With Russia once again being in the news for spreading disinformation regarding COVID-19, cyber threat intelligence advisor commented below.
ISBuzz Team
Cyber gangsters failed attack on a research firm working on the Covid-19 vaccine, despite earlier claims by many ransomware groups including Maze (the offender) that they would avoid targeting healthcare. Please see the comment below about how the healthcare sector can better protect itself against these type of attacks, including securing the cloud based data that remote working relies upon, covering up the unique IT vulnerabilities of the sector, the importance of IT infrastructure more widely and why attacks of this nature are likely to persist.
A major provision of New York’s Shield Act has just gone into effect that broadens the scope of consumer privacy and data security protection and goes much further that other current data privacy laws. https://twitter.com/KgsSec/status/1242043694837985282
It has been reported that Microsoft says attackers are exploiting a previously undisclosed security vulnerability found in all supported versions of Windows, including Windows 10 – the company said there is currently no patch for the vulnerability. The security flaw, which Microsoft deems “critical” is found in how Windows handles and renders fonts, according to the advisory posted Monday. The bug can be exploited by tricking a victim into opening a malicious document. Once the document is opened — or viewed in Windows Preview — an attacker can remotely run malware, such as ransomware, on a vulnerable device. The advisory said that Microsoft was…
As reported by Reuters, elite hackers tried to break into the World Health Organization earlier this month, part of what a senior agency official said was a more than two-fold increase in cyberattacks. WHO Chief Information Security Officer Flavio Aggio said the identity of the hackers was unclear and the effort was unsuccessful. But he warned that hacking attempts against the agency and its partners have soared as they battle to contain the coronavirus, which has killed more than 15,000 worldwide.
The TalkTalk data breach in 2015 was monumental for the cyber security industry. At the time, data breaches were hardly new, but this particular breach resulted in UK MPs recommending that an officer should be appointed with day-to-day responsibility for protecting computer systems from cyber attack. This governmental guidance was not a consequence of the size of the breach. With the personal details of 157,000 customers accessed, including bank account numbers and sort codes of over 15,000 customers, it certainly was not the largest the industry had seen. Rather, the guidance resulted from the way in which the immediate situation and the following…
Fortune 500 technology giant General Electric (GE) disclosed that personally identifiable information of current and former GE employees, as well as beneficiaries, was exposed in a security incident experienced by one of its service providers. GE says in a notice of data breach filed with the Office of the California Attorney General that Canon Business Process Services (Canon), a GE service provider, had one of their employees’ email accounts breached by an unauthorized party in February. https://twitter.com/Gurgling_MrD/status/1242217115085668352
As reported by ITPro, NHS Trusts have been granted a six-month delay to completing crucial cyber security resilience checks while resources are rechanneled into handling the coronavirus outbreak. The health service’s recently established digital transformation body NHSX has given organisations a reprieve to complete their annual cyber security checklists so it doesn’t interfere with the healthcare service’s COVID-19 response plans.
Researcher Bob Diachenko has announced that he discovered an unprotected and thus publicly available Elasticsearch instance which appeared to be managed by a UK-based security company, according to the SSL certificate and reverse DNS records. The irony of that discovery is that it was a ‘data breach database’, an enormously huge collection of previously reported (and, perhaps, non-reported) security incidents spanning 2012-2019 era.
In response to the news that a coalition of trade associations have requested California put off enforcement of its landmark privacy regulation in part due to the novel coronavirus, cybersecurity experts commented below.