Security Alert – Page 12

Paypal-Owned Company Sees Breach Of 1.6 Million Customers

December 20, 2017 by Joseph Martin

TIO Networks, a cloud-based, multi-channel bill payment platform purchased by Paypal for $233 million in 2017, was breached earlier this year, exposing PII (Personally Identifiable Information) for an estimated 1.6 million of the service’s users.

TIO Networks primarily does payment processing and accounts receivables for cable, utility, wireless and telecom companies in North America. If you do business with TIO, it’s possible that your company or personal information may have been compromised.

So far, neither Paypal nor TIO Networks has released any significant details about the breach, so we do not yet have any indication of how it happened, who was responsible or exactly which of their customers had their information exposed. Paypal did release a brief statement concerning the incident, which said, in part:

“The PayPal platform is not impacted in any way, as the TIO systems are completely separate from the PayPal network, and PayPal’s customers’ data remains secure.”

The statement went on to say that as soon as PayPal identified the breach, they took action by “initiating an internal investigation of TIO and bringing in additional third-party cybersecurity expertise to review TIO’s bill payment platform.”

For their part, TIO Networks has suspended all operations until the investigation into the matter has been completed, and has begun notifying impacted customers. In addition to that, as is common with situations like these, they’re also working with Experian to provide a year’s worth of free credit monitoring for people who were affected.

A part of TIO’s statement about the incident reads as follows: “At this point, TIO cannot provide a timeline for restoring bill pay services, and continues to recommend that you contact your biller to identify alternative ways to pay your bills….We sincerely apologize for any inconvenience caused to you by the disruption of TIO’s service.”

Joseph Martin

President & CEO
I hope you enjoyed this article. My mission is to take your stress away from dealing with IT problems. Call (252) 565-1235 or send me a message at our contact us page if you have a question, comment or want help.

Former Employees Pose Serious Risk To Security

December 19, 2017 by Joseph Martin

The Department of Health and Human Services’ Office for Civil Rights (OCR) has reminded those who deal with PHI and PII of the dangers that terminated employees can pose to system security in their monthly cyber security newsletter. Their advice is as timely as it is excellent, and includes the following:

“Making sure that user accounts are terminated so that former workforce members don’t have access to data is one important way Identity and Access Management can help reduce risks posed by insider threats.

IAM can include many processes, but most commonly would include the processes by which appropriate access to data is granted, and eventually terminated, by creating and managing user accounts.”

Kate Borten, President of The Marblehead Group, agrees, citing Verizon’s 2017 Data Breach Investigations Report, which was released earlier this year and named health care as the industry with the highest number of insider breaches.

OCR has published an extensive list of recommendations, which include:

• The creation and maintenance of user access logs used to determine when a user’s access levels are increased, or new equipment is assigned. These logs can also be used to track and trace precisely who is accessing what data, when, and using what locations, creating an audit trail.

• Establishing processes designed to terminate an employee’s access as soon as employment ends. These processes should also refer back to the aforementioned access logs to ensure that all equipment has been returned.

• Changing all administrative passwords on termination of an employee with access to those accounts, so that they will be unable to access them post-employment.

• The creation of alerts that call attention to accounts that have not been utilized in some predefined number of days in order to identify accounts that may be ripe for purging from the system.

• And developing a robust auditing procedure designed to ensure that all IAM-related policies are being followed and that the system is working as intended.

It’s an excellent piece, and if your firm is in any way involved with the handling of protected health information, you owe it to yourself to head to OCR’s website and read it in its entirety.

Joseph Martin

Many Consumers Would Withdraw Business From Companies If Data Breached

December 17, 2017 by Joseph Martin

You’ve probably heard the phrase “the customer is always right” a thousand times. It’s a truism in the business world, except when it isn’t. A recent survey released by Gemalto reveals a dismaying dichotomy that’s costing businesses around the world big money.

Only 27 percent of consumers surveyed feel that businesses do enough to protect customer data, and an overwhelming 70 percent of them say that they’d take their business elsewhere if a company suffered a data breach.

Unfortunately, most consumers have exceedingly poor data security habits, with 56 percent admitting to using the same password across multiple web properties and 41 percent failing to take advantage of stronger security measures like two-factor authentication, even when offered by companies.

That puts businesses, rather unfairly, in the crosshairs. They cannot make their customers take advantage of the added security offered, and given the statistics above, they are forced to have to spend even more money since most consumers won’t take significant action to protect themselves or their own data.

Jason Hart, Gemalto’s CTO, had this to say on the matter:

“In the face of upcoming data regulations such as GDPR, it’s now up to businesses to ensure they are forcing security protocols on their customers to keep data secure. It’s no longer enough to offer these solutions as an option. These protocols must be mandatory from the start – otherwise, businesses will face not only financial consequences but also potential legal action from consumers.”

Digging more deeply into the details of the survey, we find that consumers trust social media sites the least when it comes to safeguarding their data, with 58 percent of respondents citing these companies as their biggest worry in terms of data security.

Curiously, 33 percent of those surveyed say they trust banks with their personal data, in spite of the fact that banks and other financial institutions are frequent targets and have suffered a number of high profile breaches in recent years.

Regardless, no matter what industry you’re in, if you get breached, your customers are likely to punish you for it, even if you offer them means to make their data more secure.

Joseph Martin

Fake Symantec Blog Post Is Spreading Mac Malware

December 14, 2017 by Joseph Martin

Sometimes hackers opt for a stealthy approach. Other times, their attempts are downright brazen. That’s definitely the case with a newly launched malware campaign that seeks to spread “Proton Mac,” a strain of malware designed to steal passwords from Mac users.

The hackers registered a domain very similar to Symantec’s blog, mirrored its content and then created a fake post about a new version of CoinThief, which was moderately successful back in 2014.

After going into a bit of faux analysis about this nonexistent threat, the post recommended downloading a nonexistent piece of software called “Symantec Malware Detector” which it claimed was the best means of protecting against the new version of CoinThief. Unfortunately, “Symantec Malware Detector” is actually Proton Mac in disguise.

It’s a good scam, and it’s proven to be highly effective thus far. Its effectiveness is due in no small part to the fact that references to the post have been tweeted, initially by fake Twitter accounts, and later, by a growing number of legitimate ones.

Although the fake blog is quite good, it doesn’t stand up to intense scrutiny. For one thing, the email address used to register the domain isn’t a Symantec address. For another, their SSL certificate comes from Comodo, rather than Symantec’s own certificate authority. Unfortunately, the overwhelming majority of users don’t look that closely at websites they visit, so they are unlikely to recognize the fake for what it is.

If you have downloaded “Symantec Malware Detector,’ then you’ve got Proton Mac running on your machine right now.

It’s designed to log your username and password in plain text, sending this and any other PII (Personally Identifiable Information) on your machine to a hidden file. It will also capture browser auto-fill data, keychain files and the like, and send all of this to the hackers controlling the software.

If you have been infected, you should treat all online passwords as having been compromised and change them immediately, once you have verified that the malware has been completely removed from your system. Enabling two-factor authentication will also help make you more secure.

Joseph Martin

Bug in macOS Could Allow Hackers Root Access

December 13, 2017 by Joseph Martin

Do you own a Mac? Is it running Apple’s latest macOS, the “High Sierra?” If so, be extra careful with who you allow access to your machine.

A security flaw recently discovered by a developer named Lemi Orhan Ergin can easily allow anyone unfettered access to everything on your machine, and by extension, give them an easy “in” to whatever network it’s connected to. All they need is physical access.

Exploiting this vulnerability is a lesson in simplicity. All a hacker has to do is enter “root” in the username field, leave the password field blank, and press Enter.

Done.

They now have total access.

Needless to say, this is a large and rather glaring security issue and one which Apple will be remedying in the near future via a patch. Until they do, however, be aware that the physical security of your Mac is of paramount importance. Leaving your workstation unsecured and unattended, even for a few minutes, is all it would take to lose control over all the files on your machine and give a hacker access to the even more sensitive data lurking elsewhere on your company’s network.

Unfortunately, as bad as this security flaw is, it’s not the only recent stumble by Apple. Just last month, the company had to issue an emergency patch to fix a flaw that affected encrypted volumes, where the password hint section was displaying the actual password in plain text.

To try this exploit out for yourself to verify how easy it is to use, simply do the following:

Open your machine’s System Preferences and select “Users and Groups”

Click on the lock icon, which will allow you to make changes. You’ll get a username and password box at this point

Type in “root” in the username field

Move the cursor into the password field and hit enter

That’s all there is to it.

Until Apple issues their patch, the best thing you can do is leave your machine on and lock your workstation when you step away. At least that way, the hacker would have to know your current password in order to gain access.

Of course, they could simply power the machine off and reboot, but that would take a bit more time, during which they could be discovered.

It’s far from perfect, but for the time being, it’s the best protection you have.

Joseph Martin

A Million Imgur Users Affected By Breach

December 12, 2017 by Joseph Martin

Do you use the image hosting service, Imgur? If you do, there’s a slight chance that you’ll be prompted to change your password the next time you log on. That’s because the company’s servers were breached in 2014, and the hackers made off with 1.7 million usernames and passwords, which represents just a tiny fraction of the company’s 150 million users.

Although the breach happened a few years ago, the company only found out about it on Thanksgiving Day of this year. Their response was immediate and decisive. The company called people in over the holiday and notified their impacted users just 25 hours and 10 minutes after discovering the details of the incident.

Contrast that to Uber’s handling of their most recent hack. They kept their impacted users in the dark for more than a year, and worse, paid the hackers $100,000 to keep the incident quiet. It’s easy to see why security professionals around the world have lauded Imgur for their handling of the hack.

Three key things to note in relation to the breach:

Not much information was stolen during the hack because Imgur doesn’t ask its users for much in the way of personal information in the first place. However, if you use your Imgur password on other systems, you could be at additional risk.

At the time of the breach, Imgur was using SHA-256 encryption, which is fairly robust and impractical for most hackers to crack due to the amount of computational power required.

In 2015, the company switched to an even more secure algorithm, Bcrypt, so if the company is breached again in the future, it’ll be even harder for the hackers to glean anything useful from any data stolen.

All that to say, if you’re looking for a benchmark to compare yourself to if you’re ever hacked, Imgur’s example would be an excellent one to follow.

Joseph Martin

Breach Of Health Data Gets California Company $2M Fine

December 10, 2017 by Joseph Martin

Cottage Health System, a company that operates five hospitals in the Santa Barbara area of California, is the latest firm to have been hit with a hefty fine for losing control of PHI and PII for patients that it serves.

In this case, more than 55,000 patients were impacted between 2013 and 2015.

Cottage Health discovered the breach late in 2013. The company received a voicemail message informing company officers that there was a large file containing PHI of an unspecified number of its patients available online, without encryption or password protection that could prevent unauthorized access. In 2015, the company suffered a second, much smaller breach that impacted 4,596 of its patients.

As a result of the investigation that followed, the California Attorney General determined that the Cottage Health System had violated California’s Confidentiality of Medical Information Act, as well as several federal HIPAA regulations.

Under the terms of the agreement, in addition to a $2 million fine, the company has been required to upgrade its data security practices, including:

• Training employees on the collection, storage and proper use of PHI and PII

• Maintaining a reasonable set of policies and protocols surrounding incident tracking reports, risk assessment, data retention, internal audits and incident management plans, subject to external review

• Encrypting all PHI and PII in transit

• Assessing all hardware and software used in Cottage Health’s network for potential vulnerabilities, and upgrading as appropriate

• And conducting periodic testing to identify and address additional vulnerabilities.

This most recent incident serves as a painful reminder to any company involved in the handling of PHI and PII. According to Elizabeth Hodge, a health care attorney of the law firm Akerman, LLP:

“Even if the Office for Civil Rights slows down its enforcement activities going forward, covered entities and business associates should still anticipate enforcement activity by state attorney’s general enforcing their respective state laws.”

Joseph Martin

Uber Paid To Hide Massive Data Breach From Public

December 9, 2017 by Joseph Martin

It has recently come to light that the company was hacked in 2016 in a massive breach that exposed the personal information of more than 57 million Uber users and drivers. A wide range of data was stolen. Where users were concerned, names, email addresses, and phone numbers were compromised.

As bad as that is, the problem was even worse for more than 600,000 of the company’s drivers who had their driver’s license numbers hacked, too.

Standard protocol is that when a breach like this occurs, the company will engage law enforcement officials as appropriate, hire a third-party security firm to help with the forensic investigation and notify their consumers.

Unfortunately, that’s not the path Uber chose to take. Instead, they paid the hackers $100,000 in exchange for keeping quiet about the hack and deleting the stolen data.

The company kept the incident under wraps for more than a year, but eventually, word of the attack leaked out, and the fallout has been catastrophic. Uber’s CEO Dara Khosrowshahi has asked for the resignation of the company’s Chief Security Officer, Joe Sullivan, and one of his deputies, Craig Clark, both of whom worked to keep the attack quiet.

In a formal statement, Khosrowshahi had this to say:

“None of this should have happened, and I will not make excuses for it. While I cannot erase the past, I can commit on behalf of every Uber employee that we will learn from our mistakes. We are changing the way we do business, putting integrity at the core of every decision we make and working hard to earn the trust of our customers.”

As is common in the aftermath of events like these, Uber is offering its impacted customers a free year’s worth of credit monitoring services and will likely force password changes for its app users. More than a year too late, but it’s something.

File this away under how not to handle a data breach.

Joseph Martin

Ransomware Is Spreading Through Macros In Word

December 8, 2017 by Joseph Martin

Security researcher Jaromir Jorejsi of Trend Micro has discovered a disturbing new strain of ransomware named qkG that spreads by way of macros inside MS Word.

The ransomware strain targets only Office documents, encrypting them and infecting the Word default document in order to propagate to newly created documents opened via the Office suite on the infected computer.

This new threat is unusual in the world of ransomware because it abides by a completely different and much more tightly targeted set of operating principles than any other form of ransomware found in the wild today. It’s also a bit of a throwback. The use of macros to spread worms is still fairly commonplace on older machines running out-of-date or pirated copies of Office, but it hasn’t really been in fashion in the mainstream hacking community for quite some time.

An analysis of the code reveals it to be a work in progress. The researchers were quick to point out the ransomware has not found any actual victims to date, and that several different variants and strains of the code were found in different documents, each with a different and slightly more robust feature set.

Based on evidence Horejsi found in the qkG samples he had the opportunity to analyze, the author of this new strain is apparently based somewhere in Vietnam, and goes by the alias “TNA-MHT-TT2.”

The malware is notable for its rather innovative use of malicious macros. Horejsi warns that these techniques will undoubtedly be picked up by other hackers, refined and used more broadly in the months ahead.

That’s likely to pose a special challenge for your IT security team, who have probably fallen out of the habit of watching for such threats, given that they declined in popularity some time ago. It seems, however, that what’s old has been made new again, so alert the troops to be ready.

Joseph Martin

Known WordPress Malware Is Back For Second Round

December 7, 2017 by Joseph Martin

This past summer, an Italian security researcher named Manuel D’Orso discovered a nasty malware attack aimed at WordPress sites.

Dubbed “Wp-Ved,” after the name of the .php file bearing the malicious payload, the attack was relatively small in its scope and scale, with a few scattered attacks starting in the summer and continuing in sporadic fashion to this very day.

Apparently, the hackers who own the code learned what they needed to, and recently an updated variant of the malware has been spotted in the wild.

The malware is not subtle. It doesn’t try to hide what it’s doing in the least. It simply injects malicious code into legitimate files, focusing on old WordPress default themes such as “Twentyfifteen” and “Twentysixteen.”

Once the code is in place, it works quickly to create a new Admin user with the name “100010010,” which gives the hackers a backdoor they can use to launch other scripted attacks at their discretion.

Again, owing to the completely un-subtle nature of the code, any user who is running any sort of web application firewall (WAF) would be completely immune to this type of attack, as the WAF would have spotted it immediately and shut it down before it could do any damage. Sadly, a significant percentage of webmasters running WordPress sites don’t take advantage of this sort of protection.

Although this isn’t a large-scale, coordinated attack, given the sheer number of WordPress sites on the web, it’s something to be mindful of. As to the damage, the hackers could cause if you are infected, unfortunately, the sky’s the limit. Once they’ve got an Admin-level backdoor to work with, there’s not much they couldn’t do, so if you run a WordPress-based site, it’s worth your time to check to see if you’ve been infected. If you have, you’re sitting on a ticking time bomb.

As to how you can protect yourself, the first step is, of course, to delete the files containing the malicious code.

Once that’s done, disable and delete the rogue Admin account, and if one is available, begin making use of a web application firewall so that you can avoid any problems with Wp-Ved in the future.

The WordPress community is, on the whole, quite good at rooting out malware designed to work on the platform. However, this is certainly not the first such campaign hackers have gotten past the active community’s defenses, nor will it be the last.

Just recently, for example, security researchers found vulnerabilities in two of the platform’s most popular plugins, Yoast SEO and Formidable Forms.

In the case of the Yoast security flaw, it has been patched as of version 5.8 of the plugin, so if you use Yoast, be sure you’re using the most up-to-date version.

The bug in the Formidable Forms plugin was patched in version 2.05.02 and higher, so again, if you’re using this plugin on your website, be sure you’ve got the latest and greatest installed.

Joseph Martin

Paypal-Owned Company Sees Breach Of 1.6 Million Customers

Former Employees Pose Serious Risk To Security

Many Consumers Would Withdraw Business From Companies If Data Breached

Fake Symantec Blog Post Is Spreading Mac Malware

Bug in macOS Could Allow Hackers Root Access

Breach Of Health Data Gets California Company $2M Fine

Uber Paid To Hide Massive Data Breach From Public

Ransomware Is Spreading Through Macros In Word

Known WordPress Malware Is Back For Second Round

Contact Info

Navigation