Expert(s):
CSO feature_status*/ ?>
Outpost24

Comments Dotted : 50
February 26, 2021

NPower Shutsdown App After Hackers Steal Customer Bank Info
Password managers are helpful but two-factor authentication should ideally be something most sites offer today.

It's unfortunate this breach has occurred but in terms of security for customers, individuals should always be attentive to their card transactions because fraudulent activity is likely after a significant breach like this.

 

Furthermore, most people today will have hundreds of online accounts and trying to create a unique, but memorable, password for them all is challenging. Password managers are helpful but two-factor authentication should ideally be something most sites offer today.

.....Read More

It's unfortunate this breach has occurred but in terms of security for customers, individuals should always be attentive to their card transactions because fraudulent activity is likely after a significant breach like this.

 

Furthermore, most people today will have hundreds of online accounts and trying to create a unique, but memorable, password for them all is challenging. Password managers are helpful but two-factor authentication should ideally be something most sites offer today. Additionally, increase your password strength with longer characters (they are harder to crack with 10 plus characters) and use a combination of capitals, numbers, and special characters that don’t spell common words.

 

While the details are still unclear of how this breach happened, based on our experience, we advise all organisations to test their cybersecurity regularly. It’s a proactive approach that uncovers misconfigurations, bad assumptions, and incompatibilities in both IT and security technology that might expose an entry point for attack. Many successful attacks are made through known, exploitable vulnerabilities that go unpatched while the security staff is chasing the vector of the most recent publicly-reported breach.

  Read Less
February 22, 2021

Experts Reacted On Retail Giant Kroger Data Breach
It’s been a month from becoming aware of the breach to this wider disclosure, but it seems it’s been hard to establish who has been affected at all.

It’s been a month from becoming aware of the breach to this wider disclosure, but it seems it’s been hard to establish who has been affected at all – leaving the company with the very tough decision on who to inform, and a challenge of meeting the timeliness of doing so.

February 22, 2021

Security A Glaring Issue For Chatroom App Clubhouse After Conversations Were Breached
Clubhouse is a platform for social communication.

Clubhouse is a platform for social communication, most risks associated with the platform that are raised relate to privacy, essentially something the platform already have issues with managing and addressing according to amongst others the German data protection authorities.

 

Personally, I have not spent an ounce of effort looking into the platform and how it works, but I think we can all agree that there is room for doubt that for a company that forgot to address GDPR in its terms and

.....Read More

Clubhouse is a platform for social communication, most risks associated with the platform that are raised relate to privacy, essentially something the platform already have issues with managing and addressing according to amongst others the German data protection authorities.

 

Personally, I have not spent an ounce of effort looking into the platform and how it works, but I think we can all agree that there is room for doubt that for a company that forgot to address GDPR in its terms and conditions, technical security would have been first in mind when building it. Use the platform for what it is, a space to meet and chat in a likely insecure and far from a privacy-focused environment, and if you are comfortable with that – you won’t be disappointed. If privacy is your thing, this for sure is not the platform to choose for your interactions.

  Read Less
February 22, 2021

Parents Alerted To Nurserycam Security Breach – Experts Comments
You can choose this increased transparency but at the risk of privacy.

For anyone worried about privacy and invasion of one’s private space, having the initial thought of installing a form of security camera open to parents to log in to and check in on their kids is a very dual edged blade. You can choose this increased transparency but at the risk of privacy, and with a guaranteed invasion of privacy of concerned staff and kids. It’s also clear that a parent accessing a camera will of course also be able to see other children and parents in the space where

.....Read More

For anyone worried about privacy and invasion of one’s private space, having the initial thought of installing a form of security camera open to parents to log in to and check in on their kids is a very dual edged blade. You can choose this increased transparency but at the risk of privacy, and with a guaranteed invasion of privacy of concerned staff and kids. It’s also clear that a parent accessing a camera will of course also be able to see other children and parents in the space where cameras are installed. This is essentially something that would only fly in a country already so used in the ever present monitoring that it feels like normal everyday life, such as the UK. Any and all breaches are sad and unnecessary, but worrying about privacy when you deeply invade the privacy of others feels like a very special circumstance.

  Read Less
February 17, 2021

Cybersecurity Expert Commentary: Hacker Claims To Have Stolen Files Belonging To Law Firm Jones Day
Those who suspect they may be affected should consider informing any affected data subjects at the soonest in line with current privacy legislation.

What we are seeing now are the effects of the Accellion intrusion from December, which has already been discussed in relation to for example Singtel and others. It’s an external file-sharing solution that’s decades-old and has been used by several organizations. As we are seeing more and more data related to the breach hitting the news, other organizations that have used the services should review and prepare processes to inform any clients and any individuals for whom data has been

.....Read More

What we are seeing now are the effects of the Accellion intrusion from December, which has already been discussed in relation to for example Singtel and others. It’s an external file-sharing solution that’s decades-old and has been used by several organizations. As we are seeing more and more data related to the breach hitting the news, other organizations that have used the services should review and prepare processes to inform any clients and any individuals for whom data has been processed on this platform. Noting that we are approaching a two-month mark from when the breach likely occurred, those who suspect they may be affected should consider informing any affected data subjects at the soonest in line with current privacy legislation and not wait and hope for the best.

  Read Less
February 15, 2021

Experts On 223 Vulnerabilities Used In Recent Ransomware Attacks
The impact – malware infection – has increased. The risk is hence greater.

There is a popular misconception based on how we digest information related to security risks that the latest and greatest is what deserves focus. In this case, we are talking about a rise in risk from ransomware, but if one reads the research and understands what it is stating, 96% of those vulnerabilities targeted by the malware were more from 2019 or older. So there is not a new risk, the risks were there. The impact – malware infection – has increased. The risk is hence greater. But

.....Read More

There is a popular misconception based on how we digest information related to security risks that the latest and greatest is what deserves focus. In this case, we are talking about a rise in risk from ransomware, but if one reads the research and understands what it is stating, 96% of those vulnerabilities targeted by the malware were more from 2019 or older. So there is not a new risk, the risks were there. The impact – malware infection – has increased. The risk is hence greater. But we already had those, in worst case 14-year-old vulnerabilities sitting on the networks. Those organizations hit could, and can, have been breached over and over again without knowing. But, when it's ransomware, the breach is more evident and it can’t be ignored or missed. So please, follow the CIS guidelines, keep track of your assets, your admin accounts and do basic vulnerability management. It’s the cyber equivalence of washing your hands, it’s the absolute basics to not get serious problems later.

  Read Less
February 03, 2021

Expert Advice After SMS Bandits Leader Arrested For Large-Scale Phishing Scams
It should be noted that just as we see SaaS solutions for legal businesses, what has been taken down here is a SaaS solution for criminals.

It should be noted that just as we see SaaS solutions for legal businesses, what has been taken down here is a SaaS solution for criminals, essentially a service providers with the means to facilitate part of the fraud, the distribution, but not committing the end fraud which is left to the buyer, the other criminals. Just as EncroChat provided criminals a means of encrypted communication without requiring individuals to arrange secure communications, this service has provided criminals without

.....Read More

It should be noted that just as we see SaaS solutions for legal businesses, what has been taken down here is a SaaS solution for criminals, essentially a service providers with the means to facilitate part of the fraud, the distribution, but not committing the end fraud which is left to the buyer, the other criminals. Just as EncroChat provided criminals a means of encrypted communication without requiring individuals to arrange secure communications, this service has provided criminals without the skills or means to do so to send a large volume of text messages.

  Read Less
January 29, 2021

Experts Insight On New Cybercrime Tool Can Build Phishing Pages In Real-Time
We will keep seeing more and more advanced tooling available and being used by cyber criminals.

This is a constant arms-race, we have seen similar but slightly different tactics where attackers would retain records of targeted email addresses and, if not getting the expected parameters, serving different content in their phishing campaigns to prevent malware analyst work. This is the same base of identification of the targeted, but with a tailoring of content to the audience for increased chance of success rather than employing an evasion technique. We will keep seeing more and more

.....Read More

This is a constant arms-race, we have seen similar but slightly different tactics where attackers would retain records of targeted email addresses and, if not getting the expected parameters, serving different content in their phishing campaigns to prevent malware analyst work. This is the same base of identification of the targeted, but with a tailoring of content to the audience for increased chance of success rather than employing an evasion technique. We will keep seeing more and more advanced tooling available and being used by cyber criminals, especially in those high volume low income areas where, just as for anyone in IT, margins and efficiency is key for profitability.

  Read Less
January 19, 2021

Experts Insight On Hackers Exploiting The Windows Finger Feature
The technique as such is called LOTL.

The important bit to understand is that there are hundreds of ways to download code on a windows system, of which finger is just one in the lot. The technique as such is called LOTL, or Living Of The Land, essentially attackers have minimal code that attempts to use as many tools and features as possible when attacking a system to evade detection. The use of finger, or any other such existing binary, is not the cause of the initial infection, or a vulnerability, the code execution occurs when

.....Read More

The important bit to understand is that there are hundreds of ways to download code on a windows system, of which finger is just one in the lot. The technique as such is called LOTL, or Living Of The Land, essentially attackers have minimal code that attempts to use as many tools and features as possible when attacking a system to evade detection. The use of finger, or any other such existing binary, is not the cause of the initial infection, or a vulnerability, the code execution occurs when the victim opens that initial document and approves it to run a macro.

 

Neither the malware, nor the downloader or propagation are new or novel techniques, and the risk as well as solution remain the same – never run active content in files received from external entities.

  Read Less
January 15, 2021

Ring Is Testing End-To-End Encrypted Videos For Their Smart Doorbells
It’s still great to see something that had potential but also substantial challenges rise to take a very serious positioning in regards to security.

When we researched Ring equipment when they hit the market, they carried all the hallmarks of IoT technology rushed to market, including undocumented possibilities to extract the Wi-Fi passwords from the devices and a range of other risks privately disclosed to Ring at the time. It is good to see that those issues are long gone and that the vendor is pushing forwards to increase the control over information it offers to its users. It should be noted however that adding encryption for the feeds

.....Read More

When we researched Ring equipment when they hit the market, they carried all the hallmarks of IoT technology rushed to market, including undocumented possibilities to extract the Wi-Fi passwords from the devices and a range of other risks privately disclosed to Ring at the time. It is good to see that those issues are long gone and that the vendor is pushing forwards to increase the control over information it offers to its users. It should be noted however that adding encryption for the feeds as such relies entirely on the vendor, which is already what is safeguarding the information today – the initiative is good, but the primary risk, the vendor or an entity accessing information via the vendor, still remain. Completely regardless of this, it’s still great to see something that had potential but also substantial challenges rise to take a very serious positioning in regards to security.

  Read Less