals to compromise their work.

    The list of the latest OWASP top 10 flaws that could be exploited by hackers currently includes:

    • Broken access control — the most common type of flaw detected in the tested apps
    • Cryptographic failures — that can lead to the exposure of personal information
    • Injection — the ability of hackers to inject malicious code and gain control over the entire application
    • Insecure design — sacrificing security over novel design features
    • Security misconfiguration — mistakes in the way the safety controls are implemented
    • Vulnerable and outdated components — using parts that have well-known weaknesses that can be exploited
    • Identification and authentication failures — that can result in data breaches
    • Software and data integrity failure — assuming instead of verifying the integrity
    • Security logging and monitoring failure — that cause inaccurate forensics or false alerts
    • Server-side request forgery — that could give the hacker control over app requests

    Reliable WAF is created and continually updated according to the list of OWASP’s top threats.

    Therefore, it encrypts the communication between the user and the network, continually examines any login attempts and prevents malicious HTTP sessions.

    To Conclude

    There are more flaws and online threats than we mentioned here and even more potential vulnerabilities than listed in OWASP’s top 10.

    Many of them are advanced and zero-day threats that traditional tools can’t automatically identify and remove before they cause an incident.

    Ransomware, DDoS, flaws listed by OWASP, and phishing are only some common cyber threats that WAF is designed to prevent.

    As the tool that is first in the line against threat actors, a Web Application Firewall is an important layer of protection against malicious activity.

    Paired with other essential tools (such as anti-malware and antivirus software) that can detect and mitigate threats, it creates strong security for any business.

    Resource : https://cybersecuritynews.com/4-common-threats-a-web-application-firewall-can-prevent-from-cyber-attack/

    7Nov, 2022
    World’s Most Expensive Observatory Floored by Cyber-Attack

    The world-famous Atacama Large Millimeter Array (ALMA) observatory in Chile has become the latest unlikely victim of a cyber-attack, forcing it offline.

    The facility, which also claims to house the world’s most powerful telescope for observing molecular gas and dust, revealed the incident on Twitter earlier this week.

    It said the attack on its computer systems came last Saturday, “forcing the suspension of astronomical observations and the public website.”

    At the time of writing, the official ALMA website was still down.

    “There are limited email services at the observatory. The threat has been contained, and our specialists are working hard to restore affected systems. The attack did not compromise the ALMA antennas or any scientific data,” it explained.

    “Given the nature of the episode, it is not yet possible to estimate a date for a return to regular activities. We are thankful for the support across the ALMA partnership and apologize for any inconveniences resulting from the recovery efforts.”

    Kelvin Murray, senior threat researcher at OpenText Security Solutions, argued that space-related technology is increasingly a focus for threat actors.

    “The cyber-attack on the ALMA radio telescope is a stark reminder that no matter the industry, cyber-defenses need to be regularly assessed and updated to ensure that hacks like these don’t happen,” he added.

    “As digital equipment and software develops, the industry needs to keep cyber risk top of mind and continually assess the strength of its defenses. The consequence of the breach cannot be undermined.”

    It remains to be seen what kind of attack the observatory suffered, although ransomware would be an obvious candidate given the facility was forced offline.

    Chris Vaughan, VP of technical account management EMEA at Tanium, argued that ALMA was likely working with “very limited” IT budgets and staff.

    “A high level of network visibility should be utilized as part of a zero-trust approach. This is where implicit trust is eliminated and the principle of ‘never trust, always verify’ is used,” he advised.

    “This means that strong authentication methods, network segmentation and lateral movement prevention is key. If these practices are embedded within an organization’s culture along with effective staff training, then institutions like ALMA can carry on their fantastic work without costly interruptions caused by cyber-threats.”

    ALMA is believed to have cost around $1.4bn to build.

    Resource : https://www.infosecurity-magazine.com/news/worlds-most-expensive-observatory/

    18Jul, 2022
    Info Security News – Lithuanian ad website hit by cyberattack, warns of possible customer data leak

    Data of thousands of customers might have been leaked after the Lithuanian ad website alio. lt was hit by a cyber attack on Thursday.

    “It looks like it might have been yet another Russian attack against Lithuania’s online space, a kind of attack, which the majority of business entities appear unable to resist,” Kristi Jonas Šiaulys, head of IT at alio. lt, said in a press release.

    “We are making considerable efforts to protect our users and contain the data security breach and are already implementing the entire legal action plan,” he added.

    Hackers tried to extract data of 345,000 users from the database of the website during the attack.

    “It is not yet possible to specify the precise quantity of data that has been extracted. We have notified the State Data Protection Inspectorate, the Computer Emergency Response Team, and the police about the incident. Investigations will follow,” Šaulys said.

    The portal stressed it did not store particularly sensitive information, such as bank account and payment card details, personal ID codes, and home addresses in its database.

    Alio. lt is owned by Estonia’s Ekspress Grupp, which also owns delfi. lt news website.

    Recourse : https://www.lrt.lt/en/news-in-english/19/1739037/lithuanian-ad-website- hit-by-cyberattack-warns-of-possible-customer-data-leak