It has been reported that almost two years after Equifax’s massive hack, the majority of Fortune 100 companies still aren’t learning the lessons of using vulnerable software. In the last six months of 2018, two-thirds of the Fortune 100 companies downloaded a vulnerable version of Apache Struts, the same vulnerable server software that was used by hackers to steal the personal data on close to 150 million consumers, according to data shared by Sonatype, an open-source automation firm. That’s despite almost two years’ worth of patched Struts versions being released since the attack. Tim Mackey, Technical Evangelist at Synopsys: “Sonatype, and others, maintain public repositories containing open source components.…
ISBuzz Team
Credit card information from about 6,000 people was sold on the dark web after The City of St. John discovered that it’s parking system had been hacked with a malware that collected credit card information for the previous 18 months from those paying parking tickets. Ryan Wilk, VP of Customer Success at NuData Security: “Once data has been stolen, it’s used in a number of ways, including account takeover and identity fraud. More recently, we’ve seen a change in the value of stolen data as more and more intuitions are implementing user authentication solutions that render stolen data valueless. The…
In light of the news that around 70,000 people have been tricked by a scam that encourages users to click on malicious links by personating popular YouTubers. https://twitter.com/besttechtrade/status/1089753265376542720 Jake Moore, Cyber Security Expert at ESET UK: “Fraudsters have always enjoyed exploiting the larger and more widely known brands due to their popularity. Phishing emails will continue to use popular brands in an attempt to look authentic. Brands and YouTubers themselves, like Philip DeFranco, are able to make their subscribers aware but this type of scam usually takes time to overcome. YouTube is aware of this issue and claims to be…
A file-hosting service is passing around Formbook, an information stealing malware that all starts with a phishing campaign according to researchers at Deep Instinct. Mike Bittner, Digital Security and Operations Manager at The Media Trust: “Data breaches happen only to other people until they don’t. FormBook illustrates why there are many parties to share the blame. Companies must understand the prevalence and frequency of these malicious campaigns, and embracing an organizational culture that prioritizes security and privacy. This means beefing up their information security capabilities accordingly, as well as training employees to be wary of malicious campaigns like phishing. If…
Microsoft Exchange 2013 and newer versions are vulnerable to a privilege escalation attack that gives anyone with a mailbox a way to gain domain administrator rights at potentially 90% of organisations running Active Directory and Exchange, according to a security researcher. The attack is possible because of the extensive privileges available by default in Exchange and therefore cannot be patched against. https://twitter.com/maryjofoley/status/1090266531638829058 Patrick Hunter, Sales Engineering Director at One Identity: “Nearly every business runs and uses Active Directory as a major part of its IT strategy. As it is trusted, it is typically made the primary source of authentication and authorisation for business…
Following the server security lapse that has exposed a massive database of customer information belonging to Rubrik, Terry Ray, SVP and Imperva Fellow, stresses the catastrophic impact that the interconnectedness of security programs is creating. Terry Ray, SVP and Imperva Fellow: “Today’s Rubrik data exposure once again highlights the interconnectedness of all security programs, and how one breakdown – and in this case what looks like a human error – can end up having catastrophic impacts. While Rubrik should be commended for reacting swiftly once the issue was bought to light, the issue also shows the fundamental importance of protecting vital data wherever it lives. Additionally, the…
Earlier today, TechCrunch has reported that the government-owned State Bank of India (SBI), India’s largest bank and the number four company in the Fortune India 500, left a server unprotected, allowing anyone to access the financial information of millions of customers including partial bank account numbers, phone numbers, balances and recent transactions. The server stored two months of data from SBI Quick, a text message and call-based system used to request basic information about bank accounts by the bank’s customers. The exact number of users that had their data compromised is uncertain, however SBI boasts 500 million customers across the globe and 740…
Web application vulnerabilities have been around for years and are often caused by application design flaws and misconfigured web servers. These vulnerabilities can be easy targets for hackers looking to capitalise on security flaws. With more and more web application security solutions available on the market, organisations are increasingly placing more importance on ensuring the safety of their applications. Despite growing concerns over web application security, however, our research has revealed that in 2018 the overall number of new vulnerabilities elevated by 23% compared to 2017. To really understand why the state of web application vulnerabilities took a turn for…
Following the news that Apple has temporarily disabled the group FaceTime functionality while it fixes a bug which let users eavesdrop on those they were calling, security experts commented below. https://twitter.com/HedgeBz/status/1090565859721007105 Jake Moore, Cyber Security Expert at ESET UK: “Technology bugs occur far more often than the average user may think. Luckily Apple is usually quick to adapt and patch up the flaws. However, we do not know how long this bug has been around for and if it has been taken advantage of by cybercriminals who exploit these vulnerabilities. Apple is currently fixing the issue, and like any precaution…
Cybersecurity executives commented on the early news of a Discover Card customer data breach, including fraud and compliance concerns: https://twitter.com/Buddahfan/status/1090459368565366784 Expert Comments below: Anthony James, Chief Strategy Officer at CipherCloud: “Discover’s breach is very typical of the news we hear continually concerning financial firms and credit processors. In today’s environment attackers will get into your networks. That’s a fait accompli. We also expect that it will take months even before a card processor such as Discover is even aware of the intrusion and possible breach What we don’t expect to hear is that the databases and credit card data are, amazingly, unencrypted.…