(252) 565-1235

Carolina IT Group

Call Us (252) 565-1235 Request Support Contact Us

More Bad News From The Equifax Breach

by

The news just keeps getting worse for Equifax.  The company has already had to revise their estimates of how many people were impacted by last year’s breach more than once, and now, they’re having to revise their estimate yet again.  This latest revision comes after company officials had to testify before Congress, which has been formally investigating the matter.

Prior to the release of Equifax’s latest “statement of record,” here’s a snapshot of how bad the data breach was:

5 million consumers had their Social Security numbers compromised

99 million consumers had address information exposed

3 million consumers had gender information exposed

3 million consumers had their phone numbers exposed

209,000 consumers had their credit card numbers exposed

97,500 consumers had their Tax Identification numbers exposed

Now, in addition to all of that, the company is adding the following:

6 million consumers had their driver’s license numbers exposed

12,000 had their Social Security and Taxpayer ID cards exposed

3200 consumers had their passports exposed

An additional 3000 had other documents, such as military and state ID’s compromised

As bad as it looks that the company has to keep revising their estimates upward, there’s a logical reason for it.  The data that was stolen didn’t come from a single database.  On top of that, the databases themselves all had highly variable structures, which has made it exceedingly difficult for forensic analysts to accurately assess the extent of the damage.  All that to say, since the process is still ongoing, we may see yet another upward revision of the scope and scale of the breach.

Of course, the company is doing what most companies do in cases like these:  They’re offering a year’s worth of free credit monitoring to impacted customers.  The ironic part of their offer though, is the fact that Equifax is offering their own credit monitoring service free for a year, which converts to a paid monitoring service after the year is up.  As Congressional officials rightly pointed out, this means that the company is essentially profiting off of its own breach, which is disturbing to say the least.

Some VW and Audi Cars May Be Hacked Through WiFi

by

Thanks to researchers Daan Keuper and Thijs Alkemade (who work at the Dutch cyber-security firm Computest), newly produced Golf GTE and Audi A3 vehicles are a little bit safer, and a lot less vulnerable to remote hacks.

The duo found that by taking advantage of these vehicles’ WiFi connection, they could access the cars’ IVI, (in-vehicle infotainment system) and from there, gain access to other systems as well.

The researchers had this to say about their work:

“Under certain conditions, attackers could listen in to conversations the driver is conducting via a car kit, turn the microphone on and off, as well as gaining access to the complete address book and conversation history.  Furthermore, due to the vulnerability, there is the possibility of discovering through the navigation system precisely where the driver has been, and to follow the car live wherever it is at any given time.”

It gets worse though.  Once the researchers had gained access to these systems, they found they could also access the car’s braking and acceleration systems. They stopped short of performing exploits on these for fear of violating Volkswagen’s intellectual property rights.  A hacker, however, would not hesitate to do so.

Worse still, the company apparently had no idea there was a problem. In fact, when the researchers presented their findings, they discovered that the company had deployed the IVI system completely untested.

Since bringing the issue to the company’s attention, they have addressed the issue. However, the fix only applies to newly manufactured vehicles.  If you purchased either of the models listed above prior to June 2016, your vehicle has not received the fix, and will not get fixed unless you take it back to the dealership.  There’s no way for the company to remotely install it.  That means there are untold thousands of cars on the road right now that are vulnerable.

Hacked Routers Being Used To Spread Malware

by

Beware of compromised routers spreading malware.  This is according to both Kaspersky Labs and a recently released government report.

Using hacked routers to spread malware is nothing new.  Security insiders have known about it for years. However, since 2008, the number of instances where routers are being used to push malicious code has been steadily increasing. Researchers are observing marked increases in their use by APTs (Advanced Persistent Threat) around the world.

APTs are nothing new either, although their ranks have been growing in recent years.  Many are state-sponsored hacking groups with virtually unlimited resources. Some are simply tight-knit groups of hackers banding together under a single banner.

Many people view hackers as lone wolves and that there are millions of lone wolves hacking networks across the globe.  Increasingly though, these are becoming minor actors on the world stage.  The real threat is now well-organized groups of hackers who can execute highly coordinated globe-spanning attacks and create botnets comprised of tens, or even hundreds of thousands, of compromised computers.

In addition to identifying and calling attention to a little-known attack vector, the recent announcement underscores an important weakness in current cybersecurity thinking.  Most people are still laboring under the faulty assumption that they’re facing individual hackers operating out of a dark room in someone’s basement.

While those types of threats are no doubt present, it’s false to assume that’s where the biggest danger lies.  If you get hacked, it’s just as likely (perhaps even more likely) that you’re actually facing a well-organized group who may have more resources at their disposal than your entire IT department.  While you’re preparing to fight a skirmish, the barbarians are coming to your gates with an army.  Most people are simply planning to fight the wrong type of battle, and that could prove to be a devastating mistake.

Contact Info

740 Greenville Blvd. SE., Ste. 400-374
Greenville, NC 27858

Phone: (252) 565-1235